feat(miner): add dry-run full-execution mode to the cross-repo evaluation harness

[luciferlive112116]

Closes #7634

Summary

Extends the cross-repo evaluation harness (#4788) from readiness-only to a full-execution dry-run mode, so it answers not just "can the miner form a plan for this repo?" but "does the miner actually produce working, correct code?" — the real signal behind the #4810 launch-readiness bar.

A new --full-execution flag on the existing packages/loopover-miner/scripts/cross-repo-evaluation.mjs runs the discover → plan → code → test loop against the benchmark repos: it drives the configured coding-agent driver to generate a real diff in the local clone, builds the result, runs the target repo's own test suite locally, and checks the diff isn't a no-op. Dry-run only — it edits the clone and hard-resets it afterward; it never opens a PR, never pushes, and needs nothing beyond a local clone + a configured driver (the same safety posture the readiness harness already has).

What's added

• Execution taxonomy (CROSS_REPO_EXECUTION_CATEGORY), extending the readiness taxonomy per the issue: plan_not_formed, code_build_failed, tests_failed, no_op_diff (tests passed but the diff was empty), plus the shared clone_setup / other.
• evaluateRepoFullExecution / runFullCrossRepoExecution — reuse evaluateRepoReadiness for the plan stage, then delegate the code/build/test steps to injectable seams (runAgentAttempt, buildRepo, runRepoTests) so the orchestration + taxonomy are unit-testable without a live agent.
• summarizeCrossRepoExecution / formatCrossRepoExecutionReport — an execution report in the same shape the readiness report already produces.
• CLI --full-execution mode wiring real dry-run seams: build/test spawn the repo's own commands in the clone; the agent seam runs the configured driver via runCodingAgentAttempt and captures git diff, then resets.
• Docs — docs/cross-repo-evaluation.md documents the new mode, taxonomy, and operator prerequisites.

Scope

• --full-execution mode on the existing CLI + lib module (no new script; no live PR submission against benchmark repos)
• In scope (packages/loopover-miner/**, test/**), no blockedPaths; no secrets
• No changelog / site/ / CNAME / lovable edits

Test Coverage

packages/loopover-miner/** is outside Codecov's coverage.include (src/** only), so no patch-coverage gate applies — but the new logic has real unit tests (test/unit/miner-cross-repo-full-execution.test.ts) following this package's conventions: every execution category and the pass path are exercised with injected fake seams, plus runFullCrossRepoExecution, the summary, the report, and the CLI arg/dispatch wiring.

Validation

• tsc -p packages/loopover-miner/tsconfig.json — new module compiles clean; emitted .js/.d.ts committed
• node --check on the emitted .js and the CLI script
• Readiness mode unchanged (--full-execution is additive); CLI --help documents the new flag
• vitest run on the new test suite — green
• Branch current with main

Safety

• Dry-run only — edits the local clone and hard-resets; never opens a PR, pushes, or writes to any benchmark repo
• No forge API calls, no credentials beyond a local clone + a configured coding-agent driver

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.51%. Comparing base (4d9b9d1) to head (49d8146).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7642   +/-   ##
=======================================
  Coverage   88.51%   88.51%           
=======================================
  Files         724      724           
  Lines       75992    76066   +74     
  Branches    22618    22644   +26     
=======================================
+ Hits        67263    67330   +67     
- Misses       7681     7688    +7     
  Partials     1048     1048           

Flag	Coverage Δ
shard-1	36.50% <1.35%> (+0.77%)	⬆️
shard-2	36.82% <100.00%> (+3.84%)	⬆️
shard-3	30.20% <0.00%> (+1.57%)	⬆️
shard-4	38.31% <0.00%> (-2.31%)	⬇️
shard-5	32.62% <0.00%> (-1.38%)	⬇️
shard-6	33.85% <0.00%> (-2.17%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...ckages/loopover-miner/lib/cross-repo-evaluation.ts	100.00% <100.00%> (ø)

... and 1 file with indirect coverage changes

[superagent-security]

Superagent found 1 security concern(s).

[superagent-security]

P2: Full-execution harness runs arbitrary shell commands from third-party repos without validation

Default build/test seam passes inferred repo commands through sh -c without validation.

Run commands through the package manager directly, or sandbox the harness in a container.

AI prompt

Check if this security scanner issue is valid. If so, understand the root cause and fix it. If appropriate, update or add tests. Keep the change focused and preserve intended behavior.

<file name="packages/loopover-miner/scripts/cross-repo-evaluation.mjs">
<violation number="1" location="packages/loopover-miner/scripts/cross-repo-evaluation.mjs:86">
<priority>P2</priority>
<title>Full-execution harness runs arbitrary shell commands from third-party repos without validation</title>
<evidence>The spawnRepoCommand default seam uses spawnSync('sh', ['-c', command], ...) where command is inferred from a benchmark repo's own configuration (e.g., package.json scripts). A compromised or malicious benchmark repo can inject arbitrary shell commands that execute on the evaluation runner without sandboxing or allowlisting.</evidence>
<recommendation>Replace sh -c with a safer execution strategy: invoke the repository's package manager directly (e.g., npm test) rather than extracting and shelling raw commands, or document the RCE risk and run the harness inside an isolated container/VM with no access to sensitive data.</recommendation>
</violation>
</file>

[JSONbored]

Superagent findings, closing.