@cleocode/core 2026.3.42 → 2026.3.44

package/dist/validation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/validation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,YAAY,EACV,cAAc,EACd,cAAc,EACd,0BAA0B,EAC1B,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,gCAAgC,CAAC;AAYxC,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,0BAA0B,EAC1B,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,gCAAgC,EAChC,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,yBAAyB,EACzB,uBAAuB,EACvB,sBAAsB,EACtB,gBAAgB,EAChB,gCAAgC,EAChC,oBAAoB,EACpB,4BAA4B,EAC5B,6BAA6B,EAC7B,+BAA+B,EAC/B,6BAA6B,EAC7B,0BAA0B,EAC1B,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,2BAA2B,EAC3B,sBAAsB,EACtB,mBAAmB,EACnB,0BAA0B,EAC1B,wBAAwB,EACxB,gBAAgB,EAChB,sBAAsB,EACtB,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,EACzB,6BAA6B,EAC7B,wBAAwB,EACxB,0BAA0B,EAC1B,6BAA6B,EAC7B,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,4BAA4B,EAC5B,6BAA6B,EAC7B,+BAA+B,EAC/B,6BAA6B,EAC7B,0BAA0B,EAC1B,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,2BAA2B,EAC3B,sBAAsB,EACtB,mBAAmB,EACnB,0BAA0B,EAC1B,wBAAwB,EACxB,gBAAgB,EAChB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,KAAK,iBAAiB,EACtB,8BAA8B,EAC9B,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,YAAY,GAClB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAExB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,6BAA6B,EAClC,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,KAAK,IAAI,EACT,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,+BAA+B,EAC/B,mBAAmB,EACnB,sBAAsB,EACtB,YAAY,EACZ,+BAA+B,EAC/B,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,EACzB,wBAAwB,EACxB,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,eAAe,EACf,KAAK,aAAa,EAClB,aAAa,EACb,cAAc,EACd,eAAe,EACf,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,aAAa,EACb,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,KAAK,eAAe,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,cAAc,EACd,qBAAqB,GACtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,EACzB,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,kCAAkC,GACnC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,KAAK,SAAS,EACd,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,wBAAwB,EAC7B,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,QAAQ,EACb,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,UAAU,EACV,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC"}

package/dist/validation/manifest.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Manifest validation - ported from lib/validation/manifest-validation.sh
+ *
+ * Validates subagent output by finding manifest entries, running protocol
+ * validators on actual output, and logging real compliance metrics.
+ *
+ * @task T4526
+ * @epic T4454
+ */
+export interface ManifestEntry {
+    id: string;
+    file: string;
+    title: string;
+    date: string;
+    status: 'completed' | 'partial' | 'blocked';
+    agent_type: string;
+    topics?: string[];
+    key_findings?: string[];
+    actionable?: boolean;
+    needs_followup?: string[];
+    linked_tasks?: string[];
+    [key: string]: unknown;
+}
+export interface ManifestViolation {
+    requirement: string;
+    severity: 'error' | 'warning';
+    message: string;
+    fix?: string;
+}
+export interface ManifestValidationResult {
+    valid: boolean;
+    score: number;
+    pass: boolean;
+    agent_type?: string;
+    violations: ManifestViolation[];
+    note?: string;
+}
+export interface ComplianceEntry {
+    timestamp: string;
+    source_id: string;
+    source_type: string;
+    compliance: {
+        compliance_pass_rate: number;
+        rule_adherence_score: number;
+        violation_count: number;
+        violation_severity: 'none' | 'warning' | 'error';
+        manifest_integrity: 'valid' | 'violations_found';
+    };
+    efficiency: {
+        input_tokens: number;
+        output_tokens: number;
+        context_utilization: number;
+        token_utilization_rate: number;
+    };
+    _context: {
+        agent_type: string;
+        validation_score: number;
+        violations: ManifestViolation[];
+    };
+}
+/**
+ * Find a manifest entry for a task ID in a JSONL file.
+ * @task T4526
+ */
+export declare function findManifestEntry(taskId: string, manifestPath?: string): Promise<ManifestEntry | null>;
+/**
+ * Run validation on a manifest entry for a specific task.
+ * @task T4526
+ */
+export declare function validateManifestEntry(taskId: string, manifestEntry?: ManifestEntry | null, manifestPath?: string): Promise<ManifestValidationResult>;
+/**
+ * Log validation results to the compliance JSONL file.
+ * @task T4526
+ */
+export declare function logRealCompliance(taskId: string, validationResult: ManifestValidationResult, agentType?: string, compliancePath?: string): Promise<void>;
+/**
+ * Find, validate, and log compliance for a task in one call.
+ * @task T4526
+ */
+export declare function validateAndLog(taskId: string, manifestPath?: string, compliancePath?: string): Promise<ManifestValidationResult>;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/validation/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/validation/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE;QACV,oBAAoB,EAAE,MAAM,CAAC;QAC7B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,eAAe,EAAE,MAAM,CAAC;QACxB,kBAAkB,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;QACjD,kBAAkB,EAAE,OAAO,GAAG,kBAAkB,CAAC;KAClD,CAAC;IACF,UAAU,EAAE;QACV,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,sBAAsB,EAAE,MAAM,CAAC;KAChC,CAAC;IACF,QAAQ,EAAE;QACR,UAAU,EAAE,MAAM,CAAC;QACnB,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,iBAAiB,EAAE,CAAC;KACjC,CAAC;CACH;AAeD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CA0B/B;AAMD;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,EACpC,YAAY,GAAE,MAA8B,GAC3C,OAAO,CAAC,wBAAwB,CAAC,CAiHnC;AAMD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,wBAAwB,EAC1C,SAAS,GAAE,MAAkB,EAC7B,cAAc,GAAE,MAAgC,GAC/C,OAAO,CAAC,IAAI,CAAC,CAuCf;AAMD;;;GAGG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,YAAY,GAAE,MAA8B,EAC5C,cAAc,GAAE,MAAgC,GAC/C,OAAO,CAAC,wBAAwB,CAAC,CAyBnC"}

package/dist/validation/operation-gate-validators.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Gate Validators for 4-Layer Operation Verification System
+ *
+ * Individual validator functions for each gate layer:
+ * - Layer 1: Schema validation (JSON Schema, format constraints)
+ * - Layer 2: Semantic validation (business rules, anti-hallucination)
+ * - Layer 3: Referential validation (cross-entity integrity)
+ * - Layer 4: Protocol validation (RCASD-IVTR+C lifecycle)
+ *
+ * Moved from src/mcp/lib/gate-validators.ts to core for proper layering.
+ *
+ * @task T2936
+ * @task T3138
+ * @task T5707
+ * @epic T2908
+ */
+import type { ProtocolEnforcer } from '../compliance/protocol-enforcement.js';
+import { type GateViolation, type LayerResult, type OperationContext, type WorkflowGateTracker } from './operation-verification-gates.js';
+/**
+ * Layer 1: Schema Validation
+ *
+ * Validates operation parameters against JSON Schema definitions.
+ * Checks required fields, data types, and format constraints.
+ */
+export declare function validateLayer1Schema(context: OperationContext): Promise<LayerResult>;
+/**
+ * Layer 2: Semantic Validation
+ *
+ * Validates business rules and logical constraints.
+ */
+export declare function validateLayer2Semantic(context: OperationContext): Promise<LayerResult>;
+/**
+ * Layer 3: Referential Validation
+ *
+ * Validates cross-entity references and relationships.
+ */
+export declare function validateLayer3Referential(context: OperationContext): Promise<LayerResult>;
+/**
+ * Layer 4: Protocol Validation
+ *
+ * Validates RCASD-IVTR+C lifecycle compliance and protocol requirements.
+ */
+export declare function validateLayer4Protocol(context: OperationContext, _enforcer: ProtocolEnforcer): Promise<LayerResult>;
+/**
+ * Validation rule definitions for reuse
+ */
+export declare const GATE_VALIDATION_RULES: {
+    TASK_ID_PATTERN: RegExp;
+    MANIFEST_ID_PATTERN: RegExp;
+    DATE_FORMAT_PATTERN: RegExp;
+    TITLE_MIN_LENGTH: number;
+    TITLE_MAX_LENGTH: number;
+    DESCRIPTION_MIN_LENGTH: number;
+    DESCRIPTION_MAX_LENGTH: number;
+    VALID_STATUSES: readonly ["pending", "active", "blocked", "done", "cancelled", "archived"];
+    VALID_MANIFEST_STATUSES: readonly ["completed", "partial", "blocked", "archived"];
+    VALID_AGENT_TYPES: readonly ["research", "analysis", "specification", "implementation", "testing", "validation", "documentation", "release"];
+    VALID_PRIORITIES: readonly ["critical", "high", "medium", "low"];
+    PRIORITY_NUMERIC_MIN: number;
+    PRIORITY_NUMERIC_MAX: number;
+    MAX_DEPTH: number;
+    MAX_SIBLINGS: number;
+    KEY_FINDINGS_MIN: number;
+    KEY_FINDINGS_MAX: number;
+};
+/**
+ * Helper to check if a field is required for an operation
+ */
+export declare function isFieldRequired(domain: string, operation: string, field: string): boolean;
+/**
+ * Valid workflow gate agent names per Section 7.2
+ */
+export declare const VALID_WORKFLOW_AGENTS: readonly ["coder", "testing", "qa", "cleanup", "security", "docs"];
+/**
+ * Valid workflow gate status values per Section 7.3
+ */
+export declare const VALID_WORKFLOW_GATE_STATUSES: readonly [null, "passed", "failed", "blocked"];
+/**
+ * Validate a workflow gate name
+ *
+ * @task T3141
+ */
+export declare function validateWorkflowGateName(name: string): boolean;
+/**
+ * Validate a workflow gate status value per Section 7.3
+ *
+ * @task T3141
+ */
+export declare function validateWorkflowGateStatus(status: unknown): status is null | 'passed' | 'failed' | 'blocked';
+/**
+ * Validate a gate update operation.
+ *
+ * @task T3141
+ */
+export declare function validateWorkflowGateUpdate(gateName: string, status: string, agent?: string, tracker?: WorkflowGateTracker): GateViolation[];
+//# sourceMappingURL=operation-gate-validators.d.ts.map

package/dist/validation/operation-gate-validators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-gate-validators.d.ts","sourceRoot":"","sources":["../../src/validation/operation-gate-validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE9E,OAAO,EAGL,KAAK,aAAa,EAElB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EAGrB,KAAK,mBAAmB,EACzB,MAAM,mCAAmC,CAAC;AAE3C;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAiM1F;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAwH5F;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAsI/F;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,gBAAgB,EACzB,SAAS,EAAE,gBAAgB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAgItB;AAED;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;CA2BjC,CAAC;AAEF;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAezF;AAMD;;GAEG;AACH,eAAO,MAAM,qBAAqB,oEAOxB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,4BAA4B,gDAAiD,CAAC;AAE3F;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,OAAO,GACd,MAAM,IAAI,IAAI,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAElD;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,mBAAmB,GAC5B,aAAa,EAAE,CA8DjB"}

package/dist/validation/operation-verification-gates.d.ts

@@ -0,0 +1,274 @@
+/**
+ * Operation Verification Gate System for CLEO
+ *
+ * Implements 4-layer validation gate system for MCP/dispatch operations:
+ * Layer 1: Schema Validation (JSON Schema compliance)
+ * Layer 2: Semantic Validation (Business rules)
+ * Layer 3: Referential Validation (Cross-entity integrity)
+ * Layer 4: Protocol Validation (RCASD-IVTR+C lifecycle)
+ *
+ * Moved from src/mcp/lib/verification-gates.ts to core for proper layering.
+ *
+ * @task T2936
+ * @task T5707
+ * @epic T2908
+ */
+import { type ProtocolType } from '../compliance/protocol-enforcement.js';
+import { ErrorCategory, ErrorSeverity, ProtocolExitCode } from '../compliance/protocol-types.js';
+/**
+ * Gate layer enumeration
+ */
+export declare enum GateLayer {
+    SCHEMA = 1,
+    SEMANTIC = 2,
+    REFERENTIAL = 3,
+    PROTOCOL = 4
+}
+/**
+ * Gate status for each layer
+ */
+export declare enum GateStatus {
+    PENDING = "pending",
+    PASSED = "passed",
+    FAILED = "failed",
+    BLOCKED = "blocked",
+    SKIPPED = "skipped"
+}
+/**
+ * Violation detail for a specific gate layer
+ */
+export interface GateViolation {
+    layer: GateLayer;
+    severity: ErrorSeverity;
+    code: string;
+    message: string;
+    field?: string;
+    value?: unknown;
+    constraint?: string;
+    fix?: string;
+}
+/**
+ * Result from a single gate layer validation
+ */
+export interface LayerResult {
+    layer: GateLayer;
+    status: GateStatus;
+    passed: boolean;
+    violations: GateViolation[];
+    duration_ms: number;
+}
+/**
+ * Complete verification result across all 4 layers
+ */
+export interface VerificationResult {
+    passed: boolean;
+    layers: Record<GateLayer, LayerResult>;
+    totalViolations: number;
+    exitCode: ProtocolExitCode;
+    category: ErrorCategory;
+    summary: string;
+    blockedAt?: GateLayer;
+}
+/**
+ * Operation context for gate validation
+ */
+export interface OperationContext {
+    domain: string;
+    operation: string;
+    gateway: 'query' | 'mutate';
+    params?: Record<string, unknown>;
+    taskId?: string;
+    protocolType?: ProtocolType;
+}
+/**
+ * Main Verification Gate class
+ *
+ * Orchestrates 4-layer validation and determines pass/fail status.
+ * Each layer must pass before proceeding to the next.
+ */
+export declare class VerificationGate {
+    private protocolEnforcer;
+    private strictMode;
+    constructor(strictMode?: boolean);
+    /**
+     * Execute all 4 gate layers sequentially
+     *
+     * Stops at first failure unless in advisory mode.
+     */
+    verifyOperation(context: OperationContext): Promise<VerificationResult>;
+    /**
+     * Run a single validation layer with timing
+     */
+    private runLayer;
+    /**
+     * Build success result when all gates pass
+     */
+    private buildSuccessResult;
+    /**
+     * Build failure result when a gate fails
+     */
+    private buildFailureResult;
+    /**
+     * Determine semantic layer exit code from violations
+     */
+    private determineSemanticExitCode;
+    /**
+     * Determine referential layer exit code from violations
+     */
+    private determineReferentialExitCode;
+    /**
+     * Determine protocol layer exit code from violations
+     */
+    private determineProtocolExitCode;
+    /**
+     * Check if an operation requires gate validation
+     *
+     * All mutate operations require validation.
+     * Query operations skip validation for performance.
+     */
+    static requiresValidation(context: OperationContext): boolean;
+    /**
+     * Get human-readable layer name
+     */
+    static getLayerName(layer: GateLayer): string;
+}
+/**
+ * Factory function for creating verification gates
+ */
+export declare function createVerificationGate(strictMode?: boolean): VerificationGate;
+/**
+ * Export gate layer sequence for external use
+ */
+export declare const GATE_SEQUENCE: readonly [GateLayer.SCHEMA, GateLayer.SEMANTIC, GateLayer.REFERENTIAL, GateLayer.PROTOCOL];
+/**
+ * Workflow gate names per MCP-SERVER-SPECIFICATION.md Section 7.1
+ *
+ * @task T3141
+ */
+export declare enum WorkflowGateName {
+    IMPLEMENTED = "implemented",
+    TESTS_PASSED = "testsPassed",
+    QA_PASSED = "qaPassed",
+    CLEANUP_DONE = "cleanupDone",
+    SECURITY_PASSED = "securityPassed",
+    DOCUMENTED = "documented"
+}
+/**
+ * Workflow gate status values per Section 7.3
+ */
+export type WorkflowGateStatus = null | 'passed' | 'failed' | 'blocked';
+/**
+ * Agent responsible for each gate per Section 7.2
+ */
+export type WorkflowGateAgent = 'coder' | 'testing' | 'qa' | 'cleanup' | 'security' | 'docs';
+/**
+ * Individual workflow gate definition per Section 7.2
+ */
+export interface WorkflowGateDefinition {
+    name: WorkflowGateName;
+    agent: WorkflowGateAgent;
+    dependsOn: WorkflowGateName[];
+    description: string;
+}
+/**
+ * State of a single workflow gate
+ */
+export interface WorkflowGateState {
+    name: WorkflowGateName;
+    status: WorkflowGateStatus;
+    agent: WorkflowGateAgent;
+    updatedAt: string | null;
+    failureReason?: string;
+}
+/**
+ * Complete workflow gate definitions per Section 7.2
+ */
+export declare const WORKFLOW_GATE_DEFINITIONS: WorkflowGateDefinition[];
+/**
+ * Ordered workflow gate sequence per Section 7.1
+ */
+export declare const WORKFLOW_GATE_SEQUENCE: WorkflowGateName[];
+/**
+ * WorkflowGateTracker
+ *
+ * Tracks the status of all 6 workflow verification gates for a task.
+ * Implements Section 7.4 failure cascade behavior: when a gate fails,
+ * all downstream gates reset to null.
+ *
+ * @task T3141
+ */
+export declare class WorkflowGateTracker {
+    private gates;
+    constructor();
+    /**
+     * Get the status of a specific gate
+     */
+    getGateStatus(gateName: WorkflowGateName): WorkflowGateStatus;
+    /**
+     * Get the full state of a specific gate
+     */
+    getGateState(gateName: WorkflowGateName): WorkflowGateState | undefined;
+    /**
+     * Get all gate states
+     */
+    getAllGates(): WorkflowGateState[];
+    /**
+     * Check if a gate can be attempted (all dependencies passed)
+     */
+    canAttempt(gateName: WorkflowGateName): boolean;
+    /**
+     * Mark a gate as passed.
+     */
+    passGate(gateName: WorkflowGateName, agent?: string): boolean;
+    /**
+     * Mark a gate as failed.
+     *
+     * Per Section 7.4: When a gate fails, all downstream gates reset to null.
+     */
+    failGate(gateName: WorkflowGateName, reason?: string): boolean;
+    /**
+     * Reset a gate and all downstream gates to null.
+     */
+    private cascadeReset;
+    /**
+     * Update blocked status for all gates based on current state.
+     */
+    updateBlockedStatus(): void;
+    /**
+     * Check if all gates have passed
+     */
+    allPassed(): boolean;
+    /**
+     * Get all gates that are currently blocked or have null status
+     */
+    getPendingGates(): WorkflowGateState[];
+    /**
+     * Get the next gate that can be attempted
+     */
+    getNextAttemptable(): WorkflowGateName | null;
+    /**
+     * Get downstream gates of a given gate (not including the gate itself)
+     */
+    getDownstreamGates(gateName: WorkflowGateName): WorkflowGateName[];
+    /**
+     * Serialize gate states to a plain record
+     */
+    toRecord(): Record<string, WorkflowGateStatus>;
+    /**
+     * Restore gate states from a record
+     */
+    fromRecord(record: Record<string, WorkflowGateStatus>): void;
+    /**
+     * Check if a gate name is valid
+     */
+    private isValidGate;
+}
+/**
+ * Validate a workflow gate name string
+ */
+export declare function isValidWorkflowGateName(name: string): name is WorkflowGateName;
+/**
+ * Get the definition for a workflow gate
+ */
+export declare function getWorkflowGateDefinition(name: WorkflowGateName): WorkflowGateDefinition | undefined;
+//# sourceMappingURL=operation-verification-gates.d.ts.map

package/dist/validation/operation-verification-gates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-verification-gates.d.ts","sourceRoot":"","sources":["../../src/validation/operation-verification-gates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAQjG;;GAEG;AACH,oBAAY,SAAS;IACnB,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,WAAW,IAAI;IACf,QAAQ,IAAI;CACb;AAED;;GAEG;AACH,oBAAY,UAAU;IACpB,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,SAAS,CAAC;IACjB,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;;GAKG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,UAAU,CAAU;gBAEhB,UAAU,GAAE,OAAc;IAKtC;;;;OAIG;IACG,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA6C7E;;OAEG;YACW,QAAQ;IA6BtB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAW1B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAuC1B;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAWjC;;OAEG;IACH,OAAO,CAAC,4BAA4B;IASpC;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAgBjC;;;;;OAKG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;IAO7D;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM;CAS9C;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,GAAE,OAAc,GAAG,gBAAgB,CAEnF;AAED;;GAEG;AACH,eAAO,MAAM,aAAa,4FAKhB,CAAC;AAMX;;;;GAIG;AACH,oBAAY,gBAAgB;IAC1B,WAAW,gBAAgB;IAC3B,YAAY,gBAAgB;IAC5B,SAAS,aAAa;IACtB,YAAY,gBAAgB;IAC5B,eAAe,mBAAmB;IAClC,UAAU,eAAe;CAC1B;AAED;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAExE;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,SAAS,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;AAE7F;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,gBAAgB,CAAC;IACvB,KAAK,EAAE,iBAAiB,CAAC;IACzB,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,KAAK,EAAE,iBAAiB,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBAAsB,EAqC7D,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAE,gBAAgB,EAOpD,CAAC;AASF;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,KAAK,CAA2C;;IAcxD;;OAEG;IACH,aAAa,CAAC,QAAQ,EAAE,gBAAgB,GAAG,kBAAkB;IAK7D;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,gBAAgB,GAAG,iBAAiB,GAAG,SAAS;IAIvE;;OAEG;IACH,WAAW,IAAI,iBAAiB,EAAE;IAIlC;;OAEG;IACH,UAAU,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO;IAa/C;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO;IAe7D;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO;IAc9D;;OAEG;IACH,OAAO,CAAC,YAAY;IAapB;;OAEG;IACH,mBAAmB,IAAI,IAAI;IAY3B;;OAEG;IACH,SAAS,IAAI,OAAO;IAOpB;;OAEG;IACH,eAAe,IAAI,iBAAiB,EAAE;IAItC;;OAEG;IACH,kBAAkB,IAAI,gBAAgB,GAAG,IAAI;IAU7C;;OAEG;IACH,kBAAkB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE;IAMlE;;OAEG;IACH,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAQ9C;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAAG,IAAI;IAS5D;;OAEG;IACH,OAAO,CAAC,WAAW;CAGpB;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,gBAAgB,CAE9E;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,gBAAgB,GACrB,sBAAsB,GAAG,SAAS,CAEpC"}

package/dist/validation/param-utils.d.ts

@@ -0,0 +1,121 @@
+/**
+ * Param derivation utilities (Core).
+ *
+ * Converts operation parameter definitions into the shapes required by:
+ *  - Commander.js (CLI adapter): positionals + option strings
+ *  - MCP JSON Schema (MCP adapter): input_schema object
+ *
+ * Canonical location: src/core/validation/param-utils.ts
+ * Re-exported from: src/dispatch/lib/param-utils.ts (backward compat)
+ *
+ * @task T4894
+ * @task T4900
+ * @task T5706
+ */
+interface OperationDef {
+    gateway: string;
+    domain: string;
+    operation: string;
+    description: string;
+    tier: number;
+    params?: ParamDef[];
+    [key: string]: unknown;
+}
+type ParamType = 'string' | 'number' | 'boolean' | 'array' | 'object';
+interface ParamCliDef {
+    positional?: boolean;
+    variadic?: boolean;
+    alias?: string;
+    flag?: string;
+    short?: string;
+    hidden?: boolean;
+    [key: string]: unknown;
+}
+interface ParamMcpDef {
+    name?: string;
+    description?: string;
+    enum?: string[];
+    hidden?: boolean;
+    [key: string]: unknown;
+}
+interface ParamDef {
+    name: string;
+    type: ParamType;
+    required: boolean;
+    description: string;
+    default?: unknown;
+    enum?: string[];
+    items?: {
+        type: ParamType;
+    };
+    cli?: ParamCliDef;
+    mcp?: ParamMcpDef;
+}
+export type JsonSchemaType = 'string' | 'number' | 'boolean' | 'array' | 'object';
+export interface JsonSchemaProperty {
+    type: JsonSchemaType;
+    description: string;
+    enum?: readonly string[];
+    items?: {
+        type: JsonSchemaType;
+    };
+}
+export interface JSONSchemaObject {
+    type: 'object';
+    properties: Record<string, JsonSchemaProperty>;
+    required: string[];
+}
+/**
+ * Build a JSON Schema `input_schema` object from an `OperationDef`.
+ *
+ * Algorithm:
+ *  1. Iterate `def.params`
+ *  2. Skip params where `mcp.hidden === true`
+ *  3. Map ParamType → JSON Schema type
+ *  4. Collect names where `required === true` into `required[]`
+ *  5. Return { type: 'object', properties, required }
+ */
+export declare function buildMcpInputSchema(def: OperationDef): JSONSchemaObject;
+export interface CommanderArgSplit {
+    /** Params that map to `.argument('<name>')` or `.argument('[name]')`. */
+    positionals: ParamDef[];
+    /** Params that map to `.option(...)` calls. */
+    options: ParamDef[];
+}
+/**
+ * Split `OperationDef.params` into positional arguments and option flags,
+ * suitable for Commander.js registration.
+ *
+ * - `cli.positional === true` → goes into `positionals[]`
+ * - everything else with a `cli` key → goes into `options[]`
+ * - Params with no `cli` key → MCP-only; excluded from both arrays
+ */
+export declare function buildCommanderArgs(def: OperationDef): CommanderArgSplit;
+/**
+ * Build the Commander option string for a single non-positional ParamDef.
+ *
+ * Examples:
+ *   { name:'taskId', type:'string', cli:{} }
+ *     → '--taskId <taskId>'
+ *   { name:'status', type:'string', cli:{short:'-s', flag:'status'} }
+ *     → '-s, --status <status>'
+ *   { name:'dryRun', type:'boolean', cli:{flag:'dry-run'} }
+ *     → '--dry-run'
+ *   { name:'limit', type:'number', cli:{} }
+ *     → '--limit <limit>'
+ */
+export declare function buildCommanderOptionString(param: ParamDef): string;
+/**
+ * Convert a camelCase string to kebab-case.
+ * e.g. 'includeArchive' → 'include-archive'
+ */
+export declare function camelToKebab(s: string): string;
+/**
+ * Validates that all required parameters are present in the request.
+ * Returns an array of missing parameter names.
+ *
+ * Replaces the old `requiredParams: string[]` check in registry.ts.
+ */
+export declare function validateRequiredParamsDef(def: OperationDef, params?: Record<string, unknown>): string[];
+export {};
+//# sourceMappingURL=param-utils.d.ts.map

package/dist/validation/param-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"param-utils.d.ts","sourceRoot":"","sources":["../../src/validation/param-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,UAAU,YAAY;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,KAAK,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEtE,UAAU,WAAW;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,UAAU,WAAW;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,UAAU,QAAQ;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,SAAS,CAAA;KAAE,CAAC;IAC5B,GAAG,CAAC,EAAE,WAAW,CAAC;IAClB,GAAG,CAAC,EAAE,WAAW,CAAC;CACnB;AAMD,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAElF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,cAAc,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,cAAc,CAAA;KAAE,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/C,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAMD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,CA6BvE;AAqBD,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,WAAW,EAAE,QAAQ,EAAE,CAAC;IACxB,+CAA+C;IAC/C,OAAO,EAAE,QAAQ,EAAE,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAgBvE;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,CAWlE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9C;AAMD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,YAAY,EACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,MAAM,EAAE,CASV"}