phasegate 0.160.21 → 0.162.0

package/CHANGELOG.md

@@ -7,9 +7,43 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.162.0] - 2026-07-04
+
+### Fixed
+
+- **WI-221 — second-wave audit remediation: make the defenses real** — closes the remaining defects from the 2026-07-04 security audit where "advertised gates were not actually enforced". Product-default strictness is unchanged; where phasegate's own repo could not yet meet a now-real gate, it is configured honestly with a documented ratchet (see `docs/inception/_shared/l3-004-traceability-ratchet.md`).
+  - **フェーズゲート残存穴**: `BashWriteTargetExtractor` が `>|` / `dd of=` / `install` / `rsync` / `bash -c`・`sh -c`（ネスト再帰）の書き込みベクトルを検出するよう拡張。`.phasegate/baseline.json` を保護対象に追加し、grandfather 判定をパス一致のみから **sha1 整合検証**へ強化（手書き追記による素通りを封鎖）。
+  - **fail-open → fail-closed**: `phase-gate-query` / `phase-dependency-phase-gate-policy` / `phase-dependency-model-query` / skill-quality L1・L2 / nyquist-ac-coverage の各アダプタで、例外を握り潰して「合格」を返していた挙動を fail-closed 化（エラーを表面化し、防御が静かに開かないようにした）。
+  - **不発・誤発火バリデータ**: L4-003 dead-code の `.js`→`.ts/.tsx`（`.mjs/.cjs/.jsx`・index）解決で誤検出約1592件を解消。L4-002/WI 反映チェックが標準レイアウトで常時スキップされる不具合を修正。セキュリティスキャナの allowlist をファイル全体スキップから行スコープへ。`ci-check --quick` にバリデータを配線。`NEW_DOMAIN` の `changeKind` ハードコードを create/modify 判定に修正。
+  - **config スキーマ不整合（CLI 文鎮化）**: `storyReflection.mappings` のスキーマをコード/ドキュメントの `{inception, product, required}` に整合。`config:plan --intent l4-strict --apply`（および `ci-fail-on-warning`）が実消費キー `/validate/failOnWarning` を出力するよう修正。
+  - **Nyquist トレーサビリティ**: L3-003 カバレッジを実配線（`coverageReportPort`）し閾値を実効化。legacy StoryId エイリアス解決・`HF2-01` 形式・`MatrixValidationService` no-op を修正。domain→application の依存方向逆転を解消。
+  - **L3-003 カバレッジ・セマンティクス精緻化**: カバレッジ閾値未設定時はスキップ（オプトイン）、設定済み×レポート欠如/不足時は fail-closed、単一バリデータの例外が全体をクラッシュさせないよう per-validator 化。
+  - **L3-004 実バグ修正 + パス配線**: AC 網羅ゲートの story レジストリ空スタブを実レジストリ（traceability-model）へ配線し、`layers.L3.requirementMatrixPath`（既定 `.harness/requirement-test-matrix.json`）を新設して ci-check がマトリクスパスを供給するようにした（従来は全ユーザーで L3-004 が満たせなかった）。
+  - **シェル・移植性**: `deny-check.sh` のコマンド連結回避・world-readable ログ・`jq` 不在時 fail-open・glob 変換の部分適用を修正。Windows パス区切りでの WI 反映スキャン/採番不具合と 3桁固定の採番破綻を修正。import-graph substring フォールバックのレイヤー違反見逃しをセグメント境界一致で修正。`work-items --apply` の `completed`→`tested` 降格を防止。personal install の既存 pre-commit 無警告スキップと JSON マージのキー順依存を修正。
+  - **アーキ整合**: import-graph 修正で顕在化した `installation/application → setup/skill-deployer`（infrastructure）の禁止依存を、port（`ModelDelegationPort`）+ アダプタ + DI で解消。
+  - **カバレッジ計測基盤**: `@vitest/coverage-v8` を導入し、エントリポイント/サブプロセス専用ファイルを分母から原則除外した上で自リポの実カバレッジ **90.2%** を確認。`coverage` / `ci` スクリプトでレポート生成→検査の循環を解消（`coverage/` は gitignore）。
+
+## [0.161.0] - 2026-07-04
+
+### Fixed
+
+- **WI-220 — phase-gate bypass and quick-mode relaxation defects** — closes four defects reproduced against the published `0.160.21` package:
+  - Claude Code の PreToolUse `Bash` matcher に `phasegate hook pre-tool-use` を配線し、Bash 経由（`cat >`, heredoc, `tee`, `sed -i`, `cp`, `mv` 等）の書き込みもフェーズゲート・保護ファイル判定を通すようにした（従来は Codex のみ配線され Claude では素通りしていた）。
+  - `WriteTargetScope.fromPath` の `normalize()` で `.`/`..` セグメントを解決し、`.../__tests__/../domain/*` トラバーサルによる保護回避を塞いだ（本物のテストファイルの除外は維持）。
+  - `WriteTargetScope` のプレフィックス一致を大文字小文字非依存にし、大小非依存ファイルシステム（macOS/Windows）での `Scripts/harness/...` 経由の保護回避を塞いだ。
+  - `QuickModeConfig.isMaintained` がレイヤー名エントリ（`"L2"`）を配下バリデータ ID（`"L2-002"` 等）にマッチさせるようにし、`maintainedLayers: ["L1","L2"]` で L2 が全件 skip されていた不具合を修正（ID 完全一致も後方互換）。
+
+## [0.160.22] - 2026-06-12
+
+### Added
+
+- **WI-212 — language-aware validator and skill metadata** — adds `project.languages` configuration, `init --language`, unsupported-language skips for TypeScript-only validators, bundled skill `languages` frontmatter, and a supported languages matrix for adoption planning.
+- **WI-219 — configurable model delegation policy** — adds `modelRouting.delegation` so projects can keep the existing `delegate-sonnet` skill behavior or disable fixed Sonnet delegation while preserving local review guidance.
+
 ### Fixed
 
 - **WI-217 — personal inception/product consistency** — makes L4-002 validate configured personal documentation roots, scopes L4-004 freshness to `paths.designDocs`, adds personal hook L4 backstop behavior for `.phasegate-local` docs, and lets `scaffold-wi` use custom IDs and personal inception roots.
+- **WI-218 — WI description scope classification** — treats `docs/inception/**/WI-*/description.md` as a Phase 1 description artifact instead of Level 3, matching hook guidance and allowing description-only inception work without Full Mode.
 
 ## [0.160.16] - 2026-05-22
 

package/README.md

@@ -413,6 +413,9 @@ For selection guidance and config examples see [Preset Selection Guide](docs/gui
     "preset": "standard",
     "storyReflection": { "enabled": true }
   },
+  "modelRouting": {
+    "delegation": "delegate-sonnet"
+  },
   "protectedFiles": {
     "exclude": ["tsconfig.json", "package.json"]
   },
@@ -433,6 +436,8 @@ For selection guidance and config examples see [Preset Selection Guide](docs/gui
 
 `paths` maps PhaseGate's design and reference documentation roots. Repositories that do not use `docs/` can point `designDocs`, `inceptionDocs`, `principlesDocs`, and `folderRulesDoc` at their own documentation layout; product-wide Level 1 artifacts are overridden separately with custom `phaseDependencies.gates[]`. <!-- @work-item-id WI-214 -->
 
+`modelRouting.delegation` controls whether bundled skills may use the legacy `delegate-sonnet` workflow. Set it to `"none"` when the main agent session should do the work directly; skill deployment removes fixed model routing text and normal `delegate-sonnet` execution is refused. <!-- @work-item-id WI-219 -->
+
 `baseline` opts in to the **Phase A-2 retrofit grandfather**: pre-existing files captured in `.phasegate/baseline.json` are exempted from `phase-gate` until they are structurally modified. Generate the snapshot with `npx phasegate baseline` before introducing the harness to an existing repository. Since v0.71.0 the `baseline.enabled` flag defaults to `true`, so simply running `npx phasegate baseline` after `init` is enough — no manual config edit needed. For a step-by-step retrofit walkthrough see [Retrofit Adoption Guide](docs/guide/retrofit-adoption.md).
 
 ---
@@ -560,7 +565,7 @@ README keeps only the entry points most users need. The full public/compatibilit
 | `hook <pre-tool-use\|post-tool-use\|stop\|session-start\|user-prompt-submit>` | Run an agent hook (reads JSON from stdin; session-start/user-prompt-submit write JSON context) |
 | `pre-commit` | Run L2 pre-commit validators on staged files |
 | `bypass:audit --base <ref> [--head <ref>]` | Replay pre-commit validation over a push/CI range and require structured bypass evidence for gate failures |
-| `delegate-sonnet [...args]` | Delegate task to Sonnet 4.6 (transparent wrapper) |
+| `delegate-sonnet [...args]` | Delegate task to Sonnet 4.6 when `modelRouting.delegation` allows it; `--help` and `--dry-run` remain available |
 | `migrate work-items --dry-run` / `--apply` | Migrate legacy `ISSUE-XXX` / `H{NN}-{NN}` directories under `docs/inception/` to the unified `WI-XXX` layout (frontmatter `type` / `legacy_id` / `affects` injected). Sequential allocator skips numbers already used by existing WIs. See [CLI Reference -- Work Item Migration](docs/guide/cli-reference.md#work-item-migration). |
 | `migrate --schema v3` | Upgrade `phasegate.config.json` to v3 schema by adding the `architecture` key (idempotent). |
 

package/docs/contracts/requirement-test-matrix.schema.json

@@ -18,7 +18,7 @@
         "properties": {
           "storyId": {
             "type": "string",
-            "pattern": "^H\\d{2}-\\d{2}$"
+            "pattern": "^H(?:F\\d+|\\d{2})-\\d{2}$"
           },
           "storyMappings": {
             "type": "array",

package/docs/guide/cli-reference.md

@@ -22,7 +22,7 @@ Command names in this document are split into three surfaces:
 
 | Command | Description |
 |---|---|
-| `init --name <name>` | Legacy-compatible bootstrap for new projects: deploy skills, generate config, and optionally add hooks/CI. Options: `--preset <full\|standard\|minimal\|custom>`, `--skills <core\|all>`, `--agent <claude\|codex\|both>`, `--workflow <standard\|strict>`, `--with-husky`, `--with-ci`, `--yes`. |
+| `init --name <name>` | Legacy-compatible bootstrap for new projects: deploy skills, generate config, and optionally add hooks/CI. Options: `--preset <full\|standard\|minimal\|custom>`, `--skills <core\|all>`, `--agent <claude\|codex\|both>`, `--workflow <standard\|strict>`, `--language <language>`, `--with-husky`, `--with-ci`, `--yes`. `--language` writes `project.languages: ["<language>"]`; omitted language keeps the TypeScript-compatible default. <!-- @work-item-id WI-212 --> |
 | `install --dry-run` / `--apply` | Idempotently merge PhaseGate into an existing project, preserve user content, add package scripts/devDependency, create selected `AGENTS.md` / `CLAUDE.md` managed sections, and write `.phasegate/manifest.json`. `--agent <claude\|codex\|both>`, `--skills <core\|all>`, and `--workflow <standard\|strict>` affect rendered agent context; `--force` replaces managed targets after backup. |
 | `doctor` | Diagnose silent or partial installations and report repair hints (`--json`, `--strict`, `--agent <claude\|codex\|both>`, `--report-out <path>`). `--agent` defaults to `both`; single-agent scopes keep shared targets applicable and mark the other agent's findings as not applicable. `--report-out` writes exactly to the supplied path, not to `reporting.outputDir`. |
 | `uninstall --dry-run` / `--apply` | Remove PhaseGate-managed files and managed blocks using `.phasegate/manifest.json`; `--force` handles managed conflict cases. |

package/docs/guide/configuration.md

@@ -24,7 +24,8 @@ The plan identifies target fields, managed artifacts, commands, validation, risk
 {
   "project": {
     "name": "my-project",
-    "preset": "standard"       // "minimal" | "standard" | "strict"
+    "preset": "standard",      // "minimal" | "standard" | "strict"
+    "languages": ["typescript"]
   },
   "layers": {
     "L1": { "enabled": true },
@@ -56,6 +57,9 @@ The plan identifies target fields, managed artifacts, commands, validation, risk
     "default": "interactive",  // "interactive" | "embedded-qa"
     "perPhase": {}
   },
+  "modelRouting": {
+    "delegation": "delegate-sonnet" // "delegate-sonnet" | "none"
+  },
   "harnesses": {
     "agentLessonCollection": false,
     "cascadeUpdate": false,
@@ -121,6 +125,24 @@ The `strict` preset also enables:
 |-----------|----------|--------------|----------------------------------------------------------------|
 | `name`    | `string` | --           | Project identifier. Used in reports and validation output.     |
 | `preset`  | `string` | `"standard"` | One of `"minimal"`, `"standard"`, `"strict"`. Controls which layers and harnesses are active by default. Individual settings override the preset. |
+| `languages` | `string[]` | `["typescript"]` | Project implementation languages used for validator dispatch and skill applicability. Unknown values are accepted as declarations; unsupported validator/language pairs are reported as skips with `unsupported-language` reasons. <!-- @work-item-id WI-212 --> |
+
+#### Supported Languages
+
+<!-- @work-item-id WI-212 -->
+
+PhaseGate currently ships TypeScript-backed source, test, and coverage validators. Non-TypeScript declarations are supported as configuration metadata so architecture, phase-gate, documentation, pointer, and WI workflow checks can still run while TypeScript-only validators skip with a clear reason.
+
+| Capability | TypeScript | Python / Go / Rust / other declared languages |
+|---|---:|---:|
+| `project.languages` config | Supported | Accepted |
+| `init --language <lang>` bootstrap | Supported | Accepted |
+| Architecture preset / phase-gate / WI workflow | Supported | Supported |
+| Markdown document validators (`L4-002`, `L4-004`, `L4-005`, `L4-006`) | Supported | Supported |
+| L3 performance AST validator (`L3-002`) | Supported | Skipped as `unsupported-language` |
+| L3 coverage validator (`L3-003`) | Supported through Vitest coverage | Skipped as `unsupported-language` |
+| L4 dead-code validator (`L4-003`) | Supported | Skipped as `unsupported-language` |
+| Bundled skills | `languages: [typescript]` metadata present | Future language-specific skills can coexist by declaring their own `languages` metadata |
 
 #### `layers`
 
@@ -454,6 +476,14 @@ Quick Mode with `relaxedGates: ["phase-gate"]` relaxes `storyReflection` as well
 | `default`  | `string` | `"interactive"` | `"interactive"` prompts the user at each decision point. `"embedded-qa"` embeds QA checks inline without prompting. |
 | `perPhase` | `object` | `{}`            | Override the planning mode for specific phases. Keys are phase names, values are `"interactive"` or `"embedded-qa"`. |
 
+#### `modelRouting`
+
+<!-- @work-item-id WI-219 -->
+
+| Sub-field    | Type     | Default              | Description |
+|--------------|----------|----------------------|-------------|
+| `delegation` | `string` | `"delegate-sonnet"`  | `"delegate-sonnet"` preserves the legacy skill routing and `phasegate delegate-sonnet` behavior. `"none"` deploys bundled skills without fixed `model` / `review` frontmatter or `delegate-sonnet` body instructions, and blocks normal `phasegate delegate-sonnet` execution. Help and `--dry-run` remain available. |
+
 #### `harnesses`
 
 | Sub-field              | Type      | Default | Description                                                          |

package/docs/guide/skills-overview.md

@@ -2,6 +2,8 @@
 
 Phasegate provides 30 skills covering the full AIDLC (AI-Driven Development Life Cycle). `npx phasegate init` and project `npx phasegate install` deploy skill bodies to root `skills/` and expose them to enabled agents through `.claude/skills/` / `.codex/skills/` links. Personal install instead writes real local-only per-agent skill directories. <!-- @work-item-id WI-210 -->
 
+Bundled `SKILL.md` files include `languages: [typescript]` frontmatter so PhaseGate can distinguish current TypeScript-oriented guidance from future language-specific skill variants. The metadata is advisory for applicability and does not prevent non-TypeScript projects from installing the catalog. <!-- @work-item-id WI-212 -->
+
 ## AIDLC Process — Skill Execution Order
 
 The AIDLC follows a 3-level execution flow, each level producing design artifacts that gate the next.

package/docs/principles/model-routing.md

@@ -17,6 +17,7 @@
 - 実装、テスト、リポジトリ内の整合修正は Implementor が担当する。
 - 委任結果は必ず親エージェントがレビューし、配置ルール、上位文書整合、スコープ逸脱を確認する。
 - ユーザーまたは実行環境の指示でサブエージェント利用が制限されている場合は、その指示を優先する。
+- `phasegate.config.json` の `modelRouting.delegation` はPhaseGate配備物に対する委任可否の正本である。`"none"` の場合、配備済みスキルは固定モデル委任を指示せず、`delegate-sonnet` の通常実行も拒否される。@work-item-id WI-219
 
 ## 委任してよい作業
 

package/docs/templates/personal/phasegate-local-config.json

@@ -1,7 +1,10 @@
 {
   "project": {
     "name": "personal-phasegate",
-    "preset": "standard"
+    "preset": "standard",
+    "languages": [
+      "typescript"
+    ]
   },
   "layers": {
     "L1": {

package/docs/templates/project/phasegate.config.json

@@ -1,7 +1,10 @@
 {
   "project": {
     "name": "phasegate-project",
-    "preset": "standard"
+    "preset": "standard",
+    "languages": [
+      "typescript"
+    ]
   },
   "architecture": {
     "preset": "clean"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phasegate",
-  "version": "0.160.21",
+  "version": "0.162.0",
   "packageManager": "pnpm@10.30.1",
   "description": "Phasegate — AI-agnostic quality defense toolkit. Enforces structural integrity between design intent and code.",
   "license": "MIT",
@@ -59,7 +59,9 @@
     "harness:disable": "pnpm phasegate:disable",
     "harness:check-phase": "pnpm phasegate:check-phase",
     "harness:check-ready": "pnpm phasegate:check-ready",
-    "test": "vitest run --config scripts/harness/__tests__/vitest.config.forks.ts && vitest run --config scripts/harness/__tests__/vitest.config.ts"
+    "test": "vitest run --config scripts/harness/__tests__/vitest.config.forks.ts && vitest run --config scripts/harness/__tests__/vitest.config.ts",
+    "coverage": "node -e \"require('node:fs').rmSync('coverage',{recursive:true,force:true})\" && vitest run --config scripts/harness/__tests__/vitest.config.coverage.forks.ts --reporter=blob --outputFile=coverage/.blob/forks.json && vitest run --config scripts/harness/__tests__/vitest.config.coverage.ts --reporter=blob --outputFile=coverage/.blob/threads.json && vitest run --config scripts/harness/__tests__/vitest.config.coverage.ts --merge-reports=coverage/.blob",
+    "ci": "npm run coverage && npm run test"
   },
   "dependencies": {
     "ajv": "^8.18.0",
@@ -69,8 +71,9 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.7",
-    "@types/picomatch": "^4.0.0",
     "@types/node": "^25.3.5",
+    "@types/picomatch": "^4.0.0",
+    "@vitest/coverage-v8": "^3.2.4",
     "typescript": "^5.0.0",
     "vitest": "^3.0.0"
   },

package/scripts/harness/agent-integration/domain/services/bash-write-target-extractor.ts

@@ -8,12 +8,16 @@
  * Phase Gate フックが Bash 経由のファイル書き込みを検知して保護するための基盤。
  *
  * 副作用なし・純粋関数相当。対応パターンは以下:
- *   - リダイレクト `>` / `>>`
+ *   - リダイレクト `>` / `>>` / `>|` (clobber)
  *   - heredoc (`<<EOF > path`)
  *   - `tee` / `tee -a`
  *   - `sed -i` / `sed -i ''` (BSD)
  *   - `cp` / `mv` (宛先のみ)
  *   - `touch`
+ *   - `dd of=<path>`
+ *   - `install [opts] SRC... DEST` (coreutils, ファイル作成)
+ *   - `rsync [opts] SRC... DEST`
+ *   - `bash -c '...'` / `sh -c '...'` (ネストしたコマンドを再帰解析)
  *   - 複合コマンド (`&&`, `;`, `||`) とパイプ (`|`) 分割
  *   - ダブル/シングルクォート対応
  *   - `apply_patch` ヒアドキュメント (`*** Begin Patch` / `*** End Patch` ブロック内の
@@ -44,7 +48,11 @@ function tokenize(input: string): Token[] {
     // 演算子をそのままトークン化
     if (ch === '>' || ch === '<' || ch === '|' || ch === ';' || ch === '&') {
       let op = ch;
-      if (i + 1 < len && input[i + 1] === ch && (ch === '>' || ch === '<' || ch === '|' || ch === '&')) {
+      // `>|` (clobber redirect) は独立した 2 文字演算子として扱う
+      if (ch === '>' && i + 1 < len && input[i + 1] === '|') {
+        op = '>|';
+        i += 2;
+      } else if (i + 1 < len && input[i + 1] === ch && (ch === '>' || ch === '<' || ch === '|' || ch === '&')) {
         op = ch + ch;
         i += 2;
       } else {
@@ -139,10 +147,10 @@ function getCommandName(tokens: Token[]): string | undefined {
 function extractFromSingleCommand(tokens: Token[]): string[] {
   const results: string[] = [];
 
-  // 1) リダイレクト `>` / `>>` の右辺 (heredoc の `>` もこのパスで拾える)
+  // 1) リダイレクト `>` / `>>` / `>|` の右辺 (heredoc の `>` もこのパスで拾える)
   for (let i = 0; i < tokens.length; i += 1) {
     const t = tokens[i];
-    if (t.quoted === 'none' && (t.value === '>' || t.value === '>>')) {
+    if (t.quoted === 'none' && (t.value === '>' || t.value === '>>' || t.value === '>|')) {
       const next = tokens[i + 1];
       if (next !== undefined) {
         results.push(next.value);
@@ -213,14 +221,89 @@ function extractFromSingleCommand(tokens: Token[]): string[] {
     for (let i = 1; i < tokens.length; i += 1) {
       const t = tokens[i];
       if (t.quoted === 'none' && t.value.startsWith('-')) continue;
-      if (t.quoted === 'none' && (t.value === '>' || t.value === '>>' || t.value === '|' || t.value === '<')) break;
+      if (t.quoted === 'none' && (t.value === '>' || t.value === '>>' || t.value === '>|' || t.value === '|' || t.value === '<')) break;
       results.push(t.value);
     }
+  } else if (baseName === 'dd') {
+    // `dd of=<path>` — 出力ファイルは `of=` オペランド
+    for (let i = 1; i < tokens.length; i += 1) {
+      const t = tokens[i];
+      if (t.value.startsWith('of=')) {
+        const dest = t.value.slice('of='.length);
+        if (dest.length > 0) results.push(dest);
+      }
+    }
+  } else if (baseName === 'install') {
+    // `install [opts] SRC... DEST` — 宛先は最後の非オプション引数 (coreutils はファイルを作成する)
+    const positionals = collectPositionals(tokens);
+    if (positionals.length >= 1) {
+      // `install -d DIR...` はディレクトリ作成のみだが保護側に倒し全ディレクトリを対象化
+      const isDirMode = tokens.some(
+        (t) => t.quoted === 'none' && (t.value === '-d' || t.value === '--directory'),
+      );
+      if (isDirMode) {
+        for (const p of positionals) results.push(p.value);
+      } else if (positionals.length >= 2) {
+        results.push(positionals[positionals.length - 1].value);
+      } else {
+        // SRC 省略で DEST のみ渡された不正形でも保護側に倒す
+        results.push(positionals[positionals.length - 1].value);
+      }
+    }
+  } else if (baseName === 'rsync') {
+    // `rsync [opts] SRC... DEST` — 宛先は最後の非オプション引数
+    const positionals = collectPositionals(tokens);
+    if (positionals.length >= 2) {
+      results.push(positionals[positionals.length - 1].value);
+    }
+  } else if (baseName === 'bash' || baseName === 'sh') {
+    // `bash -c '<nested command>'` — ネストしたコマンドを再帰解析
+    for (let i = 1; i < tokens.length; i += 1) {
+      const t = tokens[i];
+      if (t.quoted === 'none' && t.value === '-c') {
+        const script = tokens[i + 1];
+        if (script !== undefined) {
+          for (const nested of extractFromCommandString(script.value)) {
+            results.push(nested);
+          }
+        }
+        break;
+      }
+    }
   }
 
   return results;
 }
 
+/** コマンド先頭 (cmd 名) を除いた非オプション位置引数を収集する。リダイレクト境界で停止。 */
+function collectPositionals(tokens: Token[]): Token[] {
+  const positionals: Token[] = [];
+  for (let i = 1; i < tokens.length; i += 1) {
+    const t = tokens[i];
+    if (t.quoted === 'none' && t.value.startsWith('-')) continue;
+    if (t.quoted === 'none' && (t.value === '>' || t.value === '>>' || t.value === '>|' || t.value === '|' || t.value === '<')) break;
+    positionals.push(t);
+  }
+  return positionals;
+}
+
+/** コマンド文字列を token 化 → 演算子分割 → 各コマンドから書き込み先を抽出する内部関数。 */
+function extractFromCommandString(command: string): string[] {
+  const tokens = tokenize(command);
+  const groups = splitByOperators(tokens);
+  const collected: string[] = [];
+  for (const group of groups) {
+    for (const path of extractFromSingleCommand(group)) {
+      collected.push(path);
+    }
+  }
+  // ネスト内の apply_patch heredoc も拾う
+  for (const p of extractApplyPatchTargets(command)) {
+    collected.push(p);
+  }
+  return collected;
+}
+
 /** apply_patch ブロック境界マーカー (Begin/End) */
 const APPLY_PATCH_BEGIN_SOURCE = String.raw`\*\*\*\s+Begin\s+Patch`;
 const APPLY_PATCH_END_SOURCE = String.raw`\*\*\*\s+End\s+Patch`;
@@ -284,24 +367,9 @@ export class BashWriteTargetExtractor {
       return Object.freeze([]);
     }
 
-    const tokens = tokenize(command);
-    const groups = splitByOperators(tokens);
-
-    const collected: string[] = [];
-    for (const group of groups) {
-      const found = extractFromSingleCommand(group);
-      for (const path of found) {
-        collected.push(path);
-      }
-    }
-
-    // apply_patch ヒアドキュメント対応 (ISSUE-013 Wave 1)
-    // 既存の token ベース抽出では heredoc body 内のマーカー行を拾えないため、
-    // raw command 文字列から独立にスキャンする。
-    const applyPatchTargets = extractApplyPatchTargets(command);
-    for (const p of applyPatchTargets) {
-      collected.push(p);
-    }
+    // token 化 → 演算子分割 → 各コマンド抽出 + apply_patch ヒアドキュメント対応
+    // (ISSUE-013 Wave 1)。bash -c '...' 等のネストコマンドは内部で再帰解析される。
+    const collected = extractFromCommandString(command);
 
     // 重複除去 (挿入順保持)
     const seen = new Set<string>();

package/scripts/harness/agent-integration/domain/value-objects/protected-file-list.ts

@@ -21,6 +21,10 @@ const DEFAULT_PATTERNS = [
   'tsconfig.json',
   'package.json',
   'package-lock.json',
+  // baseline.json は grandfather 判定の信頼基盤。手動追記による protected file の
+  // grandfather bypass を防ぐため、書き込み自体を保護対象とする。
+  '.phasegate/baseline.json',
+  '**/.phasegate/baseline.json',
 ];
 
 /**

package/scripts/harness/agent-integration/domain/value-objects/write-target-scope.ts

@@ -75,11 +75,15 @@ export class WriteTargetScope {
 
     const inceptionMatch = matchPrefix(normalizedPath, inceptionPath);
     if (inceptionMatch !== null) {
-      const [unitId, secondSegment] = inceptionMatch;
+      const [unitId, secondSegment, thirdSegment] = inceptionMatch;
 
       // 横断的 WI: docs/inception/_cross/{WI-XXX}/ → Level 3
       if (unitId === "_cross") {
         if (secondSegment !== undefined && WORK_ITEM_ID_PATTERN.test(secondSegment)) {
+          if (thirdSegment === "description.md") {
+            return WriteTargetScope.create({ level: 1 });
+          }
+
           return WriteTargetScope.create({ level: 3, unitId, storyId: secondSegment });
         }
 
@@ -88,6 +92,10 @@ export class WriteTargetScope {
 
       // Unit 所有 WI / 既存 US パス: docs/inception/{unit}/{storyId}/ → Level 3
       if (unitId !== undefined && secondSegment !== undefined && WORK_ITEM_ID_PATTERN.test(secondSegment)) {
+        if (secondSegment.startsWith("WI-") && thirdSegment === "description.md") {
+          return WriteTargetScope.create({ level: 1 });
+        }
+
         return WriteTargetScope.create({ level: 3, unitId, storyId: secondSegment });
       }
     }
@@ -121,24 +129,65 @@ export class WriteTargetScope {
   }
 }
 
-const normalize = (value: string): string =>
-  value
+const normalize = (value: string): string => {
+  const cleaned = value
     .replaceAll("\\", "/")
     .replace(/^\.\/+/, "")
     .replace(/\/+/g, "/")
     .replace(/\/$/, "");
 
+  return resolveTraversal(cleaned);
+};
+
+// posix セマンティクスで `.`/`..` セグメントを解決する（プロジェクト相対パス想定）。
+// これにより `a/b/../c` → `a/c`。フェーズゲート保護回避（P-2）対策として、
+// __tests__ 除外や prefix 一致判定はこの解決後のパスに対して適用される。
+const resolveTraversal = (value: string): string => {
+  if (value === "") {
+    return "";
+  }
+
+  const segments = value.split("/");
+  const resolved: string[] = [];
+
+  for (const segment of segments) {
+    if (segment === "" || segment === ".") {
+      continue;
+    }
+
+    if (segment === "..") {
+      if (resolved.length > 0 && resolved[resolved.length - 1] !== "..") {
+        resolved.pop();
+      } else {
+        // プロジェクトルートより上への参照はそのまま残す（保護判定に影響させない）
+        resolved.push("..");
+      }
+      continue;
+    }
+
+    resolved.push(segment);
+  }
+
+  return resolved.join("/");
+};
+
 const matchPrefix = (targetPath: string, basePath: string): string[] | null => {
   const normalizedBase = normalize(basePath);
 
-  if (targetPath === normalizedBase) {
+  // フェーズゲートはセキュリティ境界のため、大小非依存 FS（macOS/Windows）での
+  // 保護回避（P-3）を防ぐべく prefix 一致は大文字小文字を無視して判定する。
+  const lowerTarget = targetPath.toLowerCase();
+  const lowerBase = normalizedBase.toLowerCase();
+
+  if (lowerTarget === lowerBase) {
     return [];
   }
 
-  if (!targetPath.startsWith(`${normalizedBase}/`)) {
+  if (!lowerTarget.startsWith(`${lowerBase}/`)) {
     return null;
   }
 
+  // remainder（unitId 等の抽出結果）は元の大小を保持する。
   const remainder = targetPath.slice(normalizedBase.length + 1);
   return remainder === "" ? [] : remainder.split("/");
 };

package/scripts/harness/agent-integration/infrastructure/adapters/ci-governance-baseline-grandfather-adapter.ts

@@ -8,6 +8,8 @@ import type {
 import type { ConfigQueryPort } from '../../domain/ports/config-query-port.js';
 import type { BaselineRepositoryPort } from '../../../ci-governance/domain/ports/baseline-repository-port.js';
 import { BaselineJsonRepositoryAdapter } from '../../../ci-governance/infrastructure/adapters/baseline-json-repository-adapter.js';
+import type { FileHasherPort } from '../../../ci-governance/domain/ports/file-hasher-port.js';
+import { FileSystemSha1HasherAdapter } from '../../../ci-governance/infrastructure/adapters/file-system-sha1-hasher-adapter.js';
 
 export interface CiGovernanceBaselineGrandfatherAdapterDeps {
   readonly baseDir: string;
@@ -16,6 +18,7 @@ export interface CiGovernanceBaselineGrandfatherAdapterDeps {
     baseDir: string,
     relativePath: string,
   ) => BaselineRepositoryPort;
+  readonly fileHasherFactory?: (baseDir: string) => FileHasherPort;
 }
 
 export class CiGovernanceBaselineGrandfatherAdapter
@@ -68,11 +71,31 @@ export class CiGovernanceBaselineGrandfatherAdapter
         };
       }
 
+      // 整合性検証: baseline に path が載っているだけでは grandfather しない。
+      // 記録済み sha1 と実ファイルの sha1 が一致する場合のみ grandfather 扱いとする。
+      // これにより baseline.json への手動 path 追記による bypass を防ぐ
+      //（追記側は実ファイルの正しい sha1 を予測できず、改変後の content とも一致しない）。
+      const hasherFactory =
+        this.deps.fileHasherFactory ??
+        ((baseDir) => new FileSystemSha1HasherAdapter(baseDir));
+      const hasher = hasherFactory(this.deps.baseDir);
+      const entryByPath = new Map(snapshot.entries.map((e) => [e.path, e.sha1] as const));
+
       const grandfathered: string[] = [];
       for (const p of targetFilePaths) {
-        if (snapshot.contains(p)) grandfathered.push(p);
+        const recordedSha1 = entryByPath.get(p);
+        if (recordedSha1 === undefined) continue;
+        let actualSha1: string;
+        try {
+          actualSha1 = await hasher.hashFile(p);
+        } catch {
+          // ファイル読み取り失敗 (未作成・権限等) は grandfather 不可扱い (保護側に倒す)
+          continue;
+        }
+        if (actualSha1 === recordedSha1) grandfathered.push(p);
       }
-      const allGrandfathered = grandfathered.length === targetFilePaths.length;
+      const allGrandfathered =
+        targetFilePaths.length > 0 && grandfathered.length === targetFilePaths.length;
 
       return {
         allGrandfathered,

package/scripts/harness/agent-integration/infrastructure/adapters/phase-gate-query-adapter.ts

@@ -39,13 +39,28 @@ export class PhaseGateQueryAdapter implements PhaseGateQueryPort {
         return PhaseGateQueryResult.create(false, [result.text], []);
       }
 
-      return PhaseGateQueryResult.create(true, [], ['phase gate check returned error']);
+      // Fail-closed: an unexpected exit code means the gate could not be evaluated.
+      // A quality gate that cannot confirm PASS must block, not open.
+      console.error(`[agent-integration] phase gate check returned unexpected exit code ${result.exitCode}`);
+      return PhaseGateQueryResult.create(
+        false,
+        [`phase gate check returned unexpected exit code ${result.exitCode}; treating as NOT passed (fail-closed)`],
+        []
+      );
     } catch (error) {
       if (error instanceof ConfigValidationError) {
         return PhaseGateQueryResult.create(false, [error.message], []);
       }
 
-      return PhaseGateQueryResult.create(true, [], ['phase-dependency-model not available']);
+      // Fail-closed: if phase-dependency-model could not be loaded/executed we cannot
+      // confirm the gate passed, so treat it as blocked rather than silently opening it.
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[agent-integration] phase gate check failed to run: ${message}`);
+      return PhaseGateQueryResult.create(
+        false,
+        [`phase gate check could not be evaluated (phase-dependency-model unavailable): ${message}`],
+        []
+      );
     }
   }
 

package/scripts/harness/biome-ast-engine/domain/value-objects/import-graph.ts

@@ -46,6 +46,13 @@ const globToRegex = (pattern: string): RegExp => {
     const next = pattern[index + 1];
 
     if (current === '*' && next === '*') {
+      // A `**/` segment matches any number of leading path segments, INCLUDING
+      // none, so `**/shared-kernel/**` still matches `shared-kernel/a.ts`.
+      if (pattern[index + 2] === '/') {
+        output += '(?:.*/)?';
+        index += 2;
+        continue;
+      }
       output += '.*';
       index += 1;
       continue;
@@ -62,8 +69,28 @@ const globToRegex = (pattern: string): RegExp => {
   return new RegExp(`^${output}$`);
 };
 
+// Fallback for wildcard-free patterns (e.g. `generated`, `shared-kernel`). It
+// must align on a `/` segment boundary at the START and terminate on a real
+// boundary — a `/`, the extension dot, or end of string. This replaces a naive
+// `value.includes(pattern stripped of * and /)` substring test that over-matched
+// (e.g. `vendor` matched `domain/vendorized-service.ts`), which silently
+// suppressed genuine layer violations. The boundary-terminated form keeps
+// intended ignores working (`generated` → `generated.ts`) while no longer
+// swallowing unrelated segments.
+const segmentPrefixRegex = (pattern: string): RegExp => {
+  return new RegExp(`(^|/)${escapeRegex(pattern)}([./]|$)`);
+};
+
 export const matchesPattern = (value: string, pattern: string): boolean => {
-  return globToRegex(pattern).test(value) || value.includes(pattern.replace(/\*/g, '').replace(/\//g, ''));
+  if (globToRegex(pattern).test(value)) {
+    return true;
+  }
+  // Wildcard patterns are authoritative via the glob regex above; only bare
+  // (wildcard-free) patterns fall back to segment-boundary matching.
+  if (pattern.includes('*')) {
+    return false;
+  }
+  return segmentPrefixRegex(pattern).test(value);
 };
 
 const canonicalCycleKey = (path: readonly string[]): string => {