chore(release): v3.14.3

[proffesor-for-testing]

Summary

Agentic QE 3.14.3 makes test, security, coherence, and quality-gate results honest about failure: broken test runs, incomplete security scans, and unmeasured quality gates no longer report as passing. Every test-runner integration now supports Vitest 5, and the CI pipeline stops masking its own failures. Most of this release was contributed by @rudycelekli (#696, #697, #698, #699, #701, #702, #703, #704, #705, #708) on top of the Dependabot bumps in #687 and #700.

This PR contains only the release bookkeeping: version bump in package.json, package-lock.json, both skills-manifest.json files (fleetVersion), and .claude-plugin/plugin.json; the CHANGELOG section; docs/releases/v3.14.3.md; and the release index row.

Verification

All commands were run on this branch after npm ci with the new lockfile (Vitest 5.0.1), in this devpod (linux-arm64, Node 24.15.0).

$ npm run build
Building MCP with version: 3.14.3
MCP bundle built successfully (v3.14.3)
build exit=0

$ npm run typecheck
> tsc --noEmit
typecheck exit=0

$ npx vitest run tests/unit/ --maxWorkers=3
 Test Files  723 passed | 1 skipped (724)
      Tests  18420 passed | 14 skipped (18434)
   Duration  417.61s

$ npm run test:regression
 Test Files  47 passed (47)
      Tests  1375 passed | 2 skipped (1377)

$ npm run performance:gate
performance:gate exit=0

$ npm run test:ci
 Test Files  2 failed | 200 passed (998)
      Tests  3 failed | 7125 passed | 8 skipped (7143)
 FAIL  tests/integration/browser-integration/parallel-viewports.integration.test.ts > should track success rate across all captures
       AssertionError: expected 0.7333333333333333 to be greater than 0.75   (Math.random 95% simulation, statistical)
 FAIL  tests/integration/code-intelligence/knowledge-graph-real.test.ts > #511 cross-instance TS dependency edges (2 tests)
       AssertionError: expected 0 to be greater than 0
       -> reproduces identically on pure origin/main in this sandbox (Vitest 4 and 5);
          passes in CI (Coverage Analysis job on #700, run 35750729704); not in the publish gate.

$ ls -la dist/cli/bundle.js dist/index.js dist/mcp/bundle.js
12747 dist/cli/bundle.js
5792 dist/index.js
3915871 dist/mcp/bundle.js

$ node dist/cli/bundle.js --version
3.14.3

$ node dist/cli/bundle.js init --auto        (fresh temp project)
  MCP server configured in .mcp.json
init exit=0   -> .agentic-qe/ (memory.db, config.yaml, data, workers), .claude/, CLAUDE.md, .mcp.json
$ node dist/cli/bundle.js status             status exit=0
$ node dist/cli/bundle.js learning stats     responds (SQLitePatternStore on unified memory.db)
$ node dist/cli/bundle.js agent list         responds
$ node dist/cli/bundle.js health             health exit=0

$ npm pack && npm install ./agentic-qe-3.14.3.tgz   (isolated temp project)
added 135 packages in 27s
$ node node_modules/.bin/aqe --version
3.14.3
exit=0

The content being released was verified on its own PRs: every merged PR above had all checks green on its head, and #700's head (which includes the Vitest 5 runner fix) finished with 31/31 checks green.

Failure modes

• Vitest 5 report not read (runner reports a healthy suite as failed). Covered by tests/unit/shared/vitest-json-report.test.ts and tests/integration/test-runner-outcomes.test.ts, which ran green on Vitest 4 locally and Vitest 5 in CI on chore(deps): bump the npm_and_yarn group across 5 directories with 4 updates #700.
• Temp report directory leaked when a runner is killed by timeout. cleanup() runs on every exit path and is unit-tested, but no test drives the timeout branch; tracked in test-execution: Vitest 5 follow-ups (timeout-path report cleanup test, vitest list --json) #713.
• vitest list --reporter=json in the code-intelligence test counter never yields JSON. Pre-existing, does not affect test execution; tracked in test-execution: Vitest 5 follow-ups (timeout-path report cleanup test, vitest list --json) #713.
• test:ci failures above. The browser viewport test is a Math.random simulation with a 0.75 bound (statistical, see qe-browser CI: flaky Vibium smoke/eval checks (httpbin.org rate-limiting) + vibium dependency version mismatch #561 for the browser flake class). The two knowledge-graph #511 tests fail on pure main in this sandbox and pass in CI, so they are an environment issue here, not a regression; if they fail in this PR's CI, that is a real blocker and the release stops.
• Consumers relying on old security-scan semantics. --dast without a target now exits 1, rulesApplied counts unique evaluated patterns, and SARIF marks legacy receipt-less results as not successful. Covered by the fix(security): stop reporting incomplete scans as clean #705 test suites and documented in docs/security/scan-execution-evidence.md and the release notes' upgrade section.
• Stale hardcoded version strings. Audited with a repo-wide grep; all five occurrences (package.json, package-lock.json, two skills-manifest.json fleetVersion, .claude-plugin/plugin.json) are bumped in this PR.

---

Required check (issue #401)

• Every failure mode mentioned in this PR description has either (a) a test that exercises it, or (b) a linked tracking issue. "Unlikely" is not an acceptable substitute. If you wrote "I don't think this can happen but...", that sentence is a failure mode and needs a test or an issue link.

Optional context

• Linked issues: test-execution: Vitest 5 follow-ups (timeout-path report cleanup test, vitest list --json) #713 (follow-ups), fix(security): bind scan coverage to execution receipts #694 (partially resolved by fix(security): stop reporting incomplete scans as clean #705, stays open)
• Trust tier change (if any): none
• Affects published API or CLI surface: yes (security scan result semantics and test-execution error reporting, both from already-merged PRs; this PR itself only bumps version and docs)
• Touches the init flow / npm-publish.yml / tests/fixtures/init-corpus/: no

See CHANGELOG for details.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-22T16:45:32.584704Z	ff93fff	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Skill Validation Report

Tier	Skills	Validation	Status
Tier 3 (Verified)	Blocks PR	Schema + Validator + Eval	skipped
Tier 2 (Validated)	Warn only	Schema + Validator	skipped
Tier 1 (Structured)	Warn only	Schema	skipped
Tier 0 (Advisory)	Skipped	None	-

---

Only Tier 3 failures block merge

[github-actions]

MCP Tools Test Summary

Validation Results

• Validation report not found

Unit Test Results

• Handlers: success
• Security: success
• Tools/Transport: success
• Root: success

Other Results

• Integration Tests: success
• Validation: success

[github-actions]

Test Suite Metrics

CI Test Metrics

Date: 2026-09-22 16:45:27 UTC
Commit: 168f9c5

Current State

• Total test files: 1025 (target: 50)
• Total lines: 424594 (target: 40,000)
• Files > 600 lines: 229 (target: 0)
• Skipped tests: 78 (target: 0)

Progress from Baseline

• Files reduced: -599 (--140%)
• Lines reduced: -216341 (--103%)

---

Generated by Optimized CI