phasegate 0.151.1 → 0.152.1

package/CHANGELOG.md

@@ -7,6 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.152.1] - 2026-05-12
+
+### Fixed
+
+- **G5 post-publish dogfood / WI-134 / WI-135** — wires architecture semantic policy into `L4-002` runtime validation so side-effect capability denials and decision-placement advisories are reported with file zone, evidence, confidence, and suggested owner zone.
+
+## [0.152.0] - 2026-05-12
+
+### Added
+
+- **G5 / WI-119 / WI-120 / WI-121 / WI-134 / WI-135 — architecture semantic analysis** — strengthens code semantic analysis across L3/L4 validators and architecture presets.
+  - L4-003 dead-code detection now builds a real import/export/re-export/dynamic-import graph and reports unused export candidates with reviewable reasons while preserving public/test/generated boundaries.
+  - L3-001 security scanning detects representative OpenAI, GitHub, AWS, npm, Slack, and keyword-context token families, supports explicit fixture allowlisting, and redacts secret values from findings.
+  - L3-002 performance scanning defines practical static scope with file-size thresholds, await-in-loop, synchronous I/O, large literal checks, and inline suppression for accepted migration/batch cases.
+  - Architecture presets now expose side-effect capability policies and advisory decision-placement responsibilities separately from dependency-direction checks.
+
 ## [0.151.1] - 2026-05-12
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phasegate",
-  "version": "0.151.1",
+  "version": "0.152.1",
   "packageManager": "pnpm@10.30.1",
   "description": "Phasegate — AI-agnostic quality defense toolkit. Enforces structural integrity between design intent and code.",
   "license": "MIT",

package/scripts/harness/biome-ast-engine/domain/value-objects/architecture-spec.ts

@@ -7,6 +7,8 @@ export type ArchitectureSpec = {
   readonly layers: readonly string[];
   readonly allowedDependencies: Readonly<Record<string, readonly string[]>>;
   readonly metadataTags: ArchitectureMetadataTags;
+  readonly capabilityPolicies: Readonly<Record<string, ArchitectureCapabilityPolicy>>;
+  readonly decisionPolicies: Readonly<Record<string, ArchitectureDecisionPolicy>>;
 };
 
 export type ArchitectureMetadataTags = {
@@ -14,10 +16,39 @@ export type ArchitectureMetadataTags = {
   readonly layer: string;
 };
 
+export type EffectCapability =
+  | 'filesystem'
+  | 'network'
+  | 'database'
+  | 'process-env'
+  | 'time'
+  | 'random'
+  | 'subprocess'
+  | 'user-io';
+
+export type DecisionSignal =
+  | 'business-rule-branch'
+  | 'validation-rule'
+  | 'error-construction'
+  | 'state-transition'
+  | 'policy-selection';
+
+export type ArchitectureCapabilityPolicy = {
+  readonly allowed: readonly EffectCapability[];
+  readonly denied: readonly EffectCapability[];
+};
+
+export type ArchitectureDecisionPolicy = {
+  readonly expected: readonly DecisionSignal[];
+  readonly advisoryOnly: boolean;
+};
+
 export type ArchitectureSpecInput = {
   readonly layers: readonly string[];
   readonly allowedDependencies: Readonly<Record<string, readonly string[]>>;
   readonly metadataTags?: Partial<ArchitectureMetadataTags>;
+  readonly capabilityPolicies?: Readonly<Record<string, ArchitectureCapabilityPolicy>>;
+  readonly decisionPolicies?: Readonly<Record<string, ArchitectureDecisionPolicy>>;
 };
 
 export const DEFAULT_METADATA_TAGS: ArchitectureMetadataTags = Object.freeze({
@@ -37,6 +68,32 @@ const freezeDependencyMap = (
   return Object.freeze(frozen);
 };
 
+const freezeCapabilityPolicies = (
+  policies: Readonly<Record<string, ArchitectureCapabilityPolicy>> = {},
+): Readonly<Record<string, ArchitectureCapabilityPolicy>> => {
+  const frozen: Record<string, ArchitectureCapabilityPolicy> = {};
+  for (const [zone, policy] of Object.entries(policies)) {
+    frozen[zone] = Object.freeze({
+      allowed: Object.freeze([...policy.allowed]),
+      denied: Object.freeze([...policy.denied]),
+    });
+  }
+  return Object.freeze(frozen);
+};
+
+const freezeDecisionPolicies = (
+  policies: Readonly<Record<string, ArchitectureDecisionPolicy>> = {},
+): Readonly<Record<string, ArchitectureDecisionPolicy>> => {
+  const frozen: Record<string, ArchitectureDecisionPolicy> = {};
+  for (const [zone, policy] of Object.entries(policies)) {
+    frozen[zone] = Object.freeze({
+      expected: Object.freeze([...policy.expected]),
+      advisoryOnly: policy.advisoryOnly,
+    });
+  }
+  return Object.freeze(frozen);
+};
+
 export const freezeArchitectureSpec = (spec: ArchitectureSpecInput): ArchitectureSpec => {
   return Object.freeze({
     layers: Object.freeze([...spec.layers]),
@@ -45,6 +102,8 @@ export const freezeArchitectureSpec = (spec: ArchitectureSpecInput): Architectur
       ...DEFAULT_METADATA_TAGS,
       ...spec.metadataTags,
     }),
+    capabilityPolicies: freezeCapabilityPolicies(spec.capabilityPolicies),
+    decisionPolicies: freezeDecisionPolicies(spec.decisionPolicies),
   });
 };
 
@@ -56,4 +115,40 @@ export const CLEAN_PRESET_SPEC: ArchitectureSpec = freezeArchitectureSpec({
     infrastructure: ['infrastructure', 'application', 'domain'],
     presentation: ['presentation', 'application', 'domain'],
   },
+  capabilityPolicies: {
+    domain: {
+      allowed: [],
+      denied: ['filesystem', 'network', 'database', 'process-env', 'subprocess', 'user-io'],
+    },
+    application: {
+      allowed: ['time', 'random'],
+      denied: ['filesystem', 'network', 'database', 'subprocess'],
+    },
+    infrastructure: {
+      allowed: ['filesystem', 'network', 'database', 'process-env', 'time', 'random', 'subprocess', 'user-io'],
+      denied: [],
+    },
+    presentation: {
+      allowed: ['user-io', 'time'],
+      denied: ['database', 'subprocess'],
+    },
+  },
+  decisionPolicies: {
+    domain: {
+      expected: ['business-rule-branch', 'validation-rule', 'state-transition'],
+      advisoryOnly: true,
+    },
+    application: {
+      expected: ['policy-selection', 'error-construction'],
+      advisoryOnly: true,
+    },
+    infrastructure: {
+      expected: ['error-construction'],
+      advisoryOnly: true,
+    },
+    presentation: {
+      expected: ['validation-rule', 'error-construction'],
+      advisoryOnly: true,
+    },
+  },
 });

package/scripts/harness/config-foundation/application/mappers/validator-system-config-mapper.ts

@@ -1,22 +1,64 @@
 /**
  * @layer application
  * @unit config-foundation
- * @work-item-id WI-092 / WI-094 / WI-033 / WI-140
+ * @work-item-id WI-133
  */
 import type { HarnessConfigV2 } from '../../domain/harness-config.js';
 
 export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefined): object | undefined {
   if (!resolvedConfig) return undefined;
 
+  const l3Validators = normalizeValidators(resolvedConfig.layers.L3.validators, {
+    security: 'L3-001',
+    performance: 'L3-002',
+    coverage: 'L3-003',
+    nyquist: 'L3-004',
+  }, /^L3-\d{3}$/);
+  const l4Validators = normalizeValidators(resolvedConfig.layers.L4.validators, {
+    'drift-detect': 'L4-001',
+    'drift-detector': 'L4-001',
+    'consistency-check': 'L4-002',
+    'consistency-checker': 'L4-002',
+    'dead-code': 'L4-003',
+    'dead-code-detector': 'L4-003',
+    'doc-freshness': 'L4-004',
+    'doc-freshness-checker': 'L4-004',
+    'pointer-validation': 'L4-005',
+    'pointer-validator': 'L4-005',
+  }, /^L4-\d{3}$/);
+
   return {
     project: { preset: resolvedConfig.project.preset },
     layers: {
       L2: { enabled: resolvedConfig.layers.L2.enabled, validators: ['L2-001', 'L2-002', 'L2-003', 'L2-013', 'L2-014', 'L2-015'] },
-      L3: { enabled: resolvedConfig.layers.L3.enabled },
-      L4: { enabled: resolvedConfig.layers.L4.enabled, validators: resolvedConfig.layers.L4.validators },
+      L3: {
+        enabled: resolvedConfig.layers.L3.enabled,
+        ...(l3Validators.length > 0 ? { validators: l3Validators } : {}),
+        coverageThreshold: resolvedConfig.layers.L3.coverageThreshold,
+      },
+      L4: {
+        enabled: resolvedConfig.layers.L4.enabled,
+        ...(l4Validators.length > 0 ? { validators: l4Validators } : {}),
+      },
+    },
+    harnesses: {
+      bundleSizeLimit: resolvedConfig.harnesses.bundleSizeLimit,
+      deadCodeGC: resolvedConfig.harnesses.deadCodeGC,
     },
+    architecture: resolvedConfig.architecture,
     validate: {
       failOnWarning: resolvedConfig.validate.failOnWarning,
     },
   };
 }
+
+function normalizeValidators(
+  validators: readonly string[],
+  aliases: Readonly<Record<string, string>>,
+  idPattern: RegExp,
+): readonly string[] {
+  const normalized = validators
+    .map((validator) => aliases[validator] ?? validator)
+    .filter((validator) => idPattern.test(validator));
+  return [...new Set(normalized)];
+}

package/scripts/harness/config-foundation/domain/services/architecture-resolution-service.ts

@@ -8,6 +8,8 @@ import {
   freezeArchitectureDocument,
   type ArchitectureConfigDocument,
   type ArchitectureConfigSource,
+  type CapabilityPolicy,
+  type DecisionPolicy,
   type ArchitectureLayerDetection,
   type ArchitectureMetadataTags,
   type ArchitecturePresetId,
@@ -48,6 +50,32 @@ const cloneDependencies = (
   return cloned;
 };
 
+const cloneCapabilityPolicies = (
+  source: Readonly<Record<string, CapabilityPolicy>>
+): Record<string, CapabilityPolicy> => {
+  const cloned: Record<string, CapabilityPolicy> = {};
+  for (const [key, value] of Object.entries(source)) {
+    cloned[key] = {
+      allowed: [...value.allowed],
+      denied: [...value.denied],
+    };
+  }
+  return cloned;
+};
+
+const cloneDecisionPolicies = (
+  source: Readonly<Record<string, DecisionPolicy>>
+): Record<string, DecisionPolicy> => {
+  const cloned: Record<string, DecisionPolicy> = {};
+  for (const [key, value] of Object.entries(source)) {
+    cloned[key] = {
+      expected: [...value.expected],
+      advisoryOnly: value.advisoryOnly,
+    };
+  }
+  return cloned;
+};
+
 const lookupPresetDefinition = (
   preset: ArchitecturePresetId
 ): ArchitecturePresetDefinition | null => {
@@ -92,6 +120,28 @@ const mergeDependencies = (
   return preset !== null ? cloneDependencies(preset.allowedDependencies) : {};
 };
 
+const mergeCapabilityPolicies = (
+  preset: ArchitecturePresetDefinition | null,
+  override: Readonly<Record<string, CapabilityPolicy>> | undefined
+): Record<string, CapabilityPolicy> => {
+  if (override !== undefined) {
+    return cloneCapabilityPolicies(override);
+  }
+
+  return preset !== null ? cloneCapabilityPolicies(preset.capabilityPolicies) : {};
+};
+
+const mergeDecisionPolicies = (
+  preset: ArchitecturePresetDefinition | null,
+  override: Readonly<Record<string, DecisionPolicy>> | undefined
+): Record<string, DecisionPolicy> => {
+  if (override !== undefined) {
+    return cloneDecisionPolicies(override);
+  }
+
+  return preset !== null ? cloneDecisionPolicies(preset.decisionPolicies) : {};
+};
+
 const mergeMetadataTags = (
   override: Partial<ArchitectureMetadataTags> | undefined
 ): ArchitectureMetadataTags => {
@@ -230,6 +280,14 @@ export class ArchitectureResolutionService {
       presetDefinition,
       effectiveSource.allowedDependencies
     );
+    const capabilityPolicies = mergeCapabilityPolicies(
+      presetDefinition,
+      effectiveSource.capabilityPolicies,
+    );
+    const decisionPolicies = mergeDecisionPolicies(
+      presetDefinition,
+      effectiveSource.decisionPolicies,
+    );
 
     validateDependencyKeys(layers, allowedDependencies);
     validateDependencyValues(layers, allowedDependencies);
@@ -247,6 +305,8 @@ export class ArchitectureResolutionService {
       allowedDependencies: freezeDependencies(allowedDependencies),
       metadataTags: mergeMetadataTags(effectiveSource.metadataTags),
       layerDetection,
+      capabilityPolicies,
+      decisionPolicies,
     });
 
     return Object.freeze({

package/scripts/harness/config-foundation/domain/value-objects/architecture-config.ts

@@ -25,12 +25,41 @@ export interface ArchitectureLayerDetection {
   readonly byTag: boolean;
 }
 
+export type EffectCapability =
+  | 'filesystem'
+  | 'network'
+  | 'database'
+  | 'process-env'
+  | 'time'
+  | 'random'
+  | 'subprocess'
+  | 'user-io';
+
+export type DecisionSignal =
+  | 'business-rule-branch'
+  | 'validation-rule'
+  | 'error-construction'
+  | 'state-transition'
+  | 'policy-selection';
+
+export interface CapabilityPolicy {
+  readonly allowed: readonly EffectCapability[];
+  readonly denied: readonly EffectCapability[];
+}
+
+export interface DecisionPolicy {
+  readonly expected: readonly DecisionSignal[];
+  readonly advisoryOnly: boolean;
+}
+
 export interface ArchitectureConfigSource {
   readonly preset: ArchitecturePresetId;
   readonly layers?: readonly string[];
   readonly allowedDependencies?: Readonly<Record<string, readonly string[]>>;
   readonly metadataTags?: Partial<ArchitectureMetadataTags>;
   readonly layerDetection?: Partial<ArchitectureLayerDetection>;
+  readonly capabilityPolicies?: Readonly<Record<string, CapabilityPolicy>>;
+  readonly decisionPolicies?: Readonly<Record<string, DecisionPolicy>>;
 }
 
 export interface ArchitectureConfigDocument {
@@ -39,6 +68,8 @@ export interface ArchitectureConfigDocument {
   readonly allowedDependencies: Readonly<Record<string, readonly string[]>>;
   readonly metadataTags: ArchitectureMetadataTags;
   readonly layerDetection: ArchitectureLayerDetection;
+  readonly capabilityPolicies: Readonly<Record<string, CapabilityPolicy>>;
+  readonly decisionPolicies: Readonly<Record<string, DecisionPolicy>>;
 }
 
 export const isArchitecturePresetId = (value: unknown): value is ArchitecturePresetId => {
@@ -51,10 +82,24 @@ export const freezeArchitectureDocument = (
   document: ArchitectureConfigDocument
 ): ArchitectureConfigDocument => {
   const frozenDependencies: Record<string, readonly string[]> = {};
+  const frozenCapabilityPolicies: Record<string, CapabilityPolicy> = {};
+  const frozenDecisionPolicies: Record<string, DecisionPolicy> = {};
 
   for (const [key, value] of Object.entries(document.allowedDependencies)) {
     frozenDependencies[key] = Object.freeze([...value]);
   }
+  for (const [key, value] of Object.entries(document.capabilityPolicies)) {
+    frozenCapabilityPolicies[key] = Object.freeze({
+      allowed: Object.freeze([...value.allowed]),
+      denied: Object.freeze([...value.denied]),
+    });
+  }
+  for (const [key, value] of Object.entries(document.decisionPolicies)) {
+    frozenDecisionPolicies[key] = Object.freeze({
+      expected: Object.freeze([...value.expected]),
+      advisoryOnly: value.advisoryOnly,
+    });
+  }
 
   return Object.freeze({
     preset: document.preset,
@@ -62,5 +107,7 @@ export const freezeArchitectureDocument = (
     allowedDependencies: Object.freeze(frozenDependencies),
     metadataTags: Object.freeze({ ...document.metadataTags }),
     layerDetection: Object.freeze({ ...document.layerDetection }),
+    capabilityPolicies: Object.freeze(frozenCapabilityPolicies),
+    decisionPolicies: Object.freeze(frozenDecisionPolicies),
   });
 };

package/scripts/harness/config-foundation/domain/value-objects/architecture-preset-catalog.ts

@@ -3,23 +3,41 @@
  * @unit config-foundation
  */
 
-import type { ArchitecturePresetId } from './architecture-config.js';
+import type { ArchitecturePresetId, CapabilityPolicy, DecisionPolicy } from './architecture-config.js';
 
 export interface ArchitecturePresetDefinition {
   readonly layers: readonly string[];
   readonly allowedDependencies: Readonly<Record<string, readonly string[]>>;
+  readonly capabilityPolicies: Readonly<Record<string, CapabilityPolicy>>;
+  readonly decisionPolicies: Readonly<Record<string, DecisionPolicy>>;
 }
 
 const freeze = (definition: ArchitecturePresetDefinition): ArchitecturePresetDefinition => {
   const dependencies: Record<string, readonly string[]> = {};
+  const capabilityPolicies: Record<string, CapabilityPolicy> = {};
+  const decisionPolicies: Record<string, DecisionPolicy> = {};
 
   for (const [key, value] of Object.entries(definition.allowedDependencies)) {
     dependencies[key] = Object.freeze([...value]);
   }
+  for (const [key, value] of Object.entries(definition.capabilityPolicies)) {
+    capabilityPolicies[key] = Object.freeze({
+      allowed: Object.freeze([...value.allowed]),
+      denied: Object.freeze([...value.denied]),
+    });
+  }
+  for (const [key, value] of Object.entries(definition.decisionPolicies)) {
+    decisionPolicies[key] = Object.freeze({
+      expected: Object.freeze([...value.expected]),
+      advisoryOnly: value.advisoryOnly,
+    });
+  }
 
   return Object.freeze({
     layers: Object.freeze([...definition.layers]),
     allowedDependencies: Object.freeze(dependencies),
+    capabilityPolicies: Object.freeze(capabilityPolicies),
+    decisionPolicies: Object.freeze(decisionPolicies),
   });
 };
 
@@ -34,6 +52,18 @@ export const ARCHITECTURE_PRESET_CATALOG: Readonly<
       infrastructure: ['infrastructure', 'application', 'domain'],
       presentation: ['presentation', 'application', 'domain'],
     },
+    capabilityPolicies: {
+      domain: { allowed: [], denied: ['filesystem', 'network', 'database', 'process-env', 'subprocess', 'user-io'] },
+      application: { allowed: ['time', 'random'], denied: ['filesystem', 'network', 'database', 'subprocess'] },
+      infrastructure: { allowed: ['filesystem', 'network', 'database', 'process-env', 'time', 'random', 'subprocess', 'user-io'], denied: [] },
+      presentation: { allowed: ['user-io', 'time'], denied: ['database', 'subprocess'] },
+    },
+    decisionPolicies: {
+      domain: { expected: ['business-rule-branch', 'validation-rule', 'state-transition'], advisoryOnly: true },
+      application: { expected: ['policy-selection', 'error-construction'], advisoryOnly: true },
+      infrastructure: { expected: ['error-construction'], advisoryOnly: true },
+      presentation: { expected: ['validation-rule', 'error-construction'], advisoryOnly: true },
+    },
   }),
   'strict-ddd': freeze({
     layers: ['domain', 'application', 'infrastructure', 'presentation'],
@@ -43,6 +73,18 @@ export const ARCHITECTURE_PRESET_CATALOG: Readonly<
       infrastructure: ['infrastructure', 'application', 'domain'],
       presentation: ['presentation', 'application'],
     },
+    capabilityPolicies: {
+      domain: { allowed: [], denied: ['filesystem', 'network', 'database', 'process-env', 'subprocess', 'user-io'] },
+      application: { allowed: ['time'], denied: ['filesystem', 'network', 'database', 'random', 'subprocess'] },
+      infrastructure: { allowed: ['filesystem', 'network', 'database', 'process-env', 'time', 'random', 'subprocess', 'user-io'], denied: [] },
+      presentation: { allowed: ['user-io'], denied: ['database', 'subprocess'] },
+    },
+    decisionPolicies: {
+      domain: { expected: ['business-rule-branch', 'validation-rule', 'state-transition'], advisoryOnly: true },
+      application: { expected: ['policy-selection'], advisoryOnly: true },
+      infrastructure: { expected: [], advisoryOnly: true },
+      presentation: { expected: ['error-construction'], advisoryOnly: true },
+    },
   }),
   onion: freeze({
     layers: ['domain', 'application', 'interface'],
@@ -51,6 +93,16 @@ export const ARCHITECTURE_PRESET_CATALOG: Readonly<
       application: ['application', 'domain'],
       interface: ['interface', 'application', 'domain'],
     },
+    capabilityPolicies: {
+      domain: { allowed: [], denied: ['filesystem', 'network', 'database', 'process-env', 'subprocess', 'user-io'] },
+      application: { allowed: ['time', 'random'], denied: ['filesystem', 'network', 'database', 'subprocess'] },
+      interface: { allowed: ['filesystem', 'network', 'database', 'process-env', 'time', 'random', 'subprocess', 'user-io'], denied: [] },
+    },
+    decisionPolicies: {
+      domain: { expected: ['business-rule-branch', 'validation-rule', 'state-transition'], advisoryOnly: true },
+      application: { expected: ['policy-selection', 'error-construction'], advisoryOnly: true },
+      interface: { expected: ['error-construction'], advisoryOnly: true },
+    },
   }),
   hexagonal: freeze({
     layers: ['core', 'ports', 'adapters'],
@@ -59,6 +111,16 @@ export const ARCHITECTURE_PRESET_CATALOG: Readonly<
       ports: ['ports', 'core'],
       adapters: ['adapters', 'ports', 'core'],
     },
+    capabilityPolicies: {
+      core: { allowed: [], denied: ['filesystem', 'network', 'database', 'process-env', 'subprocess', 'user-io'] },
+      ports: { allowed: [], denied: ['filesystem', 'network', 'database', 'subprocess'] },
+      adapters: { allowed: ['filesystem', 'network', 'database', 'process-env', 'time', 'random', 'subprocess', 'user-io'], denied: [] },
+    },
+    decisionPolicies: {
+      core: { expected: ['business-rule-branch', 'validation-rule', 'state-transition'], advisoryOnly: true },
+      ports: { expected: [], advisoryOnly: true },
+      adapters: { expected: ['error-construction'], advisoryOnly: true },
+    },
   }),
   layered: freeze({
     layers: ['controller', 'service', 'repository'],
@@ -67,9 +129,21 @@ export const ARCHITECTURE_PRESET_CATALOG: Readonly<
       service: ['service', 'repository'],
       repository: ['repository'],
     },
+    capabilityPolicies: {
+      controller: { allowed: ['user-io'], denied: ['database', 'filesystem', 'subprocess'] },
+      service: { allowed: ['time', 'random'], denied: ['filesystem', 'network', 'database', 'subprocess'] },
+      repository: { allowed: ['database', 'filesystem', 'network', 'process-env'], denied: ['user-io'] },
+    },
+    decisionPolicies: {
+      controller: { expected: ['validation-rule', 'error-construction'], advisoryOnly: true },
+      service: { expected: ['business-rule-branch', 'policy-selection', 'state-transition'], advisoryOnly: true },
+      repository: { expected: ['error-construction'], advisoryOnly: true },
+    },
   }),
   flat: freeze({
     layers: [],
     allowedDependencies: {},
+    capabilityPolicies: {},
+    decisionPolicies: {},
   }),
 });

package/scripts/harness/config-foundation/infrastructure/schemas/harness-config-v3.schema.json

@@ -12,6 +12,16 @@
     "paths",
     "reporting"
   ],
+  "$defs": {
+    "effectCapability": {
+      "type": "string",
+      "enum": ["filesystem", "network", "database", "process-env", "time", "random", "subprocess", "user-io"]
+    },
+    "decisionSignal": {
+      "type": "string",
+      "enum": ["business-rule-branch", "validation-rule", "error-construction", "state-transition", "policy-selection"]
+    }
+  },
   "properties": {
     "project": {
       "type": "object",
@@ -565,6 +575,42 @@
             "byPath": { "type": "boolean" },
             "byTag": { "type": "boolean" }
           }
+        },
+        "capabilityPolicies": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["allowed", "denied"],
+            "properties": {
+              "allowed": {
+                "type": "array",
+                "items": { "$ref": "#/$defs/effectCapability" },
+                "uniqueItems": true
+              },
+              "denied": {
+                "type": "array",
+                "items": { "$ref": "#/$defs/effectCapability" },
+                "uniqueItems": true
+              }
+            }
+          }
+        },
+        "decisionPolicies": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["expected", "advisoryOnly"],
+            "properties": {
+              "expected": {
+                "type": "array",
+                "items": { "$ref": "#/$defs/decisionSignal" },
+                "uniqueItems": true
+              },
+              "advisoryOnly": { "type": "boolean" }
+            }
+          }
         }
       },
       "allOf": [

package/scripts/harness/validator-system/application/use-cases/run-l4-validators-usecase.ts

@@ -17,6 +17,7 @@ import type { ValidatorConfigPort } from '../../domain/ports/validator-config-po
 import type { DriftDetectionService } from '../../domain/services/l4/drift-detection-service.js';
 import type { ConsistencyCheckService } from '../../domain/services/l4/consistency-check-service.js';
 import type { DeadCodeDetectionService } from '../../domain/services/l4/dead-code-detection-service.js';
+import type { ArchitectureSemanticAnalysisService } from '../../domain/services/l4/architecture-semantic-analysis-service.js';
 
 interface ScheduledHarnessErrorContract {
   readonly severity: string;
@@ -65,6 +66,7 @@ export interface RunL4ValidatorsUseCaseDeps {
   driftDetectionService?: DriftDetectionService;
   consistencyCheckService?: ConsistencyCheckService;
   deadCodeDetectionService?: DeadCodeDetectionService;
+  architectureSemanticAnalysisService?: ArchitectureSemanticAnalysisService;
   checkDocFreshnessUseCase?: CheckDocFreshnessUseCasePort;
   validateDocPointersUseCase?: ValidateDocPointersUseCasePort;
 }
@@ -77,6 +79,7 @@ export class RunL4ValidatorsUseCase {
   private readonly driftDetectionService?: DriftDetectionService;
   private readonly consistencyCheckService?: ConsistencyCheckService;
   private readonly deadCodeDetectionService?: DeadCodeDetectionService;
+  private readonly architectureSemanticAnalysisService?: ArchitectureSemanticAnalysisService;
   private readonly checkDocFreshnessUseCase?: CheckDocFreshnessUseCasePort;
   private readonly validateDocPointersUseCase?: ValidateDocPointersUseCasePort;
 
@@ -88,6 +91,7 @@ export class RunL4ValidatorsUseCase {
     this.driftDetectionService = deps.driftDetectionService;
     this.consistencyCheckService = deps.consistencyCheckService;
     this.deadCodeDetectionService = deps.deadCodeDetectionService;
+    this.architectureSemanticAnalysisService = deps.architectureSemanticAnalysisService;
     this.checkDocFreshnessUseCase = deps.checkDocFreshnessUseCase;
     this.validateDocPointersUseCase = deps.validateDocPointersUseCase;
   }
@@ -148,10 +152,13 @@ export class RunL4ValidatorsUseCase {
       const l4002Result = overrideMap.get('L4-002');
       if (l4002Result && !l4002Result.skipped) {
         const report = await this.consistencyCheckService.check(input.targetUnits ? [...input.targetUnits] : undefined);
-        if (report.hasMismatches()) {
+        const architectureSemanticErrors = this.architectureSemanticAnalysisService
+          ? await this.architectureSemanticAnalysisService.analyze()
+          : [];
+        if (report.hasMismatches() || architectureSemanticErrors.length > 0) {
           overrideMap.set(
             'L4-002',
-            ValidationResult.fail(ValidatorId.create('L4-002'), [...report.toHarnessErrors()], 0),
+            ValidationResult.fail(ValidatorId.create('L4-002'), [...report.toHarnessErrors(), ...architectureSemanticErrors], 0),
           );
         }
       }