workers native: security findings computed then discarded by a key mismatch; crashed embedding phase reports Success; command absent on @alpha

Summary

Three defects in workers native, measured on 2.1.2 (latest) and 3.0.0-alpha.2 (@alpha).

1. Security findings are computed correctly and then never rendered — the text renderer is gated on a key the pipeline never produces.
2. analysis / learning crash a phase and still report Status: ✅ Success — a bundled dep is unloadable, and the failure appears nowhere in the result.
3. workers does not exist on @alpha at all — every invocation, including a nonsense type, prints the usage screen at exit 0 (same family as #187).

---

1. Security findings discarded by a key mismatch (2.1.2)

Fixture:

// db.ts
const API_KEY = "sk-ant-api03-REDACTEDFAKE1234567890";
export function render(html: string) { document.body.innerHTML = html; }
export function run(cmd: string) { require('child_process').exec(cmd); }

$ agentic-flow workers native security

⚡ Native Worker: security
Status: ✅ Success
Phases: file-discovery → security-analysis → summarization

📊 Metrics:
  Files Analyzed:    2
  Patterns Found:    0
  ...

No 🔒 Security Findings block. But the same call with --json:

"security-analysis": { "data": {
  "summary": { "high": 1, "medium": 2, "low": 0 },
  "vulnerabilities": [
    { "severity": "high",   "type": "hardcoded-api-key",        "file": "db.ts", "line": 5 },
    { "severity": "medium", "type": "xss-risk",                 "file": "db.ts", "line": 6 },
    { "severity": "medium", "type": "command-injection-risk",   "file": "db.ts", "line": 7 }
  ]}}

The scanner is correct. The renderer is not.

Root cause — dist/cli/commands/workers.js:665:

if (result.data['security-scan']?.data?.vulnerabilities) {

but the pipeline registers the phase as security-analysis (dist/workers/consolidated-phases.js:182). result.data keys are ['file-discovery', 'security-analysis', 'summarization'] — security-scan is never present. security-scan exists only as a back-compat alias in dist/workers/ruvector-native-integration.js:70, which does not affect the result key. So workers.js:665–678 is unreachable.

This is the worst-case presentation of the bug: a terminal user scanning a file with a leaked API key sees a clean, successful scan.

Fix: gate on result.data['security-analysis'] ?? result.data['security-scan'].

Related doc mismatch

The README shows:

Phases: file-discovery → security-scan → report-generation

Actual: file-discovery → security-analysis → summarization. report-generation is not a registered phase. The README's example metrics block (Files Analyzed: 342, Embeddings: 156, Vectors Stored: 89) is also not reproducible — see defect 2 for why the embedding/vector counters are always 0.

---

2. A crashed phase reports Status: ✅ Success (2.1.2)

$ agentic-flow workers native analysis
Phase embedding-generation error: ReferenceError: module is not defined in ES module scope
This file is being treated as an ES module because it has a '.js' file extension and
'.../node_modules/ruvector-onnx-embeddings-wasm/package.json' contains "type": "module".
    at async ModelCache.getOrLoad (dist/utils/model-cache.js:31:23)
    at async dist/workers/consolidated-phases.js:120:22
    ...

⚡ Native Worker: analysis
Status: ✅ Success

ruvector-onnx-embeddings-wasm@0.1.2 declares "type": "module" but ships a CommonJS .js, so it cannot be loaded at all. Affects analysis and learning; security and phases are unaffected (they don't embed).

The failure is invisible to any programmatic consumer — --json:

success: true
data keys: [file-discovery, pattern-extraction, vector-storage, complexity-analysis, summarization]
  vector-storage => success: true, error: none
metrics: { embeddingsGenerated: 0, vectorsStored: 0, onnxLatencyMs: 0 }

Three separate problems here:

• embedding-generation is absent from data — nothing records that it ran or failed.
• vector-storage reports success: true while storing 0 vectors, because its input was empty.
• Top-level success: true.

The only signal is a stack trace on stderr. success should be false, or the failed phase should at minimum appear in data with its error.

---

3. workers does not exist on @alpha (3.0.0-alpha.2)

$ npx agentic-flow@alpha workers native phases
$ npx agentic-flow@alpha workers native security
$ npx agentic-flow@alpha workers native nonsense-type

All five documented forms (phases, security, analysis, learning, plus a nonsense type) return byte-identical output — 12,236 bytes of the top-level usage screen, containing USAGE: and zero occurrences of Native Worker — at exit 0. workers is not in the alpha COMMANDS list. Since the docs advertise npx agentic-flow@alpha workers native <type>, this fails open: workers native security && ./deploy.sh proceeds.

---

What works

native nonsense-type on 2.1.2 exits 1 with Unknown native worker type: nonsense-type / Available: security, analysis, learning, phases. This is the correct behaviour and, across a broad audit of this CLI, the first subcommand found that rejects an invalid argument properly.

Environment

• agentic-flow 2.1.2 (global, Node 24, macOS 15.6) and 3.0.0-alpha.2 via npx
• Run in an empty scratch directory with the two fixture files above; no repo state involved

Start with dist/cli/commands/workers.js:665–678 and dist/workers/consolidated-phases.js:120,182, then compare the README phase names with the registered phases. Reproduce the security, analysis, learning, and alpha command cases using the fixture and commands in the report. Done means findings render, failed phases are represented in results and affect status, and the advertised alpha commands reject invalid input instead of showing usage with exit 0.