phasegate 0.151.1 → 0.152.0

package/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.152.0] - 2026-05-12
+
+### Added
+
+- **G5 / WI-119 / WI-120 / WI-121 / WI-134 / WI-135 — architecture semantic analysis** — strengthens code semantic analysis across L3/L4 validators and architecture presets.
+  - L4-003 dead-code detection now builds a real import/export/re-export/dynamic-import graph and reports unused export candidates with reviewable reasons while preserving public/test/generated boundaries.
+  - L3-001 security scanning detects representative OpenAI, GitHub, AWS, npm, Slack, and keyword-context token families, supports explicit fixture allowlisting, and redacts secret values from findings.
+  - L3-002 performance scanning defines practical static scope with file-size thresholds, await-in-loop, synchronous I/O, large literal checks, and inline suppression for accepted migration/batch cases.
+  - Architecture presets now expose side-effect capability policies and advisory decision-placement responsibilities separately from dependency-direction checks.
+
 ## [0.151.1] - 2026-05-12
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phasegate",
-  "version": "0.151.1",
+  "version": "0.152.0",
   "packageManager": "pnpm@10.30.1",
   "description": "Phasegate — AI-agnostic quality defense toolkit. Enforces structural integrity between design intent and code.",
   "license": "MIT",

package/scripts/harness/biome-ast-engine/domain/value-objects/architecture-spec.ts

@@ -7,6 +7,8 @@ export type ArchitectureSpec = {
   readonly layers: readonly string[];
   readonly allowedDependencies: Readonly<Record<string, readonly string[]>>;
   readonly metadataTags: ArchitectureMetadataTags;
+  readonly capabilityPolicies: Readonly<Record<string, ArchitectureCapabilityPolicy>>;
+  readonly decisionPolicies: Readonly<Record<string, ArchitectureDecisionPolicy>>;
 };
 
 export type ArchitectureMetadataTags = {
@@ -14,10 +16,39 @@ export type ArchitectureMetadataTags = {
   readonly layer: string;
 };
 
+export type EffectCapability =
+  | 'filesystem'
+  | 'network'
+  | 'database'
+  | 'process-env'
+  | 'time'
+  | 'random'
+  | 'subprocess'
+  | 'user-io';
+
+export type DecisionSignal =
+  | 'business-rule-branch'
+  | 'validation-rule'
+  | 'error-construction'
+  | 'state-transition'
+  | 'policy-selection';
+
+export type ArchitectureCapabilityPolicy = {
+  readonly allowed: readonly EffectCapability[];
+  readonly denied: readonly EffectCapability[];
+};
+
+export type ArchitectureDecisionPolicy = {
+  readonly expected: readonly DecisionSignal[];
+  readonly advisoryOnly: boolean;
+};
+
 export type ArchitectureSpecInput = {
   readonly layers: readonly string[];
   readonly allowedDependencies: Readonly<Record<string, readonly string[]>>;
   readonly metadataTags?: Partial<ArchitectureMetadataTags>;
+  readonly capabilityPolicies?: Readonly<Record<string, ArchitectureCapabilityPolicy>>;
+  readonly decisionPolicies?: Readonly<Record<string, ArchitectureDecisionPolicy>>;
 };
 
 export const DEFAULT_METADATA_TAGS: ArchitectureMetadataTags = Object.freeze({
@@ -37,6 +68,32 @@ const freezeDependencyMap = (
   return Object.freeze(frozen);
 };
 
+const freezeCapabilityPolicies = (
+  policies: Readonly<Record<string, ArchitectureCapabilityPolicy>> = {},
+): Readonly<Record<string, ArchitectureCapabilityPolicy>> => {
+  const frozen: Record<string, ArchitectureCapabilityPolicy> = {};
+  for (const [zone, policy] of Object.entries(policies)) {
+    frozen[zone] = Object.freeze({
+      allowed: Object.freeze([...policy.allowed]),
+      denied: Object.freeze([...policy.denied]),
+    });
+  }
+  return Object.freeze(frozen);
+};
+
+const freezeDecisionPolicies = (
+  policies: Readonly<Record<string, ArchitectureDecisionPolicy>> = {},
+): Readonly<Record<string, ArchitectureDecisionPolicy>> => {
+  const frozen: Record<string, ArchitectureDecisionPolicy> = {};
+  for (const [zone, policy] of Object.entries(policies)) {
+    frozen[zone] = Object.freeze({
+      expected: Object.freeze([...policy.expected]),
+      advisoryOnly: policy.advisoryOnly,
+    });
+  }
+  return Object.freeze(frozen);
+};
+
 export const freezeArchitectureSpec = (spec: ArchitectureSpecInput): ArchitectureSpec => {
   return Object.freeze({
     layers: Object.freeze([...spec.layers]),
@@ -45,6 +102,8 @@ export const freezeArchitectureSpec = (spec: ArchitectureSpecInput): Architectur
       ...DEFAULT_METADATA_TAGS,
       ...spec.metadataTags,
     }),
+    capabilityPolicies: freezeCapabilityPolicies(spec.capabilityPolicies),
+    decisionPolicies: freezeDecisionPolicies(spec.decisionPolicies),
   });
 };
 
@@ -56,4 +115,40 @@ export const CLEAN_PRESET_SPEC: ArchitectureSpec = freezeArchitectureSpec({
     infrastructure: ['infrastructure', 'application', 'domain'],
     presentation: ['presentation', 'application', 'domain'],
   },
+  capabilityPolicies: {
+    domain: {
+      allowed: [],
+      denied: ['filesystem', 'network', 'database', 'process-env', 'subprocess', 'user-io'],
+    },
+    application: {
+      allowed: ['time', 'random'],
+      denied: ['filesystem', 'network', 'database', 'subprocess'],
+    },
+    infrastructure: {
+      allowed: ['filesystem', 'network', 'database', 'process-env', 'time', 'random', 'subprocess', 'user-io'],
+      denied: [],
+    },
+    presentation: {
+      allowed: ['user-io', 'time'],
+      denied: ['database', 'subprocess'],
+    },
+  },
+  decisionPolicies: {
+    domain: {
+      expected: ['business-rule-branch', 'validation-rule', 'state-transition'],
+      advisoryOnly: true,
+    },
+    application: {
+      expected: ['policy-selection', 'error-construction'],
+      advisoryOnly: true,
+    },
+    infrastructure: {
+      expected: ['error-construction'],
+      advisoryOnly: true,
+    },
+    presentation: {
+      expected: ['validation-rule', 'error-construction'],
+      advisoryOnly: true,
+    },
+  },
 });

package/scripts/harness/config-foundation/application/mappers/validator-system-config-mapper.ts

@@ -1,7 +1,7 @@
 /**
  * @layer application
  * @unit config-foundation
- * @work-item-id WI-092 / WI-094 / WI-033 / WI-140
+ * @work-item-id WI-133
  */
 import type { HarnessConfigV2 } from '../../domain/harness-config.js';
 

package/scripts/harness/config-foundation/domain/services/architecture-resolution-service.ts

@@ -8,6 +8,8 @@ import {
   freezeArchitectureDocument,
   type ArchitectureConfigDocument,
   type ArchitectureConfigSource,
+  type CapabilityPolicy,
+  type DecisionPolicy,
   type ArchitectureLayerDetection,
   type ArchitectureMetadataTags,
   type ArchitecturePresetId,
@@ -48,6 +50,32 @@ const cloneDependencies = (
   return cloned;
 };
 
+const cloneCapabilityPolicies = (
+  source: Readonly<Record<string, CapabilityPolicy>>
+): Record<string, CapabilityPolicy> => {
+  const cloned: Record<string, CapabilityPolicy> = {};
+  for (const [key, value] of Object.entries(source)) {
+    cloned[key] = {
+      allowed: [...value.allowed],
+      denied: [...value.denied],
+    };
+  }
+  return cloned;
+};
+
+const cloneDecisionPolicies = (
+  source: Readonly<Record<string, DecisionPolicy>>
+): Record<string, DecisionPolicy> => {
+  const cloned: Record<string, DecisionPolicy> = {};
+  for (const [key, value] of Object.entries(source)) {
+    cloned[key] = {
+      expected: [...value.expected],
+      advisoryOnly: value.advisoryOnly,
+    };
+  }
+  return cloned;
+};
+
 const lookupPresetDefinition = (
   preset: ArchitecturePresetId
 ): ArchitecturePresetDefinition | null => {
@@ -92,6 +120,28 @@ const mergeDependencies = (
   return preset !== null ? cloneDependencies(preset.allowedDependencies) : {};
 };
 
+const mergeCapabilityPolicies = (
+  preset: ArchitecturePresetDefinition | null,
+  override: Readonly<Record<string, CapabilityPolicy>> | undefined
+): Record<string, CapabilityPolicy> => {
+  if (override !== undefined) {
+    return cloneCapabilityPolicies(override);
+  }
+
+  return preset !== null ? cloneCapabilityPolicies(preset.capabilityPolicies) : {};
+};
+
+const mergeDecisionPolicies = (
+  preset: ArchitecturePresetDefinition | null,
+  override: Readonly<Record<string, DecisionPolicy>> | undefined
+): Record<string, DecisionPolicy> => {
+  if (override !== undefined) {
+    return cloneDecisionPolicies(override);
+  }
+
+  return preset !== null ? cloneDecisionPolicies(preset.decisionPolicies) : {};
+};
+
 const mergeMetadataTags = (
   override: Partial<ArchitectureMetadataTags> | undefined
 ): ArchitectureMetadataTags => {
@@ -230,6 +280,14 @@ export class ArchitectureResolutionService {
       presetDefinition,
       effectiveSource.allowedDependencies
     );
+    const capabilityPolicies = mergeCapabilityPolicies(
+      presetDefinition,
+      effectiveSource.capabilityPolicies,
+    );
+    const decisionPolicies = mergeDecisionPolicies(
+      presetDefinition,
+      effectiveSource.decisionPolicies,
+    );
 
     validateDependencyKeys(layers, allowedDependencies);
     validateDependencyValues(layers, allowedDependencies);
@@ -247,6 +305,8 @@ export class ArchitectureResolutionService {
       allowedDependencies: freezeDependencies(allowedDependencies),
       metadataTags: mergeMetadataTags(effectiveSource.metadataTags),
       layerDetection,
+      capabilityPolicies,
+      decisionPolicies,
     });
 
     return Object.freeze({

package/scripts/harness/config-foundation/domain/value-objects/architecture-config.ts

@@ -25,12 +25,41 @@ export interface ArchitectureLayerDetection {
   readonly byTag: boolean;
 }
 
+export type EffectCapability =
+  | 'filesystem'
+  | 'network'
+  | 'database'
+  | 'process-env'
+  | 'time'
+  | 'random'
+  | 'subprocess'
+  | 'user-io';
+
+export type DecisionSignal =
+  | 'business-rule-branch'
+  | 'validation-rule'
+  | 'error-construction'
+  | 'state-transition'
+  | 'policy-selection';
+
+export interface CapabilityPolicy {
+  readonly allowed: readonly EffectCapability[];
+  readonly denied: readonly EffectCapability[];
+}
+
+export interface DecisionPolicy {
+  readonly expected: readonly DecisionSignal[];
+  readonly advisoryOnly: boolean;
+}
+
 export interface ArchitectureConfigSource {
   readonly preset: ArchitecturePresetId;
   readonly layers?: readonly string[];
   readonly allowedDependencies?: Readonly<Record<string, readonly string[]>>;
   readonly metadataTags?: Partial<ArchitectureMetadataTags>;
   readonly layerDetection?: Partial<ArchitectureLayerDetection>;
+  readonly capabilityPolicies?: Readonly<Record<string, CapabilityPolicy>>;
+  readonly decisionPolicies?: Readonly<Record<string, DecisionPolicy>>;
 }
 
 export interface ArchitectureConfigDocument {
@@ -39,6 +68,8 @@ export interface ArchitectureConfigDocument {
   readonly allowedDependencies: Readonly<Record<string, readonly string[]>>;
   readonly metadataTags: ArchitectureMetadataTags;
   readonly layerDetection: ArchitectureLayerDetection;
+  readonly capabilityPolicies: Readonly<Record<string, CapabilityPolicy>>;
+  readonly decisionPolicies: Readonly<Record<string, DecisionPolicy>>;
 }
 
 export const isArchitecturePresetId = (value: unknown): value is ArchitecturePresetId => {
@@ -51,10 +82,24 @@ export const freezeArchitectureDocument = (
   document: ArchitectureConfigDocument
 ): ArchitectureConfigDocument => {
   const frozenDependencies: Record<string, readonly string[]> = {};
+  const frozenCapabilityPolicies: Record<string, CapabilityPolicy> = {};
+  const frozenDecisionPolicies: Record<string, DecisionPolicy> = {};
 
   for (const [key, value] of Object.entries(document.allowedDependencies)) {
     frozenDependencies[key] = Object.freeze([...value]);
   }
+  for (const [key, value] of Object.entries(document.capabilityPolicies)) {
+    frozenCapabilityPolicies[key] = Object.freeze({
+      allowed: Object.freeze([...value.allowed]),
+      denied: Object.freeze([...value.denied]),
+    });
+  }
+  for (const [key, value] of Object.entries(document.decisionPolicies)) {
+    frozenDecisionPolicies[key] = Object.freeze({
+      expected: Object.freeze([...value.expected]),
+      advisoryOnly: value.advisoryOnly,
+    });
+  }
 
   return Object.freeze({
     preset: document.preset,
@@ -62,5 +107,7 @@ export const freezeArchitectureDocument = (
     allowedDependencies: Object.freeze(frozenDependencies),
     metadataTags: Object.freeze({ ...document.metadataTags }),
     layerDetection: Object.freeze({ ...document.layerDetection }),
+    capabilityPolicies: Object.freeze(frozenCapabilityPolicies),
+    decisionPolicies: Object.freeze(frozenDecisionPolicies),
   });
 };

package/scripts/harness/config-foundation/domain/value-objects/architecture-preset-catalog.ts

@@ -3,23 +3,41 @@
  * @unit config-foundation
  */
 
-import type { ArchitecturePresetId } from './architecture-config.js';
+import type { ArchitecturePresetId, CapabilityPolicy, DecisionPolicy } from './architecture-config.js';
 
 export interface ArchitecturePresetDefinition {
   readonly layers: readonly string[];
   readonly allowedDependencies: Readonly<Record<string, readonly string[]>>;
+  readonly capabilityPolicies: Readonly<Record<string, CapabilityPolicy>>;
+  readonly decisionPolicies: Readonly<Record<string, DecisionPolicy>>;
 }
 
 const freeze = (definition: ArchitecturePresetDefinition): ArchitecturePresetDefinition => {
   const dependencies: Record<string, readonly string[]> = {};
+  const capabilityPolicies: Record<string, CapabilityPolicy> = {};
+  const decisionPolicies: Record<string, DecisionPolicy> = {};
 
   for (const [key, value] of Object.entries(definition.allowedDependencies)) {
     dependencies[key] = Object.freeze([...value]);
   }
+  for (const [key, value] of Object.entries(definition.capabilityPolicies)) {
+    capabilityPolicies[key] = Object.freeze({
+      allowed: Object.freeze([...value.allowed]),
+      denied: Object.freeze([...value.denied]),
+    });
+  }
+  for (const [key, value] of Object.entries(definition.decisionPolicies)) {
+    decisionPolicies[key] = Object.freeze({
+      expected: Object.freeze([...value.expected]),
+      advisoryOnly: value.advisoryOnly,
+    });
+  }
 
   return Object.freeze({
     layers: Object.freeze([...definition.layers]),
     allowedDependencies: Object.freeze(dependencies),
+    capabilityPolicies: Object.freeze(capabilityPolicies),
+    decisionPolicies: Object.freeze(decisionPolicies),
   });
 };
 
@@ -34,6 +52,18 @@ export const ARCHITECTURE_PRESET_CATALOG: Readonly<
       infrastructure: ['infrastructure', 'application', 'domain'],
       presentation: ['presentation', 'application', 'domain'],
     },
+    capabilityPolicies: {
+      domain: { allowed: [], denied: ['filesystem', 'network', 'database', 'process-env', 'subprocess', 'user-io'] },
+      application: { allowed: ['time', 'random'], denied: ['filesystem', 'network', 'database', 'subprocess'] },
+      infrastructure: { allowed: ['filesystem', 'network', 'database', 'process-env', 'time', 'random', 'subprocess', 'user-io'], denied: [] },
+      presentation: { allowed: ['user-io', 'time'], denied: ['database', 'subprocess'] },
+    },
+    decisionPolicies: {
+      domain: { expected: ['business-rule-branch', 'validation-rule', 'state-transition'], advisoryOnly: true },
+      application: { expected: ['policy-selection', 'error-construction'], advisoryOnly: true },
+      infrastructure: { expected: ['error-construction'], advisoryOnly: true },
+      presentation: { expected: ['validation-rule', 'error-construction'], advisoryOnly: true },
+    },
   }),
   'strict-ddd': freeze({
     layers: ['domain', 'application', 'infrastructure', 'presentation'],
@@ -43,6 +73,18 @@ export const ARCHITECTURE_PRESET_CATALOG: Readonly<
       infrastructure: ['infrastructure', 'application', 'domain'],
       presentation: ['presentation', 'application'],
     },
+    capabilityPolicies: {
+      domain: { allowed: [], denied: ['filesystem', 'network', 'database', 'process-env', 'subprocess', 'user-io'] },
+      application: { allowed: ['time'], denied: ['filesystem', 'network', 'database', 'random', 'subprocess'] },
+      infrastructure: { allowed: ['filesystem', 'network', 'database', 'process-env', 'time', 'random', 'subprocess', 'user-io'], denied: [] },
+      presentation: { allowed: ['user-io'], denied: ['database', 'subprocess'] },
+    },
+    decisionPolicies: {
+      domain: { expected: ['business-rule-branch', 'validation-rule', 'state-transition'], advisoryOnly: true },
+      application: { expected: ['policy-selection'], advisoryOnly: true },
+      infrastructure: { expected: [], advisoryOnly: true },
+      presentation: { expected: ['error-construction'], advisoryOnly: true },
+    },
   }),
   onion: freeze({
     layers: ['domain', 'application', 'interface'],
@@ -51,6 +93,16 @@ export const ARCHITECTURE_PRESET_CATALOG: Readonly<
       application: ['application', 'domain'],
       interface: ['interface', 'application', 'domain'],
     },
+    capabilityPolicies: {
+      domain: { allowed: [], denied: ['filesystem', 'network', 'database', 'process-env', 'subprocess', 'user-io'] },
+      application: { allowed: ['time', 'random'], denied: ['filesystem', 'network', 'database', 'subprocess'] },
+      interface: { allowed: ['filesystem', 'network', 'database', 'process-env', 'time', 'random', 'subprocess', 'user-io'], denied: [] },
+    },
+    decisionPolicies: {
+      domain: { expected: ['business-rule-branch', 'validation-rule', 'state-transition'], advisoryOnly: true },
+      application: { expected: ['policy-selection', 'error-construction'], advisoryOnly: true },
+      interface: { expected: ['error-construction'], advisoryOnly: true },
+    },
   }),
   hexagonal: freeze({
     layers: ['core', 'ports', 'adapters'],
@@ -59,6 +111,16 @@ export const ARCHITECTURE_PRESET_CATALOG: Readonly<
       ports: ['ports', 'core'],
       adapters: ['adapters', 'ports', 'core'],
     },
+    capabilityPolicies: {
+      core: { allowed: [], denied: ['filesystem', 'network', 'database', 'process-env', 'subprocess', 'user-io'] },
+      ports: { allowed: [], denied: ['filesystem', 'network', 'database', 'subprocess'] },
+      adapters: { allowed: ['filesystem', 'network', 'database', 'process-env', 'time', 'random', 'subprocess', 'user-io'], denied: [] },
+    },
+    decisionPolicies: {
+      core: { expected: ['business-rule-branch', 'validation-rule', 'state-transition'], advisoryOnly: true },
+      ports: { expected: [], advisoryOnly: true },
+      adapters: { expected: ['error-construction'], advisoryOnly: true },
+    },
   }),
   layered: freeze({
     layers: ['controller', 'service', 'repository'],
@@ -67,9 +129,21 @@ export const ARCHITECTURE_PRESET_CATALOG: Readonly<
       service: ['service', 'repository'],
       repository: ['repository'],
     },
+    capabilityPolicies: {
+      controller: { allowed: ['user-io'], denied: ['database', 'filesystem', 'subprocess'] },
+      service: { allowed: ['time', 'random'], denied: ['filesystem', 'network', 'database', 'subprocess'] },
+      repository: { allowed: ['database', 'filesystem', 'network', 'process-env'], denied: ['user-io'] },
+    },
+    decisionPolicies: {
+      controller: { expected: ['validation-rule', 'error-construction'], advisoryOnly: true },
+      service: { expected: ['business-rule-branch', 'policy-selection', 'state-transition'], advisoryOnly: true },
+      repository: { expected: ['error-construction'], advisoryOnly: true },
+    },
   }),
   flat: freeze({
     layers: [],
     allowedDependencies: {},
+    capabilityPolicies: {},
+    decisionPolicies: {},
   }),
 });

package/scripts/harness/config-foundation/infrastructure/schemas/harness-config-v3.schema.json

@@ -12,6 +12,16 @@
     "paths",
     "reporting"
   ],
+  "$defs": {
+    "effectCapability": {
+      "type": "string",
+      "enum": ["filesystem", "network", "database", "process-env", "time", "random", "subprocess", "user-io"]
+    },
+    "decisionSignal": {
+      "type": "string",
+      "enum": ["business-rule-branch", "validation-rule", "error-construction", "state-transition", "policy-selection"]
+    }
+  },
   "properties": {
     "project": {
       "type": "object",
@@ -565,6 +575,42 @@
             "byPath": { "type": "boolean" },
             "byTag": { "type": "boolean" }
           }
+        },
+        "capabilityPolicies": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["allowed", "denied"],
+            "properties": {
+              "allowed": {
+                "type": "array",
+                "items": { "$ref": "#/$defs/effectCapability" },
+                "uniqueItems": true
+              },
+              "denied": {
+                "type": "array",
+                "items": { "$ref": "#/$defs/effectCapability" },
+                "uniqueItems": true
+              }
+            }
+          }
+        },
+        "decisionPolicies": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["expected", "advisoryOnly"],
+            "properties": {
+              "expected": {
+                "type": "array",
+                "items": { "$ref": "#/$defs/decisionSignal" },
+                "uniqueItems": true
+              },
+              "advisoryOnly": { "type": "boolean" }
+            }
+          }
         }
       },
       "allOf": [

package/scripts/harness/validator-system/domain/ports/source-analysis-port.ts

@@ -2,8 +2,8 @@
 // @layer domain
 
 export interface ImportGraphData {
-  readonly nodes: readonly { filePath: string; exports: readonly string[] }[];
-  readonly edges: readonly { from: string; to: string; importedNames: readonly string[] }[];
+  readonly nodes: readonly { filePath: string; exports: readonly string[]; excludedReason?: string }[];
+  readonly edges: readonly { from: string; to: string; importedNames: readonly string[]; kind?: string }[];
   readonly unusedExports?: readonly string[];
   readonly unreachableCode?: readonly { filePath: string; range: { startLine: number; endLine: number } }[];
 }

package/scripts/harness/validator-system/domain/services/l4/dead-code-detection-service.ts

@@ -9,8 +9,8 @@ import { DeadCodeReport } from '../../value-objects/dead-code-report.js';
 
 export interface DeadCodeSourceAnalysisPort {
   getImportGraph(): Promise<{
-    nodes?: readonly { filePath: string; exports: readonly string[] }[];
-    edges?: readonly { from: string; to: string; importedNames: readonly string[] }[];
+    nodes?: readonly { filePath: string; exports: readonly string[]; excludedReason?: string }[];
+    edges?: readonly { from: string; to: string; importedNames: readonly string[]; kind?: string }[];
     unusedExports?: readonly string[];
     unreachableCode?: readonly { filePath: string; range: { startLine: number; endLine: number } }[];
   }>;

package/scripts/harness/validator-system/infrastructure/adapters/ast-performance-scanner-adapter.ts

@@ -8,9 +8,11 @@
 import * as ts from 'typescript';
 import type { PerformanceScannerPort } from '../../domain/ports/performance-scanner-port.js';
 import type { HarnessErrorLike } from '../../domain/value-objects/validation-result.js';
-import { readdir, stat } from 'node:fs/promises';
+import { readFile, readdir, stat } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 
+const SUPPRESSION_MARKER = 'phasegate-ignore-performance';
+
 export class AstPerformanceScannerAdapter implements PerformanceScannerPort {
   async scan(targetPaths: readonly string[], thresholds: Record<string, number>): Promise<{
     passed: boolean;
@@ -33,12 +35,15 @@ export class AstPerformanceScannerAdapter implements PerformanceScannerPort {
 
       for (const filePath of filePaths) {
         try {
-          const [fileStat] = await Promise.all([stat(filePath)]);
+          const [fileStat, content] = await Promise.all([stat(filePath), readFile(filePath, 'utf8')]);
+          if (content.includes(SUPPRESSION_MARKER)) {
+            continue;
+          }
 
           // Bundle size check (file-level size)
           const bundleSizeLimit = thresholds.bundleSizeLimit;
           if (typeof bundleSizeLimit === 'number' && fileStat.size > bundleSizeLimit) {
-            findings.push(createFinding('L3-002', `bundleSizeLimit を超過しました: ${filePath} (${fileStat.size} bytes)`));
+            findings.push(createFinding('L3-002', `bundleSizeLimit を超過しました: ${filePath} metric=file-size actual=${fileStat.size} threshold=${bundleSizeLimit}`));
           }
 
           // AST-based await-in-loop detection
@@ -46,6 +51,13 @@ export class AstPerformanceScannerAdapter implements PerformanceScannerPort {
           if (sourceFile && hasAwaitInLoop(sourceFile)) {
             findings.push(createFinding('L3-002', `ループ内 await を検出しました: ${filePath}`));
           }
+          if (sourceFile && hasSyncIoCall(sourceFile)) {
+            findings.push(createFinding('L3-002', `同期I/O呼び出しを検出しました: ${filePath} metric=sync-io threshold=0`));
+          }
+          const largeLiteralThreshold = thresholds.largeLiteralEntries ?? 80;
+          if (sourceFile && hasLargeLiteral(sourceFile, largeLiteralThreshold)) {
+            findings.push(createFinding('L3-002', `largeLiteralEntries を超過しました: ${filePath} metric=literal-entries threshold=${largeLiteralThreshold}`));
+          }
         } catch {
           continue;
         }
@@ -56,6 +68,46 @@ export class AstPerformanceScannerAdapter implements PerformanceScannerPort {
   }
 }
 
+function hasSyncIoCall(root: ts.Node): boolean {
+  let found = false;
+
+  function visit(node: ts.Node): void {
+    if (found) return;
+    if (ts.isCallExpression(node)) {
+      const expressionText = node.expression.getText(root.getSourceFile());
+      if (/\b(?:readFileSync|writeFileSync|appendFileSync|readdirSync|statSync|existsSync|execFileSync|execSync|spawnSync)\b/.test(expressionText)) {
+        found = true;
+        return;
+      }
+    }
+    ts.forEachChild(node, visit);
+  }
+
+  visit(root);
+  return found;
+}
+
+function hasLargeLiteral(root: ts.Node, threshold: number): boolean {
+  let found = false;
+
+  function visit(node: ts.Node): void {
+    if (found) return;
+    const literalSize = ts.isObjectLiteralExpression(node)
+      ? node.properties.length
+      : ts.isArrayLiteralExpression(node)
+        ? node.elements.length
+        : 0;
+    if (literalSize > threshold) {
+      found = true;
+      return;
+    }
+    ts.forEachChild(node, visit);
+  }
+
+  visit(root);
+  return found;
+}
+
 /**
  * ループノード（for/while/do/for-in/for-of）の直下に await が存在するか検出する。
  * ネストされた関数・アロー関数境界は越えない。

package/scripts/harness/validator-system/infrastructure/adapters/biome-ast-source-code-analyzer-adapter.ts

@@ -131,8 +131,11 @@ function extractExports(sourceFile: ts.SourceFile): SourceAnalysisResult['export
           exports.push({ name: element.name.text, type: 'type' });
         }
       }
-    } else if (ts.isExportDeclaration(node) && !node.exportClause && ts.isStringLiteral(node.moduleSpecifier)) {
-      exports.push({ name: `* from ${node.moduleSpecifier.text}`, type: 'type' });
+    } else if (ts.isExportDeclaration(node) && !node.exportClause) {
+      const moduleSpecifier = node.moduleSpecifier;
+      if (moduleSpecifier !== undefined && ts.isStringLiteral(moduleSpecifier)) {
+        exports.push({ name: `* from ${moduleSpecifier.text}`, type: 'type' });
+      }
     }
 
     const hasDefault = modifiers?.some((m) => m.kind === ts.SyntaxKind.DefaultKeyword) ?? false;

package/scripts/harness/validator-system/infrastructure/adapters/file-system-security-pattern-scanner-adapter.ts

@@ -8,11 +8,26 @@ import type { SecurityPatternScannerPort } from '../../domain/ports/security-pat
 import type { HarnessErrorLike } from '../../domain/value-objects/validation-result.js';
 import { readFile } from 'node:fs/promises';
 
-const SECURITY_PATTERNS = [
-  { pattern: /(?:API_KEY|api_key|apikey)\s*=\s*["'][^"']{8,}["']/gi, description: 'ハードコードAPIキー' },
-  { pattern: /(?:password|PASSWORD|passwd)\s*=\s*["'][^"']{4,}["']/gi, description: 'ハードコードパスワード' },
-  { pattern: /sk-[a-zA-Z0-9]{20,}/g, description: 'OpenAI APIキー形式' },
-];
+const ALLOWLIST_MARKER = 'phasegate-allow-secret-fixture';
+
+interface SecurityPattern {
+  readonly ruleId: string;
+  readonly pattern: RegExp;
+  readonly description: string;
+}
+
+const SECURITY_PATTERNS: readonly SecurityPattern[] = Object.freeze([
+  { ruleId: 'secret.openai', pattern: /\b(?:sk|rk|sess)-[a-zA-Z0-9_-]{20,}\b/g, description: 'OpenAI token family' },
+  { ruleId: 'secret.github', pattern: /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/g, description: 'GitHub token family' },
+  { ruleId: 'secret.aws-access-key', pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, description: 'AWS access key id' },
+  { ruleId: 'secret.npm', pattern: /\bnpm_[A-Za-z0-9]{24,}\b/g, description: 'npm token family' },
+  { ruleId: 'secret.slack', pattern: /\bxox[abprs]-[A-Za-z0-9-]{20,}\b/g, description: 'Slack token family' },
+  {
+    ruleId: 'secret.keyword-context',
+    pattern: /\b(?:API_KEY|api_key|apikey|password|PASSWORD|passwd|secret|token)\b\s*[:=]\s*["'][^"']{8,}["']/g,
+    description: 'keyword-context secret',
+  },
+]);
 
 export class FileSystemSecurityPatternScannerAdapter implements SecurityPatternScannerPort {
   async scan(targetPaths: readonly string[]): Promise<{
@@ -24,15 +39,24 @@ export class FileSystemSecurityPatternScannerAdapter implements SecurityPatternS
     for (const filePath of targetPaths) {
       try {
         const content = await readFile(filePath, 'utf-8');
+        if (content.includes(ALLOWLIST_MARKER)) {
+          continue;
+        }
         const lines = content.split('\n');
         lines.forEach((line, idx) => {
-          for (const { pattern, description } of SECURITY_PATTERNS) {
-            if (pattern.test(line)) {
+          if (isAllowlisted(line, content)) {
+            return;
+          }
+          for (const { pattern, description, ruleId } of SECURITY_PATTERNS) {
+            pattern.lastIndex = 0;
+            const matches = [...line.matchAll(pattern)];
+            for (const match of matches) {
+              const secretValue = match[0] ?? '';
               findings.push({
                 code: { value: 'L3-001', toString: () => 'L3-001' },
                 severity: { value: 'error', toString: () => 'error' },
-                message: `セキュリティ問題: ${description} at ${filePath}:${idx + 1}`,
-                suggestion: '秘密情報は環境変数または秘密管理サービスを使用してください',
+                message: `セキュリティ問題: ${description} (${ruleId}) at ${filePath}:${idx + 1} value=${redactSecret(secretValue)}`,
+                suggestion: `${ruleId}: 秘密情報は環境変数または秘密管理サービスを使用してください。fixture/docs のダミー値は ${ALLOWLIST_MARKER} を明示してください。`,
               });
             }
           }
@@ -45,3 +69,14 @@ export class FileSystemSecurityPatternScannerAdapter implements SecurityPatternS
     return { passed: findings.length === 0, findings };
   }
 }
+
+function isAllowlisted(line: string, content: string): boolean {
+  if (line.includes(ALLOWLIST_MARKER)) return true;
+  return /@example|dummy|placeholder/i.test(line) && content.includes(ALLOWLIST_MARKER);
+}
+
+function redactSecret(secretValue: string): string {
+  const value = secretValue.trim();
+  if (value.length <= 8) return '<redacted>';
+  return `${value.slice(0, 3)}...<redacted:${value.length}>`;
+}

package/scripts/harness/validator-system/infrastructure/adapters/import-graph-source-analysis-adapter.ts

@@ -6,39 +6,82 @@
  */
 import type { SourceAnalysisPort, ImportGraphData } from '../../domain/ports/source-analysis-port.js';
 import { readdir, readFile } from 'node:fs/promises';
-import { join } from 'node:path';
+import { dirname, extname, join, normalize, resolve } from 'node:path';
 
 const HARNESS_ROOT = join(process.cwd(), 'scripts', 'harness');
 const IMPORT_PATTERN = /import\s+(?:type\s+)?(.+?)\s+from\s+['"]([^'"]+)['"]/g;
-const EXPORT_PATTERN = /export\s+(?:class|interface|type|function|const)\s+(\w+)/g;
+const SIDE_EFFECT_IMPORT_PATTERN = /import\s+['"]([^'"]+)['"]/g;
+const DYNAMIC_IMPORT_PATTERN = /import\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+const RE_EXPORT_NAMED_PATTERN = /export\s+(?:type\s+)?\{([^}]+)\}\s+from\s+['"]([^'"]+)['"]/g;
+const RE_EXPORT_ALL_PATTERN = /export\s+\*\s+from\s+['"]([^'"]+)['"]/g;
+const EXPORT_PATTERN = /export\s+(?:declare\s+)?(?:abstract\s+)?(?:class|interface|type|function|const|let|var|enum)\s+(\w+)/g;
+const EXPORT_LIST_PATTERN = /export\s+(?:type\s+)?\{([^}]+)\}/g;
 
 export class ImportGraphSourceAnalysisAdapter implements SourceAnalysisPort {
+  private readonly root: string;
+
+  constructor(root: string = HARNESS_ROOT) {
+    this.root = root;
+  }
+
   async getImportGraph(): Promise<ImportGraphData> {
-    const filePaths = await walkTsFiles(HARNESS_ROOT);
-    const nodes: Array<{ filePath: string; exports: readonly string[] }> = [];
-    const edges: Array<{ from: string; to: string; importedNames: readonly string[] }> = [];
+    const filePaths = await walkTsFiles(this.root);
+    const fileSet = new Set(filePaths.map((filePath) => normalize(filePath)));
+    const nodes: Array<{ filePath: string; exports: readonly string[]; excludedReason?: string }> = [];
+    const edges: Array<{ from: string; to: string; importedNames: readonly string[]; kind: string }> = [];
 
     for (const filePath of filePaths) {
       try {
         const content = await readFile(filePath, 'utf8');
+        const exports = extractExports(content);
+        const excludedReason = classifyDeadCodeExclusion(filePath);
         nodes.push({
           filePath,
-          exports: Array.from(content.matchAll(EXPORT_PATTERN), (match) => match[1]),
+          exports,
+          ...(excludedReason ? { excludedReason } : {}),
         });
 
         for (const match of content.matchAll(IMPORT_PATTERN)) {
+          const target = resolveImportTarget(filePath, match[2] ?? '', fileSet);
+          if (!target) continue;
+          edges.push({
+            from: filePath,
+            to: target,
+            importedNames: normalizeImportNames(match[1] ?? ''),
+            kind: 'static-import',
+          });
+        }
+        for (const match of content.matchAll(SIDE_EFFECT_IMPORT_PATTERN)) {
+          const target = resolveImportTarget(filePath, match[1] ?? '', fileSet);
+          if (!target) continue;
+          edges.push({ from: filePath, to: target, importedNames: ['*'], kind: 'side-effect-import' });
+        }
+        for (const match of content.matchAll(DYNAMIC_IMPORT_PATTERN)) {
+          const target = resolveImportTarget(filePath, match[1] ?? '', fileSet);
+          if (!target) continue;
+          edges.push({ from: filePath, to: target, importedNames: ['*'], kind: 'dynamic-import' });
+        }
+        for (const match of content.matchAll(RE_EXPORT_NAMED_PATTERN)) {
+          const target = resolveImportTarget(filePath, match[2] ?? '', fileSet);
+          if (!target) continue;
           edges.push({
             from: filePath,
-            to: match[2],
+            to: target,
             importedNames: normalizeImportNames(match[1] ?? ''),
+            kind: 're-export',
           });
         }
+        for (const match of content.matchAll(RE_EXPORT_ALL_PATTERN)) {
+          const target = resolveImportTarget(filePath, match[1] ?? '', fileSet);
+          if (!target) continue;
+          edges.push({ from: filePath, to: target, importedNames: ['*'], kind: 're-export-all' });
+        }
       } catch {
         continue;
       }
     }
 
-    return { nodes, edges, unusedExports: [], unreachableCode: [] };
+    return { nodes, edges, unusedExports: detectUnusedExports(nodes, edges), unreachableCode: [] };
   }
 }
 
@@ -62,6 +105,7 @@ function normalizeImportNames(clause: string): string[] {
   const cleaned = clause
     .replace(/\btype\s+/g, '')
     .replace(/\s+as\s+\w+/g, '')
+    .replace(/\*\s+as\s+(\w+)/g, '*')
     .replace(/[{}]/g, ',');
 
   return cleaned
@@ -69,3 +113,71 @@ function normalizeImportNames(clause: string): string[] {
     .map((part) => part.trim())
     .filter((part) => part.length > 0);
 }
+
+function extractExports(content: string): string[] {
+  const names = new Set<string>();
+  for (const match of content.matchAll(EXPORT_PATTERN)) {
+    if (match[1]) names.add(match[1]);
+  }
+  for (const match of content.matchAll(EXPORT_LIST_PATTERN)) {
+    for (const name of normalizeImportNames(match[1] ?? '')) {
+      const [exportName] = name.split(/\s+as\s+/).map((part) => part.trim()).reverse();
+      if (exportName) names.add(exportName);
+    }
+  }
+  if (/export\s+default\b/.test(content)) {
+    names.add('default');
+  }
+  return [...names];
+}
+
+function resolveImportTarget(fromFile: string, specifier: string, fileSet: ReadonlySet<string>): string | null {
+  if (!specifier.startsWith('.')) return null;
+  const base = resolve(dirname(fromFile), specifier);
+  const candidates = extname(base)
+    ? [base]
+    : [`${base}.ts`, `${base}.tsx`, join(base, 'index.ts'), join(base, 'index.tsx')];
+  for (const candidate of candidates) {
+    const normalized = normalize(candidate);
+    if (fileSet.has(normalized)) return normalized;
+  }
+  return null;
+}
+
+function classifyDeadCodeExclusion(filePath: string): string | undefined {
+  const normalized = filePath.replaceAll('\\', '/');
+  if (/(^|\/)__tests__\//.test(normalized) || /\.test\.ts$/.test(normalized) || /\.it\.test\.ts$/.test(normalized)) {
+    return 'test';
+  }
+  if (/(^|\/)fixtures?\//.test(normalized)) return 'fixture';
+  if (/(^|\/)(templates|generated)\//.test(normalized)) return 'generated';
+  if (/\/(index|main)\.ts$/.test(normalized) || /\/bin\//.test(normalized) || /\/presentation\/(cli|handlers)\//.test(normalized)) {
+    return 'entrypoint';
+  }
+  return undefined;
+}
+
+function detectUnusedExports(
+  nodes: readonly { filePath: string; exports: readonly string[]; excludedReason?: string }[],
+  edges: readonly { to: string; importedNames: readonly string[] }[],
+): string[] {
+  const usedByFile = new Map<string, Set<string>>();
+  for (const edge of edges) {
+    const names = usedByFile.get(edge.to) ?? new Set<string>();
+    for (const importedName of edge.importedNames) {
+      names.add(importedName);
+    }
+    usedByFile.set(edge.to, names);
+  }
+
+  const unused: string[] = [];
+  for (const node of nodes) {
+    if (node.excludedReason) continue;
+    const used = usedByFile.get(normalize(node.filePath)) ?? new Set<string>();
+    for (const exportName of node.exports) {
+      if (used.has('*') || used.has(exportName)) continue;
+      unused.push(`${node.filePath}::${exportName} (reason: no import/export graph reference)`);
+    }
+  }
+  return unused;
+}