@ai-sdlc/orchestrator 0.10.0 → 0.13.0

package/dist/adapters.d.ts

@@ -4,7 +4,7 @@
  * into the dogfood pipeline.
  */
 import type { AiSdlcConfig } from './config.js';
-import { type IssueTracker, type AdapterRegistry, type ScanOptions, type ScanResult, type WebhookBridge, type GitAdapterFetcher, type GitResolveResult, type AuditLog, type AuditSink, type Sandbox, type SecretStore, type MemoryStore, type EventBus, type CIPipeline } from '@ai-sdlc/reference';
+import { type IssueTracker, type SourceControl, type AdapterRegistry, type ScanOptions, type ScanResult, type WebhookBridge, type GitAdapterFetcher, type GitResolveResult, type AuditLog, type AuditSink, type Sandbox, type SecretStore, type MemoryStore, type EventBus, type CIPipeline } from '@ai-sdlc/reference';
 /**
  * Create an adapter registry pre-loaded with all built-in and community adapters.
  */
@@ -70,6 +70,45 @@ export declare function resolveIssueTrackerFromConfig(config: AiSdlcConfig, fall
         secretRef: string;
     };
 }): IssueTracker;
-export { createGitHubCIPipeline, createDockerSandbox, createLinearIssueTracker, resolveSecret, createGitLabSourceControl, createGitLabCIPipeline, createJiraIssueTracker, createBacklogMdIssueTracker, createWebhookServer, createGitHubWebhookProvider, verifyGitHubSignature, createGitLabWebhookProvider, verifyGitLabToken, createJiraWebhookProvider, createLinearWebhookProvider, verifyLinearSignature, createAdapterRegistry, validateAdapterMetadata, parseMetadataYaml, scanLocalAdapters, createStubCodeAnalysis, createStubMessenger, createStubDeploymentTarget, createStubGitLabCI, createStubGitLabSource, createStubJira, createStubBitbucket, createStubSonarQube, createStubSemgrep, createInMemoryAuditSink, createFileSink, createEnvSecretStore, createInMemoryMemoryStore, createInProcessEventBus, createStubSandbox, createCompositeIssueTracker, createWebhookBridge, parseGitAdapterRef, buildRawUrl, createGitAdapterFetcher, createStubGitAdapterFetcher, resolveGitAdapter, } from '@ai-sdlc/reference';
-export type { AdapterRegistry, AdapterMetadata, AdapterStability, AdapterFactory, MetadataValidationResult, ScanOptions, ScanResult, WebhookBridge, WebhookTransformer, GitAdapterReference, GitAdapterFetcher, GitResolveResult, CIPipeline, CodeAnalysis, Messenger, DeploymentTarget, EventBus, IssueTracker, LinearClientLike, IssueComment, AdapterInterfaces, EventStream, IssueFilter, CommitStatus, TestResults, CoverageReport, Finding, SeveritySummary, DeploymentStatus, StubCodeAnalysisConfig, StubCodeAnalysisAdapter, NotificationLogEntry, StubMessengerAdapter, StubDeploymentTargetAdapter, StubGitLabCIAdapter, StubGitLabSourceAdapter, StubJiraAdapter, StubBitbucketAdapter, StubSonarQubeConfig, StubSonarQubeAdapter, StubSemgrepConfig, StubSemgrepAdapter, AuditSink, AuditLog, InMemoryAuditSink, SecretStore, Sandbox, MemoryStore, InMemoryMemoryStore, InProcessEventBus, DockerSandboxConfig, BuildStatus, GitLabConfig, JiraConfig, BacklogMdConfig, BacklogFs, WebhookServer, WebhookServerConfig, WebhookProviderConfig, GitHubWebhookConfig, GitHubWebhookBridges, GitLabWebhookConfig, JiraWebhookConfig, LinearWebhookConfig, CompositeIssueTrackerConfig, BackendRoute, } from '@ai-sdlc/reference';
+/**
+ * A no-op SourceControl adapter for local-only repositories (no remote).
+ *
+ * When an adopter has no 'origin' remote (or sets `type: local` in their
+ * AdapterBinding), the pipeline must not block on API calls. This adapter:
+ *
+ * - `createBranch` — delegates to the local git command-line (via execute.ts)
+ *   so the branch checkout path works unchanged.
+ * - `createPR` — resolves immediately with a sentinel local PR object; the
+ *   caller (execute.ts step 15) should check `pr.url` to detect the skip.
+ * - All other methods are no-ops.
+ *
+ * Callers detect local-only mode by checking `pr.url === 'local'` and skip
+ * tracker comments + Slack notifications for the PR URL.
+ */
+export declare function createLocalSourceControl(): SourceControl;
+/**
+ * Resolve a SourceControl adapter from the AdapterBinding whose
+ * `spec.interface === 'SourceControl'`.
+ *
+ * Resolution order (first wins):
+ *   1. `type: github` → existing GitHub adapter using `spec.config` or fallback.
+ *   2. `type: gitlab` → GitLab adapter with `spec.config.url` (required for
+ *      self-hosted) and optional `spec.config.token.secretRef`.
+ *   3. `type: local`  → local-only no-op adapter that skips push/create-pr.
+ *   4. No SourceControl AdapterBinding present → GitHub (current default, no regression).
+ *
+ * When multiple SourceControl bindings exist, the FIRST one wins.  This is an
+ * intentional design choice — multiple SourceControl bindings are unusual and
+ * the pipeline has a single active remote. If this constraint is too tight,
+ * escalate to the Decision Catalog before changing it.
+ */
+export declare function resolveSourceControlFromConfig(config: AiSdlcConfig, fallbackGitHubConfig: {
+    org: string;
+    repo: string;
+    token: {
+        secretRef: string;
+    };
+}): SourceControl;
+export { createGitHubCIPipeline, createGitHubSourceControl, createDockerSandbox, createLinearIssueTracker, resolveSecret, createGitLabSourceControl, createGitLabCIPipeline, createJiraIssueTracker, createBacklogMdIssueTracker, createWebhookServer, createGitHubWebhookProvider, verifyGitHubSignature, createGitLabWebhookProvider, verifyGitLabToken, createJiraWebhookProvider, createLinearWebhookProvider, verifyLinearSignature, createAdapterRegistry, validateAdapterMetadata, parseMetadataYaml, scanLocalAdapters, createStubCodeAnalysis, createStubMessenger, createStubDeploymentTarget, createStubGitLabCI, createStubGitLabSource, createStubJira, createStubBitbucket, createStubSonarQube, createStubSemgrep, createInMemoryAuditSink, createFileSink, createEnvSecretStore, createInMemoryMemoryStore, createInProcessEventBus, createStubSandbox, createCompositeIssueTracker, createWebhookBridge, parseGitAdapterRef, buildRawUrl, createGitAdapterFetcher, createStubGitAdapterFetcher, resolveGitAdapter, } from '@ai-sdlc/reference';
+export type { AdapterRegistry, AdapterMetadata, AdapterStability, AdapterFactory, MetadataValidationResult, ScanOptions, ScanResult, WebhookBridge, WebhookTransformer, GitAdapterReference, GitAdapterFetcher, GitResolveResult, CIPipeline, SourceControl, CodeAnalysis, Messenger, DeploymentTarget, EventBus, IssueTracker, LinearClientLike, IssueComment, AdapterInterfaces, EventStream, IssueFilter, CommitStatus, TestResults, CoverageReport, Finding, SeveritySummary, DeploymentStatus, StubCodeAnalysisConfig, StubCodeAnalysisAdapter, NotificationLogEntry, StubMessengerAdapter, StubDeploymentTargetAdapter, StubGitLabCIAdapter, StubGitLabSourceAdapter, StubJiraAdapter, StubBitbucketAdapter, StubSonarQubeConfig, StubSonarQubeAdapter, StubSemgrepConfig, StubSemgrepAdapter, AuditSink, AuditLog, InMemoryAuditSink, SecretStore, Sandbox, MemoryStore, InMemoryMemoryStore, InProcessEventBus, DockerSandboxConfig, BuildStatus, GitLabConfig, JiraConfig, BacklogMdConfig, BacklogFs, WebhookServer, WebhookServerConfig, WebhookProviderConfig, GitHubWebhookConfig, GitHubWebhookBridges, GitLabWebhookConfig, JiraWebhookConfig, LinearWebhookConfig, CompositeIssueTrackerConfig, BackendRoute, } from '@ai-sdlc/reference';
 //# sourceMappingURL=adapters.d.ts.map

package/dist/adapters.js

@@ -24,8 +24,10 @@ createWebhookBridge,
 createStubGitAdapterFetcher, createGitAdapterFetcher, resolveGitAdapter, 
 // GitHub CI adapter
 createGitHubCIPipeline, 
-// GitHub issue tracker
-createGitHubIssueTracker, 
+// GitHub source control + issue tracker
+createGitHubSourceControl, createGitHubIssueTracker, 
+// GitLab source control
+createGitLabSourceControl, 
 // Composite issue tracker
 createCompositeIssueTracker, 
 // Production adapters (for resolveIssueTrackerFromConfig)
@@ -228,10 +230,138 @@ export function resolveIssueTrackerFromConfig(config, fallbackGitHubConfig) {
     }
     return createCompositeIssueTracker({ backends });
 }
+// ── Source-control resolution from config ────────────────────────────
+/**
+ * A no-op SourceControl adapter for local-only repositories (no remote).
+ *
+ * When an adopter has no 'origin' remote (or sets `type: local` in their
+ * AdapterBinding), the pipeline must not block on API calls. This adapter:
+ *
+ * - `createBranch` — delegates to the local git command-line (via execute.ts)
+ *   so the branch checkout path works unchanged.
+ * - `createPR` — resolves immediately with a sentinel local PR object; the
+ *   caller (execute.ts step 15) should check `pr.url` to detect the skip.
+ * - All other methods are no-ops.
+ *
+ * Callers detect local-only mode by checking `pr.url === 'local'` and skip
+ * tracker comments + Slack notifications for the PR URL.
+ */
+export function createLocalSourceControl() {
+    return {
+        async createBranch(input) {
+            // Branches are created via git CLI in execute.ts; this is a passthrough stub.
+            return { name: input.name, sha: '' };
+        },
+        async createPR(_input) {
+            // Sentinel URL signals to the pipeline that we are in local-only mode and
+            // no remote PR was created. The pipeline checks for this and skips the
+            // "PR created" comment + Slack notification (avoiding noise).
+            return {
+                id: 'local',
+                title: _input.title,
+                sourceBranch: _input.sourceBranch,
+                targetBranch: _input.targetBranch ?? 'main',
+                status: 'open',
+                author: 'local',
+                url: 'local',
+            };
+        },
+        async mergePR(_id, _strategy) {
+            return { sha: '', merged: false };
+        },
+        async getFileContents(_path, _ref) {
+            throw new Error('getFileContents: local-only source control has no remote to read from');
+        },
+        async listChangedFiles(_prId) {
+            return [];
+        },
+        async setCommitStatus(_sha, _status) {
+            /* no-op: no remote to post status to */
+        },
+        watchPREvents(_filter) {
+            return {
+                async *[Symbol.asyncIterator]() {
+                    /* no-op: no remote events in local-only mode */
+                },
+            };
+        },
+    };
+}
+/**
+ * Resolve a SourceControl adapter from the AdapterBinding whose
+ * `spec.interface === 'SourceControl'`.
+ *
+ * Resolution order (first wins):
+ *   1. `type: github` → existing GitHub adapter using `spec.config` or fallback.
+ *   2. `type: gitlab` → GitLab adapter with `spec.config.url` (required for
+ *      self-hosted) and optional `spec.config.token.secretRef`.
+ *   3. `type: local`  → local-only no-op adapter that skips push/create-pr.
+ *   4. No SourceControl AdapterBinding present → GitHub (current default, no regression).
+ *
+ * When multiple SourceControl bindings exist, the FIRST one wins.  This is an
+ * intentional design choice — multiple SourceControl bindings are unusual and
+ * the pipeline has a single active remote. If this constraint is too tight,
+ * escalate to the Decision Catalog before changing it.
+ */
+export function resolveSourceControlFromConfig(config, fallbackGitHubConfig) {
+    const bindings = (config.adapterBindings ?? []).filter((b) => b.spec.interface === 'SourceControl');
+    if (bindings.length === 0) {
+        // No SourceControl binding — default to GitHub exactly as before (AC #2).
+        return createGitHubSourceControl(fallbackGitHubConfig);
+    }
+    // First binding wins (see JSDoc above for rationale).
+    const binding = bindings[0];
+    const cfg = binding.spec.config ?? {};
+    switch (binding.spec.type) {
+        case 'github': {
+            // Honor spec.config.token.secretRef when present (consistent with the GitLab case).
+            // Fall back to the fallback token so existing GitHub adopters are unaffected.
+            const tokenSecretRef = cfg.token?.secretRef ??
+                fallbackGitHubConfig.token.secretRef;
+            return createGitHubSourceControl({
+                org: cfg.org ?? fallbackGitHubConfig.org,
+                repo: cfg.repo ?? fallbackGitHubConfig.repo,
+                token: { secretRef: tokenSecretRef },
+            });
+        }
+        case 'gitlab': {
+            // `url` is required for self-hosted GitLab; defaults to gitlab.com for SaaS.
+            const baseUrl = cfg.url ?? 'https://gitlab.com';
+            // projectId is required — an empty value produces confusing API responses
+            // (encodeURIComponent('') → '' → the request hits /api/v4/projects/ which
+            // returns the list of all projects, not the configured one).
+            const projectId = cfg.projectId;
+            if (!projectId && projectId !== 0) {
+                throw new Error(`SourceControl AdapterBinding '${binding.metadata.name}' (type: gitlab) is missing a required ` +
+                    `spec.config.projectId. Set it to the numeric project ID or the URL-encoded path ` +
+                    `(e.g. "group%2Fsubgroup%2Fproject" or 12345).`);
+            }
+            // Token: use secretRef from config if present, else fall back to env GITLAB_TOKEN.
+            const tokenSecretRef = cfg.token?.secretRef ?? 'gitlab-token';
+            const gitLabCfg = {
+                baseUrl,
+                projectId,
+                token: { secretRef: tokenSecretRef },
+            };
+            return createGitLabSourceControl(gitLabCfg);
+        }
+        case 'local': {
+            return createLocalSourceControl();
+        }
+        default: {
+            // Unknown type — emit a warning so mistyped types (e.g. 'bitbucket') surface
+            // visibly, then fall back to GitHub so the pipeline keeps running.
+            console.warn(`[ai-sdlc] SourceControl AdapterBinding '${binding.metadata.name}' has unknown type ` +
+                `'${binding.spec.type}'. Falling back to the GitHub adapter. ` +
+                `Supported types: github, gitlab, local.`);
+            return createGitHubSourceControl(fallbackGitHubConfig);
+        }
+    }
+}
 // Direct re-exports (passthrough)
 export { 
 // Core adapters
-createGitHubCIPipeline, createDockerSandbox, createLinearIssueTracker, resolveSecret, 
+createGitHubCIPipeline, createGitHubSourceControl, createDockerSandbox, createLinearIssueTracker, resolveSecret, 
 // Production adapters
 createGitLabSourceControl, createGitLabCIPipeline, createJiraIssueTracker, 
 // Backlog.md adapter

package/dist/admission-composite.d.ts

@@ -1,5 +1,5 @@
 /**
- * Admission-subset composite (RFC-0008 §A.6).
+ * Admission-subset composite (RFC-0008 §A.6 + RFC-0009 Phase 2.1).
  *
  * The admission gate uses a subset of the full PPA composite:
  *
@@ -23,10 +23,18 @@
  * The `override` bypass is preserved at position 1: when the input has
  * `override: true`, we return `composite = Infinity` without running
  * the admission math — identical to the legacy PPA behaviour.
+ *
+ * **RFC-0009 Phase 2.1 tessellation extension:**
+ * When `AdmissionCompositeOptions.tessellationContext` is provided, the
+ * composite routes SA and Eρ₄ (designSystemReadiness) through soul scope
+ * per RFC-0009 §6. See `tessellation-admission.ts` for the routing algorithm.
  */
 import type { PriorityConfig, PriorityInput, PriorityScore } from '@ai-sdlc/reference';
 import type { AdmissionInput } from './admission-score.js';
 import { type AdmissionHumanCurveResult } from './admission-hc.js';
+import { type TessellationContext, type TessellatedSaResult } from './tessellation-admission.js';
+import { type VariantContext, type VariantScopedSaResult } from './variant-admission.js';
+import { type ComplianceClearanceContext, type ComplianceClearanceResult } from './compliance-clearance.js';
 /**
  * Result of the admission composite — returns a `PriorityScore`
  * (backward-compatible with `scoreIssueForAdmission` consumers) plus
@@ -44,6 +52,33 @@ export interface AdmissionComposite {
         designSystemReadiness: number;
         executionReality: number;
         humanCurve: AdmissionHumanCurveResult;
+        /**
+         * RFC-0009 Phase 2.1 — tessellation routing result.
+         * Present when `AdmissionCompositeOptions.tessellationContext` was
+         * supplied. Absent (undefined) when the single-DID path was used.
+         */
+        tessellation?: TessellatedSaResult;
+        /**
+         * RFC-0017 Phase 2 — variant routing result.
+         * Present when `AdmissionCompositeOptions.variantContext` was supplied.
+         * Absent (undefined) when the single-soul path was used (backward-compat).
+         *
+         * `variantScopedSa` represents the variant-resolved soul-alignment value
+         * that REPLACED the tessellation/soul-aggregate `soulAlignment` when the
+         * work item declared `targetedVariants` of one of the affected souls.
+         */
+        variant?: VariantScopedSaResult;
+        /**
+         * RFC-0009 Phase 4.1 — Eρ₅ Compliance Clearance result.
+         * Present when `AdmissionCompositeOptions.complianceClearanceContext`
+         * was supplied AND the adopter has opted in (`enabled: true`).
+         *
+         * When `er5 === 0` the composite is GATED to zero — the work item cannot
+         * proceed without resolving the violation. The `routingPath` field
+         * surfaces the decision branch for audit purposes; when the adopter has
+         * not opted in, the breakdown field is elided (backward-compat).
+         */
+        complianceClearance?: ComplianceClearanceResult;
     };
 }
 export interface AdmissionCompositeOptions {
@@ -62,8 +97,84 @@ export interface AdmissionCompositeOptions {
      * cannot extract. Only fields with defined values overwrite.
      */
     priorityInputOverrides?: Partial<PriorityInput>;
+    /**
+     * RFC-0009 Phase 2.1 — Tessellated DID context.
+     *
+     * When present, SA and Eρ₄ (designSystemReadiness) are computed using
+     * soul-scope routing per RFC-0009 §6 instead of the platform-aggregate
+     * DSB. The routing algorithm:
+     *
+     *   resolveAffectedSouls(w) → scope filter from dep-graph snapshot
+     *   |souls| == 0 → min over ALL souls (substrate-only degenerate)
+     *   |souls| == 1 → score against that soul's DSB
+     *   |souls| > 1 → crossSoulScoringRule (default `min`) over affected souls
+     *
+     * @see tessellation-admission.ts + spec/rfcs/RFC-0009 §6
+     */
+    tessellationContext?: TessellationContext;
+    /**
+     * RFC-0017 Phase 2 — variant-scope routing context.
+     *
+     * When present AND the work item declares `targetedVariants[]` of one of
+     * the affected souls, the composite's `soulAlignment` value is REFINED
+     * by per-variant Sα₁ + Sα₂ scoring per RFC-0017 §5.4:
+     *
+     *   resolveTargetedVariants(w) → variant scope filter from work-item targeting
+     *   |targets| == 0  → backward-compat: soul-aggregate Sα/Eρ₄ unchanged
+     *   |targets| == 1  → variant's per-variant Sα₁ + Sα₂ replaces soul-aggregate
+     *   |targets| > 1   → crossVariantAggregation (default `min`) over targeted variants
+     *
+     * Composes cleanly with `tessellationContext` — soul-scope tessellation runs
+     * first, then variant routing refines the resulting Sα/Eρ₄ to variant scope.
+     * Work items WITHOUT `targetedVariants` preserve the tessellation result
+     * unchanged (backward-compat per RFC-0017 §7).
+     *
+     * @see variant-admission.ts + spec/rfcs/RFC-0017 §5.4 + §6.2
+     */
+    variantContext?: VariantContext;
+    /**
+     * RFC-0009 Phase 4.1 — Eρ₅ Compliance Clearance context.
+     *
+     * When present AND `enabled: true`, the admission composite applies the
+     * Eρ₅ multiplier (categorical 0/1 gating) per RFC-0009 §7.1:
+     *
+     *   Eρ₅ = 0 if any declared regime is violated → composite gated to 0
+     *   Eρ₅ = 1 otherwise → composite unchanged
+     *
+     * When absent OR `enabled: false`, Eρ₅ is not applied — backward-compatible
+     * with Phase 2/3 behavior. The opt-in gate is intentional per RFC-0009 §10
+     * Phase 4; promotion to default-on is subject to ecosystem feedback.
+     *
+     * The regime set is the union of (a) each affected soul's
+     * `triad.engineering.complianceRegimes` (passed through
+     * `perSoulRegimes`) and (b) any RFC-0022 `CompliancePosture` regimes
+     * (passed through `posture`). Both pass the OQ-5 hard-regulatory scope
+     * filter; soft regimes are filtered at declaration time.
+     *
+     * Composes with `tessellationContext` — the soul scope from tessellation
+     * routing is used to select which souls' regimes apply to this work item.
+     *
+     * @see compliance-clearance.ts + spec/rfcs/RFC-0009 §7.1 + §10
+     * @see spec/rfcs/RFC-0022 (consumption surface)
+     */
+    complianceClearanceContext?: ComplianceClearanceContext;
 }
 export declare function computeAdmissionComposite(input: AdmissionInput, config?: PriorityConfig, options?: AdmissionCompositeOptions): AdmissionComposite;
+/**
+ * Combine variant-scope Sα₁ (audience resonance) + Sα₂ (vibe coherence) into
+ * a single soul-alignment value for the admission composite's SA pillar.
+ *
+ * The legacy admission composite uses a single `soulAlignment` scalar that
+ * conceptually rolls Sα₁ + Sα₂ together (RFC-0008 §A.6 SA pillar). When
+ * variant routing splits them out per RFC-0017 §5.4, we recombine via the
+ * arithmetic mean — equal weighting matches the soul-aggregate combination
+ * implied by `pillar-breakdown.ts` and avoids favouring one Sα facet over
+ * the other when both are equally variant-bounded.
+ *
+ * Exported for unit testing + so downstream callers can replicate the
+ * combination logic if they need to surface the constituent pieces.
+ */
+export declare function combineVariantSaForSoulAlignment(sa1: number, sa2: number): number;
 /**
  * Compute admission confidence in [0, 1] as a 50/50 blend of two
  * independent evidence channels:

package/dist/admission-composite.js

@@ -1,5 +1,5 @@
 /**
- * Admission-subset composite (RFC-0008 §A.6).
+ * Admission-subset composite (RFC-0008 §A.6 + RFC-0009 Phase 2.1).
  *
  * The admission gate uses a subset of the full PPA composite:
  *
@@ -23,10 +23,18 @@
  * The `override` bypass is preserved at position 1: when the input has
  * `override: true`, we return `composite = Infinity` without running
  * the admission math — identical to the legacy PPA behaviour.
+ *
+ * **RFC-0009 Phase 2.1 tessellation extension:**
+ * When `AdmissionCompositeOptions.tessellationContext` is provided, the
+ * composite routes SA and Eρ₄ (designSystemReadiness) through soul scope
+ * per RFC-0009 §6. See `tessellation-admission.ts` for the routing algorithm.
  */
 import { mapIssueToPriorityInput } from './admission-score.js';
 import { computeAutonomyFactor, computeDefectRiskFactor, computeReadinessFromDesignSystemContext, } from './admission-enrichment.js';
 import { computeAdmissionHumanCurve } from './admission-hc.js';
+import { computeTessellatedScores, } from './tessellation-admission.js';
+import { computeVariantScopedScores, } from './variant-admission.js';
+import { computeComplianceClearance, } from './compliance-clearance.js';
 const DEFAULT_SIGNAL = 0.5;
 export function computeAdmissionComposite(input, config, options) {
     const timestamp = new Date().toISOString();
@@ -77,7 +85,7 @@ export function computeAdmissionComposite(input, config, options) {
         };
     }
     // ── SA (soul alignment) — SA-1 override (M5) or label-based fallback ──
-    const soulAlignment = clamp01(options?.soulAlignmentOverride ?? priorityInput.soulAlignment ?? DEFAULT_SIGNAL);
+    const baseSoulAlignment = clamp01(options?.soulAlignmentOverride ?? priorityInput.soulAlignment ?? DEFAULT_SIGNAL);
     // ── D-pi_adjusted ─────────────────────────────────────────────
     const demand = priorityInput.demandSignal ?? DEFAULT_SIGNAL;
     const consensus = priorityInput.teamConsensus ?? DEFAULT_SIGNAL;
@@ -91,12 +99,49 @@ export function computeAdmissionComposite(input, config, options) {
     const complexity = priorityInput.complexity ?? 5;
     const baseExecutionReality = clamp01(1 - complexity / 10);
     const autonomyFactor = computeAutonomyFactor(input.autonomyContext);
-    const designSystemReadiness = computeReadinessFromDesignSystemContext(input.designSystemContext);
+    const baseDesignSystemReadiness = computeReadinessFromDesignSystemContext(input.designSystemContext);
+    // ── RFC-0009 Phase 2.1: tessellation soul-scope routing ────────
+    // When tessellationContext is present, route SA and Eρ₄ through soul
+    // scope per RFC-0009 §6. When absent, single-DID path applies.
+    //
+    // Prefer the canonical workItemId (e.g. "AISDLC-313") over the GitHub-style
+    // "#313" so the dep-graph snapshot lookup matches the backlog task ID format.
+    const workItemId = input.workItemId ?? `#${input.issueNumber}`;
+    const tessellationResult = computeTessellatedScores(workItemId, baseSoulAlignment, baseDesignSystemReadiness, options?.tessellationContext);
+    // ── RFC-0017 Phase 2: variant-scope refinement ────────────────
+    // When `variantContext` is provided AND the work item declares
+    // `targetedVariants[]`, the per-variant Sα₁ + Sα₂ scores REFINE the
+    // soul-aggregate `soulAlignment` from tessellation. The combined SA score
+    // fed to the composite is the mean of the variant-resolved Sα₁ + Sα₂
+    // (both feed soul-alignment per RFC-0008 §A.6 SA pillar definition).
+    // When no targeting declared OR variantContext is absent, this is a
+    // passthrough — the tessellation result is preserved unchanged
+    // (backward-compat per RFC-0017 §7).
+    const variantResult = computeVariantScopedScores(workItemId, tessellationResult.soulAlignment, tessellationResult.soulAlignment, options?.variantContext);
+    const soulAlignment = variantResult.routingPath === 'no-variant-routing'
+        ? tessellationResult.soulAlignment
+        : combineVariantSaForSoulAlignment(variantResult.sa1, variantResult.sa2);
+    const designSystemReadiness = tessellationResult.er4;
     const executionReality = Math.min(baseExecutionReality * autonomyFactor, designSystemReadiness);
+    // ── RFC-0009 Phase 4.1: Eρ₅ Compliance Clearance ──────────────
+    // Categorical 0/1 gating per §7.1. When the adopter has opted in AND any
+    // declared regime is violated, the composite is gated to 0 (work item
+    // cannot proceed without resolving the violation). When the adopter has
+    // not opted in (default), this returns er5=1 and the composite is
+    // unchanged — full backward compatibility with Phase 2/3 behavior.
+    //
+    // Uses the same `affectedSoulIds` resolved by tessellation routing, so the
+    // regime check follows the work item's actual soul scope. Substrate-only
+    // work (affectedSoulIds = []) falls through to the `__platform` sentinel.
+    const complianceClearanceResult = computeComplianceClearance(workItemId, tessellationResult.affectedSoulIds, options?.complianceClearanceContext);
     // ── HC (tanh-compressed with HC_design) ───────────────────────
     const humanCurve = computeAdmissionHumanCurve(input);
     // ── §A.6 admission subset composite ───────────────────────────
-    const composite = soulAlignment * demandPressureAdjusted * executionReality * (1 + humanCurve.hcComposite);
+    const composite = soulAlignment *
+        demandPressureAdjusted *
+        executionReality *
+        complianceClearanceResult.er5 *
+        (1 + humanCurve.hcComposite);
     const score = {
         composite,
         dimensions: {
@@ -116,6 +161,20 @@ export function computeAdmissionComposite(input, config, options) {
         confidence: computeAdmissionConfidence(input, priorityInput, options),
         timestamp,
     };
+    // Only include tessellation breakdown when the caller provided a context
+    // (non-tessellated path produces routingPath: 'non-tessellated' but we
+    // elide the field to preserve backward compat with callers that don't
+    // destructure the breakdown exhaustively).
+    const tessellationBreakdown = options?.tessellationContext !== undefined ? tessellationResult : undefined;
+    // Variant breakdown surfaced ONLY when the caller wired a variant context
+    // AND the work item actually targeted variants. Pure backward-compat for
+    // callers on the soul-aggregate path.
+    const variantBreakdown = options?.variantContext !== undefined && variantResult.routingPath !== 'no-variant-routing'
+        ? variantResult
+        : undefined;
+    // Compliance clearance breakdown surfaced ONLY when the adopter opted in
+    // (avoids polluting the breakdown shape for Phase 2/3 callers).
+    const complianceClearanceBreakdown = options?.complianceClearanceContext?.enabled === true ? complianceClearanceResult : undefined;
     return {
         score,
         breakdown: {
@@ -128,9 +187,31 @@ export function computeAdmissionComposite(input, config, options) {
             designSystemReadiness,
             executionReality,
             humanCurve,
+            ...(tessellationBreakdown !== undefined ? { tessellation: tessellationBreakdown } : {}),
+            ...(variantBreakdown !== undefined ? { variant: variantBreakdown } : {}),
+            ...(complianceClearanceBreakdown !== undefined
+                ? { complianceClearance: complianceClearanceBreakdown }
+                : {}),
         },
     };
 }
+/**
+ * Combine variant-scope Sα₁ (audience resonance) + Sα₂ (vibe coherence) into
+ * a single soul-alignment value for the admission composite's SA pillar.
+ *
+ * The legacy admission composite uses a single `soulAlignment` scalar that
+ * conceptually rolls Sα₁ + Sα₂ together (RFC-0008 §A.6 SA pillar). When
+ * variant routing splits them out per RFC-0017 §5.4, we recombine via the
+ * arithmetic mean — equal weighting matches the soul-aggregate combination
+ * implied by `pillar-breakdown.ts` and avoids favouring one Sα facet over
+ * the other when both are equally variant-bounded.
+ *
+ * Exported for unit testing + so downstream callers can replicate the
+ * combination logic if they need to surface the constituent pieces.
+ */
+export function combineVariantSaForSoulAlignment(sa1, sa2) {
+    return clamp01((sa1 + sa2) / 2);
+}
 // ── Admission confidence (AISDLC-172) ──────────────────────────────────
 /**
  * `PriorityInput` fields that the admission mapper (`mapIssueToPriorityInput`)

package/dist/admission-enrichment.d.ts

@@ -92,15 +92,24 @@ export declare function complexityToAutonomyLevel(complexity: number): number;
  */
 export declare function computeAutonomyFactor(ctx: AutonomyContext | undefined): number;
 /**
- * Compute the C5 design-authority weight per §A.5.
+ * Compute the C5 design-authority weight per §A.5 (Source 1) plus
+ * the RFC-0008 §C5 Source 3 compliance-assessment signal.
  *
+ * Source 1 (principal participation):
  *   non-authority           → 0.0
  *   authority + positive    → +0.6 × modulation
  *   authority + negative    → -0.4 × modulation
  *   authority + no type     → +0.3 × modulation
  *
- * where `modulation = 1.2 - areaComplianceScore` when the score is
- * supplied, else `1.0` (unmodulated base weight).
+ *   where `modulation = 1.2 - areaComplianceScore` when the score is
+ *   supplied, else `1.0` (unmodulated base weight).
+ *
+ * Source 3 (compliance assessment — additive):
+ *   `signal.complianceSignal` contributes directly when present (see
+ *   `buildDesignAuthoritySignal`). This fires from DSB health data
+ *   alone — no principal participation required — so a fully-loaded DSB
+ *   with high token compliance produces `hcDesign > 0` regardless of
+ *   whether a design-authority principal commented on the issue.
  */
 export declare function computeDesignAuthorityWeight(signal: DesignAuthoritySignal | undefined): number;
 /**

package/dist/admission-enrichment.js

@@ -204,23 +204,65 @@ const DESIGN_AUTHORITY_BASE_WEIGHT = Object.freeze({
     unspecified: 0.3,
 });
 /**
- * Compute the C5 design-authority weight per §A.5.
+ * Compute the C5 design-authority weight per §A.5 (Source 1) plus
+ * the RFC-0008 §C5 Source 3 compliance-assessment signal.
  *
+ * Source 1 (principal participation):
  *   non-authority           → 0.0
  *   authority + positive    → +0.6 × modulation
  *   authority + negative    → -0.4 × modulation
  *   authority + no type     → +0.3 × modulation
  *
- * where `modulation = 1.2 - areaComplianceScore` when the score is
- * supplied, else `1.0` (unmodulated base weight).
+ *   where `modulation = 1.2 - areaComplianceScore` when the score is
+ *   supplied, else `1.0` (unmodulated base weight).
+ *
+ * Source 3 (compliance assessment — additive):
+ *   `signal.complianceSignal` contributes directly when present (see
+ *   `buildDesignAuthoritySignal`). This fires from DSB health data
+ *   alone — no principal participation required — so a fully-loaded DSB
+ *   with high token compliance produces `hcDesign > 0` regardless of
+ *   whether a design-authority principal commented on the issue.
  */
 export function computeDesignAuthorityWeight(signal) {
-    if (!signal || !signal.isDesignAuthority)
+    if (!signal)
+        return 0;
+    // Source 1: principal-participation weight.
+    const participationWeight = signal.isDesignAuthority
+        ? (() => {
+            const signalType = signal.signalType ?? 'unspecified';
+            const base = DESIGN_AUTHORITY_BASE_WEIGHT[signalType];
+            const modulation = signal.areaComplianceScore !== undefined ? 1.2 - signal.areaComplianceScore : 1;
+            return base * modulation;
+        })()
+        : 0;
+    // Source 3: compliance-assessment signal (additive).
+    const complianceWeight = signal.complianceSignal ?? 0;
+    return participationWeight + complianceWeight;
+}
+/**
+ * RFC-0008 §C5 Source 3 — map DSB token-compliance coverage to a
+ * small automatic signal for HC_design.
+ *
+ *   >= 0.8 (80 %)  → +0.3  (design system is healthy — small positive)
+ *   < 0.4  (40 %)  → −0.2  (design system is fragile — small negative)
+ *   otherwise      →  0.0  (neutral)
+ *
+ * The signal is intentionally small so it cannot outweigh Source 1
+ * (principal-participation, which carries base weights up to ±0.6).
+ * A DSB with missing status data returns 0 (graceful degradation).
+ */
+function computeComplianceSignal(binding) {
+    const rawCoverage = binding.status?.tokenCompliance?.currentCoverage;
+    if (rawCoverage === undefined || Number.isNaN(rawCoverage))
         return 0;
-    const signalType = signal.signalType ?? 'unspecified';
-    const base = DESIGN_AUTHORITY_BASE_WEIGHT[signalType];
-    const modulation = signal.areaComplianceScore !== undefined ? 1.2 - signal.areaComplianceScore : 1;
-    return base * modulation;
+    // Normalise: values > 1 are percent (0-100), values ≤ 1 are already fractions.
+    const coverage = rawCoverage > 1 ? rawCoverage / 100 : rawCoverage;
+    const clamped = Math.min(1, Math.max(0, coverage));
+    if (clamped >= 0.8)
+        return 0.3;
+    if (clamped < 0.4)
+        return -0.2;
+    return 0;
 }
 function buildDesignAuthoritySignal(input, ctx) {
     if (!ctx.designSystemBinding)
@@ -228,23 +270,32 @@ function buildDesignAuthoritySignal(input, ctx) {
     // AISDLC-171: surface whether the DSB declares any design authority
     // principals at all. This is a diagnostic flag — it does NOT participate
     // in the HC_design weight calculation (per RFC-0008 §14.2, only
-    // principals who participate as author/commenter can emit HC_design).
-    // Surfacing it lets pillarBreakdown distinguish "DSB has no design
-    // authority structure" from "DSB has design authority but no principal
-    // participated in this issue".
+    // principals who participate as author/commenter can emit HC_design via
+    // Source 1). The flag lets pillarBreakdown distinguish "DSB has no
+    // design authority structure" from "DSB has design authority but no
+    // principal participated in this issue".
     const principalsDeclared = (ctx.designSystemBinding.spec.stewardship.designAuthority.principals?.length ?? 0) > 0;
     const { isDesignAuthority, signalType } = checkDesignAuthority({
         authorLogin: input.authorLogin,
         commenterLogins: input.commenterLogins,
         labels: input.labels,
     }, ctx.designSystemBinding);
+    // RFC-0008 §C5 Source 3: compliance-assessment auto-signal from DSB health.
+    // Fires regardless of principal participation — gives a fully-loaded DSB
+    // a non-zero hcDesign even when no design-authority principal commented.
+    const complianceSignal = computeComplianceSignal(ctx.designSystemBinding);
     if (!isDesignAuthority) {
-        return { isDesignAuthority: false, principalsDeclared };
+        return {
+            isDesignAuthority: false,
+            principalsDeclared,
+            ...(complianceSignal !== 0 ? { complianceSignal } : {}),
+        };
     }
     return {
         isDesignAuthority: true,
         signalType,
         principalsDeclared,
+        ...(complianceSignal !== 0 ? { complianceSignal } : {}),
         ...(ctx.areaComplianceScore !== undefined
             ? { areaComplianceScore: ctx.areaComplianceScore }
             : {}),