bmad-method-test-architecture-enterprise 1.27.2-next.3 → 1.27.2-next.4

package/.claude-plugin/marketplace.json

@@ -31,7 +31,7 @@
       "name": "bmad-method-test-architecture-enterprise",
       "source": "./",
       "description": "Master Test Architect module for quality strategy, test automation, CI/CD quality gates, and structured testing education. Part of the BMad Method ecosystem.",
-      "version": "1.27.2-next.3",
+      "version": "1.27.2-next.4",
       "author": {
         "name": "Murat K Ozcan (TEA Creator) & Brian (BMad) Madison"
       },

package/README.md

@@ -392,7 +392,7 @@ A passing fragment-selection eval means the workflow loaded the right knowledge.
 
 ### Deterministic Checks
 
-`npm test` chains seventy-four checks. That count covers the whole chain: every entry in it is deterministic and credential-free, so the chain and its credential-free subset are the same list. `npm run test:ci-coverage` derives the count from `package.json` and prints it. Ten of the seventy-four keep the rules, guidance, hook, eval data, eval contracts, diagnostics, and documentation aligned:
+`npm test` chains seventy-five checks. That count covers the whole chain: every entry in it is deterministic and credential-free, so the chain and its credential-free subset are the same list. `npm run test:ci-coverage` derives the count from `package.json` and prints it. Eleven of the seventy-five keep the rules, guidance, hook, eval data, eval contracts, diagnostics, and documentation aligned:
 
 - `test:criteria-fragments` fails when a registry row is neither mapped to a knowledge fragment nor declared a known gap. A rule the reviewer scores but no fragment teaches is a rule TEA punishes without ever having explained it. All 36 rows are currently mapped across 50 anchors. Because the declared-gap list is empty, the validator feeds itself a synthetic unmapped row on every run to prove that path still works.
 - `test:doc-counts` runs `eval-quality-gates doc-counts`, which holds a hand-written count on a published page against the source that computes it: the roadmap's per-suite `eval:all` call counts, the knowledge-fragment tier breakdown, this section's own npm-test-chain length, and the fragment-selection case count. A pattern matching no sentence, or more than one, fails the same way a wrong number does, so the entry cannot go stale by drifting out from under its own pattern either.
@@ -403,6 +403,7 @@ A passing fragment-selection eval means the workflow loaded the right knowledge.
 - `test:eval-routing-boundaries` mutates the facts, candidate codes, and missing deciding information in each source-bound routing ambiguity rule. It also rejects duplicate and orphan boundaries, plus any boundary that would turn a clear intent into a clarification.
 - `test:eval-schemas` checks this repository's own eval suite manifest against its schema, confirms that every threshold it declares is the threshold the harness actually applies, that the runner capabilities it declares are the ones the harness grants its runner, and that the preflight argv it declares fails on a missing runner and passes on a present one, and fails when a TEA skill has neither a behavioral suite nor a deferred declaration. A suite list that omits a skill reads as coverage, so the omission has to be an error rather than a silence.
 - `test:eval-diagnostics` checks that current result writers emit bounded case and repetition diagnostics, that quality and environment outcomes stay separate, that unstable signatures remain visible, and that the protected 1.3.0 baseline remains readable and byte-for-byte unchanged.
+- `test:nfr-evidence-guidance` holds every NFR worker and the publication audit to the supplied-evidence ledger, exercises supported, missing, and mismatched evidence, rejects contaminating examples, and binds the protected baseline and focused remediation records by digest.
 - `test:contract-oracles` evaluates every oracle in every eval contract with `eval-quality`'s own evaluator, over the stored replay outputs and over constructed selections for all 24 fragment-selection cases, and fails when an oracle faults or disagrees with the harness scorer on the same evidence. The first run found that every regex oracle in the `test-review` contract was refused by the evaluator before it matched anything.
 
 These checks produce the same answer from the same repository state. They need no agent credential, network call, or model budget. `test:eval-data` runs through `npm test`, the local pre-commit hook, pull-request quality checks, and the publish workflow.

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "bmad-method-test-architecture-enterprise",
-  "version": "1.27.2-next.3",
+  "version": "1.27.2-next.4",
   "description": "Master Test Architect for quality strategy, test automation, and release gates",
   "keywords": [
     "bmad",
@@ -83,7 +83,7 @@
     "release:minor": "gh workflow run publish.yaml -f channel=latest -f bump=minor",
     "release:next": "gh workflow run publish.yaml -f channel=next",
     "release:patch": "gh workflow run publish.yaml -f channel=latest -f bump=patch",
-    "test": "npm run test:conflict-markers && npm run test:schemas && npm run test:install && npm run test:knowledge && npm run test:criteria-fragments && npm run test:doc-count-sources && npm run test:doc-counts && npm run test:doc-claim-sources && npm run test:doc-claims && npm run test:doc-invocation-entry && npm run test:doc-invocations && npm run test:enforce-hook && npm run test:framework-scaffold && npm run test:atdd-isolation && npm run test:atdd-net-guard && npm run test:atdd-scoring && npm run test:atdd-workflow-guidance && npm run test:framework-scaffold-install-isolation && npm run test:transcript-harness && npm run test:suite-manifest && npm run test:teach-me-testing-scoring && npm run test:eval-data && npm run test:eval-atdd-data && npm run test:eval-ci-data && npm run test:eval-framework-scaffold-data && npm run test:eval-nfr-data && npm run test:nfr-validate-corpus && npm run test:eval-test-design-data && npm run test:eval-trace-data && npm run test:eval-routing-data && npm run test:eval-routing-boundaries && npm run test:eval-routing-evidence && npm run test:eval-transcript-data && npm run test:eval-teach-me-testing-data && npm run test:eval-schemas && npm run test:eval-diagnostics && npm run test:eval-replay && npm run test:eval-quality-corpus && npm run test:schema-versions && npm run test:contract-sources && npm run test:contracts && npm run test:contract-oracles && npm run test:probe-sources && npm run test:probe-corpus && npm run test:compare-dominance && npm run test:compare-eval-runs && npm run test:automate-eval-fixture && npm run test:eval-automate-data && npm run test:clock-port && npm run test:probe-conformance && npm run test:corpus-conformance && npm run test:file-system-conformance && npm run test:file-system-port && npm run test:probe-targets && npm run test:port-totality && npm run test:ci-coverage && npm run test:ci-coverage-filters && npm run test:bmad-output-gated && npm run test:release-metadata && npm run test:lockfile-age && npm run test:lockfile-age-cache && npm run test:licences && npm run test:supply-chain && npm run test:boundary && npm run test:direction && npm run test:lineage && npm run test:guard-publish && npm run test:layering-boundary-lineage && npm run test:changelog && npm run test:tea-workflow-descriptions && npm run validate:schemas && npm run lint && npm run lint:md && npm run format:check",
+    "test": "npm run test:conflict-markers && npm run test:schemas && npm run test:install && npm run test:knowledge && npm run test:criteria-fragments && npm run test:doc-count-sources && npm run test:doc-counts && npm run test:doc-claim-sources && npm run test:doc-claims && npm run test:doc-invocation-entry && npm run test:doc-invocations && npm run test:enforce-hook && npm run test:framework-scaffold && npm run test:atdd-isolation && npm run test:atdd-net-guard && npm run test:atdd-scoring && npm run test:atdd-workflow-guidance && npm run test:framework-scaffold-install-isolation && npm run test:transcript-harness && npm run test:suite-manifest && npm run test:teach-me-testing-scoring && npm run test:eval-data && npm run test:eval-atdd-data && npm run test:eval-ci-data && npm run test:eval-framework-scaffold-data && npm run test:eval-nfr-data && npm run test:nfr-validate-corpus && npm run test:nfr-evidence-guidance && npm run test:eval-test-design-data && npm run test:eval-trace-data && npm run test:eval-routing-data && npm run test:eval-routing-boundaries && npm run test:eval-routing-evidence && npm run test:eval-transcript-data && npm run test:eval-teach-me-testing-data && npm run test:eval-schemas && npm run test:eval-diagnostics && npm run test:eval-replay && npm run test:eval-quality-corpus && npm run test:schema-versions && npm run test:contract-sources && npm run test:contracts && npm run test:contract-oracles && npm run test:probe-sources && npm run test:probe-corpus && npm run test:compare-dominance && npm run test:compare-eval-runs && npm run test:automate-eval-fixture && npm run test:eval-automate-data && npm run test:clock-port && npm run test:probe-conformance && npm run test:corpus-conformance && npm run test:file-system-conformance && npm run test:file-system-port && npm run test:probe-targets && npm run test:port-totality && npm run test:ci-coverage && npm run test:ci-coverage-filters && npm run test:bmad-output-gated && npm run test:release-metadata && npm run test:lockfile-age && npm run test:lockfile-age-cache && npm run test:licences && npm run test:supply-chain && npm run test:boundary && npm run test:direction && npm run test:lineage && npm run test:guard-publish && npm run test:layering-boundary-lineage && npm run test:changelog && npm run test:tea-workflow-descriptions && npm run validate:schemas && npm run lint && npm run lint:md && npm run format:check",
     "test:atdd-isolation": "node test/test-atdd-isolation.js",
     "test:atdd-net-guard": "node test/test-atdd-net-guard.js",
     "test:atdd-scoring": "node test/test-atdd-scoring.js",
@@ -142,6 +142,7 @@
     "test:lineage": "eval-quality-gates field-ownership",
     "test:lockfile-age": "eval-quality-gates lockfile-age",
     "test:lockfile-age-cache": "node test/test-generate-lockfile-age-cache.js",
+    "test:nfr-evidence-guidance": "node test/test-nfr-evidence-guidance.js",
     "test:nfr-validate-corpus": "node test/test-nfr-validate-corpus.js",
     "test:port-totality": "node test/test-port-totality.js",
     "test:probe-conformance": "node test/test-probe-conformance.js",

package/src/workflows/testarch/bmad-testarch-nfr/nfr-report-template.md

@@ -35,7 +35,8 @@ Note: This audit summarizes existing implementation evidence; it does not run te
 - **Status:** {STATUS} {STATUS_ICON}
 - **Threshold:** {THRESHOLD_VALUE}
 - **Actual:** {ACTUAL_VALUE}
-- **Evidence:** {EVIDENCE_SOURCE}
+- **Evidence:** {PROJECT_RELATIVE_PATH}
+- **Supports:** {SUPPORTED_OBSERVATION}
 - **Findings:** {FINDINGS_DESCRIPTION}
 
 ### Throughput
@@ -43,7 +44,8 @@ Note: This audit summarizes existing implementation evidence; it does not run te
 - **Status:** {STATUS} {STATUS_ICON}
 - **Threshold:** {THRESHOLD_VALUE}
 - **Actual:** {ACTUAL_VALUE}
-- **Evidence:** {EVIDENCE_SOURCE}
+- **Evidence:** {PROJECT_RELATIVE_PATH}
+- **Supports:** {SUPPORTED_OBSERVATION}
 - **Findings:** {FINDINGS_DESCRIPTION}
 
 ### Resource Usage
@@ -52,13 +54,15 @@ Note: This audit summarizes existing implementation evidence; it does not run te
   - **Status:** {STATUS} {STATUS_ICON}
   - **Threshold:** {THRESHOLD_VALUE}
   - **Actual:** {ACTUAL_VALUE}
-  - **Evidence:** {EVIDENCE_SOURCE}
+  - **Evidence:** {PROJECT_RELATIVE_PATH}
+  - **Supports:** {SUPPORTED_OBSERVATION}
 
 - **Memory Usage**
   - **Status:** {STATUS} {STATUS_ICON}
   - **Threshold:** {THRESHOLD_VALUE}
   - **Actual:** {ACTUAL_VALUE}
-  - **Evidence:** {EVIDENCE_SOURCE}
+  - **Evidence:** {PROJECT_RELATIVE_PATH}
+  - **Supports:** {SUPPORTED_OBSERVATION}
 
 ---
 
@@ -69,7 +73,8 @@ Note: This audit summarizes existing implementation evidence; it does not run te
 - **Status:** {STATUS} {STATUS_ICON}
 - **Threshold:** {THRESHOLD_DESCRIPTION}
 - **Actual:** {ACTUAL_DESCRIPTION}
-- **Evidence:** {EVIDENCE_SOURCE}
+- **Evidence:** {PROJECT_RELATIVE_PATH}
+- **Supports:** {SUPPORTED_OBSERVATION}
 - **Findings:** {FINDINGS_DESCRIPTION}
 - **Recommendation:** {RECOMMENDATION} (if CONCERNS or FAIL)
 
@@ -78,7 +83,8 @@ Note: This audit summarizes existing implementation evidence; it does not run te
 - **Status:** {STATUS} {STATUS_ICON}
 - **Threshold:** {THRESHOLD_DESCRIPTION}
 - **Actual:** {ACTUAL_DESCRIPTION}
-- **Evidence:** {EVIDENCE_SOURCE}
+- **Evidence:** {PROJECT_RELATIVE_PATH}
+- **Supports:** {SUPPORTED_OBSERVATION}
 - **Findings:** {FINDINGS_DESCRIPTION}
 
 ### Data Protection
@@ -86,23 +92,26 @@ Note: This audit summarizes existing implementation evidence; it does not run te
 - **Status:** {STATUS} {STATUS_ICON}
 - **Threshold:** {THRESHOLD_DESCRIPTION}
 - **Actual:** {ACTUAL_DESCRIPTION}
-- **Evidence:** {EVIDENCE_SOURCE}
+- **Evidence:** {PROJECT_RELATIVE_PATH}
+- **Supports:** {SUPPORTED_OBSERVATION}
 - **Findings:** {FINDINGS_DESCRIPTION}
 
 ### Vulnerability Management
 
 - **Status:** {STATUS} {STATUS_ICON}
-- **Threshold:** {THRESHOLD_DESCRIPTION} (e.g., "0 critical, <3 high vulnerabilities")
-- **Actual:** {ACTUAL_DESCRIPTION} (e.g., "0 critical, 1 high, 5 medium vulnerabilities")
-- **Evidence:** {EVIDENCE_SOURCE} (e.g., "Snyk scan results - scan-2025-10-14.json")
+- **Threshold:** {THRESHOLD_DESCRIPTION}
+- **Actual:** {ACTUAL_DESCRIPTION}
+- **Evidence:** {PROJECT_RELATIVE_PATH}
+- **Supports:** {SUPPORTED_OBSERVATION}
 - **Findings:** {FINDINGS_DESCRIPTION}
 
 ### Compliance (if applicable)
 
 - **Status:** {STATUS} {STATUS_ICON}
-- **Standards:** {COMPLIANCE_STANDARDS} (e.g., "GDPR, HIPAA, PCI-DSS")
+- **Standards:** {COMPLIANCE_STANDARDS}
 - **Actual:** {ACTUAL_COMPLIANCE_STATUS}
-- **Evidence:** {EVIDENCE_SOURCE}
+- **Evidence:** {PROJECT_RELATIVE_PATH}
+- **Supports:** {SUPPORTED_OBSERVATION}
 - **Findings:** {FINDINGS_DESCRIPTION}
 
 ---
@@ -112,25 +121,28 @@ Note: This audit summarizes existing implementation evidence; it does not run te
 ### Availability (Uptime)
 
 - **Status:** {STATUS} {STATUS_ICON}
-- **Threshold:** {THRESHOLD_VALUE} (e.g., "99.9%")
-- **Actual:** {ACTUAL_VALUE} (e.g., "99.95%")
-- **Evidence:** {EVIDENCE_SOURCE} (e.g., "Uptime monitoring - uptime-report-2025-10-14.csv")
+- **Threshold:** {THRESHOLD_VALUE}
+- **Actual:** {ACTUAL_VALUE}
+- **Evidence:** {PROJECT_RELATIVE_PATH}
+- **Supports:** {SUPPORTED_OBSERVATION}
 - **Findings:** {FINDINGS_DESCRIPTION}
 
 ### Error Rate
 
 - **Status:** {STATUS} {STATUS_ICON}
-- **Threshold:** {THRESHOLD_VALUE} (e.g., "<0.1%")
-- **Actual:** {ACTUAL_VALUE} (e.g., "0.05%")
-- **Evidence:** {EVIDENCE_SOURCE} (e.g., "Error logs - logs/errors-2025-10.log")
+- **Threshold:** {THRESHOLD_VALUE}
+- **Actual:** {ACTUAL_VALUE}
+- **Evidence:** {PROJECT_RELATIVE_PATH}
+- **Supports:** {SUPPORTED_OBSERVATION}
 - **Findings:** {FINDINGS_DESCRIPTION}
 
 ### MTTR (Mean Time To Recovery)
 
 - **Status:** {STATUS} {STATUS_ICON}
-- **Threshold:** {THRESHOLD_VALUE} (e.g., "<15 minutes")
-- **Actual:** {ACTUAL_VALUE} (e.g., "12 minutes")
-- **Evidence:** {EVIDENCE_SOURCE} (e.g., "Incident reports - incidents/")
+- **Threshold:** {THRESHOLD_VALUE}
+- **Actual:** {ACTUAL_VALUE}
+- **Evidence:** {PROJECT_RELATIVE_PATH}
+- **Supports:** {SUPPORTED_OBSERVATION}
 - **Findings:** {FINDINGS_DESCRIPTION}
 
 ### Fault Tolerance
@@ -138,15 +150,17 @@ Note: This audit summarizes existing implementation evidence; it does not run te
 - **Status:** {STATUS} {STATUS_ICON}
 - **Threshold:** {THRESHOLD_DESCRIPTION}
 - **Actual:** {ACTUAL_DESCRIPTION}
-- **Evidence:** {EVIDENCE_SOURCE}
+- **Evidence:** {PROJECT_RELATIVE_PATH}
+- **Supports:** {SUPPORTED_OBSERVATION}
 - **Findings:** {FINDINGS_DESCRIPTION}
 
 ### CI Burn-In (Stability)
 
 - **Status:** {STATUS} {STATUS_ICON}
-- **Threshold:** {THRESHOLD_VALUE} (e.g., "100 consecutive successful runs")
-- **Actual:** {ACTUAL_VALUE} (e.g., "150 consecutive successful runs")
-- **Evidence:** {EVIDENCE_SOURCE} (e.g., "CI burn-in results - ci-burn-in-2025-10-14.log")
+- **Threshold:** {THRESHOLD_VALUE}
+- **Actual:** {ACTUAL_VALUE}
+- **Evidence:** {PROJECT_RELATIVE_PATH}
+- **Supports:** {SUPPORTED_OBSERVATION}
 - **Findings:** {FINDINGS_DESCRIPTION}
 
 ### Disaster Recovery (if applicable)
@@ -155,13 +169,15 @@ Note: This audit summarizes existing implementation evidence; it does not run te
   - **Status:** {STATUS} {STATUS_ICON}
   - **Threshold:** {THRESHOLD_VALUE}
   - **Actual:** {ACTUAL_VALUE}
-  - **Evidence:** {EVIDENCE_SOURCE}
+  - **Evidence:** {PROJECT_RELATIVE_PATH}
+  - **Supports:** {SUPPORTED_OBSERVATION}
 
 - **RPO (Recovery Point Objective)**
   - **Status:** {STATUS} {STATUS_ICON}
   - **Threshold:** {THRESHOLD_VALUE}
   - **Actual:** {ACTUAL_VALUE}
-  - **Evidence:** {EVIDENCE_SOURCE}
+  - **Evidence:** {PROJECT_RELATIVE_PATH}
+  - **Supports:** {SUPPORTED_OBSERVATION}
 
 ---
 
@@ -170,33 +186,37 @@ Note: This audit summarizes existing implementation evidence; it does not run te
 ### Test Coverage
 
 - **Status:** {STATUS} {STATUS_ICON}
-- **Threshold:** {THRESHOLD_DESCRIPTION} (e.g., "≥80% coverage")
+- **Threshold:** {THRESHOLD_DESCRIPTION}
 - **Actual:** {ACTUAL_DESCRIPTION}
-- **Evidence:** {EVIDENCE_SOURCE} (e.g., "CI coverage report - coverage/lcov-report/index.html")
+- **Evidence:** {PROJECT_RELATIVE_PATH}
+- **Supports:** {SUPPORTED_OBSERVATION}
 - **Findings:** {FINDINGS_DESCRIPTION}
 
 ### Code Duplication
 
 - **Status:** {STATUS} {STATUS_ICON}
-- **Threshold:** {THRESHOLD_DESCRIPTION} (e.g., "<5% duplication")
+- **Threshold:** {THRESHOLD_DESCRIPTION}
 - **Actual:** {ACTUAL_DESCRIPTION}
-- **Evidence:** {EVIDENCE_SOURCE} (e.g., "jscpd report - reports/jscpd/jscpd-report.json")
+- **Evidence:** {PROJECT_RELATIVE_PATH}
+- **Supports:** {SUPPORTED_OBSERVATION}
 - **Findings:** {FINDINGS_DESCRIPTION}
 
 ### Vulnerability Scan
 
 - **Status:** {STATUS} {STATUS_ICON}
-- **Threshold:** {THRESHOLD_DESCRIPTION} (e.g., "0 critical, 0 high vulnerabilities")
+- **Threshold:** {THRESHOLD_DESCRIPTION}
 - **Actual:** {ACTUAL_DESCRIPTION}
-- **Evidence:** {EVIDENCE_SOURCE} (e.g., "npm audit CI job output")
+- **Evidence:** {PROJECT_RELATIVE_PATH}
+- **Supports:** {SUPPORTED_OBSERVATION}
 - **Findings:** {FINDINGS_DESCRIPTION}
 
 ### Observability
 
 - **Status:** {STATUS} {STATUS_ICON}
-- **Threshold:** {THRESHOLD_DESCRIPTION} (e.g., "structured logging + error tracking configured")
+- **Threshold:** {THRESHOLD_DESCRIPTION}
 - **Actual:** {ACTUAL_DESCRIPTION}
-- **Evidence:** {EVIDENCE_SOURCE}
+- **Evidence:** {PROJECT_RELATIVE_PATH}
+- **Supports:** {SUPPORTED_OBSERVATION}
 - **Findings:** {FINDINGS_DESCRIPTION}
 
 ---
@@ -208,7 +228,8 @@ Note: This audit summarizes existing implementation evidence; it does not run te
 - **Status:** {STATUS} {STATUS_ICON}
 - **Threshold:** {THRESHOLD_DESCRIPTION}
 - **Actual:** {ACTUAL_DESCRIPTION}
-- **Evidence:** {EVIDENCE_SOURCE}
+- **Evidence:** {PROJECT_RELATIVE_PATH}
+- **Supports:** {SUPPORTED_OBSERVATION}
 - **Findings:** {FINDINGS_DESCRIPTION}
 
 ### {CUSTOM_NFR_NAME_2}
@@ -216,7 +237,8 @@ Note: This audit summarizes existing implementation evidence; it does not run te
 - **Status:** {STATUS} {STATUS_ICON}
 - **Threshold:** {THRESHOLD_DESCRIPTION}
 - **Actual:** {ACTUAL_DESCRIPTION}
-- **Evidence:** {EVIDENCE_SOURCE}
+- **Evidence:** {PROJECT_RELATIVE_PATH}
+- **Supports:** {SUPPORTED_OBSERVATION}
 - **Findings:** {FINDINGS_DESCRIPTION}
 
 ---

package/src/workflows/testarch/bmad-testarch-nfr/steps-c/step-02-define-thresholds.md

@@ -49,7 +49,8 @@ Before deriving thresholds from raw documents, check if a `test-design` output e
 
 ## 1. Select Categories
 
-Use the ADR Quality Readiness Checklist (8 categories) as the elicitation source for thresholds:
+Use the ADR Quality Readiness Checklist (8 categories) only as an elicitation
+source for finding explicitly declared requirements:
 
 1. Testability & Automation
 2. Test Data Strategy
@@ -62,13 +63,51 @@ Use the ADR Quality Readiness Checklist (8 categories) as the elicitation source
 
 Add any `custom_nfr_categories` if provided.
 
+The checklist never creates an assessment criterion by itself. Build a canonical
+`declared_nfr_criteria` map containing only requirements in the four automated
+audit domains: Security, Performance, Reliability, and Maintainability. Put
+explicit requirements from every other category in a separate
+`recorded_only_nfr_criteria` list. Both collections come only from the supplied
+test-design plan, tech spec, PRD, story, or custom configuration.
+For each criterion record a stable ID, its source-order position, exact label,
+domain, threshold, and canonical threshold-source path. Preserve source order.
+Do not add a broad checklist category, evidence gap, or CONCERNS finding when
+the supplied requirements do not declare it.
+
+Derive the stable ID mechanically from the domain plus the exact declared label:
+lowercase both, replace each run of non-alphanumeric characters with one hyphen,
+and trim leading or trailing hyphens. Stop with an explicit ambiguity error if
+two criteria produce the same ID. Repeated runs over the same requirements must
+produce the same IDs and order.
+
+```json
+{
+  "{NFR_DOMAIN}": [
+    {
+      "id": "{STABLE_CRITERION_ID}",
+      "order": "{SOURCE_ORDER}",
+      "label": "{DECLARED_REQUIREMENT_LABEL}",
+      "threshold": "{DECLARED_THRESHOLD_OR_UNKNOWN}",
+      "threshold_source": "{PATH_RELATIVE_TO_SUPPLIED_PROJECT_ROOT}"
+    }
+  ]
+}
+```
+
+Each recorded-only entry uses the same fields and stable-ID derivation, plus
+`assessment_mode: "recorded-only"`. Recorded-only criteria are preserved for
+publication with their exact threshold and threshold source. They never enter a
+worker payload, finding, domain status, evidence gap, risk rollup, compliance
+summary, or gate decision.
+
 **Note:** This workflow's automated evidence audit in Step 4 evaluates exactly four domains: Security, Performance, Reliability, and Maintainability. Security and Performance draw their thresholds from the ADR-8 list above. The Reliability worker consumes availability, error-rate, fault-tolerance, and MTTR thresholds. Disaster Recovery remains a separate ADR-8 category for RTO, RPO, backup, restore, and regional recovery evidence; no automated Step 4 worker evaluates it. Maintainability criteria (test coverage, code duplication, dependency vulnerabilities, structured logging, and error tracking) come directly from `nfr-criteria.md`. Thresholds gathered here for Test Data Strategy, Disaster Recovery, Monitorability, QoS/QoE, and Deployability are recorded for the report and are not evaluated by an automated subagent in this workflow.
 
 ---
 
 ## 2. Define Thresholds
 
-For each category, use thresholds from the test-design NFR plan (step 0) where available. For any remaining UNKNOWN or missing thresholds, extract from:
+For each declared criterion, use thresholds from the test-design NFR plan (step 0) where available. For any remaining UNKNOWN or missing thresholds, extract
+from:
 
 - tech-spec (primary)
 - PRD (secondary)
@@ -76,11 +115,19 @@ For each category, use thresholds from the test-design NFR plan (step 0) where a
 
 If a threshold is still unknown after checking all sources, mark it **UNKNOWN** and plan to report **CONCERNS**.
 
+A requirements document proves only the declared target. Record it as
+`threshold_source`; never treat it as implementation evidence or place it in a
+finding's `evidence` array.
+
 ---
 
 ## 3. Confirm NFR Matrix
 
-List each NFR category with its threshold or UNKNOWN status.
+List each declared NFR criterion with its stable ID, domain, source order,
+threshold or UNKNOWN status, threshold source, and assessment mode. The ordered
+`declared_nfr_criteria` map is the complete worker assessment scope passed to
+Steps 3 through 5. The ordered `recorded_only_nfr_criteria` list is passed to
+Step 5 solely for the recorded-only report table.
 
 ---
 

package/src/workflows/testarch/bmad-testarch-nfr/steps-c/step-03-gather-evidence.md

@@ -37,13 +37,79 @@ Collect measurable evidence to evaluate each NFR category.
 
 ## 1. Evidence Sources
 
-Collect evidence for:
+For the criteria present in `declared_nfr_criteria`, collect relevant evidence
+from these source families:
 
 - **Performance**: load tests, metrics, response time data
 - **Security**: scans, auth tests, vuln reports
 - **Reliability**: error rates, burn-in runs, failover tests
 - **Maintainability**: CI coverage report, jscpd duplication report, npm audit results, structured logging and error-tracking config
-- **Other categories**: logs, monitoring, DR drills, deployability checks
+- **Other declared categories**: logs, monitoring, DR drills, deployability checks
+
+These source families are discovery hints. An item in this list that has no
+matching declared criterion creates no finding and no evidence gap.
+
+### Build the supplied-evidence ledger
+
+First identify `supplied_project_root`: the root directory of the project being
+audited, containing its supplied `docs`, `evidence`, and configuration paths.
+This can be a child of the runner workspace. Build one canonical
+`supplied_evidence_ledger` before any domain evaluation. The ledger is the
+complete allowlist for factual NFR claims. Include only files that exist under
+`supplied_project_root` and were supplied for this audit. Exclude the skill,
+templates, temporary worker output, and `{outputFile}`.
+
+For every ledger entry, record:
+
+```json
+{
+  "path": "{PROJECT_RELATIVE_PATH}",
+  "observations": [
+    {
+      "criterion_id": "{STABLE_CRITERION_ID_FROM_DECLARED_SCOPE}",
+      "supports": "{OBSERVATION_SUPPORTED_BY_THIS_FILE}"
+    }
+  ],
+  "domains": ["{NFR_DOMAIN}"],
+  "source": "supplied",
+  "source_type": "implementation-evidence"
+}
+```
+
+Rules:
+
+- `path` is relative to `supplied_project_root`, uses `/` separators, and has no
+  leading `./`, absolute prefix, or supplied project-directory prefix. For a
+  supplied root ending in `{PROJECT_DIRECTORY}`, the one canonical spelling is
+  `evidence/{FILE}`, never `{PROJECT_DIRECTORY}/evidence/{FILE}`.
+- Resolve the canonical path under `supplied_project_root`, confirm it remains
+  inside that root, and confirm it is a regular file before adding it.
+- Every `observations` item binds one supported statement to the exact stable
+  `criterion_id` from `declared_nfr_criteria`. Read the file before recording
+  the observation. A statement that supports two declared criteria is recorded
+  once for each criterion ID.
+- Keep requirements and planning documents in
+  `declared_nfr_criteria[].threshold_source`. Exclude them from the
+  implementation-evidence ledger. A requirement or threshold proves the target
+  only. It never proves implementation, an achieved measurement, or PASS.
+- Sort ledger entries by `path`. Within each entry, de-duplicate observations by
+  the pair `criterion_id` plus `supports`, then sort by `criterion_id` and
+  `supports`. Order `domains` as security, performance, reliability,
+  maintainability. Equivalent supplied evidence must produce identical ledger
+  bytes.
+- Record an explicit evidence gap only for a criterion in
+  `declared_nfr_criteria` whose required implementation observation has no
+  supporting ledger observation. Emit exactly one structured gap in declared
+  source order:
+  `{"criterion_id":"{criterion.id}","message":"{criterion.label}: no supplied implementation evidence"}`.
+  Never split one
+  unsupported criterion into narrower gaps or combine several criteria into a
+  broader gap.
+- Pass the complete ledger and gaps to Step 4 as
+  `subagentContext.supplied_project_root`,
+  `subagentContext.declared_nfr_criteria`,
+  `subagentContext.supplied_evidence_ledger` and
+  `subagentContext.evidence_gaps`.
 
 ---
 
@@ -68,7 +134,11 @@ Store artifacts under `{test_artifacts}/nfr/`
 
 ## 3. Evidence Gaps
 
+Here, "category" means one criterion present in `declared_nfr_criteria`.
 If evidence is missing for a category, mark that category as **CONCERNS**.
+Name the missing observation in `evidence_gaps`.
+Ignore discovery-checklist items absent from `declared_nfr_criteria`. Never add
+a remembered, inferred, or example path or value to the ledger.
 
 ---
 

package/src/workflows/testarch/bmad-testarch-nfr/steps-c/step-04-evaluate-and-score.md

@@ -55,7 +55,11 @@ const parseBooleanFlag = (value, defaultValue = true) => {
 const subagentContext = {
   system_context: /* from Step 1 */,
   nfr_thresholds: /* from Step 2 */,
+  declared_nfr_criteria: /* ordered, explicit assessment scope from Step 2 */,
   evidence_gathered: /* from Step 3 */,
+  supplied_project_root: /* audited project root from Step 3 */,
+  supplied_evidence_ledger: /* canonical ledger from Step 3 */,
+  evidence_gaps: /* explicit gaps from Step 3 */,
   config: {
     execution_mode: config.tea_execution_mode || 'auto',  // "auto" | "subagent" | "agent-team" | "sequential"
     capability_probe: parseBooleanFlag(config.tea_capability_probe, true),  // supports booleans and "false"/"true" strings
@@ -141,6 +145,22 @@ If probing is disabled, honor the requested mode strictly. If that mode cannot b
 
 ### 3. Dispatch 4 NFR Workers
 
+Every worker receives the complete `supplied_evidence_ledger` and
+`evidence_gaps`, plus the ordered `declared_nfr_criteria` scope. A worker emits
+exactly one finding for each declared criterion in its domain, in declared
+source order. It must omit every broad checklist or worker category absent from
+that scope; omitted categories create no gap and cannot affect domain status.
+A worker may cite only an exact `path` from the implementation-evidence ledger
+and may state only an observation listed in that entry's `supports` array.
+Threshold sources remain separate and never appear in a finding's `evidence`
+array. A declared criterion with no matching implementation support cannot
+receive PASS. The worker must emit CONCERNS, or the workflow's declared
+undecidable state, and add the missing observation to the evidence gaps.
+
+Before writing output, de-duplicate and sort every finding's evidence by
+`path`, then `supports`; de-duplicate gaps while preserving declared criterion
+order. These rules apply in every execution mode.
+
 #### Subagent A: Security Evidence Audit
 
 - File: `./step-04a-subagent-security.md`