phasegate 0.142.0 → 0.143.0

package/README.ja.md

@@ -86,7 +86,7 @@ claude
 - `.codex/hooks.json` — Codex CLI hooks 設定（`--agent codex|both` 時）
 - `docs/principles/*.md` — アーキテクチャ哲学・テスト規約（immutable）
 - `docs/folder_management_rules.md` — ドキュメント配置ルール（**正本**）
-- `--with-husky` を付けると `.husky/pre-commit` ・ `.husky/commit-msg` も配置
+- `--with-husky` を付けると `.husky/pre-commit` ・ `.husky/commit-msg` ・ `.husky/pre-push` も配置
 - `--with-ci` を付けると `.github/workflows/aidlc-gate.yml` ・ `.github/workflows/consistency-check.yml` ・ `.github/workflows/agent-context-refresh.yml` も配置
 
 **`init` が生成しないもの**（後で skill が作る）:
@@ -293,7 +293,7 @@ npx phasegate <command> [options]
 | `baseline` | retrofit grandfather snapshot 生成（`--dry-run`, `--force`, `--paths <glob>`, `--json`） |
 | `scaffold-design --unit <id> --phase <logical\|domain\|uiux\|unit-test\|it-test>` | 最小構成の設計文書を `templates/` から生成 |
 | `phasegate:status` | 全体の健全性サマリ |
-| `work-items:status --dry-run` / `--apply` | 成果物から WI status を導出し、必要に応じて `description.md` frontmatter を更新 |
+| `work-items:status --dry-run` / `--apply` | 成果物から WI status を導出し、必要に応じて `description.md` frontmatter を更新。`--apply` は既定で downgrade を拒否し、必要時のみ `--allow-downgrade` を指定 |
 | `phasegate:check-phase --unit <id>` | 指定 Unit の現在フェーズ |
 | `phasegate:detect-drift` | 設計-コード乖離レポート |
 | `migrate work-items --dry-run` / `--apply` | 既存リポジトリの旧 `ISSUE-XXX` / `H{NN}-{NN}` directory を WI 統一レイアウト（`_cross/{WI-XXX}/` / `{unit}/{WI-XXX}/`）へ移行。frontmatter（`type` / `severity` / `legacy_id` / `affects`）を自動注入。冪等。`--json` で CI/スクリプト連携可。詳細: [Work Item Migration](docs/guide/cli-reference.md#work-item-migration) |
@@ -305,6 +305,7 @@ npx phasegate <command> [options]
 | `list-errors --layer <L0-L4>` | エラー定義一覧 |
 | `hook <pre-tool-use\|post-tool-use\|stop>` | agent hook を起動（stdin から JSON） |
 | `pre-commit` | L2 pre-commit バリデータをステージファイルに適用 |
+| `bypass:audit --base <ref> [--head <ref>]` | push/CI range に pre-commit validation を再適用し、gate failure に structured bypass evidence を要求 |
 
 完全な CLI Reference: [CLI Reference](docs/guide/cli-reference.md)
 
@@ -407,7 +408,7 @@ TESTED (@work-item-id 付きテストあり / green)
 
 `type: chore` は DRAFTED で完結。`type: fix` は DRAFTED → REFLECTED → IMPLEMENTED の簡略パス。`status` は PhaseGate が自動更新します。
 
-`phasegate work-items:status --dry-run` で current status / derived status / reason / next action を確認できます。単一 WI に絞る場合は `--id WI-XXX`、CI 風に stale status を検出する場合は `--fail-on-stale`、`description.md` frontmatter の `status:` 行だけを書き戻す場合は `--apply` を指定します。
+`phasegate work-items:status --dry-run` で current status / derived status / reason / next action / structured missing evidence を確認できます。単一 WI に絞る場合は `--id WI-XXX`、CI 風に stale status を検出する場合は `--fail-on-stale`、`description.md` frontmatter の `status:` 行だけを書き戻す場合は `--apply` を指定します。標準 L2 validation は `L2-014 work-item-status-staleness` も実行し、stale WI status を pre-commit / CI の fail signal として扱います。
 
 詳細仕様: [`docs/folder_management_rules.md`](docs/folder_management_rules.md)
 

package/README.md

@@ -85,7 +85,7 @@ claude
 - `.claude/skills` and/or `.codex/skills` links for agent use
 - `.claude/settings.json` and/or `.codex/hooks.json` hook configuration
 - `docs/principles/*.md` and `docs/folder_management_rules.md`
-- `.husky/pre-commit` and `.husky/commit-msg` when `--with-husky` is passed
+- `.husky/pre-commit`, `.husky/commit-msg`, and `.husky/pre-push` when `--with-husky` is passed
 - `.github/workflows/aidlc-gate.yml`, `.github/workflows/consistency-check.yml`, and `.github/workflows/agent-context-refresh.yml` when `--with-ci` is passed
 
 `init` intentionally does **not** create `docs/inception/` work item directories or `docs/product/` design documents. Those are produced later by skills such as `/product-architect`, `/domain-designer`, and `/logical-designer`. That is the core contract: no design, no code.
@@ -152,7 +152,7 @@ npx phasegate update-skills
 
 | Layer | Trigger | Key Checks |
 |---|---|---|
-| L0 | AI agent runtime (`.claude/settings.json` / `.codex/hooks.json`) + Husky git hooks | PreToolUse blocks Write/Edit/Bash that violate gates; PostToolUse runs lint/format; Stop enforces ReentryGuard + `complete-check`; `.husky/pre-commit` runs `phasegate pre-commit`; `.husky/commit-msg` enforces `Work-Item: WI-XXX` trailer |
+| L0 | AI agent runtime (`.claude/settings.json` / `.codex/hooks.json`) + Husky git hooks | PreToolUse blocks Write/Edit/Bash that violate gates; PostToolUse runs lint/format; Stop enforces ReentryGuard + `complete-check`; `.husky/pre-commit` runs `phasegate pre-commit`; `.husky/commit-msg` enforces `Work-Item: WI-XXX` and bypass trailers; `.husky/pre-push` runs `phasegate bypass:audit` |
 | L1 | Editor save / `phasegate lint` | `@unit` / `@layer` metadata, layer violations, AI anti-patterns, dead code |
 | L2 | Pre-commit (also evaluated inside PreToolUse at L0) | Phase gate, metadata completeness, `@work-item-id` reflection (`L2-STORY-REFLECTION`), test quality |
 | L3 | CI/CD pipeline | Security, performance, coverage (90%/95%), requirements traceability |
@@ -247,7 +247,7 @@ TESTED  (test files annotated with @work-item-id, all green)
 
 `type: chore` ends at DRAFTED. `type: fix` shortcuts via DRAFTED → REFLECTED → IMPLEMENTED. PhaseGate auto-updates `status`.
 
-Use `phasegate work-items:status --dry-run` to inspect current status, derived status, reason, and next action. Add `--id WI-XXX` to scope the report, `--fail-on-stale` for CI-style stale status detection, or `--apply` to update only the `status:` line in each stale `description.md` frontmatter.
+Use `phasegate work-items:status --dry-run` to inspect current status, derived status, reason, next action, and structured missing evidence. Add `--id WI-XXX` to scope the report, `--fail-on-stale` for CI-style stale status detection, or `--apply` to update only the `status:` line in each stale `description.md` frontmatter. Standard L2 validation also runs `L2-014 work-item-status-staleness`; stale WI status fails `validate --layer L2` for pre-commit/CI use.
 
 Full spec: [`docs/folder_management_rules.md`](docs/folder_management_rules.md)
 
@@ -476,7 +476,7 @@ npx phasegate <command> [options]
 | `p2:check-agent-context` | Check AGENTS.md / CLAUDE.md freshness |
 | `update-skills` | Update skills to latest version |
 | `phasegate:status` | Display overall harness health summary |
-| `work-items:status --dry-run` / `--apply` | Derive WI status from artifacts and optionally update stale `description.md` frontmatter |
+| `work-items:status --dry-run` / `--apply` | Derive WI status from artifacts and optionally update stale `description.md` frontmatter. Apply refuses downgrades unless `--allow-downgrade` is supplied. |
 | `phasegate:check-phase --unit <id>` | Check current phase for a Unit |
 | `check-change-category --paths <csv>` | Classify changed files into Quick Mode categories and report whether Full Mode is required (`--format json`, `--fail-on-full-required`) |
 | `baseline` | Create `.phasegate/baseline.json` snapshot for Phase A-2 retrofit grandfather (`--dry-run`, `--force`, `--paths <glob,glob,...>`, `--json`). `baseline.enabled` defaults to `true` since v0.71.0. |
@@ -484,6 +484,7 @@ npx phasegate <command> [options]
 | `list-errors --layer <L0-L4>` | List error definitions with fix examples |
 | `hook <pre-tool-use\|post-tool-use\|stop>` | Run a Claude Code hook (reads JSON from stdin) |
 | `pre-commit` | Run L2 pre-commit validators on staged files |
+| `bypass:audit --base <ref> [--head <ref>]` | Replay pre-commit validation over a push/CI range and require structured bypass evidence for gate failures |
 | `delegate-sonnet [...args]` | Delegate task to Sonnet 4.6 (transparent wrapper) |
 | `migrate work-items --dry-run` / `--apply` | Migrate legacy `ISSUE-XXX` / `H{NN}-{NN}` directories under `docs/inception/` to the unified `WI-XXX` layout (frontmatter `type` / `legacy_id` / `affects` injected). Sequential allocator skips numbers already used by existing WIs. See [CLI Reference -- Work Item Migration](docs/guide/cli-reference.md#work-item-migration). |
 | `migrate --schema v3` | Upgrade `phasegate.config.json` to v3 schema by adding the `architecture` key (idempotent). |

package/docs/guide/layer-model.md

@@ -50,7 +50,8 @@ Deployed by `phasegate init --with-husky` into `.husky/`.
 | Hook file | Invokes | Responsibility |
 |-----------|---------|----------------|
 | **.husky/pre-commit** | `npx phasegate pre-commit` | Runs L2 validators (phase-gate / metadata / story-reflection / test-quality) on staged files. Fails the commit on violation. |
-| **.husky/commit-msg** | `npx phasegate commit-msg $1` | Enforces the `Work-Item: WI-XXX` trailer when WI directories or their contents are staged. Ensures every commit is traceable to a work item. |
+| **.husky/commit-msg** | `npx phasegate commit-msg $1` | Enforces the `Work-Item: WI-XXX` trailer when WI directories or their contents are staged, and validates structured bypass trailers when present. |
+| **.husky/pre-push** | `npx phasegate bypass:audit --base origin/main --head HEAD` | Replays pre-commit validation for the push range so commits created with `git commit --no-verify` still need complete bypass evidence before leaving the workstation. |
 
 ### About `validate --layer L0`
 

package/docs/templates/ci/aidlc-gate.yml

@@ -5,9 +5,10 @@
 #
 # 実行タイミング: Pull Request（open / synchronize / reopen）
 # 実行内容:
-#   1. harness:lint  — L1 Biome AST ルール検証
-#   2. harness:ci-check — L3 CI バリデータ（security / performance / coverage / nyquist）
-#   3. 失敗時: PR にエラーサマリーをコメント
+#   1. bypass:audit — bypass trailer / evidence 監査
+#   2. harness:lint  — L1 Biome AST ルール検証
+#   3. harness:ci-check — L3 CI バリデータ（security / performance / coverage / nyquist）
+#   4. 失敗時: PR にエラーサマリーをコメント
 
 name: AIDLC Quality Gate
 
@@ -25,6 +26,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -40,6 +43,21 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      # Bypass audit: local `git commit --no-verify` can skip hooks, but CI
+      # replays the gate over the PR range and requires structured evidence.
+      - name: Bypass Audit
+        id: bypass_audit
+        run: |
+          set +e
+          git fetch origin "${{ github.base_ref }}" --depth=1
+          RESULT=$(npx phasegate bypass:audit --base "origin/${{ github.base_ref }}" --head HEAD 2>&1)
+          EXIT_CODE=$?
+          echo "result<<EOF" >> $GITHUB_OUTPUT
+          echo "$RESULT" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+          echo "exit_code=$EXIT_CODE" >> $GITHUB_OUTPUT
+          exit $EXIT_CODE
+
       # L1: Biome AST ルール
       - name: L1 Lint (Biome AST)
         id: lint
@@ -75,11 +93,16 @@ jobs:
           script: |
             const lintResult   = `${{ steps.lint.outputs.result }}`;
             const ciResult     = `${{ steps.ci_check.outputs.result }}`;
+            const bypassResult = `${{ steps.bypass_audit.outputs.result }}`;
             const lintFailed   = '${{ steps.lint.outputs.exit_code }}' !== '0';
             const ciFailed     = '${{ steps.ci_check.outputs.exit_code }}' !== '0';
+            const bypassFailed = '${{ steps.bypass_audit.outputs.exit_code }}' !== '0';
 
             let body = '## ❌ AIDLC Quality Gate — 失敗\n\n';
 
+            if (bypassFailed) {
+              body += '### Bypass Audit エラー\n```text\n' + bypassResult + '\n```\n\n';
+            }
             if (lintFailed) {
               body += '### L1 Lint エラー\n```json\n' + lintResult + '\n```\n\n';
             }

package/docs/templates/hooks/pre-push

@@ -0,0 +1,6 @@
+#!/usr/bin/env sh
+# PhaseGate pre-push hook template.
+#
+# Audits commits that may have bypassed local hooks with `git commit --no-verify`.
+
+npx phasegate bypass:audit --base origin/main --head HEAD

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phasegate",
-  "version": "0.142.0",
+  "version": "0.143.0",
   "packageManager": "pnpm@10.30.1",
   "description": "Phasegate — AI-agnostic quality defense toolkit. Enforces structural integrity between design intent and code.",
   "license": "MIT",

package/scripts/harness/config-foundation/application/mappers/validator-system-config-mapper.ts

@@ -1,7 +1,7 @@
 /**
  * @layer application
  * @unit config-foundation
- * @work-item-id WI-092 / WI-094 / WI-033
+ * @work-item-id WI-092 / WI-094 / WI-033 / WI-140
  */
 import type { HarnessConfigV2 } from '../../domain/harness-config.js';
 
@@ -11,7 +11,7 @@ export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefi
   return {
     project: { preset: resolvedConfig.project.preset },
     layers: {
-      L2: { enabled: resolvedConfig.layers.L2.enabled, validators: ['L2-001', 'L2-002', 'L2-003', 'L2-013'] },
+      L2: { enabled: resolvedConfig.layers.L2.enabled, validators: ['L2-001', 'L2-002', 'L2-003', 'L2-013', 'L2-014'] },
       L3: { enabled: resolvedConfig.layers.L3.enabled },
       L4: { enabled: resolvedConfig.layers.L4.enabled, validators: resolvedConfig.layers.L4.validators },
     },

package/scripts/harness/integrations/pre-commit.ts

@@ -1,7 +1,7 @@
 /**
  * @unit harness-api
  * @layer presentation
- * @work-item-id WI-092
+ * @work-item-id WI-141
  *
  * Pre-commit CLI entry.
  * Runs L2 validators against staged TypeScript files AND design-document
@@ -14,8 +14,8 @@
  *   2 = runtime error
  */
 
-import { execSync } from "node:child_process";
-import { readFile } from "node:fs/promises";
+import { execFileSync, execSync } from "node:child_process";
+import { access, readFile } from "node:fs/promises";
 import { createConfigFoundationModule } from "../config-foundation/composition-root.js";
 import { toValidatorSystemConfig } from "../config-foundation/application/mappers/validator-system-config-mapper.js";
 import { createTraceabilityModelModule } from "../traceability-model/composition-root.js";
@@ -36,6 +36,9 @@ const MD_EXTENSION = ".md";
 const WORK_ITEM_PATH_PATTERN = /(?:^|\/)WI-\d+(?:\/|$)/;
 const WORK_ITEM_TRAILER_PATTERN = /^Work-Item:\s*WI-\d+\s*$/m;
 const TEST_FILE_SUFFIXES = Object.freeze([".test.ts", ".test.tsx", ".spec.ts", ".spec.tsx"]);
+const BYPASS_TRAILER_NAMES = Object.freeze(["Bypass-Reason", "Bypass-Evidence", "Bypass-Owner"]);
+const OPTIONAL_BYPASS_TRAILER_NAMES = Object.freeze(["Bypass-Report"]);
+const NON_BYPASSABLE_VALIDATOR_IDS = Object.freeze(["L2-002", "L2-003", "L2-014"]);
 
 function isConfigNotFoundError(err: unknown): boolean {
   return err instanceof Error && err.name === "ConfigNotFoundError";
@@ -184,6 +187,7 @@ export interface PreCommitDeps {
 export interface PreCommitResult {
   readonly exitCode: 0 | 1 | 2;
   readonly stdout: string;
+  readonly blockerClasses: readonly BypassBlockerClass[];
 }
 
 export interface PreCommitOptions {
@@ -194,6 +198,28 @@ export interface PreCommitOptions {
    */
   readonly commitMessage?: string;
   readonly implementationExtensions?: readonly string[];
+  readonly allowConditionalBypass?: boolean;
+  readonly evidenceRoot?: string;
+}
+
+export interface BypassBlockerClass {
+  readonly code: string;
+  readonly label: string;
+  readonly bypassable: boolean;
+}
+
+export interface BypassTrailerValidationResult {
+  readonly hasAnyBypassTrailer: boolean;
+  readonly complete: boolean;
+  readonly errors: readonly string[];
+}
+
+export interface BypassAuditOptions {
+  readonly baseRef?: string;
+  readonly headRef?: string;
+  readonly commitMessages?: readonly string[];
+  readonly changedFiles?: readonly string[];
+  readonly evidenceRoot?: string;
 }
 
 function getStagedFiles(): string[] {
@@ -248,6 +274,95 @@ function hasWorkItemTrailer(commitMessage: string): boolean {
   return WORK_ITEM_TRAILER_PATTERN.test(commitMessage);
 }
 
+function extractTrailer(commitMessage: string, trailerName: string): string | undefined {
+  const pattern = new RegExp(`^${trailerName}:\\s*(.+?)\\s*$`, "m");
+  return pattern.exec(commitMessage)?.[1]?.trim();
+}
+
+function hasTrailer(commitMessage: string, trailerName: string): boolean {
+  return extractTrailer(commitMessage, trailerName) !== undefined;
+}
+
+function isPathLikeEvidence(value: string): boolean {
+  return value.startsWith("report:");
+}
+
+function evidencePath(value: string): string {
+  return value.slice("report:".length).trim();
+}
+
+async function pathExists(path: string, root = process.cwd()): Promise<boolean> {
+  try {
+    const { resolve } = await import("node:path");
+    await access(resolve(root, path));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function validateBypassTrailers(
+  commitMessage: string,
+  evidenceRoot = process.cwd(),
+): Promise<BypassTrailerValidationResult> {
+  const allTrailerNames = [...BYPASS_TRAILER_NAMES, ...OPTIONAL_BYPASS_TRAILER_NAMES];
+  const hasAnyBypassTrailer = allTrailerNames.some((name) => hasTrailer(commitMessage, name));
+  if (!hasAnyBypassTrailer) {
+    return { hasAnyBypassTrailer: false, complete: false, errors: [] };
+  }
+
+  const errors: string[] = [];
+  for (const name of BYPASS_TRAILER_NAMES) {
+    if (!hasTrailer(commitMessage, name)) {
+      errors.push(`Missing required bypass trailer: ${name}`);
+    }
+  }
+
+  const evidence = extractTrailer(commitMessage, "Bypass-Evidence");
+  if (evidence !== undefined) {
+    if (evidence.startsWith("command:")) {
+      const command = evidence.slice("command:".length).trim();
+      if (command.length === 0) {
+        errors.push("Bypass-Evidence command must not be empty.");
+      }
+    } else if (isPathLikeEvidence(evidence)) {
+      const reportPath = evidencePath(evidence);
+      if (reportPath.length === 0) {
+        errors.push("Bypass-Evidence report path must not be empty.");
+      } else if (!(await pathExists(reportPath, evidenceRoot))) {
+        errors.push(`Bypass-Evidence report does not exist: ${reportPath}`);
+      }
+    } else {
+      errors.push("Bypass-Evidence must start with command: or report:.");
+    }
+  }
+
+  const report = extractTrailer(commitMessage, "Bypass-Report");
+  if (report !== undefined && !(await pathExists(report, evidenceRoot))) {
+    errors.push(`Bypass-Report does not exist: ${report}`);
+  }
+
+  return { hasAnyBypassTrailer: true, complete: errors.length === 0, errors };
+}
+
+function classifyValidatorFailure(result: ValidationResultContract): BypassBlockerClass | undefined {
+  if (result.passed || result.skipped) return undefined;
+  const nonBypassable = NON_BYPASSABLE_VALIDATOR_IDS.includes(result.validatorId);
+  return {
+    code: result.validatorId,
+    label: result.validatorId === "L2-003" ? "test-quality" : result.validatorId,
+    bypassable: !nonBypassable,
+  };
+}
+
+function metadataBlocker(): BypassBlockerClass {
+  return { code: "metadata", label: "metadata", bypassable: false };
+}
+
+function hasNonBypassableBlocker(blockers: readonly BypassBlockerClass[]): boolean {
+  return blockers.some((blocker) => !blocker.bypassable);
+}
+
 function normalizeImplementationExtensions(extensions: readonly string[] | undefined): readonly string[] {
   const rawExtensions = extensions === undefined || extensions.length === 0
     ? DEFAULT_IMPLEMENTATION_EXTENSIONS
@@ -274,6 +389,7 @@ export async function runPreCommit(
     return {
       exitCode: 0,
       stdout: `${DIM}[phasegate] No staged files to check. Skipping.${RESET}`,
+      blockerClasses: [],
     };
   }
 
@@ -284,6 +400,7 @@ export async function runPreCommit(
   );
 
   let exitCode: 0 | 1 | 2 = 0;
+  const blockerClasses: BypassBlockerClass[] = [];
 
   if (implementationFiles.length > 0) {
     // staged TS file を Unit ごとにグルーピングし、Unit 単位で L2 phase gate
@@ -311,6 +428,10 @@ export async function runPreCommit(
     }
 
     const merged = mergePerUnitResults(runs);
+    blockerClasses.push(...merged.flatMap((result) => {
+      const blocker = classifyValidatorFailure(result);
+      return blocker === undefined ? [] : [blocker];
+    }));
     const report = buildReport(merged);
     sections.push("");
     sections.push(`${BOLD}== 実装ファイル (${implementationFiles.length} file(s)) ==${RESET}`);
@@ -328,6 +449,9 @@ export async function runPreCommit(
     sections.push(`${BOLD}== 設計 / テスト メタデータ注釈 (${metadataFiles.length} file(s)) ==${RESET}`);
     sections.push(metadataResult.text);
     exitCode = maxExitCode(exitCode, metadataResult.exitCode);
+    if (metadataResult.exitCode !== 0) {
+      blockerClasses.push(metadataBlocker());
+    }
   }
 
   if (options.commitMessage !== undefined && requiresWorkItemTrailer(stagedFiles)) {
@@ -343,6 +467,29 @@ export async function runPreCommit(
     }
   }
 
+  if (options.commitMessage !== undefined) {
+    const bypassValidation = await validateBypassTrailers(options.commitMessage, options.evidenceRoot);
+    if (bypassValidation.hasAnyBypassTrailer) {
+      sections.push("");
+      sections.push(`${BOLD}== Bypass audit ==${RESET}`);
+      if (!bypassValidation.complete) {
+        for (const error of bypassValidation.errors) {
+          sections.push(`${RED}FAIL${RESET} ${error}`);
+        }
+        exitCode = maxExitCode(exitCode, 1);
+      } else if (hasNonBypassableBlocker(blockerClasses)) {
+        const labels = blockerClasses.filter((blocker) => !blocker.bypassable).map((blocker) => blocker.label);
+        sections.push(`${RED}FAIL${RESET} Bypass rejected for non-bypassable blocker(s): ${labels.join(", ")}`);
+        exitCode = maxExitCode(exitCode, 1);
+      } else if (exitCode !== 0 && options.allowConditionalBypass === true) {
+        sections.push(`${GREEN}PASS${RESET} Conditional bypass evidence is complete.`);
+        exitCode = 0;
+      } else {
+        sections.push(`${GREEN}PASS${RESET} Bypass trailers are complete.`);
+      }
+    }
+  }
+
   sections.push("");
   if (exitCode === 0) {
     sections.push(`${GREEN}[phasegate]${RESET} All checks passed.`);
@@ -353,6 +500,72 @@ export async function runPreCommit(
   return {
     exitCode,
     stdout: sections.join("\n"),
+    blockerClasses,
+  };
+}
+
+function getChangedFilesInRange(baseRef: string, headRef: string): string[] {
+  try {
+    const output = execFileSync("git", ["diff", "--name-only", "--diff-filter=ACM", `${baseRef}..${headRef}`], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+    return output.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+  } catch {
+    return [];
+  }
+}
+
+function getCommitMessagesInRange(baseRef: string, headRef: string): string[] {
+  try {
+    const output = execFileSync("git", ["log", "--format=%B%x1e", `${baseRef}..${headRef}`], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+    return output.split("\x1e").map((message) => message.trim()).filter((message) => message.length > 0);
+  } catch {
+    return [];
+  }
+}
+
+function hasCompleteBypassTrailerSet(results: readonly BypassTrailerValidationResult[]): boolean {
+  return results.some((result) => result.hasAnyBypassTrailer && result.complete);
+}
+
+export async function runBypassAudit(
+  deps: PreCommitDeps,
+  options: BypassAuditOptions = {},
+): Promise<PreCommitResult> {
+  const baseRef = options.baseRef ?? "origin/main";
+  const headRef = options.headRef ?? "HEAD";
+  const changedFiles = options.changedFiles ?? getChangedFilesInRange(baseRef, headRef);
+  const commitMessages = options.commitMessages ?? getCommitMessagesInRange(baseRef, headRef);
+  const syntheticCommitMessage = commitMessages.join("\n\n");
+
+  const result = await runPreCommit(changedFiles, deps, {
+    commitMessage: syntheticCommitMessage,
+    allowConditionalBypass: true,
+    evidenceRoot: options.evidenceRoot,
+  });
+  const bypassResults = await Promise.all(
+    commitMessages.map((message) => validateBypassTrailers(message, options.evidenceRoot)),
+  );
+
+  const sections = [
+    `${BOLD}[phasegate]${RESET} Bypass audit (${baseRef}..${headRef})`,
+    result.stdout,
+  ];
+  let exitCode = result.exitCode;
+  if (result.exitCode !== 0 && !hasCompleteBypassTrailerSet(bypassResults)) {
+    sections.push("");
+    sections.push(`${RED}FAIL${RESET} Gate failure requires complete bypass trailers.`);
+    exitCode = 1;
+  }
+
+  return {
+    exitCode,
+    stdout: sections.join("\n"),
+    blockerClasses: result.blockerClasses,
   };
 }
 
@@ -410,6 +623,41 @@ export async function runCommitMsgCli(commitMessagePath: string | undefined): Pr
       {
         commitMessage,
         implementationExtensions: await loadPreCommitImplementationExtensions(),
+        evidenceRoot: process.cwd(),
+      },
+    );
+
+    process.stdout.write(`${result.stdout}\n`);
+    process.exit(result.exitCode);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`${RED}[phasegate] Unexpected error:${RESET} ${msg}\n`);
+    process.exit(2);
+  }
+}
+
+function parseCliFlag(args: readonly string[], flag: string): string | undefined {
+  const index = args.indexOf(flag);
+  if (index === -1 || index + 1 >= args.length) return undefined;
+  return args[index + 1];
+}
+
+export async function runBypassAuditCli(args: readonly string[] = []): Promise<void> {
+  try {
+    const validatorMod = createValidatorSystemModule(await loadValidatorSystemConfig());
+    const traceabilityMod = createTraceabilityModelModule(
+      process.cwd(),
+      await loadTraceabilityModelOptions(),
+    );
+    const result = await runBypassAudit(
+      {
+        runL2ValidatorsUseCase: validatorMod.runL2ValidatorsUseCase,
+        validateMetadataCommandHandler: traceabilityMod.validateMetadataCommandHandler,
+      },
+      {
+        baseRef: parseCliFlag(args, "--base"),
+        headRef: parseCliFlag(args, "--head"),
+        evidenceRoot: process.cwd(),
       },
     );
 

package/scripts/harness/main.ts

@@ -46,6 +46,7 @@ import {
   deployHookScripts,
   deployHuskyCommitMsgHook,
   deployHuskyHook,
+  deployHuskyPrePushHook,
   deploySkills,
   getCategoryForSkill,
   getDeployedVersion,
@@ -154,6 +155,7 @@ Commands:
   hook <pre-tool-use|post-tool-use|stop|session-start|user-prompt-submit>  Run agent hook (reads JSON from stdin; writes JSON to stdout for session-start/user-prompt-submit)
   pre-commit                              Run L2 pre-commit validators on staged files
   commit-msg <message-file>               Validate commit message trailers against staged files
+  bypass:audit --base <ref> [--head <ref>] Audit bypass evidence for a push/CI commit range
   delegate-sonnet [...args]               Delegate task to Sonnet 4.6 (forwards args to scripts/delegate-sonnet.sh)
 
 Skills:
@@ -316,6 +318,8 @@ Options:
   --apply           Update only the status line in each stale description.md frontmatter.
   --id <WI-XXX>     Limit report/apply to one work item.
   --fail-on-stale   Return exit code 1 when dry-run finds stale status.
+  --allow-downgrade Allow apply to lower a frontmatter status.
+  --changed-only    Reserve apply scope for changed WI files; currently accepted as a no-op policy flag.
   --json            Output machine-readable JSON.
   --help, -h        Show this help`,
   "phasegate:detect-drift": `Usage: phasegate phasegate:detect-drift [options]
@@ -716,6 +720,7 @@ async function main(): Promise<void> {
         const withHusky = hasFlag(args, "--with-husky");
         const huskyResult = withHusky ? await deployHuskyHook(harnessRoot, rootDir) : null;
         const huskyCommitMsgResult = withHusky ? await deployHuskyCommitMsgHook(harnessRoot, rootDir) : null;
+        const huskyPrePushResult = withHusky ? await deployHuskyPrePushHook(harnessRoot, rootDir) : null;
         const ciWorkflowResult = withCi ? await deployCiWorkflows(harnessRoot, rootDir) : null;
         console.log(
           `✓ Skills deployed to ${result.targetDir} (${result.deployedSkills.length} skills, set: ${skillSet})`,
@@ -781,6 +786,13 @@ async function main(): Promise<void> {
             console.log(`  .husky/commit-msg already exists, skipped`);
           }
         }
+        if (huskyPrePushResult !== null) {
+          if (huskyPrePushResult.created) {
+            console.log(`✓ .husky/pre-push deployed`);
+          } else {
+            console.log(`  .husky/pre-push already exists, skipped`);
+          }
+        }
         if (ciWorkflowResult !== null) {
           if (ciWorkflowResult.copiedFiles.length > 0) {
             console.log(`✓ CI workflows deployed (${ciWorkflowResult.copiedFiles.length} files)`);
@@ -983,6 +995,8 @@ async function main(): Promise<void> {
           dryRun: hasFlag(args, "--dry-run"),
           apply: hasFlag(args, "--apply"),
           failOnStale: hasFlag(args, "--fail-on-stale"),
+          allowDowngrade: hasFlag(args, "--allow-downgrade"),
+          changedOnly: hasFlag(args, "--changed-only"),
           id: parseFlag(args, "--id"),
           json,
         });
@@ -1583,6 +1597,15 @@ Examples:
         break;
       }
 
+      case "bypass:audit": {
+        const preCommitPath = join(harnessRoot, "scripts/harness/integrations/pre-commit.js");
+        const preCommitMod = (await import(preCommitPath)) as {
+          runBypassAuditCli: (args: readonly string[]) => Promise<void>;
+        };
+        await preCommitMod.runBypassAuditCli(args.slice(1));
+        break;
+      }
+
       case "delegate-sonnet": {
         const { spawn } = await import("node:child_process");
         const scriptPath = join(harnessRoot, "scripts/delegate-sonnet.sh");

package/scripts/harness/quick-mode/domain/value-objects/validator-relaxation-profile.ts

@@ -1,11 +1,12 @@
 /**
  * @layer domain
  * @unit quick-mode
+ * @work-item-id WI-140
  *
  * Quick Mode時のバリデータ実行構成を表す値オブジェクト
  */
 
-const L2_IDS = ['L2-001', 'L2-002', 'L2-003'] as const;
+const L2_IDS = ['L2-001', 'L2-002', 'L2-003', 'L2-014'] as const;
 const L3_IDS = ['L3-001', 'L3-002', 'L3-003', 'L3-004'] as const;
 
 type L2Id = (typeof L2_IDS)[number];
@@ -48,7 +49,7 @@ export class ValidatorRelaxationProfile {
     return new ValidatorRelaxationProfile({
       levelDependencyRelaxed: false,
       l1: { all: true },
-      l2: { maintained: ['L2-002', 'L2-003'], skipped: ['L2-001'] },
+      l2: { maintained: ['L2-002', 'L2-003', 'L2-014'], skipped: ['L2-001'] },
       l3: { maintained: ['L3-001'], skipped: ['L3-002', 'L3-003', 'L3-004'] },
       l4: { all: false },
       phaseExecution: { twoPhaseRequired: false },
@@ -65,7 +66,7 @@ export class ValidatorRelaxationProfile {
   }): ValidatorRelaxationProfile {
     const { l2, l3 } = params;
 
-    // INV-P5: l2.maintained ∪ l2.skipped = {L2-001, L2-002, L2-003}
+    // INV-P5: l2.maintained ∪ l2.skipped = {L2-001, L2-002, L2-003, L2-014}
     const l2Union = [...l2.maintained, ...l2.skipped].sort();
     const l2Expected = [...L2_IDS].sort();
     if (JSON.stringify(l2Union) !== JSON.stringify(l2Expected)) {

package/scripts/harness/quick-mode/infrastructure/adapters/harness-config-quick-mode-config-adapter.ts

@@ -1,6 +1,7 @@
 /**
  * @layer infrastructure
  * @unit quick-mode
+ * @work-item-id WI-140
  *
  * phasegate.config.json から QuickModeConfig を取得する Adapter
  */
@@ -25,7 +26,7 @@ export class HarnessConfigParseError extends Error {
 
 const DEFAULT_QUICK_MODE_CONFIG = {
   allowedCategories: ['bugfix', 'docs', 'test', 'config'],
-  maintainedLayers: ['L1', 'L2-002', 'L2-003', 'L3-001'],
+  maintainedLayers: ['L1', 'L2-002', 'L2-003', 'L2-014', 'L3-001'],
   relaxedGates: ['L2-001', 'L3-002', 'L3-003', 'L3-004', 'L4'],
 };
 

package/scripts/harness/quick-mode/infrastructure/adapters/validator-system-validator-id-registry-adapter.ts

@@ -1,13 +1,14 @@
 /**
  * @layer infrastructure
  * @unit quick-mode
+ * @work-item-id WI-140
  *
  * integration_contract.md §9 の確定ID一覧を静的定義で保持する ValidatorIdRegistry Adapter
  */
 
 const STATIC_VALIDATOR_IDS: readonly string[] = Object.freeze([
   'L1-001', 'L1-002', 'L1-003', 'L1-004', 'L1-005', 'L1-006', 'L1-007', 'L1-008',
-  'L2-001', 'L2-002', 'L2-003',
+  'L2-001', 'L2-002', 'L2-003', 'L2-014',
   'L3-001', 'L3-002', 'L3-003', 'L3-004',
   'L4-001', 'L4-002', 'L4-003', 'L4-004', 'L4-005',
 ]);

package/scripts/harness/setup/skill-deployer.ts

@@ -617,6 +617,25 @@ export async function deployHuskyCommitMsgHook(
   return { created: true, path: targetPath };
 }
 
+export async function deployHuskyPrePushHook(
+  harnessRoot: string,
+  projectRoot: string,
+): Promise<DeployHuskyHookResult> {
+  const targetPath = join(projectRoot, ".husky", "pre-push");
+
+  try {
+    await fs.access(targetPath);
+    return { created: false, path: targetPath };
+  } catch {}
+
+  const sourcePath = join(harnessRoot, "docs", "templates", "hooks", "pre-push");
+  await fs.mkdir(join(projectRoot, ".husky"), { recursive: true });
+  await fs.copyFile(sourcePath, targetPath);
+  await fs.chmod(targetPath, 0o755);
+
+  return { created: true, path: targetPath };
+}
+
 export interface DeployCodexHooksResult {
   created: boolean;
   path: string;

package/scripts/harness/traceability-model/application/usecases/apply-work-item-status-usecase.ts

@@ -1,10 +1,11 @@
 // @unit traceability-model
 // @layer application
-// @work-item-id WI-126
+// @work-item-id WI-126 / WI-140
 
 import type { WorkItemStatusPort } from "../../domain/ports/work-item-status-port.js";
-import type { WorkItemStatusApplyResult } from "../../domain/value-objects/work-item-status-report.js";
+import type { WorkItemStatusApplyResult, WorkItemStatusReport } from "../../domain/value-objects/work-item-status-report.js";
 import type { DeriveWorkItemStatusUseCase } from "./derive-work-item-status-usecase.js";
+import type { WorkItemStatus } from "../../domain/value-objects/work-item-frontmatter.js";
 
 export interface ApplyWorkItemStatusUseCaseDeps {
   readonly deriveWorkItemStatusUseCase: Pick<DeriveWorkItemStatusUseCase, "execute">;
@@ -20,11 +21,35 @@ export class ApplyWorkItemStatusUseCase {
     this.workItemStatusPort = deps.workItemStatusPort;
   }
 
-  async execute(input: { readonly id?: string } = {}): Promise<WorkItemStatusApplyResult> {
+  async execute(input: { readonly id?: string; readonly allowDowngrade?: boolean; readonly changedOnly?: boolean } = {}): Promise<WorkItemStatusApplyResult> {
     const reports = await this.deriveWorkItemStatusUseCase.execute();
     const targetReports = input.id
       ? reports.filter((report) => report.id === input.id)
       : reports;
-    return this.workItemStatusPort.applyDerivedStatuses(targetReports);
+    const blocked = input.allowDowngrade ? [] : targetReports.filter((report) => this.isDowngrade(report));
+    const allowed = input.allowDowngrade ? targetReports : targetReports.filter((report) => !this.isDowngrade(report));
+    const result = await this.workItemStatusPort.applyDerivedStatuses(allowed);
+    return Object.freeze({
+      updated: result.updated,
+      unchanged: result.unchanged,
+      blocked: Object.freeze([...result.blocked, ...blocked]),
+    });
   }
+
+  private isDowngrade(report: WorkItemStatusReport): boolean {
+    if (!report.stale) return false;
+    return statusOrder(report.derivedStatus) < statusOrder(report.currentStatus);
+  }
+}
+
+const STATUS_ORDER: Record<WorkItemStatus, number> = {
+  drafted: 0,
+  reflected: 1,
+  implemented: 2,
+  tested: 3,
+  completed: 3,
+};
+
+function statusOrder(status: WorkItemStatus): number {
+  return STATUS_ORDER[status];
 }

package/scripts/harness/traceability-model/domain/services/work-item-status-derivation-service.ts

@@ -1,6 +1,6 @@
 // @unit traceability-model
 // @layer domain
-// @work-item-id WI-126
+// @work-item-id WI-126 / WI-140
 
 import type { WorkItemStatus } from "../value-objects/work-item-frontmatter.js";
 import type {
@@ -34,10 +34,18 @@ export class WorkItemStatusDerivationService {
       nextAction,
       evidence: Object.freeze({
         hasRequiredInceptionArtifacts: this.hasRequiredInceptionArtifacts(input),
+        missingInceptionArtifacts: Object.freeze([...this.missingInceptionArtifacts(input)]),
         reflectedUnits: Object.freeze([...this.reflectedUnits(input)]),
         missingReflectionUnits: Object.freeze([...this.missingReflectionUnits(input)]),
         implementationPaths: Object.freeze([...input.implementationPaths]),
         testPaths: Object.freeze([...input.testPaths]),
+        missingImplementation: this.missingImplementation(input),
+        missingTests: this.missingTests(input),
+        validation: Object.freeze({
+          state: "not-run" as const,
+          source: "work-items:status",
+          blockingValidation: Object.freeze([]),
+        }),
       }),
     });
   }
@@ -56,10 +64,10 @@ export class WorkItemStatusDerivationService {
       return "drafted";
     }
 
+    if (!reflected) return "drafted";
+    if (!implemented) return "reflected";
     if (tested) return "tested";
-    if (implemented) return "implemented";
-    if (reflected) return "reflected";
-    return "drafted";
+    return "implemented";
   }
 
   private reasonFor(input: WorkItemStatusInput, status: WorkItemStatus): string {
@@ -114,6 +122,14 @@ export class WorkItemStatusDerivationService {
     return input.affectedUnits.filter((unit) => !reflected.has(unit));
   }
 
+  private missingImplementation(input: WorkItemStatusInput): boolean {
+    return input.frontmatter.type !== "chore" && this.missingReflectionUnits(input).length === 0 && input.implementationPaths.length === 0;
+  }
+
+  private missingTests(input: WorkItemStatusInput): boolean {
+    return input.frontmatter.type !== "chore" && input.frontmatter.type !== "fix" && input.implementationPaths.length > 0 && input.testPaths.length === 0;
+  }
+
   private extractConstructionUnit(filePath: string): string | null {
     const match = /^docs\/product\/construction\/([^/]+)\//.exec(filePath);
     return match?.[1] ?? null;

package/scripts/harness/traceability-model/domain/value-objects/work-item-status-report.ts

@@ -1,6 +1,6 @@
 // @unit traceability-model
 // @layer domain
-// @work-item-id WI-126
+// @work-item-id WI-126 / WI-140
 
 import type {
   WorkItemFrontmatter,
@@ -10,10 +10,18 @@ import type {
 
 export interface WorkItemStatusEvidence {
   readonly hasRequiredInceptionArtifacts: boolean;
+  readonly missingInceptionArtifacts: readonly string[];
   readonly reflectedUnits: readonly string[];
   readonly missingReflectionUnits: readonly string[];
   readonly implementationPaths: readonly string[];
   readonly testPaths: readonly string[];
+  readonly missingImplementation: boolean;
+  readonly missingTests: boolean;
+  readonly validation: {
+    readonly state: "passed" | "failed" | "not-run";
+    readonly source: string;
+    readonly blockingValidation: readonly string[];
+  };
 }
 
 export interface WorkItemStatusInput {
@@ -44,4 +52,5 @@ export interface WorkItemStatusReport {
 export interface WorkItemStatusApplyResult {
   readonly updated: readonly WorkItemStatusReport[];
   readonly unchanged: readonly WorkItemStatusReport[];
+  readonly blocked: readonly WorkItemStatusReport[];
 }

package/scripts/harness/traceability-model/infrastructure/gateways/file-system-work-item-status-gateway.ts

@@ -1,6 +1,6 @@
 // @unit traceability-model
 // @layer infrastructure
-// @work-item-id WI-126
+// @work-item-id WI-126 / WI-140
 
 import { readdir, readFile, writeFile } from "node:fs/promises";
 import * as path from "node:path";
@@ -97,6 +97,7 @@ export class FileSystemWorkItemStatusGateway implements WorkItemStatusPort {
     return Object.freeze({
       updated: Object.freeze(updated),
       unchanged: Object.freeze(unchanged),
+      blocked: Object.freeze([]),
     });
   }
 

package/scripts/harness/traceability-model/presentation/cli/work-item-status-command-handler.ts

@@ -1,6 +1,6 @@
 // @unit traceability-model
 // @layer presentation
-// @work-item-id WI-126
+// @work-item-id WI-126 / WI-140
 
 import type { ApplyWorkItemStatusUseCase } from "../../application/usecases/apply-work-item-status-usecase.js";
 import type { DeriveWorkItemStatusUseCase } from "../../application/usecases/derive-work-item-status-usecase.js";
@@ -14,6 +14,8 @@ export interface WorkItemStatusCommandInput {
   readonly apply?: boolean;
   readonly json?: boolean;
   readonly failOnStale?: boolean;
+  readonly allowDowngrade?: boolean;
+  readonly changedOnly?: boolean;
   readonly id?: string;
 }
 
@@ -54,10 +56,14 @@ export class WorkItemStatusCommandHandler {
     }
 
     if (input.apply) {
-      const result = await this.applyWorkItemStatusUseCase.execute({ id: input.id });
-      const reports = Object.freeze([...result.updated, ...result.unchanged]);
+      const result = await this.applyWorkItemStatusUseCase.execute({
+        id: input.id,
+        allowDowngrade: input.allowDowngrade,
+        changedOnly: input.changedOnly,
+      });
+      const reports = Object.freeze([...result.updated, ...result.unchanged, ...result.blocked]);
       return Object.freeze({
-        exitCode: 0,
+        exitCode: result.blocked.length > 0 ? 1 : 0,
         text: input.json ? JSON.stringify(result, null, 2) : this.formatApply(result),
         reports,
       });
@@ -97,6 +103,9 @@ export class WorkItemStatusCommandHandler {
     if (result.updated.length === 0) {
       lines.push("no updates required");
     }
+    for (const report of result.blocked) {
+      lines.push(`blocked ${report.id}: ${report.currentStatus} -> ${report.derivedStatus} requires --allow-downgrade`);
+    }
     lines.push(`unchanged: ${result.unchanged.length}`);
     return lines.join("\n");
   }

package/scripts/harness/validator-system/application/mappers/validation-result-contract-mapper.ts

@@ -12,12 +12,16 @@ export class ValidationResultContractMapper {
     return {
       validatorId: result.validatorId.value,
       passed: result.passed,
-      errors: result.errors.map((e) => ({
-        code: typeof e.code === 'string' ? e.code : e.code.toString(),
-        severity: typeof e.severity === 'string' ? e.severity : e.severity.toString(),
+      errors: result.errors.map((e) => {
+        const { code, severity, message, suggestion, ...details } = e;
+        return {
+        ...details,
+        code: typeof code === 'string' ? code : code.toString(),
+        severity: typeof severity === 'string' ? severity : severity.toString(),
         message: e.message,
         suggestion: e.suggestion,
-      })),
+        };
+      }),
       durationMs: result.durationMs,
       skipped: result.skipped,
     };

package/scripts/harness/validator-system/application/use-cases/run-l2-validators-usecase.ts

@@ -3,6 +3,7 @@
  * @unit validator-system
  *
  * RunL2ValidatorsUseCase — H08-01: L2バリデータ実行
+ * @work-item-id WI-140
  */
 import { readFile } from 'node:fs/promises';
 import { ValidatorId, InvalidValidatorIdError } from '../../domain/value-objects/validator-id.js';
@@ -19,6 +20,7 @@ import type { TestQualityAnalyzerPort } from '../../domain/ports/test-quality-an
 import type { CliCommandRegistryPort } from '../../domain/ports/cli-command-registry-port.js';
 import type { E2eTestFileRegistryPort } from '../../domain/ports/e2e-test-file-registry-port.js';
 import { CliE2eTestExistenceService } from '../../domain/services/cli-e2e-test-existence-service.js';
+import type { WorkItemStatusPolicyPort } from '../../domain/ports/work-item-status-policy-port.js';
 
 export interface RunL2ValidatorsUseCaseDeps {
   validatorRegistry: ValidatorRegistry;
@@ -30,6 +32,7 @@ export interface RunL2ValidatorsUseCaseDeps {
   testQualityAnalyzerPort?: TestQualityAnalyzerPort;
   cliCommandRegistryPort?: CliCommandRegistryPort;
   e2eTestFileRegistryPort?: E2eTestFileRegistryPort;
+  workItemStatusPolicyPort?: WorkItemStatusPolicyPort;
 }
 
 export class RunL2ValidatorsUseCase {
@@ -42,6 +45,7 @@ export class RunL2ValidatorsUseCase {
   private readonly testQualityAnalyzerPort?: TestQualityAnalyzerPort;
   private readonly cliCommandRegistryPort?: CliCommandRegistryPort;
   private readonly e2eTestFileRegistryPort?: E2eTestFileRegistryPort;
+  private readonly workItemStatusPolicyPort?: WorkItemStatusPolicyPort;
   private readonly cliE2eTestExistenceService = new CliE2eTestExistenceService();
 
   constructor(deps: RunL2ValidatorsUseCaseDeps) {
@@ -54,6 +58,7 @@ export class RunL2ValidatorsUseCase {
     this.testQualityAnalyzerPort = deps.testQualityAnalyzerPort;
     this.cliCommandRegistryPort = deps.cliCommandRegistryPort;
     this.e2eTestFileRegistryPort = deps.e2eTestFileRegistryPort;
+    this.workItemStatusPolicyPort = deps.workItemStatusPolicyPort;
   }
 
   async execute(input: RunL2ValidatorsInput): Promise<readonly ValidationResultContract[]> {
@@ -152,6 +157,29 @@ export class RunL2ValidatorsUseCase {
       }
     }
 
+    if (this.workItemStatusPolicyPort) {
+      const l2014Result = overrideMap.get('L2-014');
+      if (l2014Result && !l2014Result.skipped) {
+        const staleReports = await this.workItemStatusPolicyPort.findStaleReports(input.targetPaths);
+        if (staleReports.length > 0) {
+          const errors = staleReports.map((report) => ({
+            code: { value: 'L2-014', toString: () => 'L2-014' },
+            severity: { value: 'error', toString: () => 'error' },
+            message: `${report.id} status is stale: current=${report.currentStatus}, derived=${report.derivedStatus}`,
+            suggestion: report.nextAction,
+            workItemId: report.id,
+            descriptionPath: report.descriptionPath,
+            currentStatus: report.currentStatus,
+            derivedStatus: report.derivedStatus,
+            evidence: report.evidence,
+          }));
+          overrideMap.set('L2-014', ValidationResult.fail(ValidatorId.create('L2-014'), errors, 0));
+        } else {
+          overrideMap.set('L2-014', ValidationResult.pass(ValidatorId.create('L2-014'), 0));
+        }
+      }
+    }
+
     const finalResults = definitions.map(
       (definition) => overrideMap.get(definition.validatorId.value) ?? ValidationResult.skip(definition.validatorId),
     );

package/scripts/harness/validator-system/composition-root.ts

@@ -22,6 +22,7 @@ import { ItTestFileAnalyzerAdapter } from './infrastructure/adapters/it-test-fil
 import { SourceFileTextScannerAdapter } from './infrastructure/adapters/source-file-text-scanner-adapter.js';
 import { E2eTestFileRegistryAdapter } from './infrastructure/adapters/e2e-test-file-registry-adapter.js';
 import { CliCommandRegistryAdapter } from './infrastructure/adapters/cli-command-registry-adapter.js';
+import { TraceabilityWorkItemStatusPolicyAdapter } from './infrastructure/adapters/traceability-work-item-status-policy-adapter.js';
 import { PhaseDependencyPhaseGatePolicyAdapter } from './infrastructure/adapters/phase-dependency-phase-gate-policy-adapter.js';
 import { TraceabilityMetadataPolicyAdapter } from './infrastructure/adapters/traceability-metadata-policy-adapter.js';
 import { NyquistAcCoveragePolicyAdapter } from './infrastructure/adapters/nyquist-ac-coverage-policy-adapter.js';
@@ -45,7 +46,7 @@ import { join } from 'node:path';
 const DEFAULT_CONFIG = {
   preset: 'standard' as const,
   layers: {
-    L2: { enabled: true, validators: ['L2-001', 'L2-002', 'L2-003', 'L2-013'] },
+    L2: { enabled: true, validators: ['L2-001', 'L2-002', 'L2-003', 'L2-013', 'L2-014'] },
     L3: { enabled: true, validators: ['L3-001', 'L3-002', 'L3-003', 'L3-004'], coverageThreshold: 90, bundleSizeLimit: 512000 },
     L4: { enabled: true, validators: ['L4-001', 'L4-002', 'L4-003', 'L4-004', 'L4-005'] },
   },
@@ -78,6 +79,7 @@ function buildDefaultRegistry(): ValidatorRegistry {
     createDef('L2-002', 'L2', 'always', 'MetadataPolicyPort'),
     createDef('L2-003', 'L2', 'always'),
     createDef('L2-013', 'L2', 'always', 'CliE2eTestExistenceService'),
+    createDef('L2-014', 'L2', 'always', 'WorkItemStatusPolicyPort'),
     createDef('L3-001', 'L3', 'always'),
     createDef('L3-002', 'L3', 'strictOnly'),
     createDef('L3-003', 'L3', 'always'),
@@ -123,6 +125,7 @@ export function createValidatorSystemModule(config?: object): ValidatorSystemMod
   const testQualityAnalyzerPort = new BiomeAstTestQualityAnalyzerAdapter();
   const securityScannerPort = new FileSystemSecurityPatternScannerAdapter();
   const performanceScannerPort = new AstPerformanceScannerAdapter();
+  const workItemStatusPolicyPort = new TraceabilityWorkItemStatusPolicyAdapter(process.cwd());
 
   const docsRoot = join(process.cwd(), 'docs/product/construction');
   const cwd = process.cwd();
@@ -146,6 +149,7 @@ export function createValidatorSystemModule(config?: object): ValidatorSystemMod
     testQualityAnalyzerPort,
     e2eTestFileRegistryPort,
     cliCommandRegistryPort,
+    workItemStatusPolicyPort,
   });
 
   const runL3ValidatorsUseCase = new RunL3ValidatorsUseCase({

package/scripts/harness/validator-system/domain/ports/work-item-status-policy-port.ts

@@ -0,0 +1,11 @@
+/**
+ * @layer domain
+ * @unit validator-system
+ * @work-item-id WI-140
+ */
+
+import type { WorkItemStatusReport } from "../../../traceability-model/domain/value-objects/work-item-status-report.js";
+
+export interface WorkItemStatusPolicyPort {
+  findStaleReports(targetPaths?: readonly string[]): Promise<readonly WorkItemStatusReport[]>;
+}

package/scripts/harness/validator-system/domain/value-objects/validator-id.ts

@@ -5,6 +5,7 @@
  * ValidatorId 値オブジェクト
  * L1-001〜L4-005 のバリデータを識別する不変値オブジェクト
  * Wave 2A で L1-017, L1-018, L2-013 を追加
+ * WI-140 で L2-014 を追加
  */
 
 export class InvalidValidatorIdError extends Error {
@@ -26,6 +27,7 @@ const VALIDATOR_NAME_MAP: Record<string, string> = {
   'L2-002': 'metadata',
   'L2-003': 'test-quality',
   'L2-013': 'cli-e2e-test-existence',
+  'L2-014': 'work-item-status-staleness',
   'L3-001': 'security',
   'L3-002': 'performance',
   'L3-003': 'coverage',

package/scripts/harness/validator-system/infrastructure/adapters/harness-config-validator-config-adapter.ts

@@ -38,7 +38,7 @@ export class HarnessConfigValidatorConfigAdapter implements ValidatorConfigPort
     const layerData = this.config.layers?.[layer] ?? {};
 
     const defaultValidators: Record<string, string[]> = {
-      L2: ['L2-001', 'L2-002', 'L2-003', 'L2-013'],
+      L2: ['L2-001', 'L2-002', 'L2-003', 'L2-013', 'L2-014'],
       L3: ['L3-001', 'L3-002', 'L3-003', 'L3-004'],
       L4: ['L4-001', 'L4-002', 'L4-003', 'L4-004', 'L4-005'],
     };

package/scripts/harness/validator-system/infrastructure/adapters/traceability-work-item-status-policy-adapter.ts

@@ -0,0 +1,52 @@
+/**
+ * @layer infrastructure
+ * @unit validator-system
+ * @work-item-id WI-140
+ */
+
+import { createTraceabilityModelModule } from "../../../traceability-model/composition-root.js";
+import type { WorkItemStatusPolicyPort } from "../../domain/ports/work-item-status-policy-port.js";
+import type { WorkItemStatusReport } from "../../../traceability-model/domain/value-objects/work-item-status-report.js";
+
+export class TraceabilityWorkItemStatusPolicyAdapter implements WorkItemStatusPolicyPort {
+  private readonly rootDir: string;
+
+  constructor(rootDir: string) {
+    this.rootDir = rootDir;
+  }
+
+  async findStaleReports(targetPaths: readonly string[] = []): Promise<readonly WorkItemStatusReport[]> {
+    if (targetPaths.length === 0) return Object.freeze([]);
+
+    const traceability = createTraceabilityModelModule(this.rootDir);
+    const output = await traceability.workItemStatusCommandHandler.execute({ dryRun: true });
+    const staleReports = output.reports.filter(
+      (report) => report.stale && report.evidence.hasRequiredInceptionArtifacts,
+    );
+
+    const normalizedTargets = targetPaths.map((targetPath) => targetPath.replace(/^\.\//, ""));
+    const explicitlyTargetedWorkItems = this.extractTargetedWorkItemIds(normalizedTargets);
+    if (explicitlyTargetedWorkItems.size > 0) {
+      return Object.freeze(staleReports.filter((report) => explicitlyTargetedWorkItems.has(report.id)));
+    }
+    return Object.freeze(staleReports.filter((report) => this.matchesAnyTarget(report, normalizedTargets)));
+  }
+
+  private extractTargetedWorkItemIds(targetPaths: readonly string[]): ReadonlySet<string> {
+    const ids = new Set<string>();
+    for (const targetPath of targetPaths) {
+      const match = /^docs\/inception\/.+\/(WI-\d+)\/description\.md$/.exec(targetPath);
+      if (match) ids.add(match[1]);
+    }
+    return ids;
+  }
+
+  private matchesAnyTarget(report: WorkItemStatusReport, targetPaths: readonly string[]): boolean {
+    const evidencePaths = [
+      report.descriptionPath,
+      ...report.evidence.implementationPaths,
+      ...report.evidence.testPaths,
+    ];
+    return targetPaths.some((targetPath) => evidencePaths.some((evidencePath) => evidencePath === targetPath));
+  }
+}

package/templates/.husky/pre-push

@@ -0,0 +1 @@
+npx phasegate bypass:audit --base origin/main --head HEAD