@ai-sdlc/orchestrator 0.9.0 → 0.13.0

package/dist/admission-composite.js

@@ -1,5 +1,5 @@
 /**
- * Admission-subset composite (RFC-0008 §A.6).
+ * Admission-subset composite (RFC-0008 §A.6 + RFC-0009 Phase 2.1).
  *
  * The admission gate uses a subset of the full PPA composite:
  *
@@ -23,11 +23,18 @@
  * The `override` bypass is preserved at position 1: when the input has
  * `override: true`, we return `composite = Infinity` without running
  * the admission math — identical to the legacy PPA behaviour.
+ *
+ * **RFC-0009 Phase 2.1 tessellation extension:**
+ * When `AdmissionCompositeOptions.tessellationContext` is provided, the
+ * composite routes SA and Eρ₄ (designSystemReadiness) through soul scope
+ * per RFC-0009 §6. See `tessellation-admission.ts` for the routing algorithm.
  */
 import { mapIssueToPriorityInput } from './admission-score.js';
 import { computeAutonomyFactor, computeDefectRiskFactor, computeReadinessFromDesignSystemContext, } from './admission-enrichment.js';
 import { computeAdmissionHumanCurve } from './admission-hc.js';
-import { computeConfidence } from './priority.js';
+import { computeTessellatedScores, } from './tessellation-admission.js';
+import { computeVariantScopedScores, } from './variant-admission.js';
+import { computeComplianceClearance, } from './compliance-clearance.js';
 const DEFAULT_SIGNAL = 0.5;
 export function computeAdmissionComposite(input, config, options) {
     const timestamp = new Date().toISOString();
@@ -78,7 +85,7 @@ export function computeAdmissionComposite(input, config, options) {
         };
     }
     // ── SA (soul alignment) — SA-1 override (M5) or label-based fallback ──
-    const soulAlignment = clamp01(options?.soulAlignmentOverride ?? priorityInput.soulAlignment ?? DEFAULT_SIGNAL);
+    const baseSoulAlignment = clamp01(options?.soulAlignmentOverride ?? priorityInput.soulAlignment ?? DEFAULT_SIGNAL);
     // ── D-pi_adjusted ─────────────────────────────────────────────
     const demand = priorityInput.demandSignal ?? DEFAULT_SIGNAL;
     const consensus = priorityInput.teamConsensus ?? DEFAULT_SIGNAL;
@@ -92,12 +99,49 @@ export function computeAdmissionComposite(input, config, options) {
     const complexity = priorityInput.complexity ?? 5;
     const baseExecutionReality = clamp01(1 - complexity / 10);
     const autonomyFactor = computeAutonomyFactor(input.autonomyContext);
-    const designSystemReadiness = computeReadinessFromDesignSystemContext(input.designSystemContext);
+    const baseDesignSystemReadiness = computeReadinessFromDesignSystemContext(input.designSystemContext);
+    // ── RFC-0009 Phase 2.1: tessellation soul-scope routing ────────
+    // When tessellationContext is present, route SA and Eρ₄ through soul
+    // scope per RFC-0009 §6. When absent, single-DID path applies.
+    //
+    // Prefer the canonical workItemId (e.g. "AISDLC-313") over the GitHub-style
+    // "#313" so the dep-graph snapshot lookup matches the backlog task ID format.
+    const workItemId = input.workItemId ?? `#${input.issueNumber}`;
+    const tessellationResult = computeTessellatedScores(workItemId, baseSoulAlignment, baseDesignSystemReadiness, options?.tessellationContext);
+    // ── RFC-0017 Phase 2: variant-scope refinement ────────────────
+    // When `variantContext` is provided AND the work item declares
+    // `targetedVariants[]`, the per-variant Sα₁ + Sα₂ scores REFINE the
+    // soul-aggregate `soulAlignment` from tessellation. The combined SA score
+    // fed to the composite is the mean of the variant-resolved Sα₁ + Sα₂
+    // (both feed soul-alignment per RFC-0008 §A.6 SA pillar definition).
+    // When no targeting declared OR variantContext is absent, this is a
+    // passthrough — the tessellation result is preserved unchanged
+    // (backward-compat per RFC-0017 §7).
+    const variantResult = computeVariantScopedScores(workItemId, tessellationResult.soulAlignment, tessellationResult.soulAlignment, options?.variantContext);
+    const soulAlignment = variantResult.routingPath === 'no-variant-routing'
+        ? tessellationResult.soulAlignment
+        : combineVariantSaForSoulAlignment(variantResult.sa1, variantResult.sa2);
+    const designSystemReadiness = tessellationResult.er4;
     const executionReality = Math.min(baseExecutionReality * autonomyFactor, designSystemReadiness);
+    // ── RFC-0009 Phase 4.1: Eρ₅ Compliance Clearance ──────────────
+    // Categorical 0/1 gating per §7.1. When the adopter has opted in AND any
+    // declared regime is violated, the composite is gated to 0 (work item
+    // cannot proceed without resolving the violation). When the adopter has
+    // not opted in (default), this returns er5=1 and the composite is
+    // unchanged — full backward compatibility with Phase 2/3 behavior.
+    //
+    // Uses the same `affectedSoulIds` resolved by tessellation routing, so the
+    // regime check follows the work item's actual soul scope. Substrate-only
+    // work (affectedSoulIds = []) falls through to the `__platform` sentinel.
+    const complianceClearanceResult = computeComplianceClearance(workItemId, tessellationResult.affectedSoulIds, options?.complianceClearanceContext);
     // ── HC (tanh-compressed with HC_design) ───────────────────────
     const humanCurve = computeAdmissionHumanCurve(input);
     // ── §A.6 admission subset composite ───────────────────────────
-    const composite = soulAlignment * demandPressureAdjusted * executionReality * (1 + humanCurve.hcComposite);
+    const composite = soulAlignment *
+        demandPressureAdjusted *
+        executionReality *
+        complianceClearanceResult.er5 *
+        (1 + humanCurve.hcComposite);
     const score = {
         composite,
         dimensions: {
@@ -114,9 +158,23 @@ export function computeAdmissionComposite(input, config, options) {
             // display continuity but do not multiply it into `composite`.
             calibration: clampCalibration(config?.calibrationCoefficient),
         },
-        confidence: computeConfidence(priorityInput),
+        confidence: computeAdmissionConfidence(input, priorityInput, options),
         timestamp,
     };
+    // Only include tessellation breakdown when the caller provided a context
+    // (non-tessellated path produces routingPath: 'non-tessellated' but we
+    // elide the field to preserve backward compat with callers that don't
+    // destructure the breakdown exhaustively).
+    const tessellationBreakdown = options?.tessellationContext !== undefined ? tessellationResult : undefined;
+    // Variant breakdown surfaced ONLY when the caller wired a variant context
+    // AND the work item actually targeted variants. Pure backward-compat for
+    // callers on the soul-aggregate path.
+    const variantBreakdown = options?.variantContext !== undefined && variantResult.routingPath !== 'no-variant-routing'
+        ? variantResult
+        : undefined;
+    // Compliance clearance breakdown surfaced ONLY when the adopter opted in
+    // (avoids polluting the breakdown shape for Phase 2/3 callers).
+    const complianceClearanceBreakdown = options?.complianceClearanceContext?.enabled === true ? complianceClearanceResult : undefined;
     return {
         score,
         breakdown: {
@@ -129,9 +187,115 @@ export function computeAdmissionComposite(input, config, options) {
             designSystemReadiness,
             executionReality,
             humanCurve,
+            ...(tessellationBreakdown !== undefined ? { tessellation: tessellationBreakdown } : {}),
+            ...(variantBreakdown !== undefined ? { variant: variantBreakdown } : {}),
+            ...(complianceClearanceBreakdown !== undefined
+                ? { complianceClearance: complianceClearanceBreakdown }
+                : {}),
         },
     };
 }
+/**
+ * Combine variant-scope Sα₁ (audience resonance) + Sα₂ (vibe coherence) into
+ * a single soul-alignment value for the admission composite's SA pillar.
+ *
+ * The legacy admission composite uses a single `soulAlignment` scalar that
+ * conceptually rolls Sα₁ + Sα₂ together (RFC-0008 §A.6 SA pillar). When
+ * variant routing splits them out per RFC-0017 §5.4, we recombine via the
+ * arithmetic mean — equal weighting matches the soul-aggregate combination
+ * implied by `pillar-breakdown.ts` and avoids favouring one Sα facet over
+ * the other when both are equally variant-bounded.
+ *
+ * Exported for unit testing + so downstream callers can replicate the
+ * combination logic if they need to surface the constituent pieces.
+ */
+export function combineVariantSaForSoulAlignment(sa1, sa2) {
+    return clamp01((sa1 + sa2) / 2);
+}
+// ── Admission confidence (AISDLC-172) ──────────────────────────────────
+/**
+ * `PriorityInput` fields that the admission mapper (`mapIssueToPriorityInput`)
+ * actually populates from issue/backlog signals. The full PPA `SCORABLE_FIELDS`
+ * list (used by `computeConfidence` in `priority.ts`) includes runtime-only
+ * dimensions like `regulatoryUrgency`, `techInflection`, `marketDivergence`,
+ * `meetingDecision`, `budgetUtilization`, and `dependencyClearance` — none of
+ * which the admission mapper ever sets. Counting against the full 16-field
+ * list capped admit confidence at ~9/16 ≈ 0.56 even for fully-shaped issues
+ * (RFC-0009 §13 OQ-9 "0.5 ceiling" bug). The mapper-relevant subset is the
+ * correct denominator for the mapper-evidence half of the blend.
+ */
+const ADMISSION_MAPPER_FIELDS = [
+    'soulAlignment',
+    'demandSignal',
+    'teamConsensus',
+    'builderConviction',
+    'complexity',
+    'bugSeverity',
+    'explicitPriority',
+    'competitiveDrift',
+    'customerRequestCount',
+];
+/**
+ * RFC-0008 enrichment slots whose presence on `AdmissionInput` indicates
+ * an enrichment reader successfully loaded its context. This is the
+ * "enrichment-success signal" referenced in the OQ-9 hypothesis:
+ *
+ *   - `designSystemContext`     ← DSB loader (catalog/token coverage)
+ *   - `autonomyContext`         ← AutonomyPolicy (DID-driven) loader
+ *   - `codeAreaQuality`         ← code-area metrics loader
+ *   - `designAuthoritySignal`   ← maintainers/principals loader
+ *   - `soulAlignmentOverride`   ← soul-tracks SA-1 loader (M5 path)
+ *
+ * Total slots is `5`. Each loaded slot contributes `1/5` to the
+ * enrichment-evidence half of the confidence blend.
+ */
+const ADMISSION_ENRICHMENT_SLOT_COUNT = 5;
+function countLoadedEnrichmentSlots(input, options) {
+    let loaded = 0;
+    if (input.designSystemContext)
+        loaded++;
+    if (input.autonomyContext)
+        loaded++;
+    if (input.codeAreaQuality)
+        loaded++;
+    if (input.designAuthoritySignal)
+        loaded++;
+    if (options?.soulAlignmentOverride !== undefined)
+        loaded++;
+    return loaded;
+}
+/**
+ * Compute admission confidence in [0, 1] as a 50/50 blend of two
+ * independent evidence channels:
+ *
+ *   1. **Mapper coverage** — fraction of `ADMISSION_MAPPER_FIELDS`
+ *      explicitly populated on the derived `PriorityInput`. Captures
+ *      "how much issue/backlog signal did `mapIssueToPriorityInput`
+ *      extract".
+ *
+ *   2. **Enrichment loaded** — fraction of RFC-0008 enrichment slots
+ *      present on the input (or supplied via `options`). Captures "how
+ *      much external context did the enrichment readers contribute".
+ *
+ * Bug fixed (AISDLC-172 / RFC-0009 §13 OQ-9): previously
+ * `computeConfidence(priorityInput)` from `priority.ts` was used, which
+ * counts against the full 16-field `SCORABLE_FIELDS` list and ignores
+ * enrichment success entirely. The result was a hard ~0.5 ceiling on
+ * admit confidence even when DID + DSB + maintainers + soul-tracks all
+ * loaded — those four positive observations contributed exactly zero
+ * to the formula's denominator and zero to its numerator.
+ */
+export function computeAdmissionConfidence(input, priorityInput, options) {
+    let providedMapper = 0;
+    for (const field of ADMISSION_MAPPER_FIELDS) {
+        if (priorityInput[field] !== undefined)
+            providedMapper++;
+    }
+    const mapperFraction = providedMapper / ADMISSION_MAPPER_FIELDS.length;
+    const loadedEnrichment = countLoadedEnrichmentSlots(input, options);
+    const enrichmentFraction = loadedEnrichment / ADMISSION_ENRICHMENT_SLOT_COUNT;
+    return 0.5 * mapperFraction + 0.5 * enrichmentFraction;
+}
 function clamp01(value) {
     return Math.min(1, Math.max(0, value));
 }

package/dist/admission-enrichment.d.ts

@@ -92,15 +92,24 @@ export declare function complexityToAutonomyLevel(complexity: number): number;
  */
 export declare function computeAutonomyFactor(ctx: AutonomyContext | undefined): number;
 /**
- * Compute the C5 design-authority weight per §A.5.
+ * Compute the C5 design-authority weight per §A.5 (Source 1) plus
+ * the RFC-0008 §C5 Source 3 compliance-assessment signal.
  *
+ * Source 1 (principal participation):
  *   non-authority           → 0.0
  *   authority + positive    → +0.6 × modulation
  *   authority + negative    → -0.4 × modulation
  *   authority + no type     → +0.3 × modulation
  *
- * where `modulation = 1.2 - areaComplianceScore` when the score is
- * supplied, else `1.0` (unmodulated base weight).
+ *   where `modulation = 1.2 - areaComplianceScore` when the score is
+ *   supplied, else `1.0` (unmodulated base weight).
+ *
+ * Source 3 (compliance assessment — additive):
+ *   `signal.complianceSignal` contributes directly when present (see
+ *   `buildDesignAuthoritySignal`). This fires from DSB health data
+ *   alone — no principal participation required — so a fully-loaded DSB
+ *   with high token compliance produces `hcDesign > 0` regardless of
+ *   whether a design-authority principal commented on the issue.
  */
 export declare function computeDesignAuthorityWeight(signal: DesignAuthoritySignal | undefined): number;
 /**

package/dist/admission-enrichment.js

@@ -204,37 +204,98 @@ const DESIGN_AUTHORITY_BASE_WEIGHT = Object.freeze({
     unspecified: 0.3,
 });
 /**
- * Compute the C5 design-authority weight per §A.5.
+ * Compute the C5 design-authority weight per §A.5 (Source 1) plus
+ * the RFC-0008 §C5 Source 3 compliance-assessment signal.
  *
+ * Source 1 (principal participation):
  *   non-authority           → 0.0
  *   authority + positive    → +0.6 × modulation
  *   authority + negative    → -0.4 × modulation
  *   authority + no type     → +0.3 × modulation
  *
- * where `modulation = 1.2 - areaComplianceScore` when the score is
- * supplied, else `1.0` (unmodulated base weight).
+ *   where `modulation = 1.2 - areaComplianceScore` when the score is
+ *   supplied, else `1.0` (unmodulated base weight).
+ *
+ * Source 3 (compliance assessment — additive):
+ *   `signal.complianceSignal` contributes directly when present (see
+ *   `buildDesignAuthoritySignal`). This fires from DSB health data
+ *   alone — no principal participation required — so a fully-loaded DSB
+ *   with high token compliance produces `hcDesign > 0` regardless of
+ *   whether a design-authority principal commented on the issue.
  */
 export function computeDesignAuthorityWeight(signal) {
-    if (!signal || !signal.isDesignAuthority)
+    if (!signal)
         return 0;
-    const signalType = signal.signalType ?? 'unspecified';
-    const base = DESIGN_AUTHORITY_BASE_WEIGHT[signalType];
-    const modulation = signal.areaComplianceScore !== undefined ? 1.2 - signal.areaComplianceScore : 1;
-    return base * modulation;
+    // Source 1: principal-participation weight.
+    const participationWeight = signal.isDesignAuthority
+        ? (() => {
+            const signalType = signal.signalType ?? 'unspecified';
+            const base = DESIGN_AUTHORITY_BASE_WEIGHT[signalType];
+            const modulation = signal.areaComplianceScore !== undefined ? 1.2 - signal.areaComplianceScore : 1;
+            return base * modulation;
+        })()
+        : 0;
+    // Source 3: compliance-assessment signal (additive).
+    const complianceWeight = signal.complianceSignal ?? 0;
+    return participationWeight + complianceWeight;
+}
+/**
+ * RFC-0008 §C5 Source 3 — map DSB token-compliance coverage to a
+ * small automatic signal for HC_design.
+ *
+ *   >= 0.8 (80 %)  → +0.3  (design system is healthy — small positive)
+ *   < 0.4  (40 %)  → −0.2  (design system is fragile — small negative)
+ *   otherwise      →  0.0  (neutral)
+ *
+ * The signal is intentionally small so it cannot outweigh Source 1
+ * (principal-participation, which carries base weights up to ±0.6).
+ * A DSB with missing status data returns 0 (graceful degradation).
+ */
+function computeComplianceSignal(binding) {
+    const rawCoverage = binding.status?.tokenCompliance?.currentCoverage;
+    if (rawCoverage === undefined || Number.isNaN(rawCoverage))
+        return 0;
+    // Normalise: values > 1 are percent (0-100), values ≤ 1 are already fractions.
+    const coverage = rawCoverage > 1 ? rawCoverage / 100 : rawCoverage;
+    const clamped = Math.min(1, Math.max(0, coverage));
+    if (clamped >= 0.8)
+        return 0.3;
+    if (clamped < 0.4)
+        return -0.2;
+    return 0;
 }
 function buildDesignAuthoritySignal(input, ctx) {
     if (!ctx.designSystemBinding)
         return undefined;
+    // AISDLC-171: surface whether the DSB declares any design authority
+    // principals at all. This is a diagnostic flag — it does NOT participate
+    // in the HC_design weight calculation (per RFC-0008 §14.2, only
+    // principals who participate as author/commenter can emit HC_design via
+    // Source 1). The flag lets pillarBreakdown distinguish "DSB has no
+    // design authority structure" from "DSB has design authority but no
+    // principal participated in this issue".
+    const principalsDeclared = (ctx.designSystemBinding.spec.stewardship.designAuthority.principals?.length ?? 0) > 0;
     const { isDesignAuthority, signalType } = checkDesignAuthority({
         authorLogin: input.authorLogin,
         commenterLogins: input.commenterLogins,
         labels: input.labels,
     }, ctx.designSystemBinding);
-    if (!isDesignAuthority)
-        return { isDesignAuthority: false };
+    // RFC-0008 §C5 Source 3: compliance-assessment auto-signal from DSB health.
+    // Fires regardless of principal participation — gives a fully-loaded DSB
+    // a non-zero hcDesign even when no design-authority principal commented.
+    const complianceSignal = computeComplianceSignal(ctx.designSystemBinding);
+    if (!isDesignAuthority) {
+        return {
+            isDesignAuthority: false,
+            principalsDeclared,
+            ...(complianceSignal !== 0 ? { complianceSignal } : {}),
+        };
+    }
     return {
         isDesignAuthority: true,
         signalType,
+        principalsDeclared,
+        ...(complianceSignal !== 0 ? { complianceSignal } : {}),
         ...(ctx.areaComplianceScore !== undefined
             ? { areaComplianceScore: ctx.areaComplianceScore }
             : {}),

package/dist/admission-hc.d.ts

@@ -34,8 +34,27 @@ export interface AdmissionHumanCurveResult {
     hcConsensus: number;
     /** Signed meeting-decision signal in [-1, 1] (0 = neutral when absent). */
     hcDecision: number;
-    /** Signed design-authority signal in [-1, 1]. */
+    /**
+     * Signed design-authority signal in [-1, 1].
+     *
+     * AISDLC-171: this channel ONLY fires when one of the issue's
+     * participants (author or commenters) is a principal listed in
+     * `DesignSystemBinding.spec.stewardship.designAuthority.principals`.
+     * Per RFC-0008 §14.2, non-principal participants' design opinions
+     * route through `hcConsensus` instead — `hcDesign` carries
+     * specifically the design-authority leadership signal. To distinguish
+     * "no DSB at all" from "DSB exists but no design principal
+     * participated", consult `designAuthorityConfigured` on this result
+     * (and on `pillarBreakdown.shared.hcComposite`).
+     */
     hcDesign: number;
+    /**
+     * Diagnostic flag (AISDLC-171) — true when the resolved DSB declared
+     * `stewardship.designAuthority.principals` entries. Always undefined
+     * when no DSB was supplied (preDesignSystem). Surfaces the
+     * "configured but inactive" state without altering hcDesign weight.
+     */
+    designAuthorityConfigured?: boolean;
     /** Weighted sum before tanh. */
     hcRaw: number;
     /** `tanh(hcRaw)` — the HC value consumed by the admission composite. */

package/dist/admission-hc.js

@@ -70,12 +70,23 @@ export function computeAdmissionHumanCurve(input) {
     const hcConsensus = deriveHcConsensus(input);
     const hcDecision = deriveHcDecision(input);
     const hcDesign = deriveHcDesign(input.designAuthoritySignal);
+    // AISDLC-171: surface the diagnostic flag from the enriched signal so
+    // pillarBreakdown can render the "configured but inactive" state.
+    const designAuthorityConfigured = input.designAuthoritySignal?.principalsDeclared;
     const hcRaw = HC_WEIGHTS.explicit * hcExplicit +
         HC_WEIGHTS.consensus * hcConsensus +
         HC_WEIGHTS.decision * hcDecision +
         HC_WEIGHTS.design * hcDesign;
     const hcComposite = Math.tanh(hcRaw);
-    return { hcExplicit, hcConsensus, hcDecision, hcDesign, hcRaw, hcComposite };
+    return {
+        hcExplicit,
+        hcConsensus,
+        hcDecision,
+        hcDesign,
+        hcRaw,
+        hcComposite,
+        ...(designAuthorityConfigured !== undefined ? { designAuthorityConfigured } : {}),
+    };
 }
 function clamp(value, min, max) {
     return Math.min(max, Math.max(min, value));

package/dist/admission-score.d.ts

@@ -25,6 +25,18 @@ export interface AdmissionInput {
     commentCount: number;
     /** ISO timestamp of issue creation. */
     createdAt: string;
+    /**
+     * Canonical work item ID for dep-graph lookups (RFC-0014 / RFC-0009 Phase 2.1).
+     *
+     * When present, used instead of `#${issueNumber}` to match the work item
+     * against dep-graph snapshot entries (which use backlog task IDs like
+     * `AISDLC-313`). Backlog adapters set this from the task's frontmatter `id`.
+     *
+     * Absent for GitHub-issue based inputs — the admission composite falls back
+     * to `#${issueNumber}` which is consistent with `mapIssueToPriorityInput`'s
+     * `itemId` field.
+     */
+    workItemId?: string;
     /** GitHub author_association — determines trust-based signal boosting. */
     authorAssociation?: AuthorAssociation;
     /** GitHub login of the issue author (used by C5 principal match). */
@@ -102,6 +114,38 @@ export interface DesignAuthoritySignal {
     signalType?: DesignAuthoritySignalType;
     /** The issue's code area compliance score in [0, 1] (used to modulate weight). */
     areaComplianceScore?: number;
+    /**
+     * Diagnostic flag (AISDLC-171) — true when the resolved DSB declared
+     * one or more `stewardship.designAuthority.principals` entries,
+     * regardless of whether any of them participated in this issue.
+     *
+     * This is intentionally NOT consumed by `computeDesignAuthorityWeight`
+     * — RFC-0008 §14.2 requires principal participation for HC_design to
+     * fire at any weight. The flag exists so `pillarBreakdown.shared.
+     * hcComposite.designAuthorityConfigured` can surface "design authority
+     * is configured but absent from this issue" — distinct from "no
+     * design authority structure exists at all" — without violating the
+     * RFC's §14.2 weighting constraint.
+     */
+    principalsDeclared?: boolean;
+    /**
+     * RFC-0008 §C5 Source 3 — automated compliance-assessment signal in [-1, 1].
+     *
+     * Populated by `buildDesignAuthoritySignal` when the resolved DSB carries
+     * `status.tokenCompliance.currentCoverage`:
+     *   >= 0.8 (80 %) → small positive signal (+0.3): design system is healthy here
+     *   < 0.4  (40 %) → small negative signal (-0.2): design system is fragile here
+     *   otherwise     → 0 (neutral)
+     *
+     * This signal fires from the DSB health data alone — no principal participation
+     * required. It is additive to the principal-participation weight in
+     * `computeDesignAuthorityWeight`, so a fully-loaded DSB with high compliance
+     * produces `hcDesign > 0` even when no design-authority principal commented.
+     *
+     * Absent (undefined) when no DSB is resolved or the DSB lacks token-compliance
+     * status — callers treat absence the same as 0.
+     */
+    complianceSignal?: number;
 }
 export interface AdmissionThresholds {
     minimumScore: number;

package/dist/admission-score.js

@@ -24,7 +24,13 @@ export function mapIssueToPriorityInput(input) {
     const backlog = input.backlogContext;
     // ── Backlog status veto ─────────────────────────────────────
     // Drafts aren't ready to admit; orchestrator should ignore them.
-    if (backlog?.status === 'Draft') {
+    // RFC-0011 Phase 4 (AISDLC-115.5): the same veto applies to
+    // `Needs Clarification` — running PPA on an unready issue burns
+    // scoring effort that gets invalidated on clarification (RFC §2.3 +
+    // §7.2). The PPA admission step short-circuits with soulAlignment=0
+    // so the composite scorer treats the issue as not-admissible without
+    // calling out to the design / autonomy / trust enrichment layers.
+    if (backlog?.status === 'Draft' || backlog?.status === 'Needs Clarification') {
         return {
             itemId: `#${input.issueNumber}`,
             title: input.title,
@@ -39,7 +45,10 @@ export function mapIssueToPriorityInput(input) {
     const isTrusted = assoc === 'OWNER' || assoc === 'MEMBER' || assoc === 'COLLABORATOR';
     const isContributor = assoc === 'CONTRIBUTOR';
     // ── Complexity from issue body, AC count, or backlog context ─
-    const complexityMatch = input.body?.match(/###?\s*Complexity\s*\n+\s*(\d+)/i);
+    // Horizontal-whitespace classes ([ \t]) around \n+ so the sub-patterns can't
+    // overlap (\s includes \n) — avoids polynomial backtracking on attacker-
+    // controlled issue bodies (CodeQL js/polynomial-redos).
+    const complexityMatch = input.body?.match(/###?[ \t]*Complexity[ \t]*\n+[ \t]*(\d+)/i);
     let complexity = complexityMatch ? Number(complexityMatch[1]) : undefined;
     // Backlog tasks rarely include a `### Complexity` header — fall back to AC count
     // (each AC is roughly one logical unit; clamp at 10).

package/dist/backlog-adapter.d.ts

@@ -18,6 +18,36 @@
  */
 import type { PriorityInput, QualityFlag } from '@ai-sdlc/reference';
 import { type AdmissionInput } from './admission-score.js';
+/**
+ * Extract a code-area string from a list of file/path references.
+ *
+ * Algorithm:
+ *   1. Filter references down to path-like strings (not URLs, not AISDLC-N
+ *      IDs, not RFC-NNNN IDs) — the path-like entries are the ones that
+ *      carry blast-radius signal.
+ *   2. Compute the deepest common path prefix across all filtered paths
+ *      at the directory level (e.g. `pipeline-cli/src/orchestrator/filters/x.ts`
+ *      + `pipeline-cli/src/orchestrator/loop.ts` → `pipeline-cli/src/orchestrator`).
+ *   3. Return the prefix, or `undefined` when there are no path references.
+ *
+ * The caller uses the result to populate `EnrichmentContext.codeArea` so
+ * `buildCodeAreaQuality()` can look up per-area metrics instead of the
+ * uniform Eρ variance of 0.30.
+ *
+ * @param references  Raw reference strings from frontmatter `references:` AND
+ *                    any `## References` body section — callers are responsible
+ *                    for merging both sources before calling here.
+ */
+export declare function extractCodeAreaFromReferences(references: string[]): string | undefined;
+/**
+ * Parse file-path references from a `## References` markdown section.
+ *
+ * The body format is a bullet list where each item may be a bare path,
+ * a backtick-quoted path, a description with an inline path, or a mix.
+ * We extract the first backtick-quoted segment or the first slash-
+ * containing word from each bullet.
+ */
+export declare function parseBodyReferences(body: string): string[];
 export interface BacklogAcceptanceCriterion {
     index: number;
     text: string;
@@ -38,6 +68,11 @@ export interface BacklogTaskSnapshot {
     createdBy?: string;
     acceptanceCriteria: BacklogAcceptanceCriterion[];
     references: string[];
+    /**
+     * References extracted from the `## References` body section.
+     * Merged with frontmatter `references` when computing `codeArea`.
+     */
+    bodyReferences: string[];
     /** Task IDs this task is blocked by (frontmatter `dependencies`). */
     dependencies: string[];
     /** Filesystem path the snapshot was read from. */
@@ -83,6 +118,16 @@ export interface BacklogAdmissionMapping {
     priorityInputOverrides: Partial<PriorityInput>;
     /** Quality flags surfaced for renderers (zombie close, etc). */
     qualityFlags: QualityFlag[];
+    /**
+     * Deepest common path prefix computed from all references in the task
+     * (frontmatter `references:` + `## References` body section).
+     *
+     * Pass to `EnrichmentContext.codeArea` when calling `enrichAdmissionInput()`
+     * so `buildCodeAreaQuality()` can look up per-area metrics instead of the
+     * uniform Eρ variance of 0.30. Undefined when the task has no file-path
+     * references — callers should fall through to the uniform default.
+     */
+    codeArea: string | undefined;
 }
 /**
  * Map a Backlog snapshot onto an `AdmissionInput` plus the