harness-everything 0.47.4 → 0.47.5

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.47.4",
+      "version": "0.47.5",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.47.4",
+  "version": "0.47.5",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.47.5](https://github.com/dyphn1/Harness-everything/compare/v0.47.4...v0.47.5) (2026-11-03)
+
+### Bug Fixes
+
+* **behavioral-evals:** detect npm ERR! lines in quality gate output ([b599224](https://github.com/dyphn1/Harness-everything/commit/b599224ba09f27dc1f5e5c1156c40c20e57f6f52))
+* **behavioral-evals:** grade tdd quality gate on independently re-evaluated evidence ([f9433ed](https://github.com/dyphn1/Harness-everything/commit/f9433ed535ba4b1882029622a31325ae564cdd50)), closes [#311](https://github.com/dyphn1/Harness-everything/issues/311)
+* **behavioral-evals:** grade the last quality gate attempt, not the last completed run ([8065345](https://github.com/dyphn1/Harness-everything/commit/806534592dbc47665868e74a36b4095d44a2647b))
+* **behavioral-evals:** order gate workspace checks before outcome and compare printed report ([ded48fd](https://github.com/dyphn1/Harness-everything/commit/ded48fd7221cb66c61cc58a70c1f4924f0c0fc82))
+* **behavioral-evals:** require observed gate success and full retained report ([47d35d7](https://github.com/dyphn1/Harness-everything/commit/47d35d725623a4355dcc8a054347ec68832edaa2))
+* **tdd:** keep source defect evidence reviewer-required ([443e966](https://github.com/dyphn1/Harness-everything/commit/443e96635c972713acd9fa76e974cb79bfa310ff))
+* **tdd:** read assert.* expected from second argument; tolerate trailing semicolon ([1745ea2](https://github.com/dyphn1/Harness-everything/commit/1745ea2860a2566703af93ec23fc1ff1b00d7eef))
+* **tdd:** require quoted assertion evidence for source conflict claims ([e9e1ab9](https://github.com/dyphn1/Harness-everything/commit/e9e1ab9b8170054a1ecf57b440b18124b4f99108)), closes [#312](https://github.com/dyphn1/Harness-everything/issues/312)
+* **tdd:** require same-subject assertions for SOURCE_CONFLICT evidence ([d0ab25f](https://github.com/dyphn1/Harness-everything/commit/d0ab25fb810f390921acc9f38584eead95f18214))
+* **tdd:** verify sourceEvidence expected values against quoted literals ([77a8ba6](https://github.com/dyphn1/Harness-everything/commit/77a8ba690de69db9852371270e86c063d30b77ed))
+
 ## [0.47.4](https://github.com/dyphn1/Harness-everything/compare/v0.47.3...v0.47.4) (2026-11-03)
 
 ### Bug Fixes
@@ -53,6 +68,8 @@ All notable changes to this project are documented in this file.
 
 ### Bug Fixes
 
+* **code-review:** add evidence-gate counterexamples (claimed vs observed, select then judge, one witness per rule, comparable subjects and honest labels) for reviewers and author self-review.
+* **zoom-out:** the author applying review fixes counts repair-loop rounds too; a decision class repeated from the previous round triggers Phase 2 before editing.
 * **doc-reconciliation:** pin the owner-approved VERI-to-EVID row mapping and exclude ordinary SubagentStop completions from quality-review candidates.
 * **doc-reconciliation:** allow uniquely identified same-root reviewers that start after the correlated draft worker stops.
 

package/behavioral-evals/README.md

@@ -168,6 +168,23 @@ command ran: final prose and attempted tool inputs can mention an action that
 never completed. Use structured execution expectations instead, for example
 `tool_completed` with `command: "npm test"` (command prefixes may include
 additional arguments) or `tool_denied` when denial is the behavior under test.
+When one completion must accept several explicit command shapes, use
+`value: {command_pattern: "<regex>"}`; the regex is matched against the whole
+command, so shell control operators must be excluded explicitly.
+`tdd_quality_gate` takes the same `command_pattern` but does not trust the tool
+call's completed status. For the last matching run the grader first runs the
+workspace checks: the evidence file must be retained, valid JSON and re-evaluate
+to `PASS` with this repository's `tdd/scripts/quality-gate.js`; a `--output`
+report must be present and deep-equal the fresh re-evaluation over every
+top-level key (key order ignored); and a full report printed to stdout must do
+the same. Missing, invalid or disagreeing artifacts are definitive `fail`s, and
+a missing required key or a differing key is named in the reason. Then it reads
+the observed command outcome: the call fails when it reports an error, exits
+non-zero, prints an npm error line (`npm ERR!`, `npm error`, or `Missing script:`)
+or prints `TDD Quality Gate: FAIL`. It passes only when the output contains the
+gate's own `TDD Quality Gate: PASS` line and none of those signals. When the
+transcript shows neither output nor an exit code, the result is `inconclusive`
+rather than a pass. The last matching attempt counts, in transcript order: a later failed or denied run fails the gate, and a later unresolved run is inconclusive, even when an earlier run passed.
 Legacy one-object Claude JSON and incomplete streams are graded inconclusive
 for execution evidence.
 

package/behavioral-evals/case-validator.js

@@ -25,6 +25,7 @@ const EXPECTATION_TYPES = new Set([
   'tool_completed',
   'tool_denied',
   'execution_evidence',
+  'tdd_quality_gate',
   'final_output_json_only',
 ]);
 
@@ -119,19 +120,30 @@ function validateExpectation(expectation, index) {
     errors.push(`expectations[${index}] ${type} requires a string value`);
   }
   if (type === 'command_exit_0' && (typeof expectation.command !== 'string' || !expectation.command.trim())) errors.push(`expectations[${index}] command_exit_0 requires a non-empty command`);
+  if (type === 'tdd_quality_gate' && !(isPlainObject(expectation.value) && expectation.value.command_pattern !== undefined)) {
+    errors.push(`expectations[${index}] tdd_quality_gate requires value.command_pattern`);
+  }
   if (type === 'final_output_json_only' && expectation.required_keys !== undefined) {
     const keys = expectation.required_keys;
     if (!Array.isArray(keys) || keys.some(key => typeof key !== 'string' || !key.trim())) {
       errors.push(`expectations[${index}] required_keys must be an array of non-empty strings`);
     }
   }
-  if (['tool_attempted', 'tool_executed', 'tool_completed', 'tool_denied', 'execution_evidence'].includes(type)) {
+  if (['tool_attempted', 'tool_executed', 'tool_completed', 'tool_denied', 'execution_evidence', 'tdd_quality_gate'].includes(type)) {
     if (expectation.value === undefined && expectation.tool === undefined && expectation.name === undefined && expectation.command === undefined) {
       errors.push(`expectations[${index}] ${type} requires a tool/value target`);
     }
     if (expectation.value !== undefined && !['string', 'number'].includes(typeof expectation.value) && !isPlainObject(expectation.value)) {
       errors.push(`expectations[${index}] execution target must be scalar or mapping`);
     }
+    if (isPlainObject(expectation.value) && expectation.value.command_pattern !== undefined) {
+      if (typeof expectation.value.command_pattern !== 'string' || !expectation.value.command_pattern) {
+        errors.push(`expectations[${index}] command_pattern must be a non-empty string`);
+      } else {
+        try { new RegExp(expectation.value.command_pattern); }
+        catch { errors.push(`expectations[${index}] command_pattern must be a valid regular expression`); }
+      }
+    }
   }
   return errors;
 }
@@ -210,6 +222,8 @@ function negativeControls() {
     { id: 'bad-path', prompt: 'x', max_turns: 1, fixture: { files: [{ path: '../escape.js', content: 'x' }] }, expectations: [{ type: 'trace_contains', value: 'x' }] },
     { id: 'duplicate-path', prompt: 'x', max_turns: 1, fixture: { files: [{ path: 'x.js', content: '' }, { path: 'x.js', content: '' }] }, expectations: [{ type: 'trace_contains', value: 'x' }] },
     { id: 'bad-execution', prompt: 'x', max_turns: 1, fixture: { files: [{ path: 'x.js', content: '' }] }, expectations: [{ type: 'tool_executed' }] },
+    { id: 'quality-gate-no-pattern', prompt: 'x', max_turns: 1, fixture: { files: [{ path: 'x.js', content: '' }] }, expectations: [{ type: 'tdd_quality_gate', value: { name: 'Bash' } }] },
+    { id: 'bad-command-pattern', prompt: 'x', max_turns: 1, fixture: { files: [{ path: 'x.js', content: '' }] }, expectations: [{ type: 'tool_executed', value: { command_pattern: '(' } }] },
   ];
   return controls.map(control => ({ control, errors: validateCase(control) })).filter(result => result.errors.length === 0);
 }

package/behavioral-evals/cases/baseline-tdd-workflow.yaml

@@ -26,3 +26,7 @@ expectations:
     path: "calculator.js"
     value: "divide"
     description: divide function exists
+  - type: tdd_quality_gate
+    value:
+      command_pattern: '^(?:npm (?:run|run-script) (?:(?:--silent|-s|--quiet) )*(?:tdd:quality|test:tdd-quality)|node (?:--no-warnings )?(?:[^\s;&|<>`$()]*/)?tdd/scripts/quality-gate\.js)(?: [^;&|<>`$()\n\r]*)?$'
+    description: TDD quality gate passed on retained evidence (independently re-evaluated; skill-core completion, not artifact pass)

package/behavioral-evals/run.js

@@ -150,6 +150,7 @@ function validate(cases) {
   const EXPECT_TYPES = new Set([
     'trace_contains', 'trace_not_contains', 'file_contains', 'file_not_exists', 'command_exit_0',
     'tool_call', 'tool_attempted', 'tool_completed', 'tool_executed', 'tool_denied', 'execution_evidence',
+    'tdd_quality_gate',
     'final_output_json_only',
   ]);
   for (const c of cases) {
@@ -703,6 +704,173 @@ function finalAssistantText(events) {
   return finalAssistantTextCandidates(events)[0];
 }
 
+// --- tdd_quality_gate -------------------------------------------------------
+// A completed tool call only proves the shell returned; it does not prove the
+// gate passed (exit 1 still "completes") or that auditable evidence exists.
+// The grader therefore re-evaluates the evidence the agent pointed the gate at,
+// independently and after the run, with this repository's own evaluator.
+
+function splitCommandArgs(command) {
+  const args = [];
+  const re = /"([^"]*)"|'([^']*)'|(\S+)/g;
+  let match;
+  while ((match = re.exec(command))) args.push(match[1] ?? match[2] ?? match[3]);
+  return args;
+}
+
+// Returns { evidence, output } paths named by a quality-gate command, or null
+// when the command names no evidence file.
+function qualityGateArgs(command) {
+  const args = splitCommandArgs(String(command || ''));
+  const scriptIndex = args.findIndex(arg => /(?:^|[/\\])quality-gate\.js$/.test(arg) || arg === 'tdd:quality' || arg === 'test:tdd-quality');
+  if (scriptIndex < 0) return null;
+  const rest = args.slice(scriptIndex + 1).filter(arg => arg !== '--');
+  let evidence = null;
+  let output = null;
+  for (let index = 0; index < rest.length; index++) {
+    if (rest[index] === '--output') { output = rest[index + 1] || null; index++; continue; }
+    if (rest[index].startsWith('-')) continue;
+    if (evidence === null) evidence = rest[index];
+  }
+  return { script: args[scriptIndex], evidence, output };
+}
+
+function resolveInWorkspace(ws, file) {
+  const root = path.resolve(ws);
+  const resolved = path.resolve(root, file);
+  return resolved === root || resolved.startsWith(root + path.sep) ? resolved : null;
+}
+
+// Judges what the transcript shows the gate command did. A completed status
+// alone is not enough: OpenCode reports "completed" for a gate that exited 1.
+// Returns { status: 'pass' | 'fail' | 'inconclusive', reason }.
+// Line-anchored so prose such as "avoid npm error handling" is not an error.
+const GATE_COMMAND_ERROR_RE = /^(?:npm (?:ERR!|error)(?=\s|$)|.*Missing script:)/m;
+
+function isObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function observedGateOutcome(call) {
+  const output = typeof call.output === 'string' ? call.output : '';
+  const exitCode = typeof call.exit_code === 'number' ? call.exit_code : null;
+  if (call.is_error === true) return { status: 'fail', reason: 'the tool call reported an error' };
+  if (exitCode !== null && exitCode !== 0) return { status: 'fail', reason: `the command exited with code ${exitCode}` };
+  if (GATE_COMMAND_ERROR_RE.test(output)) return { status: 'fail', reason: 'the command output reports an npm error' };
+  if (output.includes('TDD Quality Gate: FAIL')) return { status: 'fail', reason: 'the gate printed TDD Quality Gate: FAIL' };
+  if (output.includes('TDD Quality Gate: PASS')) return { status: 'pass', reason: 'the gate printed TDD Quality Gate: PASS' };
+  if (!output && exitCode === null) return { status: 'inconclusive', reason: 'quality gate command outcome is not observable in the transcript' };
+  return { status: 'inconclusive', reason: 'the gate success line TDD Quality Gate: PASS was not observed in the command output' };
+}
+
+// Key-sorted serialisation, so two reports compare equal regardless of key order.
+function stableStringify(value) {
+  if (value === undefined) return 'undefined';
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(',')}]`;
+  return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(',')}}`;
+}
+
+// Key-sorted comparison of two reports. Returns the first top-level key that
+// differs, or undefined when they are equal. Shared by the --output file and
+// the report the gate prints to stdout.
+function firstDifferingKey(actual, expected) {
+  return [...new Set([...Object.keys(actual), ...Object.keys(expected)])].sort()
+    .find(key => stableStringify(actual[key]) !== stableStringify(expected[key]));
+}
+
+// The gate CLI prints a summary, then (without --output) the full report JSON.
+// Returns that object when the output carries a parseable one, else null.
+function embeddedReport(output) {
+  const lines = String(output || '').split(/\r?\n/);
+  const start = lines.findIndex(line => line.startsWith('{'));
+  if (start < 0) return null;
+  try {
+    const value = JSON.parse(lines.slice(start).join('\n'));
+    return isObject(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+// Workspace checks: the evidence the command names must be retained, valid and
+// re-evaluate to PASS, and any report the gate wrote or printed must equal the
+// fresh re-evaluation. Definitive failures here win over the observed outcome.
+function checkRetainedGateArtifacts(call, args, ws) {
+  const fail = reason => ({ pass: false, status: 'fail', reason });
+  const evidencePath = resolveInWorkspace(ws, args.evidence);
+  if (!evidencePath) return fail(`evidence file ${args.evidence} is outside the workspace`);
+  if (!fs.existsSync(evidencePath)) return fail(`evidence file ${args.evidence} was not retained in the workspace`);
+  let evidence;
+  try { evidence = JSON.parse(fs.readFileSync(evidencePath, 'utf8')); }
+  catch (error) { return fail(`evidence file ${args.evidence} is not valid JSON (${error.message})`); }
+  const { evaluateEvidence } = require(path.join(ROOT, 'tdd', 'scripts', 'quality-gate.js'));
+  const report = evaluateEvidence(evidence);
+  if (report.result !== 'PASS') {
+    const failed = Object.entries(report.mandatoryGates || {}).filter(([, ok]) => !ok).map(([name]) => name);
+    return fail(`independent re-evaluation of ${args.evidence} is ${report.result} (gate would exit 1)${failed.length ? `; failed gates: ${failed.join(', ')}` : ''}`);
+  }
+  // Compare through JSON so the fresh report has the same shape as a retained one.
+  const expected = JSON.parse(JSON.stringify(report));
+  if (args.output) {
+    const outputPath = resolveInWorkspace(ws, args.output);
+    if (!outputPath || !fs.existsSync(outputPath)) return fail(`quality report ${args.output} was not retained in the workspace`);
+    let retained;
+    try { retained = JSON.parse(fs.readFileSync(outputPath, 'utf8')); }
+    catch (error) { return fail(`quality report ${args.output} is not valid JSON (${error.message})`); }
+    if (!isObject(retained)) return fail(`retained report ${args.output} is not a JSON object`);
+    const { required } = require(path.join(ROOT, 'tdd', 'schemas', 'quality-report.schema.json'));
+    const missing = required.filter(key => !Object.prototype.hasOwnProperty.call(retained, key));
+    if (missing.length) return fail(`retained report ${args.output} is missing required keys: ${missing.join(', ')}`);
+    // The retained file must be the full report, not a marker.
+    const differing = firstDifferingKey(retained, expected);
+    if (differing !== undefined) return fail(`retained report ${args.output} differs from re-evaluation at "${differing}"`);
+  }
+  const printed = embeddedReport(call.output);
+  if (printed) {
+    const differing = firstDifferingKey(printed, expected);
+    if (differing !== undefined) return fail(`gate output report differs from re-evaluation at "${differing}"`);
+  }
+  return { pass: true, status: 'pass', reason: `quality gate re-evaluated ${args.evidence}: PASS` };
+}
+
+function verifyQualityGateRun(call, ws) {
+  const fail = reason => ({ pass: false, status: 'fail', reason });
+  const command = call && call.input && typeof call.input === 'object' ? call.input.command : undefined;
+  const args = qualityGateArgs(command);
+  if (!args) return fail('matched command is not a TDD quality-gate invocation');
+  if (args.script === 'test:tdd-quality') return fail('test:tdd-quality runs the repository self-test, not the gate on task evidence');
+  if (!args.evidence) return fail('quality gate was run without an evidence file, so no auditable report exists');
+  const artifacts = checkRetainedGateArtifacts(call, args, ws);
+  if (!artifacts.pass) return artifacts;
+  const outcome = observedGateOutcome(call);
+  if (outcome.status === 'fail') return fail(`quality gate command failed: ${outcome.reason}`);
+  if (outcome.status === 'inconclusive') return { pass: false, status: 'inconclusive', reason: outcome.reason };
+  return artifacts;
+}
+
+// The last matching attempt is the one that counts: an agent may fix evidence and
+// re-run. Attempts are graded in transcript order, including failed, denied and
+// unresolved ones, so an earlier PASS cannot satisfy the gate once a later run
+// did not complete. A completed last run is re-verified from retained evidence.
+function gradeQualityGate(expectation, parsed, ws) {
+  const attempted = gradeExecutionEvidence({ ...expectation, type: 'tool_attempted' }, parsed);
+  if (attempted.status === 'inconclusive') return attempted;
+  if (!attempted.pass) return { pass: false, status: 'fail', reason: `quality gate not executed: ${attempted.reason}` };
+  const last = attempted.observed[attempted.observed.length - 1];
+  if (last.denied === true || last.status === 'denied') {
+    return { pass: false, status: 'fail', reason: `the last quality gate run (${last.id}) was denied; an earlier run cannot satisfy the gate` };
+  }
+  if (last.status === 'failed') {
+    return { pass: false, status: 'fail', reason: `the last quality gate run (${last.id}) failed; an earlier run cannot satisfy the gate` };
+  }
+  if (last.status === 'completed') {
+    const verdict = verifyQualityGateRun(last, ws);
+    return { pass: verdict.pass, status: verdict.status, reason: verdict.reason };
+  }
+  return { pass: false, status: 'inconclusive', reason: `the last quality gate run (${last.id}) has no observable result` };
+}
+
 function grade(c, ws, transcriptPath, engine = 'auto') {
   const parsed = parseTranscriptFile(transcriptPath, engine);
   const ordered = parseTranscriptEvents(transcriptPath);
@@ -723,6 +891,8 @@ function grade(c, ws, transcriptPath, engine = 'auto') {
           status = 'fail';
           reason = 'expected a completed edit before the matching tool execution';
         }
+      } else if (e.type === 'tdd_quality_gate') {
+        ({ pass, status, reason } = gradeQualityGate(e, parsed, ws));
       } else if (e.type === 'trace_contains' || e.type === 'trace_not_contains') {
         if (e.type === 'trace_contains' && isExecutionLikeTraceValue(e.value)) {
           status = 'inconclusive';
@@ -1078,6 +1248,8 @@ module.exports = {
   finalAssistantText,
   finalAssistantTextCandidates,
   grade,
+  GATE_COMMAND_ERROR_RE,
+  qualityGateArgs,
   parseTranscriptEvents,
   pairVerdict,
   parseSimpleYaml,

package/behavioral-evals/transcript-parser.js

@@ -28,6 +28,32 @@ function clone(value) {
   return JSON.parse(JSON.stringify(value));
 }
 
+// Observable outcome of a tool result: the text the tool printed, whether the
+// host flagged it as an error, and an exit code when the engine reports one.
+// Claude tool_result blocks carry content and is_error; OpenCode carries
+// state.output and state.metadata (merged into the result as `metadata`).
+function normalizeOutput(content) {
+  if (content === null || content === undefined) return null;
+  if (typeof content === 'string') return content;
+  if (Array.isArray(content)) {
+    const texts = content
+      .map(block => {
+        if (typeof block === 'string') return block;
+        return isObject(block) && typeof block.text === 'string' ? block.text : null;
+      })
+      .filter(text => text !== null);
+    return texts.length ? texts.join('\n') : null;
+  }
+  if (isObject(content)) return JSON.stringify(content);
+  return String(content);
+}
+
+function exitCodeOf(result) {
+  const metadata = isObject(result.metadata) ? result.metadata : {};
+  const value = [result.exit_code, result.exitCode, metadata.exit].find(item => typeof item === 'number');
+  return value;
+}
+
 function makeMetadata() {
   return {
     cost: null,
@@ -144,6 +170,9 @@ function ensureCall(context, details = {}) {
     denied: false,
     status: 'attempted',
     result_count: 0,
+    output: null,
+    is_error: null,
+    exit_code: null,
     explicitId: Boolean(suppliedId),
     anonymousKey: suppliedId ? null : anonymousKey,
   };
@@ -194,6 +223,13 @@ function addToolResult(context, details = {}, result = {}, forcedStatus) {
     call.result_count += 1;
   }
   applyStatus(call, status);
+  // Keep the latest observable outcome. A result that does not report a field
+  // leaves the earlier value alone rather than erasing it.
+  const output = normalizeOutput(content);
+  if (output !== null) call.output = output;
+  if (typeof result.is_error === 'boolean') call.is_error = result.is_error;
+  const exitCode = exitCodeOf(result);
+  if (exitCode !== undefined) call.exit_code = exitCode;
   return call;
 }
 
@@ -417,6 +453,9 @@ function publicCall(call) {
     completed: call.completed,
     denied: call.denied,
     status: call.status,
+    output: call.output ?? null,
+    is_error: call.is_error ?? null,
+    exit_code: call.exit_code ?? null,
   };
 }
 
@@ -540,6 +579,10 @@ function targetMatches(call, target) {
     if (target.id !== undefined && call.id !== target.id) return false;
     if (target.name !== undefined && call.name !== target.name) return false;
     if (target.command !== undefined && (!isObject(call.input) || !commandMatches(call.input.command, target.command))) return false;
+    // command_pattern lets one expectation accept several explicit command shapes
+    // (for example npm run tdd:quality or node tdd/scripts/quality-gate.js) with
+    // arbitrary evidence arguments; shell control operators are rejected.
+    if (target.command_pattern !== undefined && (!isObject(call.input) || typeof call.input.command !== 'string' || !new RegExp(target.command_pattern).test(call.input.command))) return false;
     if (target.input_contains !== undefined && !stableJson(call.input).includes(String(target.input_contains))) return false;
     return true;
   }

package/ci/mechanism-2s-tdd-quality.test.js

@@ -3,7 +3,7 @@ const os = require('os');
 const path = require('path');
 const { spawnSync } = require('child_process');
 const helper = require('./test-helper');
-const { evaluateEvidence } = require('../tdd/scripts/quality-gate');
+const { evaluateEvidence, quotedExpectedValue } = require('../tdd/scripts/quality-gate');
 
 console.log('\n[2s] TDD quality evidence gate (issue #58)...');
 
@@ -15,7 +15,7 @@ const classes = {
 };
 
 const scenarioCatalog = JSON.parse(fs.readFileSync(path.join(helper.root, 'tdd', 'fixtures', 'quality-scenarios.json'), 'utf8'));
-const requiredScenarios = ['PASS', 'unit profile', 'integration profile', 'weighted integration failure', 'weighted unit failure', 'NON_CONFORMANT', 'SOURCE_DEFECT', 'SOURCE_CONFLICT', 'malformed input', 'unexpected input', 'error handling', 'nondeterministic output', 'auditable N/A', 'skipped test'];
+const requiredScenarios = ['PASS', 'unit profile', 'integration profile', 'weighted integration failure', 'weighted unit failure', 'NON_CONFORMANT', 'SOURCE_DEFECT', 'SOURCE_CONFLICT', 'SOURCE_DEFECT without sourceEvidence', 'SOURCE_CONFLICT without sourceEvidence', 'SOURCE_CONFLICT node-versus-value', 'SOURCE_CONFLICT agreeing expectations', 'SOURCE_CONFLICT two-source evidence', 'SOURCE_CONFLICT relabelled expected', 'SOURCE_CONFLICT verified literal disagreement', 'SOURCE_CONFLICT unrelated assertions', 'malformed input', 'unexpected input', 'error handling', 'nondeterministic output', 'auditable N/A', 'skipped test'];
 helper.check('2s. fixture catalog covers every required outcome', requiredScenarios.every(name => scenarioCatalog.scenarios.some(scenario => scenario.name === name)));
 
 function checks(prefix, names) {
@@ -134,15 +134,158 @@ helper.check('2s. unequal repeated integration output is rejected', nondetermini
 const nonConformant = evaluate(req => { req.sourceConformance = 'NON_CONFORMANT'; });
 helper.check('2s. implementation/source mismatches fail', nonConformant.result === 'FAIL' && nonConformant.mandatoryGates.noSourceMismatch === false);
 
-const sourceDefect = evaluate(req => { req.sourceValidity = 'SOURCE_DEFECT'; req.sourceNotes = 'The approved example appears internally wrong.'; });
+const sourceDefect = evaluate(req => {
+  req.sourceValidity = 'SOURCE_DEFECT';
+  req.sourceNotes = 'The approved example appears internally wrong.';
+  req.sourceEvidence = [{ source: 'docs/example.md', assertion: 'expect(output.value).toEqual(3)', expected: 3, observed: 2 }];
+});
 helper.check('2s. source defects are reported separately without inventing a mismatch', sourceDefect.result === 'PASS' && sourceDefect.requirements[0].sourceValidity === 'SOURCE_DEFECT');
+helper.check(
+  '2s. source defect evidence is reviewer-required: an implementation mismatch alone does not validate a source defect',
+  sourceDefect.result === 'PASS' &&
+    sourceDefect.requirements[0].sourceEvidenceStatus === 'REVIEWER_REQUIRED' &&
+    !sourceDefect.errors.some(e => /sourceEvidence/.test(e))
+);
+const sourceDefectUncheckable = evaluate(req => {
+  req.sourceValidity = 'SOURCE_DEFECT';
+  req.sourceNotes = 'The approved example appears internally wrong.';
+  req.sourceEvidence = [{ source: 'docs/example.md', assertion: 'expect(output.value).toEqual(computeExpected())', expected: 3, observed: 2 }];
+});
+helper.check(
+  '2s. source defect with a non-checkable quote is REVIEWER_REQUIRED without a sourceEvidence error',
+  sourceDefectUncheckable.requirements[0].sourceEvidenceStatus === 'REVIEWER_REQUIRED' &&
+    !sourceDefectUncheckable.errors.some(e => /sourceEvidence/.test(e))
+);
+const sourceDefectNoEvidence = evaluate(req => { req.sourceValidity = 'SOURCE_DEFECT'; req.sourceNotes = 'Appears wrong.'; });
+helper.check('2s. source defects without quoted sourceEvidence are rejected', sourceDefectNoEvidence.result === 'FAIL' && sourceDefectNoEvidence.errors.some(e => /sourceEvidence/.test(e)));
 
-const sourceConflict = evaluate(req => {
+const sourceConflictAdr = { type: 'ADR', path: 'docs/adr/001.md', section: 'Contract', status: 'AUTHORITATIVE' };
+const conflictFrom = (req, sourceEvidence) => {
   req.sourceValidity = 'SOURCE_CONFLICT';
   req.sourceNotes = 'ADR-1 and SPEC-2 disagree.';
-  req.additionalSources = [{ type: 'ADR', path: 'docs/adr/001.md', section: 'Contract', status: 'AUTHORITATIVE' }];
-});
+  req.additionalSources = [clone(sourceConflictAdr)];
+  if (sourceEvidence !== undefined) req.sourceEvidence = sourceEvidence;
+};
+
+const sourceConflict = evaluate(req => conflictFrom(req, [
+  { source: 'docs/example.md', subject: 'list.head', assertion: 'expect(list.head).toEqual(1)', expected: 1, observed: { value: 1, next: null } },
+  { source: 'docs/adr/001.md', subject: 'list.head', assertion: 'expect(list.head).toBeInstanceOf(Element)', expected: 'Element', observed: { value: 1, next: null } }
+]));
 helper.check('2s. unresolved authoritative source conflicts fail', sourceConflict.result === 'FAIL' && sourceConflict.mandatoryGates.noSourceConflict === false && sourceConflict.dimensions.sourceTraceability.traced === 2);
+helper.check(
+  '2s. two-source conflict with an unreadable quote is REVIEWER_REQUIRED, not an error; only the conflict gate stays closed',
+  !sourceConflict.errors.some(e => /sourceEvidence/.test(e)) &&
+    sourceConflict.requirements[0].sourceEvidenceStatus === 'REVIEWER_REQUIRED' &&
+    Object.entries(sourceConflict.requirements[0].mandatoryGates).filter(([, passed]) => !passed).map(([name]) => name).join() === 'noSourceConflict'
+);
+
+// expected must match the literal in its quote; a relabelled expectation cannot manufacture a conflict.
+const relabelledExpected = evaluate(req => conflictFrom(req, [
+  { source: 'docs/example.md', subject: 'list.head', assertion: 'expect(list.head).toEqual(1)', expected: 1, observed: 2 },
+  { source: 'docs/adr/001.md', subject: 'list.head', assertion: 'expect(list.head).toEqual(1)', expected: 3, observed: 2 }
+]));
+helper.check('2s. an expected value that contradicts its quoted literal is rejected, not a conflict', relabelledExpected.result === 'FAIL' && relabelledExpected.errors.some(e => /expected does not match the value in the quoted assertion/.test(e)));
+
+const relabelledDefect = evaluate(req => {
+  req.sourceValidity = 'SOURCE_DEFECT';
+  req.sourceNotes = 'Appears wrong.';
+  req.sourceEvidence = [{ source: 'docs/example.md', assertion: 'expect(output.value).toEqual(3)', expected: 4, observed: 2 }];
+});
+helper.check('2s. a source defect whose expected value contradicts its quoted literal is rejected', relabelledDefect.result === 'FAIL' && relabelledDefect.errors.some(e => /expected does not match the value in the quoted assertion/.test(e)));
+
+const verifiedConflict = evaluate(req => conflictFrom(req, [
+  { source: 'docs/example.md', subject: 'list.head.value', assertion: 'expect(list.head.value).toBe(1)', expected: 1, observed: 2 },
+  { source: 'docs/adr/001.md', subject: 'list.head.value', assertion: "expect(list.head.value).toBe('1')", expected: '1', observed: 2 }
+]));
+helper.check(
+  '2s. a literal disagreement across two sources is VERIFIED; only the conflict gate stays closed',
+  !verifiedConflict.errors.some(e => /sourceEvidence/.test(e)) &&
+    verifiedConflict.requirements[0].sourceEvidenceStatus === 'VERIFIED' &&
+    Object.entries(verifiedConflict.requirements[0].mandatoryGates).filter(([, passed]) => !passed).map(([name]) => name).join() === 'noSourceConflict'
+);
+
+const checkableCases = [
+  ['expect(list.head).toEqual(1)', { checkable: true, value: 1 }],
+  ["expect(output.name).toBe('a')", { checkable: true, value: 'a' }],
+  ['assert.strictEqual(x, null)', { checkable: true, value: null }],
+  ['expect(list.items).toEqual([1,2])', { checkable: true, value: [1, 2] }],
+  ['assert.deepEqual(x, [1, 2])', { checkable: true, value: [1, 2] }],
+  ['expect(list.head).toEqual({a:1})', { checkable: false }],
+  ['expect(list.head).toBeInstanceOf(Element)', { checkable: false }],
+  ['expect(list.head).toEqual(new Element())', { checkable: false }],
+  ['the head is 1', { checkable: false }],
+  // assert.* expected value is the second argument; an optional third argument is the message.
+  ['assert.equal(x, 1, "head")', { checkable: true, value: 1 }],
+  ['assert.strictEqual(f(a, b), "z")', { checkable: true, value: 'z' }],
+  ["assert.deepStrictEqual(x, [1, 2], 'm')", { checkable: true, value: [1, 2] }],
+  ['assert.equal(x, "a,b")', { checkable: true, value: 'a,b' }],
+  ['assert.equal(x)', { checkable: false }],
+  ['assert.equal(x, 1, 2, 3)', { checkable: false }],
+  // Negated and resolved modifiers are not expected values and must stay non-checkable.
+  ['expect(x).not.toEqual(1)', { checkable: false }],
+  ['expect(x).resolves.toBe(1)', { checkable: false }],
+  // One trailing semicolon is tolerated.
+  ['expect(list.head).toEqual(1);', { checkable: true, value: 1 }]
+];
+helper.check(
+  '2s. quotedExpectedValue reads only the recognised shapes with literal values',
+  checkableCases.every(([assertion, expected]) => JSON.stringify(quotedExpectedValue(assertion)) === JSON.stringify(expected))
+);
+
+const relabelledWithSemicolon = evaluate(req => conflictFrom(req, [
+  { source: 'docs/example.md', subject: 'list.head', assertion: 'expect(list.head).toEqual(1);', expected: 1, observed: 2 },
+  { source: 'docs/adr/001.md', subject: 'list.head', assertion: 'expect(list.head).toEqual(1);', expected: 3, observed: 2 }
+]));
+helper.check('2s. a relabelled expectation with a trailing semicolon is rejected, not a conflict', relabelledWithSemicolon.result === 'FAIL' && relabelledWithSemicolon.errors.some(e => /expected does not match the value in the quoted assertion/.test(e)));
+
+const assertMessageEntry = evaluate(req => conflictFrom(req, [
+  { source: 'docs/example.md', subject: 'list.head', assertion: 'assert.equal(list.head, 1, "head")', expected: 1, observed: 2 },
+  { source: 'docs/adr/001.md', subject: 'list.head', assertion: 'assert.equal(list.head, 1, "head")', expected: 3, observed: 2 }
+]));
+helper.check(
+  '2s. an assert.* message argument is not read as the expected value; only the relabelled entry errors',
+  !assertMessageEntry.errors.some(e => /sourceEvidence\[0\]\.expected does not match/.test(e)) &&
+    assertMessageEntry.errors.some(e => /sourceEvidence\[1\]\.expected does not match the value in the quoted assertion/.test(e))
+);
+
+const conflictWithoutEvidence = evaluate(req => conflictFrom(req));
+helper.check('2s. source conflicts without quoted sourceEvidence are rejected', conflictWithoutEvidence.result === 'FAIL' && conflictWithoutEvidence.errors.some(e => /sourceEvidence/.test(e)));
+
+const nodeVersusValue = evaluate(req => conflictFrom(req, [
+  { source: 'docs/example.md', subject: 'list.head.value', assertion: 'expect(list.head.value).toEqual(1)', expected: 1, observed: { value: 1, next: null } },
+  { source: 'docs/example.md', subject: 'list.head.next.value', assertion: 'expect(list.head.next.value).toEqual(2)', expected: 2, observed: { value: 2, next: null } }
+]));
+helper.check('2s. node-versus-value conflict citing one spec is rejected as a source conflict', nodeVersusValue.result === 'FAIL' && nodeVersusValue.errors.some(e => /two distinct authoritative sources/.test(e)));
+
+const agreeingExpectations = evaluate(req => conflictFrom(req, [
+  { source: 'docs/example.md', subject: 'output.value', assertion: 'expect(output.value).toEqual(1)', expected: 1, observed: 2 },
+  { source: 'docs/adr/001.md', subject: 'output.value', assertion: 'expect(output.value).toEqual(1)', expected: 1, observed: 2 }
+]));
+helper.check('2s. mismatch with agreeing expectations is not a source conflict', agreeingExpectations.result === 'FAIL' && agreeingExpectations.errors.some(e => /disagree across sources/.test(e)));
+
+// Unequal expectations about unrelated targets in two sources are not a conflict.
+const unrelatedAssertions = evaluate(req => conflictFrom(req, [
+  { source: 'docs/example.md', subject: 'foo', assertion: 'expect(foo).toEqual(1)', expected: 1, observed: 2 },
+  { source: 'docs/adr/001.md', subject: 'bar', assertion: 'expect(bar).toEqual(3)', expected: 3, observed: 4 }
+]));
+helper.check('2s. unrelated assertions from two sources are rejected as a source conflict', unrelatedAssertions.result === 'FAIL' && unrelatedAssertions.errors.some(e => /same subject/.test(e)));
+
+// The subject must be claimed explicitly and be the target the quote constrains.
+const subjectMissing = evaluate(req => conflictFrom(req, [
+  { source: 'docs/example.md', assertion: 'expect(foo).toEqual(1)', expected: 1, observed: 2 },
+  { source: 'docs/adr/001.md', assertion: 'expect(bar).toEqual(3)', expected: 3, observed: 2 }
+]));
+helper.check('2s. source conflict evidence without a subject is rejected', subjectMissing.result === 'FAIL' && subjectMissing.errors.some(e => /subject must name the contract target/.test(e)));
+const subjectRelabelled = evaluate(req => conflictFrom(req, [
+  { source: 'docs/example.md', subject: 'foo', assertion: 'expect(foo).toEqual(1)', expected: 1, observed: 2 },
+  { source: 'docs/adr/001.md', subject: 'foo', assertion: 'expect(bar).toEqual(3)', expected: 3, observed: 2 }
+]));
+helper.check('2s. a subject absent from the quoted assertion cannot manufacture a conflict', subjectRelabelled.result === 'FAIL' && subjectRelabelled.errors.some(e => /subject must appear as a whole target/.test(e)));
+const nestedTarget = evaluate(req => conflictFrom(req, [
+  { source: 'docs/example.md', subject: 'list.head', assertion: 'expect(list.head.value).toEqual(1)', expected: 1, observed: 2 },
+  { source: 'docs/adr/001.md', subject: 'list.head', assertion: 'expect(list.head).toBeInstanceOf(Element)', expected: 'Element', observed: 2 }
+]));
+helper.check('2s. a nested property is not the same subject as its parent', nestedTarget.result === 'FAIL' && nestedTarget.errors.some(e => /subject must appear as a whole target/.test(e)));
 
 const inferred = evaluate(req => { req.source = { type: 'INFERENCE', status: 'INFERRED', inferenceBasis: 'Observed public API and user-approved acceptance criteria.' }; });
 helper.check('2s. inferred expectations remain explicit and traceable', inferred.result === 'PASS' && inferred.dimensions.sourceTraceability.percentage === 100);