feat(v3): AI testing, graph hardening, and benchmark infrastructure

.github/workflows/ci.yml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [main, develop]
+    branches: [main]
   pull_request:
-    branches: [main, develop]
+    branches: [main]
 
 permissions:
   contents: read
@@ -83,6 +83,21 @@ jobs:
             ./terrain analyze --root "tests/fixtures/$fixture" --json > /dev/null
           done
 
+      - name: Benchmark smoke tests (4 canonical commands)
+        run: |
+          echo "=== benchmark: sample-repo ==="
+          ./terrain analyze --root tests/fixtures/sample-repo --json | python3 -c "import sys,json; d=json.load(sys.stdin); assert d['testsDetected']['testFileCount'] > 0, 'analyze: no test files'"
+          ./terrain insights --root tests/fixtures/sample-repo --json | python3 -c "import sys,json; d=json.load(sys.stdin); assert 'healthGrade' in d, 'insights: no health grade'"
+
+          echo "=== benchmark: ai-eval-suite ==="
+          ./terrain analyze --root tests/fixtures/ai-eval-suite --json | python3 -c "import sys,json; d=json.load(sys.stdin); assert d['testsDetected']['testFileCount'] > 0, 'analyze: no test files'"
+          ./terrain ai list --root tests/fixtures/ai-eval-suite --json | python3 -c "import sys,json; d=json.load(sys.stdin); assert d['summary']['scenarioCount'] > 0, 'ai list: no scenarios'"
+
+          echo "=== benchmark: backend-api ==="
+          ./terrain analyze --root tests/fixtures/backend-api --json | python3 -c "import sys,json; d=json.load(sys.stdin); assert len(d.get('riskPosture',[])) == 5, 'analyze: expected 5 posture dimensions'"
+
+          echo "All benchmark smoke tests passed."
+
   # ── Go benchmark comparison (PRs only) ──────────────────────
   go-bench-compare:
     if: github.event_name == 'pull_request'

.github/workflows/codeql.yml

@@ -2,9 +2,9 @@ name: CodeQL
 
 on:
   push:
-    branches: [main, develop]
+    branches: [main]
   pull_request:
-    branches: [main, develop]
+    branches: [main]
   schedule:
     - cron: '0 6 * * 1' # weekly Monday 6am UTC
 

.github/workflows/terrain-pr.yml

@@ -2,7 +2,7 @@ name: Terrain PR Analysis
 
 on:
   pull_request:
-    branches: [main, develop]
+    branches: [main]
 
 permissions:
   contents: read

.gitignore

@@ -1,167 +1,87 @@
-# Logs
-logs
+# === Node.js ===
+node_modules/
+*.tgz
+.npm
+.eslintcache
+.nyc_output
+*.tsbuildinfo
+
+# === Logs ===
+logs/
 *.log
 npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-lerna-debug.log*
-.pnpm-debug.log*
 
-# Diagnostic reports (https://nodejs.org/api/report.html)
-report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
-
-# Runtime data
-pids
-*.pid
-*.seed
-*.pid.lock
-
-# Directory for instrumented libs generated by jscoverage/JSCover
-lib-cov
-
-# Coverage directory used by tools like istanbul
-coverage
+# === Coverage ===
+coverage/
 !internal/coverage/
 *.lcov
 
-# nyc test coverage
-.nyc_output
-
-# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
-.grunt
-
-# Bower dependency directory (https://bower.io/)
-bower_components
-
-# node-waf configuration
-.lock-wscript
-
-# Compiled binary addons (https://nodejs.org/api/addons.html)
+# === Build output ===
+dist/
 build/Release
 
-# Dependency directories
-node_modules/
-jspm_packages/
-
-# Snowpack dependency directory (https://snowpack.dev/)
-web_modules/
-
-# TypeScript cache
-*.tsbuildinfo
-
-# Optional npm cache directory
-.npm
-
-# Optional eslint cache
-.eslintcache
-
-# Optional stylelint cache
-.stylelintcache
-
-# Microbundle cache
-.rpt2_cache/
-.rts2_cache_cjs/
-.rts2_cache_es/
-.rts2_cache_umd/
-
-# Optional REPL history
-.node_repl_history
-
-# Output of 'npm pack'
-*.tgz
-
-# Yarn Integrity file
-.yarn-integrity
-
-# dotenv environment variable files
+# === Environment ===
 .env
-.env.development.local
-.env.test.local
-.env.production.local
 .env.local
+.env.*.local
 
-# parcel-bundler cache (https://parceljs.org/)
-.cache
-.parcel-cache
-
-# Next.js build output
-.next
-out
-
-# Nuxt.js build / generate output
-.nuxt
-dist
-
-# Gatsby files
-.cache/
-# Comment in the public line in if your project uses Gatsby and not Next.js
-# https://nextjs.org/blog/next-9-1#public-directory-support
-# public
-
-# vuepress build output
-.vuepress/dist
-
-# vuepress v2.x temp and cache directory
-.temp
-.cache
-
-# Docusaurus cache and generated files
-.docusaurus
-
-# Serverless directories
-.serverless/
-
-# FuseBox cache
-.fusebox/
-
-# DynamoDB Local files
-.dynamodb/
-
-# TernJS port file
-.tern-port
-
-# Stores VSCode versions used for testing VSCode extensions
-.vscode-test
-
-# macOS
+# === OS files ===
 .DS_Store
 ._*
+Thumbs.db
 
-# yarn v2
-.yarn/cache
-.yarn/unplugged
-.yarn/build-state.yml
-.yarn/install-state.gz
-.pnp.*
+# === IDE ===
+.vscode/
+.idea/
+*.swp
+*.swo
+.vscode-test
 
-# Benchmark cloned repos (downloaded via scripts/download-benchmarks.sh)
+# === Go binaries (built locally, never committed) ===
+/terrain
+/terrain-bench
+/terrain-truthcheck
+
+# === Benchmark cloned repos (downloaded, not committed) ===
 benchmarks/cypress-playwright/
 benchmarks/jest-vitest/
 benchmarks/vitest/
 benchmarks/mocha-jasmine-etc/
 benchmarks/java/
 benchmarks/python/
+benchmarks/repos/
 benchmarks/results/
 benchmarks/run-benchmark.sh
 
-# Public benchmark repos and artifacts (generated, not committed)
-benchmarks/repos/
-artifacts/public-benchmarks/
+# === Benchmark output (generated, not committed) ===
+benchmarks/output/benchmark-results.json
+benchmarks/output/cli-benchmark-results.json
+benchmarks/output/cli-benchmark-assessment.json
+benchmarks/output/cli-benchmark-summary.md
+benchmarks/output/benchmark-report.md
 
-# Compiled Go binaries
-/terrain
-/terrain.exe
-/terrain/
-/terrain-bench
+# === Truthcheck output (generated) ===
+benchmarks/output/truthcheck/
 
-# Large local-only directories
-testing/
+# === Benchmark artifacts (large, generated) ===
+artifacts/
 
-# Test output (generated during test runs)
+# === Test output (generated during test runs) ===
 test/output/
 test/fixtures/
 reports/
 
-# Temporary files
+# === Large local-only directories ===
+testing/
+
+# === Stale / legacy ===
+hamlet/
+fixtures/demos/
+ci/
+
+# === Temporary ===
 PR_DESCRIPTION.md
 *.backup
+*.tmp
+tmp/
+temp/

.npmignore

@@ -1,34 +1,49 @@
-# Test files
+# === npm publish exclusions (defense-in-depth) ===
+# The package.json "files" field is the primary allowlist.
+# This file provides a safety net against accidental inclusion.
+
+# Go source (not part of npm package)
+internal/
+cmd/
+go.mod
+go.sum
+.goreleaser.yaml
+Makefile
+
+# Test and fixture infrastructure
 test/
+tests/
+benchmarks/
+fixtures/
 *.test.js
 *.spec.js
 jest.config.js
-coverage/
+playwright.config.js
 
-# Development files
+# Development config
 .github/
+.husky/
 .eslintrc*
 .prettierrc*
 .editorconfig
-.husky/
-commitlint.config.js
 commitlint.config.cjs
 tsconfig.json
-playwright.config.js
 
-# Internal / agent docs
+# Documentation (shipped separately, not in npm package)
+docs/
 CLAUDE.md
 DESIGN.md
+CONTRIBUTING.md
+CHANGELOG.md
 
-# Dev-only directories
-docs/
-config/
-scripts/
-benchmarks/
+# Extension source (separate distribution)
+extension/
+
+# Example/demo files
+examples/
 
-# Large untracked dirs (defense-in-depth)
-testing/
-terrain/
+# CI helpers
+ci/
 
 # IDE/Editor
 .vscode/
@@ -40,11 +55,16 @@ terrain/
 .DS_Store
 Thumbs.db
 
-# Logs
+# Logs and temp
 *.log
 npm-debug.log*
-
-# Temporary files
 tmp/
 temp/
 *.tmp
+*.backup
+
+# Generated output
+artifacts/
+reports/
+coverage/
+dist/