bmad-method-test-architecture-enterprise 2.0.4-next.2 → 2.0.4-next.4

package/.claude-plugin/marketplace.json

@@ -31,7 +31,7 @@
       "name": "bmad-method-test-architecture-enterprise",
       "source": "./",
       "description": "Master Test Architect module for quality strategy, test generation in red and expand modes with automatic run-and-heal, combined framework and CI setup, CI/CD quality gates, and structured testing education. The CI and ATDD commands remain available with existing customizations. Part of the BMad Method ecosystem.",
-      "version": "2.0.4-next.2",
+      "version": "2.0.4-next.4",
       "author": {
         "name": "Murat K Ozcan (TEA Creator) & Brian (BMad) Madison"
       },

package/README.md

@@ -113,6 +113,7 @@ It requires Node.js 22.20.0 or later:
 npm install --save-dev bmad-method-test-architecture-enterprise
 ```
 
+- [`tea-teach`](https://bmad-code-org.github.io/bmad-method-test-architecture-enterprise/reference/tea-teach-cli/) teaches one learner turn and keeps conversation and session progress.
 - [`tea-test-review`](https://bmad-code-org.github.io/bmad-method-test-architecture-enterprise/reference/tea-test-review-cli/) runs the review skill against changed tests and returns a gate verdict.
 - [`tea-framework`](https://bmad-code-org.github.io/bmad-method-test-architecture-enterprise/reference/tea-framework-cli/) creates, resumes, validates, and edits test framework and CI setup with retained run evidence.
 - [`tea-trace`](https://bmad-code-org.github.io/bmad-method-test-architecture-enterprise/reference/tea-trace-cli/) maps requirements to existing evidence and returns a coverage gate.

package/cli/lib/evaluate/http-target.js

@@ -699,19 +699,38 @@ async function deploymentAccess({
   return { origins, authorizations };
 }
 
-/** A port the system gives out now, free on every address, released for the server to take. */
-function freePort() {
+/** Tries a port on one address, then releases it for the target; a busy candidate returns null. */
+function availablePort(port, address, createServer) {
   return new Promise((resolve, reject) => {
-    const server = net.createServer();
+    const server = createServer();
     server.unref();
-    server.once('error', reject);
-    server.listen(0, () => {
-      const { port } = server.address();
-      server.close(() => resolve(port));
+    server.once('error', (error) => (error.code === 'EADDRINUSE' ? resolve(null) : reject(error)));
+    server.listen(port, address, () => {
+      const selected = server.address().port;
+      server.close(() => resolve(selected));
     });
   });
 }
 
+/** A port available on every address the policy may select, released for the server to take. */
+async function freePort(addresses, createServer = () => net.createServer()) {
+  const distinct = [...new Set(addresses.map((address) => canonicalAddress(address) ?? address))];
+  if (distinct.length === 0) throw new Error('a started server has no authorized address');
+  for (let attempt = 0; attempt < 32; attempt += 1) {
+    const candidate = await availablePort(0, distinct[0], createServer);
+    if (candidate === null) continue;
+    let available = true;
+    for (const address of distinct.slice(1)) {
+      if ((await availablePort(candidate, address, createServer)) === null) {
+        available = false;
+        break;
+      }
+    }
+    if (available) return candidate;
+  }
+  throw new Error(`could not find a free port on ${distinct.join(', ')}`);
+}
+
 /**
  * Whether `address:port` accepts a connection now: `true`, or why the attempt
  * failed (the socket error's code, `ECONNREFUSED` while nothing listens, or
@@ -1207,7 +1226,7 @@ function createApiPort({ entries, httpPort, cwd, targetOf, readEnvironment, mech
         // A server behind a bridge gets a private directory for the Unix socket its shim serves, which only that call's
         // server may write; it joins the scratch list like the port directory.
         if (launched !== null && mechanism.bridges === true) bridgeDirectory = makeBridgeDirectory(scratch);
-        const launchedPort = launched === null || reports ? null : await freePort();
+        const launchedPort = launched === null || reports ? null : await freePort(launched.addresses);
         const configurationAt = (port) =>
           portConfiguration({
             entries,
@@ -1397,6 +1416,7 @@ module.exports = {
   defaultPortOf,
   deploymentAccess,
   deploymentAuthorizations,
+  freePort,
   httpPortFile,
   isApiEntry,
   makeBridgeDirectory,

package/cli/lib/nfr-report.js

@@ -0,0 +1,432 @@
+/** Validate the actual NFR workflow context against supplied sources and its report. */
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const yaml = require('js-yaml');
+const MarkdownIt = require('markdown-it');
+const { WorkflowError } = require('./workflow-cli');
+const DOMAINS = ['security', 'performance', 'reliability', 'maintainability'];
+const STATUSES = new Set(['PASS', 'CONCERNS', 'FAIL', 'N/A']);
+const STEPS = [
+  'step-01-load-context',
+  'step-02-define-thresholds',
+  'step-03-gather-evidence',
+  'step-04e-aggregate-nfr',
+  'step-05-generate-report',
+];
+/** Reject a report field with the parser failure class used by the CLI. */
+const bad = (message) => {
+  throw new WorkflowError('environment-parser', message);
+};
+/** Collapse whitespace so quoted observations survive line wrapping. */
+const normalized = (value) => String(value).replaceAll(/\s+/g, ' ').trim();
+/** Compare ADR category labels across spaces, hyphens and capitalization. */
+const categoryLabel = (value) =>
+  value
+    .toLowerCase()
+    .replaceAll(/[-\s]+/g, ' ')
+    .trim();
+/** Compare canonical context values after JSON serialization. */
+const same = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+const markdown = new MarkdownIt({ html: true });
+const DECORATIONS = { PASS: ['✅', '✔', '✔️'], CONCERNS: ['⚠', '⚠️'], FAIL: ['❌', '✖', '✖️'], 'N/A': ['➖'] };
+/** Read visible inline text, preserving code excerpts while discarding formatting delimiters. */
+function inlineText(token) {
+  return (token?.children || [])
+    .filter((child) => ['text', 'code_inline'].includes(child.type))
+    .map((child) => child.content)
+    .join('')
+    .trim();
+}
+/** Normalize one complete display enum with an optional matching approved decoration. */
+function displayStatus(value) {
+  const match = String(value)
+    .trim()
+    .match(/^(PASS|CONCERNS|FAIL|N\/A)(?:[ \t]+(\S+))?$/i);
+  if (!match) bad('report status must contain one complete enum and an optional approved decoration');
+  const status = match[1].toUpperCase();
+  if (match[2] && !DECORATIONS[status].includes(match[2])) bad('report status decoration contradicts or ambiguously labels its enum');
+  return status;
+}
+/** Preserve a quoted source excerpt when Markdown renders it as a single inline code value. */
+function literalValue(value) {
+  const blocks = markdown.parse(value, {});
+  if (blocks.length === 1 && blocks[0].type === 'fence') return blocks[0].content.trim();
+  const children = markdown.parseInline(value, {})[0]?.children || [];
+  return children.length === 1 && children[0].type === 'code_inline' ? children[0].content : value;
+}
+/** Preserve one or more complete fenced source quotations as separate actual observations. */
+function actualValues(value) {
+  const blocks = markdown.parse(value, {});
+  if (blocks.length > 0 && blocks.every((token) => token.type === 'fence')) return blocks.map((token) => token.content.trim());
+  return [literalValue(value)];
+}
+/** The workflow's worst-status rollup excludes nonapplicable domains. */
+function worst(values) {
+  if (values.includes('FAIL')) return 'FAIL';
+  if (values.includes('CONCERNS')) return 'CONCERNS';
+  return values.includes('PASS') ? 'PASS' : 'N/A';
+}
+/** Stable criterion identity defined by NFR step02. */
+function criterionId(domain, label) {
+  return `${domain}-${label}`
+    .toLowerCase()
+    .replaceAll(/[^a-z0-9]+/g, '-')
+    .replaceAll(/^-+|-+$/g, '');
+}
+/** Parse YAML without silently accepting duplicate keys or extra documents. */
+function parseYaml(text, label) {
+  try {
+    return yaml.load(text);
+  } catch (error) {
+    bad(`invalid ${label} YAML: ${error.message}`);
+  }
+}
+/** Read canonical project-relative files from their explicit input role. */
+function sourceText(reference, projectRoot, sources, label) {
+  if (
+    typeof reference !== 'string' ||
+    !reference ||
+    path.isAbsolute(reference) ||
+    reference.includes('\\') ||
+    path.posix.normalize(reference) !== reference ||
+    reference.startsWith('../') ||
+    reference.startsWith('./')
+  )
+    bad(`${label} must name a canonical project-relative supplied path`);
+  const file = path.join(projectRoot, reference);
+  if (!sources.includes(file)) bad(`${label} is outside its supplied input role: ${reference}`);
+  return normalized(fs.readFileSync(file, 'utf8'));
+}
+/** Require an actual source excerpt, while allowing normalized line wrapping. */
+function excerpt(value, source, label) {
+  if (typeof value !== 'string' || !normalized(value) || !source.includes(normalized(value)))
+    bad(`${label} is not a quotation from its supplied source`);
+}
+/** Extract populated Markdown sections without matching headings inside fenced examples. */
+function sections(text, level) {
+  const lines = text.split(/\r?\n/);
+  const tokens = markdown.parse(text, {});
+  const headings = tokens.flatMap((token, index) => {
+    if (token.type !== 'heading_open' || token.level !== 0 || !token.map) return [];
+    const label = inlineText(tokens[index + 1]);
+    return [{ level: Number(token.tag.slice(1)), label, start: token.map[0], end: token.map[1] }];
+  });
+  return headings
+    .filter((heading) => heading.level === level)
+    .map((heading) => {
+      const next = headings.find((other) => other.start > heading.start && other.level <= level);
+      return { label: heading.label, body: lines.slice(heading.end, next?.start ?? lines.length).join('\n') };
+    });
+}
+/** Remove literal block examples before interpreting bold report fields. */
+function reportFields(text) {
+  const lines = text.split(/\r?\n/);
+  for (const token of markdown.parse(text, {})) {
+    if (['fence', 'code_block', 'html_block'].includes(token.type) && token.map)
+      for (let line = token.map[0]; line < token.map[1]; line++) lines[line] = lines[line].replaceAll(/[^\n]/g, ' ');
+  }
+  return lines.join('\n');
+}
+/** Read a unique bold report field, including multiline evidence lists. */
+function field(body, name) {
+  const expression = new RegExp(
+    `^[ \\t]*(?:-[ \\t]+)?\\*\\*${name}:?\\*\\*[ \\t]*:?[ \\t]*([^]*?)(?=^[ \\t]*(?:-[ \\t]+)?\\*\\*[A-Za-z]|$(?![\\s\\S]))`,
+    'gim',
+  );
+  const values = [...reportFields(body).matchAll(expression)].map((match) => {
+    const start = match.index + match[0].length - match[1].length;
+    return body.slice(start, match.index + match[0].length).trim();
+  });
+  if (values.length !== 1 || !values[0]) bad(`criterion must contain exactly one populated ${name} field`);
+  return values[0];
+}
+/** Validate the fresh canonical context, exact ledger bindings, report and gate together. */
+function readNfrReport(text, context, request) {
+  const { projectRoot, runScope, runKey, requestId, inputs, evidenceFiles } = request;
+  if (
+    !context ||
+    context.schemaVersion !== 1 ||
+    context.requestId !== requestId ||
+    context.runScope !== runScope ||
+    context.runKey !== runKey ||
+    context.supplied_project_root !== projectRoot
+  )
+    bad('the NFR context does not belong to the requested attempt and scope');
+  if (
+    !same(Object.keys(context.declared_nfr_criteria || {}).sort(), [...DOMAINS].sort()) ||
+    !same(Object.keys(context.domain_assessments || {}).sort(), [...DOMAINS].sort())
+  )
+    bad('context must carry exactly the four audited domains');
+  const criteria = new Map();
+  const validateCriterion = (criterion, domain, previousOrder) => {
+    if (
+      !criterion ||
+      typeof criterion.label !== 'string' ||
+      !criterion.label.trim() ||
+      criterion.id !== criterionId(domain, criterion.label) ||
+      !Number.isSafeInteger(criterion.order) ||
+      criterion.order <= previousOrder ||
+      criteria.has(criterion.id)
+    )
+      bad(`invalid criterion identity or source order in ${domain}`);
+    const source = sourceText(criterion.threshold_source, projectRoot, inputs, 'threshold source');
+    if (criterion.threshold !== 'UNKNOWN') excerpt(criterion.threshold, source, `${criterion.id} threshold`);
+    criteria.set(criterion.id, { ...criterion, domain });
+    return criterion.order;
+  };
+  for (const domain of DOMAINS) {
+    if (!Array.isArray(context.declared_nfr_criteria[domain])) bad(`invalid declared criteria for ${domain}`);
+    let order = -1;
+    for (const criterion of context.declared_nfr_criteria[domain]) order = validateCriterion(criterion, domain, order);
+  }
+  if (!Array.isArray(context.recorded_only_nfr_criteria))
+    bad('context must include recorded-only criteria, including an empty list when none were declared');
+  const recorded = new Set();
+  let recordedOrder = -1;
+  for (const criterion of context.recorded_only_nfr_criteria) {
+    if (DOMAINS.includes(criterion.domain) || typeof criterion.domain !== 'string' || criterion.assessment_mode !== 'recorded-only')
+      bad('recorded-only criteria cannot create audited domains');
+    recordedOrder = validateCriterion(criterion, criterion.domain, recordedOrder);
+    recorded.add(criterion.id);
+  }
+  if (!Array.isArray(context.supplied_evidence_ledger)) bad('context is missing the supplied evidence ledger');
+  const observations = new Map();
+  let lastPath = '';
+  for (const entry of context.supplied_evidence_ledger) {
+    if (
+      !entry ||
+      entry.source !== 'supplied' ||
+      entry.source_type !== 'implementation-evidence' ||
+      typeof entry.path !== 'string' ||
+      entry.path <= lastPath ||
+      !Array.isArray(entry.observations) ||
+      entry.observations.length === 0
+    )
+      bad('invalid or unsorted supplied evidence ledger');
+    lastPath = entry.path;
+    const source = sourceText(entry.path, projectRoot, evidenceFiles, 'implementation evidence');
+    let previous = '';
+    for (const observation of entry.observations) {
+      if (!observation || !criteria.has(observation.criterion_id) || recorded.has(observation.criterion_id))
+        bad('ledger observation has an undeclared audited criterion');
+      excerpt(observation.supports, source, `${observation.criterion_id} observation`);
+      const key = `${observation.criterion_id}\0${observation.supports}`;
+      if (key <= previous) bad('ledger observations must be deduplicated and sorted');
+      previous = key;
+      const bound = observations.get(observation.criterion_id) || [];
+      bound.push({ path: entry.path, supports: observation.supports });
+      observations.set(observation.criterion_id, bound);
+    }
+    const expectedDomains = DOMAINS.filter((domain) =>
+      entry.observations.some((observation) => criteria.get(observation.criterion_id).domain === domain),
+    );
+    if (!same(entry.domains, expectedDomains)) bad('ledger domain bindings contradict its criterion observations');
+  }
+  const frontmatter = text.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
+  if (!frontmatter) bad('the report is missing progress frontmatter');
+  const progress = parseYaml(frontmatter[1], 'progress');
+  const optionalSteps = [
+    'step-04-evaluate-and-score',
+    'step-04a-subagent-security',
+    'step-04b-subagent-performance',
+    'step-04c-subagent-reliability',
+    'step-04d-subagent-maintainability',
+  ];
+  const completed = progress?.stepsCompleted;
+  const requiredSequence = Array.isArray(completed) ? completed.filter((step) => STEPS.includes(step)) : [];
+  const validSteps =
+    Array.isArray(completed) &&
+    new Set(completed).size === completed.length &&
+    completed.every((step) => STEPS.includes(step) || optionalSteps.includes(step)) &&
+    optionalSteps.every(
+      (step) =>
+        !completed.includes(step) ||
+        (completed.indexOf(step) > completed.indexOf(STEPS[2]) && completed.indexOf(step) < completed.indexOf(STEPS[3])),
+    );
+  if (
+    progress?.workflowStatus !== 'completed' ||
+    progress.runScope !== runScope ||
+    progress.runKey !== runKey ||
+    progress.lastStep !== STEPS.at(-1) ||
+    !validSteps ||
+    !same(requiredSequence, STEPS) ||
+    !(typeof progress.lastSaved === 'string' || progress.lastSaved instanceof Date) ||
+    !Number.isFinite(Date.parse(progress.lastSaved))
+  )
+    bad('the report checkpoint does not confirm this completed run');
+  const gates = [];
+  const reportBody = text.slice(frontmatter[0].length);
+  for (const token of markdown.parse(reportBody, {})) {
+    if (token.type !== 'fence' || token.level !== 0 || !['yaml', 'yml'].includes(token.info.trim().toLowerCase())) continue;
+    const value = parseYaml(token.content, 'gate');
+    if (value && Object.hasOwn(value, 'nfr_assessment')) gates.push(value.nfr_assessment);
+  }
+  if (gates.length !== 1) bad('report must carry exactly one nfr_assessment gate');
+  const gate = gates[0];
+  if (!gate || !same(Object.keys(gate.audited_domains || {}).sort(), [...DOMAINS].sort()) || !STATUSES.has(gate.overall_status))
+    bad('gate must declare exactly four audited domains and a valid overall status');
+  if (
+    typeof gate.blockers !== 'boolean' ||
+    ['critical_issues', 'high_priority_issues', 'medium_priority_issues', 'concerns', 'evidence_gaps'].some(
+      (key) => !Number.isSafeInteger(gate[key]) || gate[key] < 0,
+    )
+  )
+    bad('gate issue counts and blockers flag must be typed');
+  const reportSections = sections(reportBody, 2);
+  for (const name of [
+    'Executive Summary',
+    'Quick Wins',
+    'Recommended Actions',
+    'Monitoring Hooks',
+    'Fail-Fast Mechanisms',
+    'Evidence Gaps',
+    'Findings Summary',
+    'Gate YAML Snippet',
+    'Related Artifacts',
+    'Recommendations Summary',
+    'Sign-Off',
+  ]) {
+    const matches = reportSections.filter((section) => section.label === name);
+    if (
+      matches.length !== 1 ||
+      !matches[0].body
+        .replaceAll(/<!--[^]*?-->/g, '')
+        .replaceAll(/^#{1,6}[^\n]*$/gm, '')
+        .trim()
+    )
+      bad(`report requires one populated ${name} section`);
+  }
+  let concerns = 0;
+  let gaps = 0;
+  for (const domain of DOMAINS) {
+    const domainSections = reportSections.filter((section) => section.label.toLowerCase() === `${domain} assessment`);
+    if (domainSections.length !== 1) bad(`report requires exactly one ${domain} Assessment`);
+    const section = domainSections[0];
+    const expected = context.declared_nfr_criteria[domain];
+    const assessment = context.domain_assessments[domain];
+    if (
+      !assessment ||
+      !Array.isArray(assessment.findings) ||
+      !same(
+        assessment.findings.map((finding) => finding.criterion_id),
+        expected.map((criterion) => criterion.id),
+      )
+    )
+      bad(`${domain} findings omit or add declared criteria`);
+    const reportFindings = sections(section.body, 3);
+    if (
+      !same(
+        reportFindings.map((finding) => finding.label),
+        expected.map((criterion) => criterion.label),
+      )
+    )
+      bad(`${domain} report headings omit, duplicate or add declared criteria`);
+    const expectedGaps = [];
+    for (const [index, criterion] of expected.entries()) {
+      const finding = assessment.findings[index];
+      const evidence = observations.get(criterion.id) || [];
+      if (!STATUSES.has(finding.status) || !same(finding.evidence, evidence))
+        bad(`${criterion.id} status or evidence contradicts the canonical ledger`);
+      if ((evidence.length === 0 || criterion.threshold === 'UNKNOWN') && finding.status !== 'CONCERNS')
+        bad(`${criterion.id} requires CONCERNS for unknown thresholds or missing evidence`);
+      if (evidence.length === 0)
+        expectedGaps.push({ criterion_id: criterion.id, message: `${criterion.label}: no supplied implementation evidence` });
+      if (criterion.threshold === 'UNKNOWN' && evidence.length > 0)
+        expectedGaps.push({ criterion_id: criterion.id, message: `${criterion.label}: UNKNOWN threshold` });
+      const body = reportFindings[index].body;
+      if (
+        displayStatus(field(body, 'Status')) !== finding.status ||
+        normalized(literalValue(field(body, 'Threshold'))) !== normalized(criterion.threshold) ||
+        field(body, 'Threshold Source') !== `\`${criterion.threshold_source}\``
+      )
+        bad(`${criterion.id} report fields contradict its canonical criterion`);
+      const actual = actualValues(field(body, 'Actual'));
+      if (finding.status === 'PASS' && actual.includes('UNKNOWN')) bad(`${criterion.id} claims PASS without a known actual measurement`);
+      for (const observation of actual) {
+        if (
+          !normalized(observation) ||
+          (observation !== 'UNKNOWN' &&
+            !evidence.some((entry) =>
+              sourceText(entry.path, projectRoot, evidenceFiles, 'actual evidence').includes(normalized(observation)),
+            ))
+        )
+          bad(`${criterion.id} actual is unsupported by supplied evidence`);
+      }
+      const evidenceText = field(body, 'Evidence');
+      const paths = [...evidenceText.matchAll(/`([^`]+)`/g)].map((match) => match[1]);
+      if (!same([...new Set(paths)], [...new Set(evidence.map((entry) => entry.path))]))
+        bad(`${criterion.id} report evidence paths contradict the canonical ledger`);
+      const supports = field(body, 'Supports');
+      for (const entry of evidence)
+        if (!normalized(supports).includes(normalized(entry.supports))) bad(`${criterion.id} report omits a bound observation`);
+      if (evidence.length === 0 && (evidenceText !== 'None' || supports !== 'None' || !same(actual, ['UNKNOWN'])))
+        bad(`${criterion.id} claims unsupported implementation evidence`);
+      concerns += finding.status === 'CONCERNS' ? 1 : 0;
+    }
+    const displayedGaps = Array.isArray(assessment.evidence_gaps)
+      ? assessment.evidence_gaps.map((gap) => {
+          const criterion = criteria.get(gap.criterion_id);
+          if (criterion?.threshold === 'UNKNOWN' && gap.message === `${criterion.label}: UNKNOWN threshold gap`)
+            return { ...gap, message: `${criterion.label}: UNKNOWN threshold` };
+          return gap;
+        })
+      : assessment.evidence_gaps;
+    if (!same(displayedGaps, expectedGaps)) bad(`${domain} evidence gaps contradict its declared criteria`);
+    gaps += expectedGaps.length;
+    const status = worst(assessment.findings.map((finding) => finding.status));
+    const firstFinding = markdown
+      .parse(section.body, {})
+      .find((token) => token.type === 'heading_open' && token.level === 0 && token.tag === 'h3');
+    const prelude = reportFields(section.body.split(/\r?\n/).slice(0, firstFinding?.map?.[0]).join('\n'));
+    const domainStatuses = [...prelude.matchAll(/^[ \t]*(?:-[ \t]+)?\*\*(?:Domain )?Status:?\*\*[ \t]*:?[ \t]*([^\n]+)$/gim)].map((match) =>
+      displayStatus(match[1]),
+    );
+    const domainStatus = domainStatuses.length === 1 ? domainStatuses[0] : null;
+    if (assessment.status !== status || domainStatus !== status || gate.audited_domains[domain] !== status)
+      bad(`${domain} status contradicts its finding rollup`);
+  }
+  if (
+    gate.overall_status !== worst(Object.values(gate.audited_domains)) ||
+    gate.concerns !== concerns ||
+    gate.evidence_gaps !== gaps ||
+    gate.blockers !== (gate.overall_status === 'FAIL')
+  )
+    bad('gate overall status or counts contradict the normalized audit');
+  const tables = reportSections.filter((section) => section.label === 'Recorded-Only NFR Criteria');
+  if (tables.length > 1 || (recorded.size > 0 && tables.length !== 1)) bad('declared recorded-only criteria require one report table');
+  if (tables.length === 1) {
+    const tokens = markdown.parse(tables[0].body, {});
+    const rows = [];
+    let row;
+    for (const [index, token] of tokens.entries()) {
+      if (token.type === 'tr_open') {
+        row = [];
+        // Markdown silently drops cells beyond the header width. Keep those extras invalid.
+        const raw = tables[0].body
+          .split(/\r?\n/)
+          .slice(...token.map)
+          .join('\n')
+          .trim();
+        const cells = raw.split(/(?<!\\)(?:\\\\)*\|/);
+        const count = cells.length - (cells[0].trim() === '' ? 1 : 0) - (cells.at(-1).trim() === '' ? 1 : 0);
+        if (count !== 6) bad('recorded-only table must contain exactly six cells per row');
+      }
+      if (token.type === 'td_open') row?.push(inlineText(tokens[index + 1]));
+      if (token.type === 'tr_close' && row?.length > 0) rows.push(row);
+    }
+    // Categories are display labels; their identity remains the canonical criterion ID.
+    for (const row of rows) if (typeof row[1] === 'string') row[1] = categoryLabel(row[1]);
+    const expectedRows = context.recorded_only_nfr_criteria.map((criterion) => [
+      criterion.id,
+      categoryLabel(criterion.domain),
+      criterion.label,
+      criterion.threshold,
+      criterion.threshold_source,
+      'RECORDED ONLY',
+    ]);
+    if (!same(rows, expectedRows)) bad('recorded-only table adds, omits, reorders or assesses criteria');
+  }
+  return { status: gate.overall_status, gate, progress, context };
+}
+module.exports = { readNfrReport, criterionId, worst, DOMAINS };

package/cli/lib/resolve-tea-config.js

@@ -78,18 +78,22 @@ function configError(message) {
 }
 
 /** Read configuration from one pinned base commit, or from the working tree. */
-function configSource(projectRoot, baseRef) {
+function configSource(projectRoot, baseRef, inputPaths, inputPatterns) {
   if (baseRef === undefined || baseRef === null) {
     return {
+      recordInput: (file) => inputPaths?.add(file),
       label: (relativePath) => path.join(projectRoot, relativePath),
       list(pattern) {
         try {
-          return globSync(pattern, { cwd: projectRoot, dot: true, nodir: true, follow: false });
+          const matches = globSync(pattern, { cwd: projectRoot, dot: true, nodir: true, follow: false });
+          inputPatterns?.set(pattern, [...matches].sort());
+          return matches;
         } catch (error) {
           throw configError(`Failed to list policy files in ${projectRoot}: ${error.message}`);
         }
       },
       read(relativePath) {
+        inputPaths?.add(path.join(projectRoot, relativePath));
         try {
           return fs.readFileSync(path.join(projectRoot, relativePath), 'utf8');
         } catch (error) {
@@ -284,6 +288,7 @@ function parseToml(content, label) {
 function readWorkflowCustomization(source, skillRoot, projectRoot, skillName = 'bmad-testarch-test-review') {
   if (!skillRoot) return {};
   const defaultsPath = path.join(skillRoot, 'customize.toml');
+  source.recordInput?.(defaultsPath);
   let merged = {};
   try {
     merged = parseToml(fs.readFileSync(defaultsPath, 'utf8'), defaultsPath);
@@ -490,13 +495,16 @@ const KEY_TO_INSTALLED_FIELD = {
  * @param {string} [options.skillRoot] - Trusted skill defaults for workflow customization.
  * @param {object} [options.flags] - Parsed CLI options; only the keys in
  *   FLAG_TO_KEY are read, and only when not undefined.
+ * @param {Set<string>} [options.inputPaths] - Receives working-tree inputs, including missing optional layers.
+ * @param {Map<string, string[]>} [options.inputPatterns] - Receives policy glob membership used during resolution.
  * @returns {{values: object, sources: object, installed: object, configSnapshot: object, workflowCustomization: object, configCommit: string|null, configPath: string, configPresent: boolean, configFormat: string|null}}
  *   `installed` carries one boolean per library gate, read from the project
  *   manifest rather than left to the agent.
  * @throws {Error} With code TEA_CONFIG_INVALID on unusable config content.
  */
-function resolveTeaConfig({ projectRoot, flags = {}, baseRef, skillRoot, skillName }) {
-  const source = configSource(projectRoot, baseRef);
+function resolveTeaConfig({ projectRoot, flags = {}, baseRef, skillRoot, skillName, inputPaths, inputPatterns }) {
+  const source = configSource(projectRoot, baseRef, inputPaths, inputPatterns);
+  inputPaths?.add(path.join(projectRoot, 'package.json'));
   const file = readTeaConfigFile(projectRoot, baseRef, source);
   const workflowCustomization = readWorkflowCustomization(source, skillRoot, projectRoot, skillName);