@cleocode/contracts 2026.5.112 → 2026.5.113

package/src/docs-taxonomy.ts

@@ -98,6 +98,20 @@ export interface DocKindMetadata {
    * Built-in kinds leave this unset; extensions set it to `true`.
    */
   readonly isExtension?: boolean;
+  /**
+   * Optional list of H2 section titles that MUST appear in the document
+   * body. Validated by `validateDocBody(kind, body)` (T10160).
+   *
+   * Match is case-insensitive and tolerant of hyphen-vs-space variants
+   * (e.g. `## Next Steps` and `## next-steps` both satisfy a required
+   * section of `Next Steps`).
+   *
+   * Empty or omitted → no body schema requirements for this kind.
+   *
+   * @task T10160 (E12.C3 · absorbs T10154)
+   * @epic T10157
+   */
+  readonly requiredSections?: ReadonlyArray<string>;
 }
 
 // ---------------------------------------------------------------------------
@@ -125,6 +139,7 @@ export const BUILTIN_DOC_KINDS: ReadonlyArray<DocKindMetadata> = [
     publishDir: 'docs/adr',
     requiresEntityId: true,
     entityIdPattern: /^adr-\d{3,4}-[a-z0-9-]+$/,
+    requiredSections: ['Status', 'Date', 'Context', 'Decision', 'Consequences'],
   },
   {
     kind: 'spec',
@@ -133,6 +148,7 @@ export const BUILTIN_DOC_KINDS: ReadonlyArray<DocKindMetadata> = [
     defaultOwnerKind: 'task',
     publishDir: 'docs/spec',
     requiresEntityId: false,
+    requiredSections: ['Goal', 'Non-Goals', 'Requirements', 'Out-of-Scope'],
   },
   {
     kind: 'research',
@@ -141,6 +157,7 @@ export const BUILTIN_DOC_KINDS: ReadonlyArray<DocKindMetadata> = [
     defaultOwnerKind: 'task',
     publishDir: 'docs/research',
     requiresEntityId: false,
+    requiredSections: ['Question', 'Findings', 'Sources'],
   },
   {
     kind: 'handoff',
@@ -149,6 +166,7 @@ export const BUILTIN_DOC_KINDS: ReadonlyArray<DocKindMetadata> = [
     defaultOwnerKind: 'session',
     publishDir: 'docs/handoff',
     requiresEntityId: false,
+    requiredSections: ['Context', 'State', 'Next-Steps'],
   },
   {
     kind: 'note',
@@ -157,6 +175,7 @@ export const BUILTIN_DOC_KINDS: ReadonlyArray<DocKindMetadata> = [
     defaultOwnerKind: 'observation',
     publishDir: 'docs/note',
     requiresEntityId: false,
+    requiredSections: [],
   },
   {
     kind: 'llm-readme',
@@ -165,6 +184,7 @@ export const BUILTIN_DOC_KINDS: ReadonlyArray<DocKindMetadata> = [
     defaultOwnerKind: 'project',
     publishDir: '.',
     requiresEntityId: false,
+    requiredSections: [],
   },
   {
     kind: 'changeset',
@@ -174,6 +194,7 @@ export const BUILTIN_DOC_KINDS: ReadonlyArray<DocKindMetadata> = [
     publishDir: '.changeset',
     requiresEntityId: true,
     entityIdPattern: /^t\d+-[a-z0-9-]+$/,
+    requiredSections: [],
   },
   {
     kind: 'release-note',
@@ -183,6 +204,7 @@ export const BUILTIN_DOC_KINDS: ReadonlyArray<DocKindMetadata> = [
     publishDir: 'docs/release',
     requiresEntityId: true,
     entityIdPattern: /^v\d{4}\.\d+\.\d+(-[a-z0-9-]+)?$/,
+    requiredSections: ['Changes', 'Migration'],
   },
   {
     kind: 'plan',
@@ -191,6 +213,7 @@ export const BUILTIN_DOC_KINDS: ReadonlyArray<DocKindMetadata> = [
     defaultOwnerKind: 'task',
     publishDir: 'docs/plan',
     requiresEntityId: false,
+    requiredSections: ['Goal', 'Steps', 'Owners'],
   },
   {
     kind: 'rcasd',
@@ -200,6 +223,7 @@ export const BUILTIN_DOC_KINDS: ReadonlyArray<DocKindMetadata> = [
     publishDir: '.cleo/rcasd',
     requiresEntityId: true,
     entityIdPattern: /^t\d+(-.+)?$/,
+    requiredSections: ['Root-Cause', 'Action', 'Schedule', 'Detection'],
   },
 ];
 
@@ -253,6 +277,16 @@ export interface DocKindExtensionConfig {
    * a malformed config can't trigger pathological backtracking.
    */
   readonly entityIdPattern?: string;
+  /**
+   * Optional list of required H2 section titles for this extension kind.
+   *
+   * Same semantics as {@link DocKindMetadata.requiredSections} — matched
+   * case-insensitively with hyphen/space normalisation. Omit or pass
+   * `[]` for kinds that have no body schema.
+   *
+   * @task T10160
+   */
+  readonly requiredSections?: ReadonlyArray<string>;
 }
 
 /**
@@ -596,6 +630,25 @@ function validateExtensionEntry(
     );
   }
 
+  let requiredSections: ReadonlyArray<string> | undefined;
+  if (obj.requiredSections !== undefined) {
+    if (!Array.isArray(obj.requiredSections)) {
+      throw new DocKindConfigError(`${where}: 'requiredSections' must be an array`, source);
+    }
+    const sections: string[] = [];
+    for (let i = 0; i < obj.requiredSections.length; i++) {
+      const item = obj.requiredSections[i];
+      if (typeof item !== 'string' || item.length === 0) {
+        throw new DocKindConfigError(
+          `${where}: 'requiredSections[${i}]' must be a non-empty string`,
+          source,
+        );
+      }
+      sections.push(item);
+    }
+    requiredSections = sections;
+  }
+
   return {
     kind,
     label,
@@ -604,6 +657,7 @@ function validateExtensionEntry(
     publishDir,
     requiresEntityId,
     ...(entityIdPattern !== undefined ? { entityIdPattern } : {}),
+    ...(requiredSections !== undefined ? { requiredSections } : {}),
   };
 }
 
@@ -633,6 +687,7 @@ function compileExtension(ext: DocKindExtensionConfig, source: string): DocKindM
     publishDir: ext.publishDir,
     requiresEntityId: ext.requiresEntityId,
     ...(entityIdPattern !== undefined ? { entityIdPattern } : {}),
+    ...(ext.requiredSections !== undefined ? { requiredSections: ext.requiredSections } : {}),
     isExtension: true,
   };
 }

package/src/doctor.ts

@@ -20,6 +20,8 @@
  * @epic T9808
  */
 
+import type { InvariantSeverity } from './invariants/index.js';
+
 /**
  * One orphan `.cleo/` directory discovered under
  * `<projectRoot>/.claude/worktrees/`.
@@ -286,6 +288,115 @@ export interface SagaAuditResult {
   driftCount: number;
 }
 
+// ============================================================================
+// Invariant Registry Audit (T10340 — Saga T10326 SG-SUBSTRATE-RECONCILIATION /
+// Epic T10327 E-INVARIANT-REGISTRY-SSOT / R6)
+// ============================================================================
+
+/**
+ * Per-entry status reported by {@link auditInvariantRegistry}.
+ *
+ * - `'pass'` — the entry has an adapter that executed against the current
+ *   `.cleo/tasks.db` state and observed zero violations.
+ * - `'fail'` — the entry has an adapter that executed and observed one or
+ *   more violations (forwarded into {@link InvariantAuditEntry.violations}).
+ * - `'not-applicable'` — the entry's `runtimeGate` is spawn-bound,
+ *   session-bound, or release-tag-bound, so there is no "scan current DB"
+ *   interpretation. Reported for completeness so the registry walk is
+ *   visible end-to-end.
+ * - `'documented'` — the entry has `runtimeGate === null` by design (the
+ *   invariant is a display/storage/process concern enforced elsewhere).
+ *   No check performed; surfaced so operators can audit gap coverage.
+ *
+ * @task T10340
+ */
+export type InvariantAuditStatus = 'pass' | 'fail' | 'not-applicable' | 'documented';
+
+/**
+ * One violation surfaced by {@link auditInvariantRegistry}.
+ *
+ * The shape intentionally mirrors {@link SagaAuditViolation} (so the saga
+ * audit pipeline can adapt its findings into this envelope without an
+ * intermediate transform), but the `invariantKey` field is the registry
+ * key (`${adr}.${code}`, e.g. `'ADR-073.I5'`) instead of a saga-only
+ * `kind` discriminator.
+ *
+ * @task T10340
+ */
+export interface InvariantAuditViolation {
+  /** Registry key — `${adr}.${code}`. */
+  invariantKey: string;
+  /** The offending task / row / resource identifier. */
+  offendingId: string;
+  /** Human-readable message naming the offender + repair command. */
+  message: string;
+  /** Canonical `cleo` command an operator should run to resolve. */
+  repairCommand: string;
+}
+
+/**
+ * Per-invariant audit entry produced by {@link auditInvariantRegistry}.
+ *
+ * One entry per registered invariant. `status` summarises the outcome of
+ * the adapter (or the lack thereof). `violations` is always present —
+ * empty when `status !== 'fail'`.
+ *
+ * @task T10340
+ */
+export interface InvariantAuditEntry {
+  /** Registry key — `${adr}.${code}`. */
+  invariantKey: string;
+  /** Source ADR identifier, e.g. `'ADR-073'`. */
+  adr: string;
+  /** Invariant code within the ADR, e.g. `'I3'` or `'ORC-001'`. */
+  code: string;
+  /** Short human-readable name. */
+  name: string;
+  /** Severity tier — drives exit code in the CLI surface. */
+  severity: InvariantSeverity;
+  /** Adapter outcome. See {@link InvariantAuditStatus}. */
+  status: InvariantAuditStatus;
+  /** Free-form note for `'not-applicable'` / `'documented'` entries. */
+  note: string;
+  /** Runtime-gate function name, when one is registered. `null` otherwise. */
+  runtimeGate: string | null;
+  /** Violations observed by the adapter. Empty when `status !== 'fail'`. */
+  violations: InvariantAuditViolation[];
+}
+
+/**
+ * Aggregated audit result returned by {@link auditInvariantRegistry}.
+ *
+ * `entries` carries one entry per registered invariant, sorted first by
+ * ADR (alphabetical), then by code. `errorCount` is the count of
+ * `severity: 'error'` entries whose status is `'fail'` — the only
+ * dimension that should drive a non-zero exit code in the CLI surface.
+ *
+ * Aggregates `warningCount` + `infoCount` cover the corresponding
+ * severities for `'fail'` entries. `notApplicableCount` + `documentedCount`
+ * surface the gap analysis (how many invariants are registry-only).
+ *
+ * @task T10340
+ */
+export interface InvariantAuditResult {
+  /** Per-invariant audit entries. Sorted by ADR then code. */
+  entries: InvariantAuditEntry[];
+  /** Total registered invariants walked. */
+  totalCount: number;
+  /** Entries with status='fail' AND severity='error'. */
+  errorCount: number;
+  /** Entries with status='fail' AND severity='warning'. */
+  warningCount: number;
+  /** Entries with status='fail' AND severity='info'. */
+  infoCount: number;
+  /** Entries with status='not-applicable' (spawn/session/release-bound). */
+  notApplicableCount: number;
+  /** Entries with status='documented' (runtimeGate:null by design). */
+  documentedCount: number;
+  /** ADR filter applied (e.g. `'ADR-073'`), or `null` when the walk was unfiltered. */
+  filteredByAdr: string | null;
+}
+
 // ============================================================================
 // DB-Substrate Survey (T10307 — Saga T10281 SG-BRAIN-DB-RESILIENCE / Epic T10282)
 // ============================================================================

package/src/errors.ts

@@ -29,6 +29,8 @@ import { ExitCode } from './exit-codes.js';
  *
  * @task T889 Orchestration Coherence v3
  * @task T907 Thin-agent enforcement
+ * @see INVARIANTS_REGISTRY['ADR-070.ORC-012'] — central-registry entry
+ *   for this invariant. Source: `./invariants/adr-070-orchestration.ts`.
  */
 export class ThinAgentViolationError extends Error {
   /** Stable LAFS error code string for envelope emission. */
@@ -209,6 +211,8 @@ export class DecisionValidatorFailedError extends Error {
  * @codeName E_LEAD_BYPASS_DETECTED
  * @task T9230
  * @adr ADR-070
+ * @see INVARIANTS_REGISTRY['ADR-070.ORC-014'] — central-registry entry
+ *   for this invariant. Source: `./invariants/adr-070-orchestration.ts`.
  */
 export class LeadBypassDetectedError extends Error {
   /** Stable LAFS error code string for envelope emission. */

package/src/exit-codes.ts

@@ -323,6 +323,45 @@ export const E_WORKFLOW_NOT_FOUND = 'E_WORKFLOW_NOT_FOUND' as const;
  */
 export const E_WRITE_CONTENTION = 'E_WRITE_CONTENTION' as const;
 
+/**
+ * E_INVALID_SEVERITY_VALUE — `--severity` was passed a value that is not one
+ * of the canonical {@link TASK_SEVERITIES} members (`P0|P1|P2|P3`).
+ *
+ * Returned by the `cleo add` and `cleo update` CLI commands at the dispatch
+ * boundary BEFORE the request reaches the database. Replaces the previous
+ * late-stage failure mode where SQLite surfaced a cryptic
+ * `CHECK constraint failed: severity` error after the write attempt.
+ *
+ * Maps to {@link ExitCode.VALIDATION_ERROR} (6) at the CLI boundary.
+ *
+ * @task T10341
+ * @epic T10327
+ * @saga T10326
+ */
+export const E_INVALID_SEVERITY_VALUE = 'E_INVALID_SEVERITY_VALUE' as const;
+
+/**
+ * E_INVALID_PIPELINE_STAGE — `--pipeline-stage` was passed a value that
+ * either (a) is not a recognised stage name in the canonical RCASD-IVTR+C
+ * pipeline (`research|consensus|architecture_decision|specification|`
+ * `decomposition|implementation|validation|testing|release|contribution|`
+ * `cancelled`), or (b) would move the task BACKWARD relative to its
+ * current stage. Pipeline stages are forward-only.
+ *
+ * Returned by the `cleo update` CLI command at the dispatch boundary BEFORE
+ * the request reaches the database. Replaces the previous late-stage
+ * failure mode where SQLite surfaced a cryptic
+ * `CHECK constraint failed: pipeline_stage` error or the core engine threw
+ * an opaque {@link CleoError} after a partial round-trip.
+ *
+ * Maps to {@link ExitCode.VALIDATION_ERROR} (6) at the CLI boundary.
+ *
+ * @task T10341
+ * @epic T10327
+ * @saga T10326
+ */
+export const E_INVALID_PIPELINE_STAGE = 'E_INVALID_PIPELINE_STAGE' as const;
+
 /** Check if an exit code represents an error (1-99). */
 export function isErrorCode(code: ExitCode): boolean {
   return code >= 1 && code < 100;

package/src/index.ts

@@ -224,6 +224,21 @@ export type {
   ConduitTopicSubscribeOptions,
   ConduitUnsubscribe,
 } from './conduit.js';
+// === Config Manifest (T9876 / Saga T9855) ===
+export type {
+  ConfigManifestEntry,
+  ConfigManifestScope,
+  ConfigScope,
+  DriftDetection,
+} from './config/manifest.js';
+export {
+  CLEO_CONFIG_MANIFEST,
+  CONFIG_MANIFEST_ENTRIES,
+  configManifestEntrySchema,
+  GLOBAL_CLEO_CONFIG_MANIFEST,
+  PROJECT_CONTEXT_MANIFEST,
+  PROJECT_INFO_MANIFEST,
+} from './config/manifest.js';
 // === Configuration Types ===
 export type {
   BackupConfig,
@@ -312,6 +327,42 @@ export { CANONICAL_DOMAINS } from './dispatch/identity.js';
 export type { OperationDef, Resolution } from './dispatch/operation-def.js';
 // === Dispatch OPERATIONS data + builder helpers (T10061 — T9833b / E-CLI-BOUNDARY / SG-ARCH-SOLID) ===
 export { defineDomain, defineOp, OPERATIONS } from './dispatch/operations-registry.js';
+// === Docs Provenance Graph (T10166 / Saga T9855 / E12) ===
+export type {
+  DocLifecycleStatus,
+  DocProvenanceResponse,
+  ProvenanceDecisionNode,
+  ProvenanceDocNode,
+  ProvenanceEdge,
+  ProvenanceEdgeRelation,
+  ProvenanceMemoryNode,
+  ProvenanceNode,
+  ProvenanceNodeKind,
+  ProvenanceSessionNode,
+  ProvenanceTaskNode,
+} from './docs/provenance.js';
+export {
+  DOC_LIFECYCLE_STATUSES,
+  docLifecycleStatusSchema,
+  docProvenanceResponseSchema,
+  isDocProvenanceResponse,
+  isProvenanceDecisionNode,
+  isProvenanceDocNode,
+  isProvenanceMemoryNode,
+  isProvenanceSessionNode,
+  isProvenanceTaskNode,
+  PROVENANCE_EDGE_RELATIONS,
+  PROVENANCE_NODE_KINDS,
+  provenanceDecisionNodeSchema,
+  provenanceDocNodeSchema,
+  provenanceEdgeRelationSchema,
+  provenanceEdgeSchema,
+  provenanceMemoryNodeSchema,
+  provenanceNodeKindSchema,
+  provenanceNodeSchema,
+  provenanceSessionNodeSchema,
+  provenanceTaskNodeSchema,
+} from './docs/provenance.js';
 // === DocsAccessor Contracts (T9063) ===
 export type {
   DocExportFormat,
@@ -342,6 +393,7 @@ export {
 // === Doctor: DB-Substrate Survey (T10307 — Saga T10281 / Epic T10282) ===
 // === Doctor: Legacy-Backup Walker (T10309 — Saga T10281 / Epic T10282) ===
 // === Doctor: Cross-DB Invariants (T10323 — Saga T10281 / Epic T10285) ===
+// === Doctor: Invariant Registry Audit (T10340 — Saga T10326 / Epic T10327) ===
 export type {
   ComprehensiveAuditResult,
   DbCrossDbInvariantId,
@@ -356,6 +408,10 @@ export type {
   DbSubstrateSurveyOptions,
   DbSubstrateWarning,
   DbSubstrateWarningKind,
+  InvariantAuditEntry,
+  InvariantAuditResult,
+  InvariantAuditStatus,
+  InvariantAuditViolation,
   LegacyBackupEntry,
   LegacyBackupOriginHint,
   LegacyBackupRecommendation,
@@ -480,6 +536,9 @@ export {
   E_EVIDENCE_INSUFFICIENT,
   // SPEC-T9345 release pipeline v2 error code names (T9530)
   E_GH_NOT_AUTHENTICATED,
+  // T10341 — typed CLI-layer validation for --severity + --pipeline-stage
+  E_INVALID_PIPELINE_STAGE,
+  E_INVALID_SEVERITY_VALUE,
   E_INVALID_STATE,
   E_PLAN_NOT_FOUND,
   E_RELEASE_PLAN_INVALID,
@@ -563,6 +622,7 @@ export type {
   RegisteredInvariant,
 } from './invariants/index.js';
 export {
+  ADR_056_INVARIANTS,
   ADR_073_INVARIANTS,
   getInvariant,
   getInvariantsByAdr,
@@ -855,6 +915,17 @@ export type {
 } from './operations/dialectic.js';
 // === Operations Types (API wire format, namespaced to avoid collision with domain types) ===
 export * as ops from './operations/index.js';
+// === Operation Input Contracts (T9914 / Saga T9855 / E7) ===
+// Re-exported at top level so SDK consumers (validator T9915, mutate DX
+// surface, generated docs) can import without the `ops.` namespace hop.
+export type {
+  JsonSchema,
+  OperationInputContract,
+  OperationInputContractRegistry,
+  OperationInputExample,
+  ValidationError,
+  ValidationResult,
+} from './operations/input-contract.js';
 // === Lifecycle Operation Types (T1455 — ADR-057 D1 Core normalization) ===
 // Re-exported at top level so @cleocode/core/lifecycle can import without the `ops.` namespace hop.
 // Note: Gate is included here — GateStatus conflict resolved (T1694): lifecycle.ts now re-exports
@@ -1844,6 +1915,25 @@ export type {
   TaskViewNextAction,
   TaskViewPipelineStage,
 } from './tasks.js';
+// === Template Manifest (T9875 / Saga T9855) ===
+export type {
+  PlaceholderSource,
+  PlaceholderSpec,
+  PlaceholderSpecInput,
+  TemplateKind,
+  TemplateManifestEntry,
+  TemplateManifestEntryInput,
+  TemplateSubstitution,
+  UpdateStrategy,
+} from './templates/manifest.js';
+export {
+  PLACEHOLDER_SOURCES,
+  PlaceholderSpecSchema,
+  TEMPLATE_KINDS,
+  TEMPLATE_SUBSTITUTIONS,
+  TEMPLATE_UPDATE_STRATEGIES,
+  TemplateManifestEntrySchema,
+} from './templates/manifest.js';
 // === Tessera Types ===
 export type {
   TesseraInstantiationInput,

package/src/invariants/__tests__/adr-056-release.test.ts

@@ -0,0 +1,102 @@
+/**
+ * Unit tests for the ADR-056 D1-D6 entries in the central invariants
+ * registry (T10339 — R5).
+ *
+ * The release-side executable subsystem at
+ * `packages/core/src/release/invariants/registry.ts` consumes these
+ * metadata entries via `getInvariantsByAdr('ADR-056')`. The tests below
+ * assert the metadata shape downstream consumers (R4 CI gate, R6 doctor
+ * audit, R8 docs renderer) rely on.
+ *
+ * @epic T10327 — E-INVARIANT-REGISTRY-SSOT
+ * @saga T10326 — SG-SUBSTRATE-RECONCILIATION
+ * @task T10339 — R5: release-registry consumes central substrate
+ */
+
+import { describe, expect, it } from 'vitest';
+import {
+  ADR_056_INVARIANTS,
+  getInvariant,
+  getInvariantsByAdr,
+  INVARIANTS_REGISTRY,
+} from '../index.js';
+
+describe('ADR-056 invariants — central registry entries', () => {
+  it('registers all six ADR-056 decisions D1-D6 under predictable keys', () => {
+    for (let i = 1; i <= 6; i++) {
+      const key = `ADR-056.D${i}`;
+      expect(INVARIANTS_REGISTRY[key]).toBeDefined();
+      expect(INVARIANTS_REGISTRY[key]?.adr).toBe('ADR-056');
+      expect(INVARIANTS_REGISTRY[key]?.code).toBe(`D${i}`);
+    }
+  });
+
+  it('getInvariantsByAdr("ADR-056") returns D1..D6 in declaration order', () => {
+    const adr056 = getInvariantsByAdr('ADR-056');
+    expect(adr056).toHaveLength(6);
+    expect(adr056.map((e) => e.code)).toEqual(['D1', 'D2', 'D3', 'D4', 'D5', 'D6']);
+  });
+
+  it('ADR_056_INVARIANTS convenience binding matches getInvariantsByAdr output', () => {
+    expect(ADR_056_INVARIANTS).toHaveLength(6);
+    const enumerated = getInvariantsByAdr('ADR-056');
+    expect(enumerated).toHaveLength(ADR_056_INVARIANTS.length);
+    for (let i = 0; i < ADR_056_INVARIANTS.length; i++) {
+      expect(enumerated[i]?.code).toBe(ADR_056_INVARIANTS[i]?.code);
+    }
+  });
+
+  it('every entry carries a non-empty name and description', () => {
+    for (const entry of ADR_056_INVARIANTS) {
+      expect(entry.name.length).toBeGreaterThan(0);
+      expect(entry.description.length).toBeGreaterThan(0);
+    }
+  });
+
+  it('D4 is the archive-reason runtime gate (severity:error)', () => {
+    const d4 = getInvariant('ADR-056.D4');
+    expect(d4).toBeDefined();
+    expect(d4?.severity).toBe('error');
+    expect(d4?.runtimeGate).not.toBeNull();
+    expect(d4?.runtimeGate?.functionName).toBe('assertArchiveReason');
+    expect(d4?.runtimeGate?.module).toBe('packages/contracts/src/tasks/archive.ts');
+  });
+
+  it('D5 points at the release-invariants registry runtime gate', () => {
+    const d5 = getInvariant('ADR-056.D5');
+    expect(d5).toBeDefined();
+    expect(d5?.severity).toBe('warning');
+    expect(d5?.runtimeGate).not.toBeNull();
+    expect(d5?.runtimeGate?.functionName).toBe('runInvariants');
+    expect(d5?.runtimeGate?.module).toBe('packages/core/src/release/invariants/registry.ts');
+  });
+
+  it('D6 carries a lintRule pointer to the commit-msg hook (info severity)', () => {
+    const d6 = getInvariant('ADR-056.D6');
+    expect(d6).toBeDefined();
+    expect(d6?.severity).toBe('info');
+    expect(d6?.runtimeGate).toBeNull();
+    expect(d6?.lintRule?.lintScript).toBe('scripts/hooks/commit-msg-release-lint.mjs');
+  });
+
+  it('D1, D2, D3 are info-tier topology/convention decisions with no runtime gate', () => {
+    for (const code of ['D1', 'D2', 'D3'] as const) {
+      const entry = getInvariant(`ADR-056.${code}`);
+      expect(entry).toBeDefined();
+      expect(entry?.severity).toBe('info');
+      expect(entry?.runtimeGate).toBeNull();
+    }
+  });
+
+  it('every severity:"error" ADR-056 entry has a non-null runtimeGate', () => {
+    const errorTier = ADR_056_INVARIANTS.filter((e) => e.severity === 'error');
+    expect(errorTier.length).toBeGreaterThan(0);
+    for (const entry of errorTier) {
+      expect(entry.runtimeGate).not.toBeNull();
+      if (entry.runtimeGate !== null) {
+        expect(entry.runtimeGate.module.length).toBeGreaterThan(0);
+        expect(entry.runtimeGate.functionName.length).toBeGreaterThan(0);
+      }
+    }
+  });
+});