phasegate 0.151.1 → 0.152.1

package/scripts/harness/validator-system/composition-root.ts

@@ -35,9 +35,11 @@ import { MarkdownDesignDocumentAdapter } from './infrastructure/adapters/markdow
 import { BiomeAstSourceCodeAnalyzerAdapter } from './infrastructure/adapters/biome-ast-source-code-analyzer-adapter.js';
 import { AdrFoundationReferenceAdapter } from './infrastructure/adapters/adr-foundation-reference-adapter.js';
 import { ImportGraphSourceAnalysisAdapter } from './infrastructure/adapters/import-graph-source-analysis-adapter.js';
+import { FileSystemArchitectureSemanticSourceAdapter } from './infrastructure/adapters/file-system-architecture-semantic-source-adapter.js';
 import { DriftDetectionService } from './domain/services/l4/drift-detection-service.js';
 import { ConsistencyCheckService } from './domain/services/l4/consistency-check-service.js';
 import { DeadCodeDetectionService } from './domain/services/l4/dead-code-detection-service.js';
+import { ArchitectureSemanticAnalysisService, type ArchitectureSemanticPolicy } from './domain/services/l4/architecture-semantic-analysis-service.js';
 import { buildPhase2Extensions } from '../phase2-extensions/composition-root.js';
 import { RunValidatorsHandler } from './presentation/handlers/run-validators-handler.js';
 import { RunQuickModeHandler } from './presentation/handlers/run-quick-mode-handler.js';
@@ -53,6 +55,20 @@ const DEFAULT_CONFIG = {
     L4: { enabled: true, validators: ['L4-001', 'L4-002', 'L4-003', 'L4-004', 'L4-005'] },
   },
   validate: { failOnWarning: false },
+  architecture: {
+    capabilityPolicies: {
+      domain: { allowed: [], denied: ['filesystem', 'network', 'database', 'process-env', 'subprocess', 'user-io'] },
+      application: { allowed: ['time', 'random'], denied: ['filesystem', 'network', 'database', 'subprocess'] },
+      infrastructure: { allowed: ['filesystem', 'network', 'database', 'process-env', 'time', 'random', 'subprocess', 'user-io'], denied: [] },
+      presentation: { allowed: ['user-io', 'time'], denied: ['database', 'subprocess'] },
+    },
+    decisionPolicies: {
+      domain: { expected: ['business-rule-branch', 'validation-rule', 'state-transition'], advisoryOnly: true },
+      application: { expected: ['policy-selection', 'error-construction'], advisoryOnly: true },
+      infrastructure: { expected: ['error-construction'], advisoryOnly: true },
+      presentation: { expected: ['validation-rule', 'error-construction'], advisoryOnly: true },
+    },
+  },
 };
 
 /** バリデータ定義カタログ */
@@ -171,6 +187,7 @@ export function createValidatorSystemModule(config?: object): ValidatorSystemMod
   const sourceCodeAnalyzerAdapter = new BiomeAstSourceCodeAnalyzerAdapter();
   const adrReferencePort = new AdrFoundationReferenceAdapter();
   const sourceAnalysisPort = new ImportGraphSourceAnalysisAdapter();
+  const architectureSemanticSourcePort = new FileSystemArchitectureSemanticSourceAdapter();
 
   const driftDetectionService = new DriftDetectionService({
     designDocumentPort: markdownDesignDocumentPort,
@@ -183,6 +200,10 @@ export function createValidatorSystemModule(config?: object): ValidatorSystemMod
   const deadCodeDetectionService = new DeadCodeDetectionService({
     sourceAnalysisPort,
   });
+  const architectureSemanticAnalysisService = new ArchitectureSemanticAnalysisService({
+    sourcePort: architectureSemanticSourcePort,
+    policy: toArchitectureSemanticPolicy(configData),
+  });
   const phase2Extensions = buildPhase2Extensions(process.cwd(), configData as never);
 
   const runL4ValidatorsUseCase = new RunL4ValidatorsUseCase({
@@ -193,6 +214,7 @@ export function createValidatorSystemModule(config?: object): ValidatorSystemMod
     driftDetectionService,
     consistencyCheckService,
     deadCodeDetectionService,
+    architectureSemanticAnalysisService,
     checkDocFreshnessUseCase: phase2Extensions.checkDocFreshnessUseCase,
     validateDocPointersUseCase: phase2Extensions.validateDocPointersUseCase,
   });
@@ -247,3 +269,11 @@ export function createValidatorSystemModule(config?: object): ValidatorSystemMod
     handlers,
   };
 }
+
+function toArchitectureSemanticPolicy(configData: typeof DEFAULT_CONFIG): ArchitectureSemanticPolicy {
+  const architecture = configData.architecture;
+  return {
+    capabilityPolicies: architecture?.capabilityPolicies ?? DEFAULT_CONFIG.architecture.capabilityPolicies,
+    decisionPolicies: architecture?.decisionPolicies ?? DEFAULT_CONFIG.architecture.decisionPolicies,
+  } as ArchitectureSemanticPolicy;
+}

package/scripts/harness/validator-system/domain/ports/source-analysis-port.ts

@@ -2,8 +2,8 @@
 // @layer domain
 
 export interface ImportGraphData {
-  readonly nodes: readonly { filePath: string; exports: readonly string[] }[];
-  readonly edges: readonly { from: string; to: string; importedNames: readonly string[] }[];
+  readonly nodes: readonly { filePath: string; exports: readonly string[]; excludedReason?: string }[];
+  readonly edges: readonly { from: string; to: string; importedNames: readonly string[]; kind?: string }[];
   readonly unusedExports?: readonly string[];
   readonly unreachableCode?: readonly { filePath: string; range: { startLine: number; endLine: number } }[];
 }

package/scripts/harness/validator-system/domain/services/l4/architecture-semantic-analysis-service.ts

@@ -0,0 +1,124 @@
+/**
+ * @layer domain
+ * @unit validator-system
+ * @work-item-id WI-134, WI-135
+ *
+ * ArchitectureSemanticAnalysisService
+ * Architecture preset の capability / decision policy と source semantic signal を照合する advisory service.
+ */
+import type { HarnessErrorLike } from '../../value-objects/validation-result.js';
+
+export type EffectCapability =
+  | 'filesystem'
+  | 'network'
+  | 'database'
+  | 'process-env'
+  | 'time'
+  | 'random'
+  | 'subprocess'
+  | 'user-io';
+
+export type DecisionSignal =
+  | 'business-rule-branch'
+  | 'validation-rule'
+  | 'error-construction'
+  | 'state-transition'
+  | 'policy-selection';
+
+export interface ArchitectureCapabilityPolicy {
+  readonly allowed: readonly EffectCapability[];
+  readonly denied: readonly EffectCapability[];
+}
+
+export interface ArchitectureDecisionPolicy {
+  readonly expected: readonly DecisionSignal[];
+  readonly advisoryOnly: boolean;
+}
+
+export interface ArchitectureSemanticPolicy {
+  readonly capabilityPolicies: Readonly<Record<string, ArchitectureCapabilityPolicy>>;
+  readonly decisionPolicies: Readonly<Record<string, ArchitectureDecisionPolicy>>;
+}
+
+export interface SourceSemanticSignal {
+  readonly kind: EffectCapability | DecisionSignal;
+  readonly evidence: string;
+  readonly confidence: number;
+}
+
+export interface SourceSemanticFile {
+  readonly filePath: string;
+  readonly zone: string;
+  readonly effects: readonly SourceSemanticSignal[];
+  readonly decisions: readonly SourceSemanticSignal[];
+}
+
+export interface ArchitectureSemanticSourcePort {
+  collectSourceSemantics(): Promise<readonly SourceSemanticFile[]>;
+}
+
+export interface ArchitectureSemanticAnalysisServiceDeps {
+  readonly sourcePort: ArchitectureSemanticSourcePort;
+  readonly policy: ArchitectureSemanticPolicy;
+}
+
+const DEFAULT_DECISION_OWNER: Readonly<Record<DecisionSignal, string>> = Object.freeze({
+  'business-rule-branch': 'domain',
+  'validation-rule': 'domain',
+  'error-construction': 'application',
+  'state-transition': 'domain',
+  'policy-selection': 'application',
+});
+
+export class ArchitectureSemanticAnalysisService {
+  private readonly sourcePort: ArchitectureSemanticSourcePort;
+  private readonly policy: ArchitectureSemanticPolicy;
+
+  constructor(deps: ArchitectureSemanticAnalysisServiceDeps) {
+    this.sourcePort = deps.sourcePort;
+    this.policy = deps.policy;
+  }
+
+  async analyze(): Promise<readonly HarnessErrorLike[]> {
+    const files = await this.sourcePort.collectSourceSemantics();
+    return files.flatMap((file) => [
+      ...this.toCapabilityFindings(file),
+      ...this.toDecisionFindings(file),
+    ]);
+  }
+
+  private toCapabilityFindings(file: SourceSemanticFile): HarnessErrorLike[] {
+    const zonePolicy = this.policy.capabilityPolicies[file.zone];
+    if (!zonePolicy) return [];
+    const denied = new Set(zonePolicy.denied);
+
+    return file.effects
+      .filter((effect) => denied.has(effect.kind as EffectCapability))
+      .map((effect) => this.toHarnessError(
+        `Side effect capability denied: ${effect.kind} in ${file.zone} at ${file.filePath}`,
+        `confidence=${effect.confidence}; evidence=${effect.evidence}; suggested owner zone=infrastructure/adapters`,
+      ));
+  }
+
+  private toDecisionFindings(file: SourceSemanticFile): HarnessErrorLike[] {
+    const zonePolicy = this.policy.decisionPolicies[file.zone];
+    if (!zonePolicy) return [];
+    const expected = new Set(zonePolicy.expected);
+
+    return file.decisions
+      .filter((decision) => !expected.has(decision.kind as DecisionSignal))
+      .map((decision) => this.toHarnessError(
+        `Decision placement advisory: ${decision.kind} observed in ${file.zone} at ${file.filePath}`,
+        `confidence=${decision.confidence}; evidence=${decision.evidence}; suggested owner zone=${DEFAULT_DECISION_OWNER[decision.kind as DecisionSignal] ?? 'domain'}; rollout=advisory`,
+      ));
+  }
+
+  private toHarnessError(message: string, suggestion: string): HarnessErrorLike {
+    return {
+      code: { value: 'L4-002', toString: () => 'L4-002' },
+      severity: { value: 'warning', toString: () => 'warning' },
+      message,
+      suggestion,
+    };
+  }
+}

package/scripts/harness/validator-system/domain/services/l4/dead-code-detection-service.ts

@@ -9,8 +9,8 @@ import { DeadCodeReport } from '../../value-objects/dead-code-report.js';
 
 export interface DeadCodeSourceAnalysisPort {
   getImportGraph(): Promise<{
-    nodes?: readonly { filePath: string; exports: readonly string[] }[];
-    edges?: readonly { from: string; to: string; importedNames: readonly string[] }[];
+    nodes?: readonly { filePath: string; exports: readonly string[]; excludedReason?: string }[];
+    edges?: readonly { from: string; to: string; importedNames: readonly string[]; kind?: string }[];
     unusedExports?: readonly string[];
     unreachableCode?: readonly { filePath: string; range: { startLine: number; endLine: number } }[];
   }>;

package/scripts/harness/validator-system/infrastructure/adapters/ast-performance-scanner-adapter.ts

@@ -8,9 +8,11 @@
 import * as ts from 'typescript';
 import type { PerformanceScannerPort } from '../../domain/ports/performance-scanner-port.js';
 import type { HarnessErrorLike } from '../../domain/value-objects/validation-result.js';
-import { readdir, stat } from 'node:fs/promises';
+import { readFile, readdir, stat } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 
+const SUPPRESSION_MARKER = 'phasegate-ignore-performance';
+
 export class AstPerformanceScannerAdapter implements PerformanceScannerPort {
   async scan(targetPaths: readonly string[], thresholds: Record<string, number>): Promise<{
     passed: boolean;
@@ -33,12 +35,15 @@ export class AstPerformanceScannerAdapter implements PerformanceScannerPort {
 
       for (const filePath of filePaths) {
         try {
-          const [fileStat] = await Promise.all([stat(filePath)]);
+          const [fileStat, content] = await Promise.all([stat(filePath), readFile(filePath, 'utf8')]);
+          if (content.includes(SUPPRESSION_MARKER)) {
+            continue;
+          }
 
           // Bundle size check (file-level size)
           const bundleSizeLimit = thresholds.bundleSizeLimit;
           if (typeof bundleSizeLimit === 'number' && fileStat.size > bundleSizeLimit) {
-            findings.push(createFinding('L3-002', `bundleSizeLimit を超過しました: ${filePath} (${fileStat.size} bytes)`));
+            findings.push(createFinding('L3-002', `bundleSizeLimit を超過しました: ${filePath} metric=file-size actual=${fileStat.size} threshold=${bundleSizeLimit}`));
           }
 
           // AST-based await-in-loop detection
@@ -46,6 +51,13 @@ export class AstPerformanceScannerAdapter implements PerformanceScannerPort {
           if (sourceFile && hasAwaitInLoop(sourceFile)) {
             findings.push(createFinding('L3-002', `ループ内 await を検出しました: ${filePath}`));
           }
+          if (sourceFile && hasSyncIoCall(sourceFile)) {
+            findings.push(createFinding('L3-002', `同期I/O呼び出しを検出しました: ${filePath} metric=sync-io threshold=0`));
+          }
+          const largeLiteralThreshold = thresholds.largeLiteralEntries ?? 80;
+          if (sourceFile && hasLargeLiteral(sourceFile, largeLiteralThreshold)) {
+            findings.push(createFinding('L3-002', `largeLiteralEntries を超過しました: ${filePath} metric=literal-entries threshold=${largeLiteralThreshold}`));
+          }
         } catch {
           continue;
         }
@@ -56,6 +68,46 @@ export class AstPerformanceScannerAdapter implements PerformanceScannerPort {
   }
 }
 
+function hasSyncIoCall(root: ts.Node): boolean {
+  let found = false;
+
+  function visit(node: ts.Node): void {
+    if (found) return;
+    if (ts.isCallExpression(node)) {
+      const expressionText = node.expression.getText(root.getSourceFile());
+      if (/\b(?:readFileSync|writeFileSync|appendFileSync|readdirSync|statSync|existsSync|execFileSync|execSync|spawnSync)\b/.test(expressionText)) {
+        found = true;
+        return;
+      }
+    }
+    ts.forEachChild(node, visit);
+  }
+
+  visit(root);
+  return found;
+}
+
+function hasLargeLiteral(root: ts.Node, threshold: number): boolean {
+  let found = false;
+
+  function visit(node: ts.Node): void {
+    if (found) return;
+    const literalSize = ts.isObjectLiteralExpression(node)
+      ? node.properties.length
+      : ts.isArrayLiteralExpression(node)
+        ? node.elements.length
+        : 0;
+    if (literalSize > threshold) {
+      found = true;
+      return;
+    }
+    ts.forEachChild(node, visit);
+  }
+
+  visit(root);
+  return found;
+}
+
 /**
  * ループノード（for/while/do/for-in/for-of）の直下に await が存在するか検出する。
  * ネストされた関数・アロー関数境界は越えない。

package/scripts/harness/validator-system/infrastructure/adapters/biome-ast-source-code-analyzer-adapter.ts

@@ -131,8 +131,11 @@ function extractExports(sourceFile: ts.SourceFile): SourceAnalysisResult['export
           exports.push({ name: element.name.text, type: 'type' });
         }
       }
-    } else if (ts.isExportDeclaration(node) && !node.exportClause && ts.isStringLiteral(node.moduleSpecifier)) {
-      exports.push({ name: `* from ${node.moduleSpecifier.text}`, type: 'type' });
+    } else if (ts.isExportDeclaration(node) && !node.exportClause) {
+      const moduleSpecifier = node.moduleSpecifier;
+      if (moduleSpecifier !== undefined && ts.isStringLiteral(moduleSpecifier)) {
+        exports.push({ name: `* from ${moduleSpecifier.text}`, type: 'type' });
+      }
     }
 
     const hasDefault = modifiers?.some((m) => m.kind === ts.SyntaxKind.DefaultKeyword) ?? false;

package/scripts/harness/validator-system/infrastructure/adapters/file-system-architecture-semantic-source-adapter.ts

@@ -0,0 +1,115 @@
+/**
+ * @layer infrastructure
+ * @unit validator-system
+ * @work-item-id WI-134, WI-135
+ *
+ * FileSystemArchitectureSemanticSourceAdapter
+ * TypeScript source から side-effect capability / decision placement signal を軽量抽出する。
+ */
+import { readdir, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import type {
+  ArchitectureSemanticSourcePort,
+  DecisionSignal,
+  EffectCapability,
+  SourceSemanticFile,
+  SourceSemanticSignal,
+} from '../../domain/services/l4/architecture-semantic-analysis-service.js';
+
+export class FileSystemArchitectureSemanticSourceAdapter implements ArchitectureSemanticSourcePort {
+  private readonly sourceRoot: string;
+
+  constructor(sourceRoot: string = join(process.cwd(), 'scripts/harness')) {
+    this.sourceRoot = sourceRoot;
+  }
+
+  async collectSourceSemantics(): Promise<readonly SourceSemanticFile[]> {
+    const filePaths = await walkTsFiles(this.sourceRoot);
+    const files: SourceSemanticFile[] = [];
+
+    for (const filePath of filePaths) {
+      if (isExcluded(filePath)) continue;
+      try {
+        const content = await readFile(filePath, 'utf8');
+        files.push({
+          filePath,
+          zone: detectZone(filePath, content),
+          effects: detectEffects(content),
+          decisions: detectDecisions(content),
+        });
+      } catch {
+        continue;
+      }
+    }
+
+    return files;
+  }
+}
+
+async function walkTsFiles(root: string): Promise<string[]> {
+  try {
+    const entries = await readdir(root, { withFileTypes: true });
+    const files = await Promise.all(entries.map(async (entry) => {
+      const fullPath = join(root, entry.name);
+      if (entry.isDirectory()) return walkTsFiles(fullPath);
+      return fullPath.endsWith('.ts') ? [fullPath] : [];
+    }));
+    return files.flat();
+  } catch {
+    return [];
+  }
+}
+
+function isExcluded(filePath: string): boolean {
+  const normalized = filePath.replaceAll('\\', '/');
+  return /(^|\/)__tests__\//.test(normalized) || /\.test\.ts$/.test(normalized) || /(^|\/)fixtures?\//.test(normalized);
+}
+
+function detectZone(filePath: string, content: string): string {
+  const tagMatch = content.match(/@layer\s+([a-z][a-z0-9-]*)/);
+  if (tagMatch?.[1]) return tagMatch[1];
+
+  const normalized = filePath.replaceAll('\\', '/');
+  for (const zone of ['domain', 'application', 'infrastructure', 'presentation', 'controller', 'service', 'repository', 'core', 'ports', 'adapters']) {
+    if (normalized.includes(`/${zone}/`)) return zone;
+  }
+  return 'application';
+}
+
+function detectEffects(content: string): SourceSemanticSignal[] {
+  const checks: Array<{ kind: EffectCapability; pattern: RegExp; evidence: string }> = [
+    { kind: 'filesystem', pattern: /\bnode:fs\b|\bfrom\s+['"]fs['"]|\b(?:readFileSync|writeFileSync|readdirSync|statSync)\b/, evidence: 'filesystem API reference' },
+    { kind: 'network', pattern: /\bfetch\s*\(|\bnode:https?\b|\bfrom\s+['"]https?['"]/, evidence: 'network API reference' },
+    { kind: 'database', pattern: /\b(?:prisma|sequelize|knex|sql`|\.query\s*\()/i, evidence: 'database API reference' },
+    { kind: 'process-env', pattern: /\bprocess\.env\b/, evidence: 'process.env reference' },
+    { kind: 'time', pattern: /\bDate\.now\s*\(|\bnew\s+Date\s*\(/, evidence: 'time source reference' },
+    { kind: 'random', pattern: /\bMath\.random\s*\(|\brandomUUID\s*\(/, evidence: 'random source reference' },
+    { kind: 'subprocess', pattern: /\bnode:child_process\b|\b(?:execSync|execFileSync|spawnSync)\b/, evidence: 'subprocess API reference' },
+    { kind: 'user-io', pattern: /\bnode:readline\b|\bprompt\s*\(/, evidence: 'user I/O reference' },
+  ];
+
+  return checks
+    .filter((check) => check.pattern.test(content))
+    .map((check) => ({ kind: check.kind, evidence: check.evidence, confidence: 0.9 }));
+}
+
+function detectDecisions(content: string): SourceSemanticSignal[] {
+  const signals: SourceSemanticSignal[] = [];
+  const branchCount = (content.match(/\bif\s*\(|\bswitch\s*\(/g) ?? []).length;
+  if (branchCount >= 3) {
+    signals.push({ kind: 'business-rule-branch', evidence: `branch-count=${branchCount}`, confidence: 0.72 });
+  }
+  if (/\b(?:validate|isValid|required|invalid)\b/i.test(content) && /\bif\s*\(/.test(content)) {
+    signals.push({ kind: 'validation-rule', evidence: 'validation keyword with branch', confidence: 0.7 });
+  }
+  if (/\b(?:new\s+Error|HarnessError|throw\s+new)\b/.test(content)) {
+    signals.push({ kind: 'error-construction', evidence: 'error construction expression', confidence: 0.86 });
+  }
+  if (/\b(?:state|status)\s*=|transition[A-Z]\w*\s*\(/.test(content)) {
+    signals.push({ kind: 'state-transition', evidence: 'state/status transition expression', confidence: 0.78 });
+  }
+  if (/\bswitch\s*\(|\bselect[A-Z]\w*\s*\(/.test(content)) {
+    signals.push({ kind: 'policy-selection', evidence: 'policy selection branch', confidence: 0.68 });
+  }
+  return signals;
+}

package/scripts/harness/validator-system/infrastructure/adapters/file-system-security-pattern-scanner-adapter.ts

@@ -8,11 +8,26 @@ import type { SecurityPatternScannerPort } from '../../domain/ports/security-pat
 import type { HarnessErrorLike } from '../../domain/value-objects/validation-result.js';
 import { readFile } from 'node:fs/promises';
 
-const SECURITY_PATTERNS = [
-  { pattern: /(?:API_KEY|api_key|apikey)\s*=\s*["'][^"']{8,}["']/gi, description: 'ハードコードAPIキー' },
-  { pattern: /(?:password|PASSWORD|passwd)\s*=\s*["'][^"']{4,}["']/gi, description: 'ハードコードパスワード' },
-  { pattern: /sk-[a-zA-Z0-9]{20,}/g, description: 'OpenAI APIキー形式' },
-];
+const ALLOWLIST_MARKER = 'phasegate-allow-secret-fixture';
+
+interface SecurityPattern {
+  readonly ruleId: string;
+  readonly pattern: RegExp;
+  readonly description: string;
+}
+
+const SECURITY_PATTERNS: readonly SecurityPattern[] = Object.freeze([
+  { ruleId: 'secret.openai', pattern: /\b(?:sk|rk|sess)-[a-zA-Z0-9_-]{20,}\b/g, description: 'OpenAI token family' },
+  { ruleId: 'secret.github', pattern: /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/g, description: 'GitHub token family' },
+  { ruleId: 'secret.aws-access-key', pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, description: 'AWS access key id' },
+  { ruleId: 'secret.npm', pattern: /\bnpm_[A-Za-z0-9]{24,}\b/g, description: 'npm token family' },
+  { ruleId: 'secret.slack', pattern: /\bxox[abprs]-[A-Za-z0-9-]{20,}\b/g, description: 'Slack token family' },
+  {
+    ruleId: 'secret.keyword-context',
+    pattern: /\b(?:API_KEY|api_key|apikey|password|PASSWORD|passwd|secret|token)\b\s*[:=]\s*["'][^"']{8,}["']/g,
+    description: 'keyword-context secret',
+  },
+]);
 
 export class FileSystemSecurityPatternScannerAdapter implements SecurityPatternScannerPort {
   async scan(targetPaths: readonly string[]): Promise<{
@@ -24,15 +39,24 @@ export class FileSystemSecurityPatternScannerAdapter implements SecurityPatternS
     for (const filePath of targetPaths) {
       try {
         const content = await readFile(filePath, 'utf-8');
+        if (content.includes(ALLOWLIST_MARKER)) {
+          continue;
+        }
         const lines = content.split('\n');
         lines.forEach((line, idx) => {
-          for (const { pattern, description } of SECURITY_PATTERNS) {
-            if (pattern.test(line)) {
+          if (isAllowlisted(line, content)) {
+            return;
+          }
+          for (const { pattern, description, ruleId } of SECURITY_PATTERNS) {
+            pattern.lastIndex = 0;
+            const matches = [...line.matchAll(pattern)];
+            for (const match of matches) {
+              const secretValue = match[0] ?? '';
               findings.push({
                 code: { value: 'L3-001', toString: () => 'L3-001' },
                 severity: { value: 'error', toString: () => 'error' },
-                message: `セキュリティ問題: ${description} at ${filePath}:${idx + 1}`,
-                suggestion: '秘密情報は環境変数または秘密管理サービスを使用してください',
+                message: `セキュリティ問題: ${description} (${ruleId}) at ${filePath}:${idx + 1} value=${redactSecret(secretValue)}`,
+                suggestion: `${ruleId}: 秘密情報は環境変数または秘密管理サービスを使用してください。fixture/docs のダミー値は ${ALLOWLIST_MARKER} を明示してください。`,
               });
             }
           }
@@ -45,3 +69,14 @@ export class FileSystemSecurityPatternScannerAdapter implements SecurityPatternS
     return { passed: findings.length === 0, findings };
   }
 }
+
+function isAllowlisted(line: string, content: string): boolean {
+  if (line.includes(ALLOWLIST_MARKER)) return true;
+  return /@example|dummy|placeholder/i.test(line) && content.includes(ALLOWLIST_MARKER);
+}
+
+function redactSecret(secretValue: string): string {
+  const value = secretValue.trim();
+  if (value.length <= 8) return '<redacted>';
+  return `${value.slice(0, 3)}...<redacted:${value.length}>`;
+}