phasegate 0.161.0 → 0.163.0

package/CHANGELOG.md

@@ -7,6 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.162.0] - 2026-07-04
+
+### Fixed
+
+- **WI-221 — second-wave audit remediation: make the defenses real** — closes the remaining defects from the 2026-07-04 security audit where "advertised gates were not actually enforced". Product-default strictness is unchanged; where phasegate's own repo could not yet meet a now-real gate, it is configured honestly with a documented ratchet (see `docs/inception/_shared/l3-004-traceability-ratchet.md`).
+  - **フェーズゲート残存穴**: `BashWriteTargetExtractor` が `>|` / `dd of=` / `install` / `rsync` / `bash -c`・`sh -c`（ネスト再帰）の書き込みベクトルを検出するよう拡張。`.phasegate/baseline.json` を保護対象に追加し、grandfather 判定をパス一致のみから **sha1 整合検証**へ強化（手書き追記による素通りを封鎖）。
+  - **fail-open → fail-closed**: `phase-gate-query` / `phase-dependency-phase-gate-policy` / `phase-dependency-model-query` / skill-quality L1・L2 / nyquist-ac-coverage の各アダプタで、例外を握り潰して「合格」を返していた挙動を fail-closed 化（エラーを表面化し、防御が静かに開かないようにした）。
+  - **不発・誤発火バリデータ**: L4-003 dead-code の `.js`→`.ts/.tsx`（`.mjs/.cjs/.jsx`・index）解決で誤検出約1592件を解消。L4-002/WI 反映チェックが標準レイアウトで常時スキップされる不具合を修正。セキュリティスキャナの allowlist をファイル全体スキップから行スコープへ。`ci-check --quick` にバリデータを配線。`NEW_DOMAIN` の `changeKind` ハードコードを create/modify 判定に修正。
+  - **config スキーマ不整合（CLI 文鎮化）**: `storyReflection.mappings` のスキーマをコード/ドキュメントの `{inception, product, required}` に整合。`config:plan --intent l4-strict --apply`（および `ci-fail-on-warning`）が実消費キー `/validate/failOnWarning` を出力するよう修正。
+  - **Nyquist トレーサビリティ**: L3-003 カバレッジを実配線（`coverageReportPort`）し閾値を実効化。legacy StoryId エイリアス解決・`HF2-01` 形式・`MatrixValidationService` no-op を修正。domain→application の依存方向逆転を解消。
+  - **L3-003 カバレッジ・セマンティクス精緻化**: カバレッジ閾値未設定時はスキップ（オプトイン）、設定済み×レポート欠如/不足時は fail-closed、単一バリデータの例外が全体をクラッシュさせないよう per-validator 化。
+  - **L3-004 実バグ修正 + パス配線**: AC 網羅ゲートの story レジストリ空スタブを実レジストリ（traceability-model）へ配線し、`layers.L3.requirementMatrixPath`（既定 `.harness/requirement-test-matrix.json`）を新設して ci-check がマトリクスパスを供給するようにした（従来は全ユーザーで L3-004 が満たせなかった）。
+  - **シェル・移植性**: `deny-check.sh` のコマンド連結回避・world-readable ログ・`jq` 不在時 fail-open・glob 変換の部分適用を修正。Windows パス区切りでの WI 反映スキャン/採番不具合と 3桁固定の採番破綻を修正。import-graph substring フォールバックのレイヤー違反見逃しをセグメント境界一致で修正。`work-items --apply` の `completed`→`tested` 降格を防止。personal install の既存 pre-commit 無警告スキップと JSON マージのキー順依存を修正。
+  - **アーキ整合**: import-graph 修正で顕在化した `installation/application → setup/skill-deployer`（infrastructure）の禁止依存を、port（`ModelDelegationPort`）+ アダプタ + DI で解消。
+  - **カバレッジ計測基盤**: `@vitest/coverage-v8` を導入し、エントリポイント/サブプロセス専用ファイルを分母から原則除外した上で自リポの実カバレッジ **90.2%** を確認。`coverage` / `ci` スクリプトでレポート生成→検査の循環を解消（`coverage/` は gitignore）。
+
 ## [0.161.0] - 2026-07-04
 
 ### Fixed

package/docs/contracts/requirement-test-matrix.schema.json

@@ -18,7 +18,7 @@
         "properties": {
           "storyId": {
             "type": "string",
-            "pattern": "^H\\d{2}-\\d{2}$"
+            "pattern": "^H(?:F\\d+|\\d{2})-\\d{2}$"
           },
           "storyMappings": {
             "type": "array",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phasegate",
-  "version": "0.161.0",
+  "version": "0.163.0",
   "packageManager": "pnpm@10.30.1",
   "description": "Phasegate — AI-agnostic quality defense toolkit. Enforces structural integrity between design intent and code.",
   "license": "MIT",
@@ -59,7 +59,9 @@
     "harness:disable": "pnpm phasegate:disable",
     "harness:check-phase": "pnpm phasegate:check-phase",
     "harness:check-ready": "pnpm phasegate:check-ready",
-    "test": "vitest run --config scripts/harness/__tests__/vitest.config.forks.ts && vitest run --config scripts/harness/__tests__/vitest.config.ts"
+    "test": "vitest run --config scripts/harness/__tests__/vitest.config.forks.ts && vitest run --config scripts/harness/__tests__/vitest.config.ts",
+    "coverage": "node -e \"require('node:fs').rmSync('coverage',{recursive:true,force:true})\" && vitest run --config scripts/harness/__tests__/vitest.config.coverage.forks.ts --reporter=blob --outputFile=coverage/.blob/forks.json && vitest run --config scripts/harness/__tests__/vitest.config.coverage.ts --reporter=blob --outputFile=coverage/.blob/threads.json && vitest run --config scripts/harness/__tests__/vitest.config.coverage.ts --merge-reports=coverage/.blob",
+    "ci": "npm run coverage && npm run test"
   },
   "dependencies": {
     "ajv": "^8.18.0",
@@ -69,8 +71,9 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.7",
-    "@types/picomatch": "^4.0.0",
     "@types/node": "^25.3.5",
+    "@types/picomatch": "^4.0.0",
+    "@vitest/coverage-v8": "^3.2.4",
     "typescript": "^5.0.0",
     "vitest": "^3.0.0"
   },

package/scripts/harness/agent-integration/domain/services/bash-write-target-extractor.ts

@@ -8,12 +8,16 @@
  * Phase Gate フックが Bash 経由のファイル書き込みを検知して保護するための基盤。
  *
  * 副作用なし・純粋関数相当。対応パターンは以下:
- *   - リダイレクト `>` / `>>`
+ *   - リダイレクト `>` / `>>` / `>|` (clobber)
  *   - heredoc (`<<EOF > path`)
  *   - `tee` / `tee -a`
  *   - `sed -i` / `sed -i ''` (BSD)
  *   - `cp` / `mv` (宛先のみ)
  *   - `touch`
+ *   - `dd of=<path>`
+ *   - `install [opts] SRC... DEST` (coreutils, ファイル作成)
+ *   - `rsync [opts] SRC... DEST`
+ *   - `bash -c '...'` / `sh -c '...'` (ネストしたコマンドを再帰解析)
  *   - 複合コマンド (`&&`, `;`, `||`) とパイプ (`|`) 分割
  *   - ダブル/シングルクォート対応
  *   - `apply_patch` ヒアドキュメント (`*** Begin Patch` / `*** End Patch` ブロック内の
@@ -44,7 +48,11 @@ function tokenize(input: string): Token[] {
     // 演算子をそのままトークン化
     if (ch === '>' || ch === '<' || ch === '|' || ch === ';' || ch === '&') {
       let op = ch;
-      if (i + 1 < len && input[i + 1] === ch && (ch === '>' || ch === '<' || ch === '|' || ch === '&')) {
+      // `>|` (clobber redirect) は独立した 2 文字演算子として扱う
+      if (ch === '>' && i + 1 < len && input[i + 1] === '|') {
+        op = '>|';
+        i += 2;
+      } else if (i + 1 < len && input[i + 1] === ch && (ch === '>' || ch === '<' || ch === '|' || ch === '&')) {
         op = ch + ch;
         i += 2;
       } else {
@@ -139,10 +147,10 @@ function getCommandName(tokens: Token[]): string | undefined {
 function extractFromSingleCommand(tokens: Token[]): string[] {
   const results: string[] = [];
 
-  // 1) リダイレクト `>` / `>>` の右辺 (heredoc の `>` もこのパスで拾える)
+  // 1) リダイレクト `>` / `>>` / `>|` の右辺 (heredoc の `>` もこのパスで拾える)
   for (let i = 0; i < tokens.length; i += 1) {
     const t = tokens[i];
-    if (t.quoted === 'none' && (t.value === '>' || t.value === '>>')) {
+    if (t.quoted === 'none' && (t.value === '>' || t.value === '>>' || t.value === '>|')) {
       const next = tokens[i + 1];
       if (next !== undefined) {
         results.push(next.value);
@@ -213,14 +221,89 @@ function extractFromSingleCommand(tokens: Token[]): string[] {
     for (let i = 1; i < tokens.length; i += 1) {
       const t = tokens[i];
       if (t.quoted === 'none' && t.value.startsWith('-')) continue;
-      if (t.quoted === 'none' && (t.value === '>' || t.value === '>>' || t.value === '|' || t.value === '<')) break;
+      if (t.quoted === 'none' && (t.value === '>' || t.value === '>>' || t.value === '>|' || t.value === '|' || t.value === '<')) break;
       results.push(t.value);
     }
+  } else if (baseName === 'dd') {
+    // `dd of=<path>` — 出力ファイルは `of=` オペランド
+    for (let i = 1; i < tokens.length; i += 1) {
+      const t = tokens[i];
+      if (t.value.startsWith('of=')) {
+        const dest = t.value.slice('of='.length);
+        if (dest.length > 0) results.push(dest);
+      }
+    }
+  } else if (baseName === 'install') {
+    // `install [opts] SRC... DEST` — 宛先は最後の非オプション引数 (coreutils はファイルを作成する)
+    const positionals = collectPositionals(tokens);
+    if (positionals.length >= 1) {
+      // `install -d DIR...` はディレクトリ作成のみだが保護側に倒し全ディレクトリを対象化
+      const isDirMode = tokens.some(
+        (t) => t.quoted === 'none' && (t.value === '-d' || t.value === '--directory'),
+      );
+      if (isDirMode) {
+        for (const p of positionals) results.push(p.value);
+      } else if (positionals.length >= 2) {
+        results.push(positionals[positionals.length - 1].value);
+      } else {
+        // SRC 省略で DEST のみ渡された不正形でも保護側に倒す
+        results.push(positionals[positionals.length - 1].value);
+      }
+    }
+  } else if (baseName === 'rsync') {
+    // `rsync [opts] SRC... DEST` — 宛先は最後の非オプション引数
+    const positionals = collectPositionals(tokens);
+    if (positionals.length >= 2) {
+      results.push(positionals[positionals.length - 1].value);
+    }
+  } else if (baseName === 'bash' || baseName === 'sh') {
+    // `bash -c '<nested command>'` — ネストしたコマンドを再帰解析
+    for (let i = 1; i < tokens.length; i += 1) {
+      const t = tokens[i];
+      if (t.quoted === 'none' && t.value === '-c') {
+        const script = tokens[i + 1];
+        if (script !== undefined) {
+          for (const nested of extractFromCommandString(script.value)) {
+            results.push(nested);
+          }
+        }
+        break;
+      }
+    }
   }
 
   return results;
 }
 
+/** コマンド先頭 (cmd 名) を除いた非オプション位置引数を収集する。リダイレクト境界で停止。 */
+function collectPositionals(tokens: Token[]): Token[] {
+  const positionals: Token[] = [];
+  for (let i = 1; i < tokens.length; i += 1) {
+    const t = tokens[i];
+    if (t.quoted === 'none' && t.value.startsWith('-')) continue;
+    if (t.quoted === 'none' && (t.value === '>' || t.value === '>>' || t.value === '>|' || t.value === '|' || t.value === '<')) break;
+    positionals.push(t);
+  }
+  return positionals;
+}
+
+/** コマンド文字列を token 化 → 演算子分割 → 各コマンドから書き込み先を抽出する内部関数。 */
+function extractFromCommandString(command: string): string[] {
+  const tokens = tokenize(command);
+  const groups = splitByOperators(tokens);
+  const collected: string[] = [];
+  for (const group of groups) {
+    for (const path of extractFromSingleCommand(group)) {
+      collected.push(path);
+    }
+  }
+  // ネスト内の apply_patch heredoc も拾う
+  for (const p of extractApplyPatchTargets(command)) {
+    collected.push(p);
+  }
+  return collected;
+}
+
 /** apply_patch ブロック境界マーカー (Begin/End) */
 const APPLY_PATCH_BEGIN_SOURCE = String.raw`\*\*\*\s+Begin\s+Patch`;
 const APPLY_PATCH_END_SOURCE = String.raw`\*\*\*\s+End\s+Patch`;
@@ -284,24 +367,9 @@ export class BashWriteTargetExtractor {
       return Object.freeze([]);
     }
 
-    const tokens = tokenize(command);
-    const groups = splitByOperators(tokens);
-
-    const collected: string[] = [];
-    for (const group of groups) {
-      const found = extractFromSingleCommand(group);
-      for (const path of found) {
-        collected.push(path);
-      }
-    }
-
-    // apply_patch ヒアドキュメント対応 (ISSUE-013 Wave 1)
-    // 既存の token ベース抽出では heredoc body 内のマーカー行を拾えないため、
-    // raw command 文字列から独立にスキャンする。
-    const applyPatchTargets = extractApplyPatchTargets(command);
-    for (const p of applyPatchTargets) {
-      collected.push(p);
-    }
+    // token 化 → 演算子分割 → 各コマンド抽出 + apply_patch ヒアドキュメント対応
+    // (ISSUE-013 Wave 1)。bash -c '...' 等のネストコマンドは内部で再帰解析される。
+    const collected = extractFromCommandString(command);
 
     // 重複除去 (挿入順保持)
     const seen = new Set<string>();

package/scripts/harness/agent-integration/domain/value-objects/protected-file-list.ts

@@ -21,6 +21,10 @@ const DEFAULT_PATTERNS = [
   'tsconfig.json',
   'package.json',
   'package-lock.json',
+  // baseline.json は grandfather 判定の信頼基盤。手動追記による protected file の
+  // grandfather bypass を防ぐため、書き込み自体を保護対象とする。
+  '.phasegate/baseline.json',
+  '**/.phasegate/baseline.json',
 ];
 
 /**

package/scripts/harness/agent-integration/infrastructure/adapters/ci-governance-baseline-grandfather-adapter.ts

@@ -8,6 +8,8 @@ import type {
 import type { ConfigQueryPort } from '../../domain/ports/config-query-port.js';
 import type { BaselineRepositoryPort } from '../../../ci-governance/domain/ports/baseline-repository-port.js';
 import { BaselineJsonRepositoryAdapter } from '../../../ci-governance/infrastructure/adapters/baseline-json-repository-adapter.js';
+import type { FileHasherPort } from '../../../ci-governance/domain/ports/file-hasher-port.js';
+import { FileSystemSha1HasherAdapter } from '../../../ci-governance/infrastructure/adapters/file-system-sha1-hasher-adapter.js';
 
 export interface CiGovernanceBaselineGrandfatherAdapterDeps {
   readonly baseDir: string;
@@ -16,6 +18,7 @@ export interface CiGovernanceBaselineGrandfatherAdapterDeps {
     baseDir: string,
     relativePath: string,
   ) => BaselineRepositoryPort;
+  readonly fileHasherFactory?: (baseDir: string) => FileHasherPort;
 }
 
 export class CiGovernanceBaselineGrandfatherAdapter
@@ -68,11 +71,31 @@ export class CiGovernanceBaselineGrandfatherAdapter
         };
       }
 
+      // 整合性検証: baseline に path が載っているだけでは grandfather しない。
+      // 記録済み sha1 と実ファイルの sha1 が一致する場合のみ grandfather 扱いとする。
+      // これにより baseline.json への手動 path 追記による bypass を防ぐ
+      //（追記側は実ファイルの正しい sha1 を予測できず、改変後の content とも一致しない）。
+      const hasherFactory =
+        this.deps.fileHasherFactory ??
+        ((baseDir) => new FileSystemSha1HasherAdapter(baseDir));
+      const hasher = hasherFactory(this.deps.baseDir);
+      const entryByPath = new Map(snapshot.entries.map((e) => [e.path, e.sha1] as const));
+
       const grandfathered: string[] = [];
       for (const p of targetFilePaths) {
-        if (snapshot.contains(p)) grandfathered.push(p);
+        const recordedSha1 = entryByPath.get(p);
+        if (recordedSha1 === undefined) continue;
+        let actualSha1: string;
+        try {
+          actualSha1 = await hasher.hashFile(p);
+        } catch {
+          // ファイル読み取り失敗 (未作成・権限等) は grandfather 不可扱い (保護側に倒す)
+          continue;
+        }
+        if (actualSha1 === recordedSha1) grandfathered.push(p);
       }
-      const allGrandfathered = grandfathered.length === targetFilePaths.length;
+      const allGrandfathered =
+        targetFilePaths.length > 0 && grandfathered.length === targetFilePaths.length;
 
       return {
         allGrandfathered,

package/scripts/harness/agent-integration/infrastructure/adapters/phase-gate-query-adapter.ts

@@ -39,13 +39,28 @@ export class PhaseGateQueryAdapter implements PhaseGateQueryPort {
         return PhaseGateQueryResult.create(false, [result.text], []);
       }
 
-      return PhaseGateQueryResult.create(true, [], ['phase gate check returned error']);
+      // Fail-closed: an unexpected exit code means the gate could not be evaluated.
+      // A quality gate that cannot confirm PASS must block, not open.
+      console.error(`[agent-integration] phase gate check returned unexpected exit code ${result.exitCode}`);
+      return PhaseGateQueryResult.create(
+        false,
+        [`phase gate check returned unexpected exit code ${result.exitCode}; treating as NOT passed (fail-closed)`],
+        []
+      );
     } catch (error) {
       if (error instanceof ConfigValidationError) {
         return PhaseGateQueryResult.create(false, [error.message], []);
       }
 
-      return PhaseGateQueryResult.create(true, [], ['phase-dependency-model not available']);
+      // Fail-closed: if phase-dependency-model could not be loaded/executed we cannot
+      // confirm the gate passed, so treat it as blocked rather than silently opening it.
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[agent-integration] phase gate check failed to run: ${message}`);
+      return PhaseGateQueryResult.create(
+        false,
+        [`phase gate check could not be evaluated (phase-dependency-model unavailable): ${message}`],
+        []
+      );
     }
   }
 

package/scripts/harness/biome-ast-engine/domain/value-objects/import-graph.ts

@@ -46,6 +46,13 @@ const globToRegex = (pattern: string): RegExp => {
     const next = pattern[index + 1];
 
     if (current === '*' && next === '*') {
+      // A `**/` segment matches any number of leading path segments, INCLUDING
+      // none, so `**/shared-kernel/**` still matches `shared-kernel/a.ts`.
+      if (pattern[index + 2] === '/') {
+        output += '(?:.*/)?';
+        index += 2;
+        continue;
+      }
       output += '.*';
       index += 1;
       continue;
@@ -62,8 +69,28 @@ const globToRegex = (pattern: string): RegExp => {
   return new RegExp(`^${output}$`);
 };
 
+// Fallback for wildcard-free patterns (e.g. `generated`, `shared-kernel`). It
+// must align on a `/` segment boundary at the START and terminate on a real
+// boundary — a `/`, the extension dot, or end of string. This replaces a naive
+// `value.includes(pattern stripped of * and /)` substring test that over-matched
+// (e.g. `vendor` matched `domain/vendorized-service.ts`), which silently
+// suppressed genuine layer violations. The boundary-terminated form keeps
+// intended ignores working (`generated` → `generated.ts`) while no longer
+// swallowing unrelated segments.
+const segmentPrefixRegex = (pattern: string): RegExp => {
+  return new RegExp(`(^|/)${escapeRegex(pattern)}([./]|$)`);
+};
+
 export const matchesPattern = (value: string, pattern: string): boolean => {
-  return globToRegex(pattern).test(value) || value.includes(pattern.replace(/\*/g, '').replace(/\//g, ''));
+  if (globToRegex(pattern).test(value)) {
+    return true;
+  }
+  // Wildcard patterns are authoritative via the glob regex above; only bare
+  // (wildcard-free) patterns fall back to segment-boundary matching.
+  if (pattern.includes('*')) {
+    return false;
+  }
+  return segmentPrefixRegex(pattern).test(value);
 };
 
 const canonicalCycleKey = (path: readonly string[]): string => {

package/scripts/harness/config-foundation/application/mappers/validator-system-config-mapper.ts

@@ -48,6 +48,7 @@ export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefi
         enabled: resolvedConfig.layers.L3.enabled,
         validators: l3Validators.length > 0 ? l3Validators : ['L3-001', 'L3-002', 'L3-003', 'L3-004'],
         coverageThreshold: resolvedConfig.layers.L3.coverageThreshold,
+        requirementMatrixPath: resolvedConfig.layers.L3.requirementMatrixPath,
       },
       L4: {
         enabled: resolvedConfig.layers.L4.enabled,

package/scripts/harness/config-foundation/domain/harness-config.ts

@@ -82,6 +82,7 @@ export interface HarnessConfigResolvedDocument {
       enabled: boolean;
       validators: string[];
       coverageThreshold: number;
+      requirementMatrixPath?: string;
     };
     L4: {
       enabled: boolean;

package/scripts/harness/config-foundation/domain/value-objects/l3-config.ts

@@ -10,12 +10,14 @@ interface L3ConfigProps {
   readonly enabled: boolean;
   readonly validators: string[];
   readonly coverageThreshold: number;
+  readonly requirementMatrixPath?: string;
 }
 
 export class L3Config {
   readonly enabled: boolean;
   readonly validators: readonly string[];
   readonly coverageThreshold: number;
+  readonly requirementMatrixPath?: string;
 
   constructor(props: L3ConfigProps) {
     if (props.coverageThreshold < 0) {
@@ -37,6 +39,7 @@ export class L3Config {
     this.enabled = props.enabled;
     this.validators = Object.freeze([...props.validators]);
     this.coverageThreshold = props.coverageThreshold;
+    this.requirementMatrixPath = props.requirementMatrixPath;
     Object.freeze(this);
   }
 
@@ -44,6 +47,7 @@ export class L3Config {
     enabled: boolean;
     validators: string[];
     coverageThreshold: number;
+    requirementMatrixPath?: string;
   }): L3Config {
     return new L3Config(raw);
   }

package/scripts/harness/config-foundation/domain/value-objects/layers-config.ts

@@ -13,7 +13,7 @@ import { L4Config } from './l4-config.js';
 interface ResolvedLayersDocument {
   L1: { enabled: boolean; rules: Record<string, string> };
   L2: { enabled: boolean; validators: string[] };
-  L3: { enabled: boolean; validators: string[]; coverageThreshold: number };
+  L3: { enabled: boolean; validators: string[]; coverageThreshold: number; requirementMatrixPath?: string };
   L4: { enabled: boolean; validators: string[]; schedule: string };
 }
 

package/scripts/harness/config-foundation/infrastructure/presets/minimal.json

@@ -11,7 +11,8 @@
     "L3": {
       "enabled": false,
       "validators": ["consistency"],
-      "coverageThreshold": 0
+      "coverageThreshold": 0,
+      "requirementMatrixPath": ".harness/requirement-test-matrix.json"
     },
     "L4": {
       "enabled": false,

package/scripts/harness/config-foundation/infrastructure/presets/standard.json

@@ -11,7 +11,8 @@
     "L3": {
       "enabled": true,
       "validators": ["consistency", "test-quality"],
-      "coverageThreshold": 90
+      "coverageThreshold": 90,
+      "requirementMatrixPath": ".harness/requirement-test-matrix.json"
     },
     "L4": {
       "enabled": false,

package/scripts/harness/config-foundation/infrastructure/presets/strict.json

@@ -11,7 +11,8 @@
     "L3": {
       "enabled": true,
       "validators": ["consistency", "test-quality"],
-      "coverageThreshold": 95
+      "coverageThreshold": 95,
+      "requirementMatrixPath": ".harness/requirement-test-matrix.json"
     },
     "L4": {
       "enabled": true,

package/scripts/harness/config-foundation/infrastructure/schemas/harness-config-v2.schema.json

@@ -126,6 +126,10 @@
               "type": "number",
               "minimum": 0,
               "maximum": 100
+            },
+            "requirementMatrixPath": {
+              "type": "string",
+              "minLength": 1
             }
           }
         },
@@ -344,20 +348,21 @@
                 "type": "object",
                 "additionalProperties": false,
                 "required": [
-                  "unitId",
-                  "artifacts"
+                  "inception",
+                  "product",
+                  "required"
                 ],
                 "properties": {
-                  "unitId": {
+                  "inception": {
                     "type": "string",
                     "minLength": 1
                   },
-                  "artifacts": {
-                    "type": "array",
-                    "items": {
-                      "type": "string",
-                      "minLength": 1
-                    }
+                  "product": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "required": {
+                    "type": "boolean"
                   }
                 }
               }

package/scripts/harness/config-foundation/infrastructure/schemas/harness-config-v3.schema.json

@@ -136,6 +136,10 @@
               "type": "number",
               "minimum": 0,
               "maximum": 100
+            },
+            "requirementMatrixPath": {
+              "type": "string",
+              "minLength": 1
             }
           }
         },
@@ -354,20 +358,21 @@
                 "type": "object",
                 "additionalProperties": false,
                 "required": [
-                  "unitId",
-                  "artifacts"
+                  "inception",
+                  "product",
+                  "required"
                 ],
                 "properties": {
-                  "unitId": {
+                  "inception": {
                     "type": "string",
                     "minLength": 1
                   },
-                  "artifacts": {
-                    "type": "array",
-                    "items": {
-                      "type": "string",
-                      "minLength": 1
-                    }
+                  "product": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "required": {
+                    "type": "boolean"
                   }
                 }
               }

package/scripts/harness/harness-api/infrastructure/adapters/phase-dependency-model-query-adapter.ts

@@ -61,8 +61,15 @@ export class PhaseDependencyModelQueryAdapter implements PhaseGateQueryPort {
             }
           }
           return results;
-        } catch {
-          return [];
+        } catch (err) {
+          // Fail-closed: returning [] here would make CheckReadyResult.fromStories treat
+          // "no stories" as an unconditional pass. Surface the error so the dispatcher
+          // reports a non-passing (error) result instead of silently opening the gate.
+          const message = err instanceof Error ? err.message : String(err);
+          console.error(`[harness-api] queryAllStories failed to evaluate phase gates: ${message}`);
+          throw err instanceof Error
+            ? err
+            : new Error(`queryAllStories failed to evaluate phase gates: ${message}`);
         }
       },
 
@@ -91,8 +98,15 @@ export class PhaseDependencyModelQueryAdapter implements PhaseGateQueryPort {
             currentPhase: `PHASE-${result.targetLevel}`,
             completedGates: result.passed ? [`level-${result.targetLevel}`] : [],
           });
-        } catch {
-          return null;
+        } catch (err) {
+          // Fail-closed: returning null here conflates a genuine execution error with
+          // "unit not found" and hides the failure. Surface the error so the dispatcher
+          // reports a non-passing (error) result instead of masking it.
+          const message = err instanceof Error ? err.message : String(err);
+          console.error(`[harness-api] queryUnit failed to evaluate phase gate for '${unitId}': ${message}`);
+          throw err instanceof Error
+            ? err
+            : new Error(`queryUnit failed to evaluate phase gate for '${unitId}': ${message}`);
         }
       },
     };

package/scripts/harness/harness-api/infrastructure/adapters/validator-system-execution-adapter.ts

@@ -10,6 +10,19 @@ import type { DriftItem } from '../../domain/value-objects/drift-report-summary.
 import { toValidatorSystemConfig } from '../../../config-foundation/application/mappers/validator-system-config-mapper.js';
 import { ConfigNotFoundError } from '../../../config-foundation/infrastructure/repositories/file-system-config-repository.js';
 
+/**
+ * validator-system config（toValidatorSystemConfig の出力）から
+ * L3-004 用の requirement-test-matrix.json パスを取り出す。
+ * 未設定・config 不在時は undefined を返し、下流の AC coverage adapter が
+ * 既定値（.harness/requirement-test-matrix.json）へフォールバックする。
+ */
+function extractRequirementMatrixPath(config: object | undefined): string | undefined {
+  if (!config) return undefined;
+  const layers = (config as { layers?: { L3?: { requirementMatrixPath?: unknown } } }).layers;
+  const path = layers?.L3?.requirementMatrixPath;
+  return typeof path === 'string' && path.length > 0 ? path : undefined;
+}
+
 // Override interface preserved for testing
 export interface IValidatorSystemStub {
   runL3Validators(): Promise<ValidatorCheckItem[]>;
@@ -40,8 +53,12 @@ export class ValidatorSystemExecutionAdapter implements ValidatorExecutionPort {
     return {
       async runL3Validators(): Promise<ValidatorCheckItem[]> {
         const { createValidatorSystemModule } = await import('../../../validator-system/composition-root.js');
-        const mod = createValidatorSystemModule(await loadValidatorSystemConfig());
-        const results = await mod.runL3ValidatorsUseCase.execute({ targetPaths: [] });
+        const config = await loadValidatorSystemConfig();
+        const mod = createValidatorSystemModule(config);
+        const results = await mod.runL3ValidatorsUseCase.execute({
+          targetPaths: [],
+          requirementMatrixPath: extractRequirementMatrixPath(config),
+        });
         return results.map((r) => ({
           validatorId: r.validatorId,
           passed: r.passed,
@@ -52,8 +69,14 @@ export class ValidatorSystemExecutionAdapter implements ValidatorExecutionPort {
 
       async runAllValidators(): Promise<ValidatorCheckItem[]> {
         const { createValidatorSystemModule } = await import('../../../validator-system/composition-root.js');
-        const mod = createValidatorSystemModule(await loadValidatorSystemConfig());
-        const report = await mod.runFullValidationUseCase.execute({ targetPaths: [], unitName: '', currentPhase: '' });
+        const config = await loadValidatorSystemConfig();
+        const mod = createValidatorSystemModule(config);
+        const report = await mod.runFullValidationUseCase.execute({
+          targetPaths: [],
+          unitName: '',
+          currentPhase: '',
+          requirementMatrixPath: extractRequirementMatrixPath(config),
+        });
         return report.results.map((r) => ({
           validatorId: r.validatorId,
           passed: r.passed,

package/scripts/harness/installation/application/ports/model-delegation-port.ts

@@ -0,0 +1,10 @@
+// @unit installation
+// @layer application
+// @work-item-id WI-219
+
+export type ModelDelegationPolicy = "delegate-sonnet" | "none";
+
+export interface ModelDelegationPort {
+  readPolicy(projectRoot: string): Promise<ModelDelegationPolicy>;
+  renderSkill(content: string, policy: ModelDelegationPolicy): string;
+}