phasegate 0.161.0 → 0.163.0

package/scripts/harness/quick-mode/application/usecases/classify-change-category-usecase.ts

@@ -50,11 +50,16 @@ export class ClassifyChangeCategoryUseCase {
     const targetChanges = new Map((input.targetChanges ?? []).map((change) => [change.filePath, change]));
     const changedFiles = input.paths.map((p) => {
       const targetChange = targetChanges.get(p);
+      const beforeContent = targetChange?.beforeContent ?? null;
+      const afterContent = targetChange?.afterContent ?? null;
       return ChangedFile.create({
         filePath: p,
-        changeKind: 'MODIFY',
-        beforeContent: targetChange?.beforeContent ?? null,
-        afterContent: targetChange?.afterContent ?? null,
+        // 変更前の内容が無く変更後の内容がある場合は新規作成 (CREATE) とみなす。
+        // 以前は無条件で MODIFY 固定だったため、新規 domain/ ファイルが
+        // NEW_DOMAIN 判定を回避して quick mode をすり抜けていた。
+        changeKind: beforeContent === null && afterContent !== null ? 'CREATE' : 'MODIFY',
+        beforeContent,
+        afterContent,
       });
     });
 

package/scripts/harness/quick-mode/composition-root.ts

@@ -8,6 +8,7 @@
 import { GitDiffChangedFilesAdapter } from './infrastructure/adapters/git-diff-changed-files-adapter.js';
 import { HarnessConfigQuickModeConfigAdapter } from './infrastructure/adapters/harness-config-quick-mode-config-adapter.js';
 import { ValidatorSystemValidatorIdRegistryAdapter } from './infrastructure/adapters/validator-system-validator-id-registry-adapter.js';
+import { ValidatorSystemQuickModeExecutionAdapter } from './infrastructure/adapters/validator-system-quick-mode-execution-adapter.js';
 import { QuickModeJudgmentEngine } from './domain/services/quick-mode-judgment-engine.js';
 import { ValidatorRelaxationService } from './domain/services/validator-relaxation-service.js';
 import { QuickModeDecisionContractMapper } from './application/mappers/quick-mode-decision-contract-mapper.js';
@@ -32,6 +33,7 @@ export function createQuickModeCompositionRoot(): QuickModeCompositionRoot {
   const gitDiffAdapter = new GitDiffChangedFilesAdapter();
   const harnessConfigAdapter = new HarnessConfigQuickModeConfigAdapter();
   const validatorIdRegistryAdapter = new ValidatorSystemValidatorIdRegistryAdapter();
+  const validatorExecutionPort = new ValidatorSystemQuickModeExecutionAdapter();
 
   // Domain Services
   const judgmentEngine = new QuickModeJudgmentEngine();
@@ -64,6 +66,7 @@ export function createQuickModeCompositionRoot(): QuickModeCompositionRoot {
   const executeUseCase = new ExecuteQuickCiCheckUseCase({
     judgeUseCase,
     buildUseCase,
+    validatorExecutionPort,
   });
 
   const classifyUseCase = new ClassifyChangeCategoryUseCase({

package/scripts/harness/quick-mode/infrastructure/adapters/validator-system-quick-mode-execution-adapter.ts

@@ -0,0 +1,18 @@
+// @layer infrastructure
+// @unit quick-mode
+
+import type { ValidatorExecutionPort } from '../../application/ports/validator-execution-port.js';
+import type { ValidatorRelaxationProfileContract } from '../../application/dto/validator-relaxation-profile-contract.js';
+
+export class ValidatorSystemQuickModeExecutionAdapter implements ValidatorExecutionPort {
+  async executeWithProfile(profile: ValidatorRelaxationProfileContract): Promise<void> {
+    const { createValidatorSystemModule } = await import('../../../validator-system/composition-root.js');
+    const module = createValidatorSystemModule();
+    await module.runQuickModeUseCase.execute({
+      relaxationProfile: profile,
+      targetPaths: [],
+      unitName: '',
+      currentPhase: '',
+    });
+  }
+}

package/scripts/harness/quick-mode/presentation/handlers/ci-check-quick-mode-handler.ts

@@ -5,12 +5,56 @@
  * phasegate:ci-check --quick フラグを受け取り、ExecuteQuickCiCheckUseCase を呼ぶハンドラー
  */
 
+import * as childProcess from 'node:child_process';
+import { existsSync } from 'node:fs';
 import { HumanQuickModeFormatter } from '../formatters/human-quick-mode-formatter.js';
 import { AgentQuickModeFormatter } from '../formatters/agent-quick-mode-formatter.js';
 import { JsonQuickModeFormatter } from '../formatters/json-quick-mode-formatter.js';
 import type { ExecuteQuickCiCheckUseCase } from '../../application/usecases/execute-quick-ci-check-usecase.js';
 import type { QuickModeRenderOptions } from '../dto/quick-mode-render-options.js';
 
+/**
+ * `--files` で列挙されたパスの変更種別 (CREATE/MODIFY) を推定する。
+ *
+ * WI: 以前は無条件で MODIFY 固定だったため、新規 domain/ ファイルが
+ * NEW_DOMAIN 判定を回避して quick mode をすり抜けていた。git のステージ状態を
+ * 参照し、追加 (A) なら CREATE、それ以外は MODIFY とする。git 情報が取れない
+ * 場合は「ファイルが未追跡（作業ツリーにのみ存在しコミット履歴に無い）」を
+ * CREATE のヒューリスティックとして用いる。
+ */
+function resolveChangeKind(filePath: string): 'CREATE' | 'MODIFY' {
+  const gitStatus = readGitStatus(filePath);
+  if (gitStatus === 'A') return 'CREATE';
+  if (gitStatus !== null) return 'MODIFY';
+  return isUntrackedNewFile(filePath) ? 'CREATE' : 'MODIFY';
+}
+
+function readGitStatus(filePath: string): string | null {
+  try {
+    const output = childProcess.execSync(
+      `git diff --name-status --cached -- ${JSON.stringify(filePath)}`,
+      { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] },
+    ) as string;
+    const line = output.trim().split('\n').find((l) => l.trim().length > 0);
+    return line ? (line.split('\t')[0]?.trim() ?? null) : null;
+  } catch {
+    return null;
+  }
+}
+
+function isUntrackedNewFile(filePath: string): boolean {
+  if (!existsSync(filePath)) return false;
+  try {
+    childProcess.execSync(
+      `git ls-files --error-unmatch -- ${JSON.stringify(filePath)}`,
+      { stdio: ['pipe', 'pipe', 'pipe'] },
+    );
+    return false; // tracked → 既存ファイル
+  } catch {
+    return true; // 未追跡 → 新規ファイル
+  }
+}
+
 export interface CiCheckQuickModeHandlerDeps {
   useCase: Pick<ExecuteQuickCiCheckUseCase, 'execute'>;
 }
@@ -25,13 +69,15 @@ export class CiCheckQuickModeHandler {
   async handle(options: QuickModeRenderOptions): Promise<void> {
     const { files, dryRun = false, format = 'human', failOnReject = false } = options;
 
-    // --files 解析: カンマ区切りのファイルパスを MODIFY として扱う
+    // --files 解析: カンマ区切りのファイルパスを git ステージ状態から
+    // CREATE/MODIFY へ分類する（新規 domain/ ファイルの NEW_DOMAIN 判定のため）
     let changedFiles: { filePath: string; changeKind: string }[] | undefined;
     if (files) {
-      changedFiles = files.split(',').map((p) => ({
-        filePath: p.trim(),
-        changeKind: 'MODIFY',
-      }));
+      changedFiles = files
+        .split(',')
+        .map((p) => p.trim())
+        .filter((p) => p.length > 0)
+        .map((filePath) => ({ filePath, changeKind: resolveChangeKind(filePath) }));
     }
 
     let decision: Awaited<ReturnType<typeof this.useCase.execute>>;

package/scripts/harness/skill-quality/infrastructure/adapters/l1-biome-validator-adapter.ts

@@ -18,8 +18,18 @@ export class L1BiomeValidatorAdapter implements L1ValidatorPort {
         message: violation.message,
         location: `${violation.filePath.toString()}:${violation.line}:${violation.column}`,
       }));
-    } catch (_err) {
-      return [];
+    } catch (err) {
+      // Fail-closed: a validator failure must NOT be treated as "合格".
+      // Surface the error as a blocking violation so the commit gate stays closed.
+      const message = err instanceof Error ? err.message : String(err);
+      console.error(`[skill-quality] L1 Biome validator failed: ${message}`);
+      return [
+        {
+          ruleId: 'L1-VALIDATOR-ERROR',
+          message: `L1 Biome validator failed to run; treating as NOT compliant (fail-closed): ${message}`,
+          location: '',
+        },
+      ];
     }
   }
 }

package/scripts/harness/skill-quality/infrastructure/adapters/l2-validator-system-adapter.ts

@@ -23,8 +23,18 @@ export class L2ValidatorSystemAdapter implements L2ValidatorPort {
         message: error.message,
         location: '',
       }));
-    } catch {
-      return [];
+    } catch (err) {
+      // Fail-closed: a validator failure must NOT be treated as "合格".
+      // Surface the error as a blocking violation so the commit gate stays closed.
+      const message = err instanceof Error ? err.message : String(err);
+      console.error(`[skill-quality] L2 validator-system failed: ${message}`);
+      return [
+        {
+          ruleId: 'L2-VALIDATOR-ERROR',
+          message: `L2 validator-system failed to run; treating as NOT compliant (fail-closed): ${message}`,
+          location: '',
+        },
+      ];
     }
   }
 }

package/scripts/harness/traceability-model/application/usecases/apply-work-item-status-usecase.ts

@@ -42,12 +42,17 @@ export class ApplyWorkItemStatusUseCase {
   }
 }
 
+// `completed` is a manually promoted terminal state that the automatic
+// derivation never emits (derivation tops out at `tested`). It must rank
+// strictly above `tested` here so that deriving `tested` for an already
+// `completed` work item is detected as a downgrade and blocked, preventing a
+// `completed` -> `tested` regression on `work-items --apply`.
 const STATUS_ORDER: Record<WorkItemStatus, number> = {
   drafted: 0,
   reflected: 1,
   implemented: 2,
   tested: 3,
-  completed: 3,
+  completed: 4,
 };
 
 function statusOrder(status: WorkItemStatus): number {

package/scripts/harness/traceability-model/infrastructure/parsers/story-catalog-parser.ts

@@ -12,9 +12,10 @@ export interface ParsedStoryCatalog {
 
 const STORY_ID_LINE_PATTERN = /\bH(?:F\d+|[0-9]{2})-[0-9]{2}\b/g;
 const TABLE_ALIAS_PATTERN =
-  /\|\s*(H[0-9]{2}-[0-9]{2})\s*\|.*?\|\s*(US-[0-9]{3})\s*\|/g;
+  /\|\s*(H(?:F\d+|[0-9]{2})-[0-9]{2})\s*\|.*?\|\s*(US-[0-9]{3})\s*\|/g;
+// 旧US ラベルは Markdown 強調（**旧US**:）で囲まれることがあるため `\**` を許容する。
 const INLINE_ALIAS_PATTERN =
-  /(H[0-9]{2}-[0-9]{2}).*?旧US\s*[:：]\s*(US-[0-9]{3})/g;
+  /(H(?:F\d+|[0-9]{2})-[0-9]{2}).*?旧US\**\s*[:：]\s*(US-[0-9]{3})/g;
 
 function execAll(pattern: RegExp, text: string): RegExpExecArray[] {
   const results: RegExpExecArray[] = [];
@@ -56,14 +57,32 @@ export function parseStoryCatalog(content: string): ParsedStoryCatalog {
     aliasMap.set(inlineMatches[i][2], inlineMatches[i][1]);
   }
 
-  // 前後行コンテキスト形式: H03-01 の直後に 旧US: US-001
+  // 見出しスコープ形式:
+  //   ### H01-01: タイトル
+  //
+  //   **旧US**: US-036
+  // のように、`### HXX-XX:` 見出しの後、次の見出しが現れるまでの範囲に `旧US: US-xxx`
+  // が出現するパターンに対応する。旧実装は直後行（lines[i+1]）のみを見ていたため、
+  // 実際の user_stories.md（見出しと旧US行の間に空行や Epic 行が挟まる）では alias が
+  // 一切抽出されず、レガシー StoryId 解決が事実上機能していなかった。
+  const HEADING_STORY_ID = /^#{1,6}\s+(H(?:F\d+|[0-9]{2})-[0-9]{2})\b/;
+  const LEGACY_IN_LINE = /旧US\**\s*[:：]\s*(US-[0-9]{3})/;
+  let currentHeadingStoryId: string | null = null;
   for (let i = 0; i < lines.length; i++) {
-    const storyIdMatch = /\b(H(?:F\d+|[0-9]{2})-[0-9]{2})\b/.exec(lines[i]);
-    if (storyIdMatch) {
-      const nextLine = i + 1 < lines.length ? lines[i + 1] : '';
-      const legacyMatch = /旧US\s*[:：]\s*(US-[0-9]{3})/.exec(nextLine);
-      if (legacyMatch) {
-        aliasMap.set(legacyMatch[1], storyIdMatch[1]);
+    const headingMatch = HEADING_STORY_ID.exec(lines[i]);
+    if (headingMatch) {
+      currentHeadingStoryId = headingMatch[1];
+      continue;
+    }
+    if (/^#{1,6}\s+/.test(lines[i])) {
+      // StoryId を含まない別の見出しに入ったらスコープを閉じる
+      currentHeadingStoryId = null;
+      continue;
+    }
+    if (currentHeadingStoryId) {
+      const legacyMatch = LEGACY_IN_LINE.exec(lines[i]);
+      if (legacyMatch && !aliasMap.has(legacyMatch[1])) {
+        aliasMap.set(legacyMatch[1], currentHeadingStoryId);
       }
     }
   }

package/scripts/harness/validator-system/application/use-cases/run-l3-validators-usecase.ts

@@ -84,38 +84,76 @@ export class RunL3ValidatorsUseCase {
     const { executableDefinitions, unsupportedResults, unsupportedValidatorIds } =
       this.languageCapabilityService.splitDefinitions(definitions, projectLanguages);
 
-    // coverageReportPort が存在する場合、カバレッジを取得して判定
-    if (this.coverageReportPort && !unsupportedValidatorIds.has('L3-003')) {
-      const coverageData = await this.coverageReportPort.getCoverage();
-      const threshold = layerConfig.getThreshold('coverageThreshold');
-
-      // カバレッジ不足の場合は fail 結果を生成
-      if (threshold !== null && coverageData.overallCoverage < threshold) {
-        const deficit = threshold - coverageData.overallCoverage;
-
-        // 他のバリデータを実行
-        const otherDefs = executableDefinitions.filter((d) => d.validatorId.value !== 'L3-003');
-        const otherResults = this.executionService.execute(otherDefs, [layerConfig]);
-        const otherContracts = this.mapper.toContracts([...unsupportedResults, ...otherResults]);
-
-        return [
-          ...otherContracts.filter((r) => r.validatorId !== 'L3-003'),
-          {
-            validatorId: 'L3-003',
-            passed: false,
-            errors: [{ code: 'L3-003', severity: 'error', message: `カバレッジ不足: 現在値 ${coverageData.overallCoverage}%、不足 ${deficit}%` , suggestion: `テストカバレッジを ${threshold}% 以上に引き上げてください` }],
-            durationMs: 0,
-            skipped: false,
-          },
-        ];
-      }
-    }
-
     const results = this.executionService.execute(executableDefinitions, [layerConfig]);
     const overrideMap = new Map<string, ValidationResult>(
       [...unsupportedResults, ...results].map((result) => [result.validatorId.value, result]),
     );
 
+    // L3-003: カバレッジ判定（カバレッジゲートはオプトイン）
+    // - coverageThreshold 未設定 → SKIP（透過的に判定をスキップ。getCoverage() は呼ばない）
+    // - coverageThreshold 設定あり → getCoverage() を try/catch で包み FAIL-CLOSED で判定する
+    //   - 閾値未満 → FAIL / 閾値以上 → PASS
+    //   - レポート不在などで getCoverage() が失敗 → FAIL（合格扱いにしない）
+    // このブロックは例外を送出せず、L3-003 の per-validator 結果のみを差し替える。
+    // これにより兄弟バリデータ（L3-001/002/004 および L2/L4 バッチ）は常に通常実行される。
+    const l3003InScope =
+      !unsupportedValidatorIds.has('L3-003') &&
+      definitions.some((d) => d.validatorId.value === 'L3-003');
+    if (this.coverageReportPort && l3003InScope) {
+      const l3003Id = ValidatorId.create('L3-003');
+      const threshold = layerConfig.getThreshold('coverageThreshold');
+
+      if (threshold === null) {
+        overrideMap.set(
+          'L3-003',
+          ValidationResult.skipWithReason(
+            l3003Id,
+            'coverageThreshold が未設定のためカバレッジ判定をスキップ（カバレッジゲートはオプトイン）',
+          ),
+        );
+      } else {
+        try {
+          const coverageData = await this.coverageReportPort.getCoverage();
+          if (coverageData.overallCoverage < threshold) {
+            overrideMap.set(
+              'L3-003',
+              ValidationResult.fail(
+                l3003Id,
+                [
+                  {
+                    code: 'L3-003',
+                    severity: 'error',
+                    message: `カバレッジ不足: 現在値 ${coverageData.overallCoverage}%、不足 ${threshold - coverageData.overallCoverage}%`,
+                    suggestion: `テストカバレッジを ${threshold}% 以上に引き上げてください`,
+                  },
+                ],
+                0,
+              ),
+            );
+          } else {
+            overrideMap.set('L3-003', ValidationResult.pass(l3003Id, 0));
+          }
+        } catch {
+          // レポート不在などで取得失敗 → FAIL-CLOSED（例外は握りつぶし per-validator FAIL に変換）
+          overrideMap.set(
+            'L3-003',
+            ValidationResult.fail(
+              l3003Id,
+              [
+                {
+                  code: 'L3-003',
+                  severity: 'error',
+                  message: `coverageThreshold=${threshold}% が設定されていますがカバレッジレポートが見つかりません（テストをカバレッジ付きで実行してください）`,
+                  suggestion: 'vitest --coverage 等でカバレッジレポートを生成してから再実行してください',
+                },
+              ],
+              0,
+            ),
+          );
+        }
+      }
+    }
+
     if (this.securityScannerPort) {
       const l3001Result = overrideMap.get('L3-001');
       if (l3001Result && !l3001Result.skipped) {

package/scripts/harness/validator-system/application/use-cases/run-l4-validators-usecase.ts

@@ -177,9 +177,12 @@ export class RunL4ValidatorsUseCase {
       const l4002Result = overrideMap.get('L4-002');
       if (l4002Result && !l4002Result.skipped) {
         const report = await this.consistencyCheckService.check(input.targetUnits ? [...input.targetUnits] : undefined);
-        const reflectionResult = this.usesConfiguredDocumentRoots()
-          ? await this.consistencyCheckService.checkWorkItemReflection(this.pathRoots)
-          : undefined;
+        // WI-217: 標準レイアウト (docs/inception, docs/product/construction) でも
+        // reflection を必ず実行する。以前は usesConfiguredDocumentRoots() が false を
+        // 返すため標準構成では reflection が恒久的にスキップされ、L4-002 が常に PASS
+        // していた。description が存在しない場合はアダプタ側が skipReason を返すため、
+        // 常時実行しても未整備プロジェクトを誤って失敗させることはない。
+        const reflectionResult = await this.consistencyCheckService.checkWorkItemReflection(this.pathRoots);
         const architectureSemanticErrors = this.architectureSemanticAnalysisService
           ? await this.architectureSemanticAnalysisService.analyze()
           : [];
@@ -289,10 +292,6 @@ export class RunL4ValidatorsUseCase {
     return this.configPort.getProjectLanguages ? await this.configPort.getProjectLanguages() : ['typescript'];
   }
 
-  private usesConfiguredDocumentRoots(): boolean {
-    return this.pathRoots.inceptionRoot !== 'docs/inception' || this.pathRoots.designRoot !== 'docs/product/construction';
-  }
-
   private toPointerValidationHarnessErrors(output: ValidateDocPointersOutputContract): readonly ValidationResult['errors'][number][] {
     const executionErrors = output.errors.map((error) => this.toHarnessErrorLike(
       'L4-005',

package/scripts/harness/validator-system/composition-root.ts

@@ -29,6 +29,7 @@ import { FileSystemContractTraceabilityPolicyAdapter } from './infrastructure/ad
 import { PhaseDependencyPhaseGatePolicyAdapter } from './infrastructure/adapters/phase-dependency-phase-gate-policy-adapter.js';
 import { TraceabilityMetadataPolicyAdapter } from './infrastructure/adapters/traceability-metadata-policy-adapter.js';
 import { NyquistAcCoveragePolicyAdapter } from './infrastructure/adapters/nyquist-ac-coverage-policy-adapter.js';
+import { JsonCoverageReportAdapter } from './infrastructure/adapters/json-coverage-report-adapter.js';
 import { BiomeAstTestQualityAnalyzerAdapter } from './infrastructure/adapters/biome-ast-test-quality-analyzer-adapter.js';
 import { FileSystemSecurityPatternScannerAdapter } from './infrastructure/adapters/file-system-security-pattern-scanner-adapter.js';
 import { AstPerformanceScannerAdapter } from './infrastructure/adapters/ast-performance-scanner-adapter.js';
@@ -54,7 +55,7 @@ const DEFAULT_CONFIG = {
   preset: 'standard' as const,
   layers: {
     L2: { enabled: true, validators: ['L2-001', 'L2-002', 'L2-003', 'L2-013', 'L2-014', 'L2-015'] },
-    L3: { enabled: true, validators: ['L3-001', 'L3-002', 'L3-003', 'L3-004'], coverageThreshold: 90, bundleSizeLimit: 512000 },
+    L3: { enabled: true, validators: ['L3-001', 'L3-002', 'L3-003', 'L3-004'], coverageThreshold: 90, bundleSizeLimit: 512000, requirementMatrixPath: '.harness/requirement-test-matrix.json' },
     L4: { enabled: true, validators: ['L4-001', 'L4-002', 'L4-003', 'L4-004', 'L4-005', 'L4-006'] },
   },
   paths: {
@@ -149,6 +150,11 @@ export function createValidatorSystemModule(config?: object): ValidatorSystemMod
   const phaseGatePolicyPort = new PhaseDependencyPhaseGatePolicyAdapter();
   const metadataPolicyPort = new TraceabilityMetadataPolicyAdapter();
   const acCoveragePolicyPort = new NyquistAcCoveragePolicyAdapter();
+  // L3-003: テストカバレッジレポート（vitest --coverage の json-summary 出力）を読み取る。
+  // 未配線だと L3-003 は装飾的な pass になり 90% 閾値が形骸化するため必ず配線する。
+  const coverageReportPort = new JsonCoverageReportAdapter(
+    join(process.cwd(), 'coverage', 'coverage-summary.json'),
+  );
   const testQualityAnalyzerPort = new BiomeAstTestQualityAnalyzerAdapter();
   const securityScannerPort = new FileSystemSecurityPatternScannerAdapter();
   const performanceScannerPort = new AstPerformanceScannerAdapter();
@@ -189,6 +195,7 @@ export function createValidatorSystemModule(config?: object): ValidatorSystemMod
     validatorConfigPort: configPort,
     contractMapper,
     acCoveragePolicyPort,
+    coverageReportPort,
     securityScannerPort,
     performanceScannerPort,
   });

package/scripts/harness/validator-system/infrastructure/adapters/file-system-security-pattern-scanner-adapter.ts

@@ -40,12 +40,14 @@ export class FileSystemSecurityPatternScannerAdapter implements SecurityPatternS
     for (const filePath of targetPaths) {
       try {
         const content = await readFile(filePath, 'utf-8');
-        if (content.includes(ALLOWLIST_MARKER)) {
-          continue;
-        }
         const lines = content.split('\n');
         lines.forEach((line, idx) => {
-          if (isAllowlisted(line, content)) {
+          // WI-120: allowlist は行/領域スコープ。以前はファイル内のどこかに
+          // マーカーが 1 つでもあればファイル全体をスキップしていたため、同一
+          // ファイル内の本物の秘密情報も検出漏れしていた。マーカーは当該行、
+          // または直前行（次行抑止コメント）にある場合のみ有効とする。
+          const previousLine = idx > 0 ? lines[idx - 1] : undefined;
+          if (isAllowlisted(line, previousLine)) {
             return;
           }
           for (const { pattern, description, ruleId } of SECURITY_PATTERNS) {
@@ -71,9 +73,17 @@ export class FileSystemSecurityPatternScannerAdapter implements SecurityPatternS
   }
 }
 
-function isAllowlisted(line: string, content: string): boolean {
+/**
+ * 当該行が allowlist されているか判定する（行/領域スコープ）。
+ *
+ * - 当該行にマーカーがある → 許可
+ * - 直前行にマーカーがある（次行抑止コメント） → 許可
+ *
+ * ファイル全体を対象にしないことで、同一ファイル内の本物の秘密情報を検出できる。
+ */
+function isAllowlisted(line: string, previousLine: string | undefined): boolean {
   if (line.includes(ALLOWLIST_MARKER)) return true;
-  return /@example|dummy|placeholder/i.test(line) && content.includes(ALLOWLIST_MARKER);
+  return previousLine?.includes(ALLOWLIST_MARKER) ?? false;
 }
 
 function redactSecret(secretValue: string): string {

package/scripts/harness/validator-system/infrastructure/adapters/file-system-work-item-reflection-adapter.ts

@@ -18,6 +18,13 @@ function normalizePath(value: string): string {
   return value.replace(/\\/g, '/');
 }
 
+// Separator-agnostic check for whether a path points at a work-item
+// description file. Exported so the Windows (`\`) normalization is unit
+// testable without depending on the host filesystem separator.
+export function isDescriptionFilePath(value: string): boolean {
+  return normalizePath(value).endsWith(`/${DESCRIPTION_FILE}`);
+}
+
 async function listFiles(root: string): Promise<string[]> {
   try {
     const entries = await readdir(root, { withFileTypes: true });
@@ -66,7 +73,9 @@ export class FileSystemWorkItemReflectionAdapter implements WorkItemReflectionPo
     const inceptionRoot = join(this.projectRoot, input.inceptionRoot);
     const designRoot = join(this.projectRoot, input.designRoot);
     const descriptionFiles = (await listFiles(inceptionRoot))
-      .filter((path) => path.endsWith(`/${DESCRIPTION_FILE}`));
+      // Normalize separators first so Windows paths (which use `\`) still match
+      // the `/description.md` suffix.
+      .filter(isDescriptionFilePath);
 
     if (descriptionFiles.length === 0) {
       return {

package/scripts/harness/validator-system/infrastructure/adapters/import-graph-source-analysis-adapter.ts

@@ -137,9 +137,7 @@ function extractExports(content: string): string[] {
 function resolveImportTarget(fromFile: string, specifier: string, fileSet: ReadonlySet<string>): string | null {
   if (!specifier.startsWith('.')) return null;
   const base = resolve(dirname(fromFile), specifier);
-  const candidates = extname(base)
-    ? [base]
-    : [`${base}.ts`, `${base}.tsx`, join(base, 'index.ts'), join(base, 'index.tsx')];
+  const candidates = buildResolutionCandidates(base);
   for (const candidate of candidates) {
     const normalized = normalize(candidate);
     if (fileSet.has(normalized)) return normalized;
@@ -147,6 +145,40 @@ function resolveImportTarget(fromFile: string, specifier: string, fileSet: Reado
   return null;
 }
 
+/**
+ * import 指定子から実ファイル候補を生成する。
+ *
+ * このプロジェクトは ESM 規約に従い `./foo.js` と書いて実体 `foo.ts` を参照する
+ * （TypeScript の `.js` 拡張子付き import）。素朴に extname を見ると `.js` 実体を
+ * 探しに行き解決に失敗するため、`.js`/`.jsx`/`.mjs`/`.cjs` 拡張子は対応する
+ * TypeScript 拡張子（およびディレクトリの index）へマッピングした候補も加える。
+ */
+function buildResolutionCandidates(base: string): string[] {
+  const ext = extname(base);
+  const JS_TO_TS: Record<string, readonly string[]> = {
+    '.js': ['.ts', '.tsx'],
+    '.jsx': ['.tsx', '.ts'],
+    '.mjs': ['.mts', '.ts'],
+    '.cjs': ['.cts', '.ts'],
+  };
+
+  if (ext) {
+    const mapped = JS_TO_TS[ext];
+    if (mapped) {
+      const withoutExt = base.slice(0, base.length - ext.length);
+      // 例: `./foo.js` → `foo.ts` / `foo.tsx`、`./dir.js`(ディレクトリ)→ `dir/index.ts`
+      return [
+        ...mapped.map((tsExt) => `${withoutExt}${tsExt}`),
+        base,
+        ...mapped.map((tsExt) => join(withoutExt, `index${tsExt}`)),
+      ];
+    }
+    return [base];
+  }
+
+  return [`${base}.ts`, `${base}.tsx`, join(base, 'index.ts'), join(base, 'index.tsx')];
+}
+
 function classifyDeadCodeExclusion(filePath: string): string | undefined {
   const normalized = filePath.replaceAll('\\', '/');
   if (/(^|\/)__tests__\//.test(normalized) || /\.test\.ts$/.test(normalized) || /\.it\.test\.ts$/.test(normalized)) {