phasegate 0.161.0 → 0.163.0

package/scripts/harness/validator-system/infrastructure/adapters/nyquist-ac-coverage-policy-adapter.ts

@@ -3,39 +3,111 @@
  * @unit validator-system
  *
  * NyquistAcCoveragePolicyAdapter — AcCoveragePolicyPort実装
+ *
+ * FAIL-CLOSED: nyquist-validation モジュールの実行時に例外が発生した場合は
+ * passed=false（不合格）として扱い、エラーを結果に含めて上位へ通知する。
+ * かつては catch 節で passed=true を返す fail-open だったが、AC 網羅ゲート
+ * （L3-004）を無効化する重大な品質防御の抜け穴だったため fail-closed へ是正した。
+ *
+ * REAL REGISTRY: storyId 整合性検査に必要な有効 storyId 一覧を
+ * traceability-model の StoryCatalog から取得して nyquist モジュールへ配線する。
+ * かつては `getStoryIds: async () => []`（空スタブ）だったため、正当かつ完全網羅の
+ * マトリクスでも全 storyId が「未登録」と判定され L3-004 が構造的に PASS 不能だった。
+ *
+ * MATRIX PATH: requirement-test-matrix.json のパスは config
+ * （layers.L3.requirementMatrixPath）から供給される。未指定時は既定値
+ * `.harness/requirement-test-matrix.json` を用いる。マトリクスが不在の場合は
+ * fail-closed で「設定されているが不在」という実行可能なメッセージを返す。
  */
+import { access } from 'node:fs/promises';
+import { isAbsolute, join } from 'node:path';
 import type { AcCoveragePolicyPort } from '../../domain/ports/ac-coverage-policy-port.js';
 import type { HarnessErrorLike } from '../../domain/value-objects/validation-result.js';
 
+const DEFAULT_MATRIX_PATH = '.harness/requirement-test-matrix.json';
+
+function toL3004Error(message: string, suggestion: string): HarnessErrorLike {
+  return {
+    code: { value: 'L3-004', toString: () => 'L3-004' },
+    severity: { value: 'error', toString: () => 'error' },
+    message,
+    suggestion,
+  };
+}
+
 export class NyquistAcCoveragePolicyAdapter implements AcCoveragePolicyPort {
   async checkCoverage(context: { matrixFilePath?: string }): Promise<{
     passed: boolean;
     errors: readonly HarnessErrorLike[];
   }> {
+    const rootDir = process.cwd();
+    const relativeOrAbsolute =
+      context.matrixFilePath && context.matrixFilePath.length > 0
+        ? context.matrixFilePath
+        : DEFAULT_MATRIX_PATH;
+    const matrixFilePath = isAbsolute(relativeOrAbsolute)
+      ? relativeOrAbsolute
+      : join(rootDir, relativeOrAbsolute);
+
+    // マトリクス不在は threshold-configured-but-absent と同様に fail-closed で
+    // 明確なメッセージを返す（ENOENT の生メッセージで落とさない）。
+    try {
+      await access(matrixFilePath);
+    } catch {
+      return {
+        passed: false,
+        errors: [
+          toL3004Error(
+            `AC網羅マトリクスが見つかりません: ${relativeOrAbsolute}（L3-004 は fail-closed）`,
+            `${relativeOrAbsolute} を生成してください（phasegate:generate-matrix）。パスは config の layers.L3.requirementMatrixPath で変更できます`,
+          ),
+        ],
+      };
+    }
+
     try {
+      // 有効 storyId 一覧を traceability-model の StoryCatalog から取得する（REAL registry）
+      const storyIds = await this.loadValidStoryIds(rootDir);
+
       const { createNyquistValidationModule } = await import('../../../nyquist-validation/composition-root.js');
       const mod = createNyquistValidationModule({
-        rootDir: process.cwd(),
-        getStoryIds: async () => [],
-      } as {
-        rootDir: string;
-        getStoryIds: () => Promise<readonly string[]>;
+        getStoryIds: async () => storyIds,
       });
       const output = await mod.checkAcCoverageGateUseCase.execute({
-        matrixFilePath: context.matrixFilePath ?? '',
+        matrixFilePath,
       });
 
       return {
         passed: output.passed,
-        errors: output.errors.map((err) => ({
-          code: { value: 'L3-004', toString: () => 'L3-004' },
-          severity: { value: 'error', toString: () => 'error' },
-          message: err.message,
-          suggestion: '',
-        })),
+        errors: output.errors.map((err) =>
+          toL3004Error(err.message, ''),
+        ),
+      };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      // FAIL-CLOSED: 例外を握り潰して合格扱いにせず、不合格として通知する
+      return {
+        passed: false,
+        errors: [
+          toL3004Error(
+            `AC網羅ゲートの検査に失敗しました（fail-closed）: ${message}`,
+            'requirement-test-matrix.json の存在・形式・スキーマ整合性を確認してください',
+          ),
+        ],
       };
-    } catch {
-      return { passed: true, errors: [] };
     }
   }
+
+  private async loadValidStoryIds(rootDir: string): Promise<readonly string[]> {
+    const { createConfigFoundationModule } = await import('../../../config-foundation/composition-root.js');
+    const configModule = createConfigFoundationModule();
+    const resolvedConfig = await configModule.usecases.loadResolvedConfigUseCase.execute();
+
+    const { createTraceabilityModelModule } = await import('../../../traceability-model/composition-root.js');
+    const traceModule = createTraceabilityModelModule(rootDir, {
+      pathRoots: { designDocsRoot: resolvedConfig.config.paths.designDocs },
+    });
+    const storyIds = await traceModule.storyCatalog.getAllStoryIds();
+    return storyIds.map((s) => s.value);
+  }
 }

package/scripts/harness/validator-system/infrastructure/adapters/phase-dependency-phase-gate-policy-adapter.ts

@@ -51,9 +51,35 @@ export class PhaseDependencyPhaseGatePolicyAdapter implements PhaseGatePolicyPor
         };
       }
 
-      return { satisfied: true, violations: [] };
-    } catch {
-      return { satisfied: true, violations: [] };
+      // Fail-closed: an unexpected exit code means prerequisites could not be confirmed.
+      console.error(`[validator-system] phase gate check returned unexpected exit code ${result.exitCode}`);
+      return {
+        satisfied: false,
+        violations: [
+          {
+            code: { value: 'L2-002', toString: () => 'L2-002' },
+            severity: { value: 'error', toString: () => 'error' },
+            message: `phase gate check returned unexpected exit code ${result.exitCode}; prerequisites cannot be confirmed`,
+            suggestion: 'phase gate prerequisites could not be evaluated; treating as NOT satisfied (fail-closed)',
+          },
+        ],
+      };
+    } catch (err) {
+      // Fail-closed: if the phase-dependency-model could not be loaded/executed we cannot
+      // confirm prerequisites are met, so treat them as NOT satisfied rather than opening the gate.
+      const message = err instanceof Error ? err.message : String(err);
+      console.error(`[validator-system] phase gate prerequisite check failed to run: ${message}`);
+      return {
+        satisfied: false,
+        violations: [
+          {
+            code: { value: 'L2-002', toString: () => 'L2-002' },
+            severity: { value: 'error', toString: () => 'error' },
+            message: `phase gate prerequisite check could not be evaluated: ${message}`,
+            suggestion: 'phase gate prerequisites could not be evaluated; treating as NOT satisfied (fail-closed)',
+          },
+        ],
+      };
     }
   }
 }

package/templates/.claude/scripts/deny-check.sh

@@ -4,14 +4,33 @@
 # Reads JSON from stdin, exits with code 2 to block dangerous commands.
 # Deny patterns are read from .claude/settings.json permissions.deny.
 
-DEBUG_LOG="/tmp/claude_deny_check_debug.log"
-echo "[$(date '+%Y-%m-%d %H:%M:%S')] deny-check.sh started" >> "$DEBUG_LOG"
+# Debug logging is OFF by default to avoid leaking command contents to a
+# world-readable file. Set CLAUDE_DENY_CHECK_DEBUG=1 to enable. When enabled,
+# the log is created with restrictive (owner-only) permissions.
+DEBUG_LOG="${CLAUDE_DENY_CHECK_DEBUG_LOG:-$HOME/.cache/claude/deny-check-debug.log}"
+
+debug_log() {
+    if [[ "$CLAUDE_DENY_CHECK_DEBUG" == "1" ]]; then
+        local dir
+        dir=$(dirname "$DEBUG_LOG")
+        mkdir -p "$dir" 2>/dev/null || return 0
+        # Restrict permissions before writing anything sensitive.
+        ( umask 077; touch "$DEBUG_LOG" 2>/dev/null ) || return 0
+        chmod 600 "$DEBUG_LOG" 2>/dev/null || true
+        printf '[%s] %s\n' "$(date '+%Y-%m-%d %H:%M:%S')" "$1" >> "$DEBUG_LOG" 2>/dev/null || true
+    fi
+}
+
+debug_log "deny-check.sh started"
 
 INPUT_JSON=$(cat)
-echo "[$(date '+%Y-%m-%d %H:%M:%S')] Input JSON: $INPUT_JSON" >> "$DEBUG_LOG"
+debug_log "input received (${#INPUT_JSON} bytes)"
 
+# Fail CLOSED: without jq we cannot parse the deny policy, so deny the command
+# rather than silently allowing it.
 if ! command -v jq &> /dev/null; then
-    exit 0
+    echo "Security policy: jq is required to evaluate the deny policy but was not found; command blocked." >&2
+    exit 2
 fi
 
 TOOL_NAME=$(echo "$INPUT_JSON" | jq -r '.tool_name // empty')
@@ -43,13 +62,55 @@ if [[ ${#DENY_PATTERNS[@]} -eq 0 ]]; then
     exit 0
 fi
 
-for pattern in "${DENY_PATTERNS[@]}"; do
-    regex_pattern=$(echo "$pattern" | sed 's/\*/.*/')
-    if echo "$COMMAND" | grep -E "^$regex_pattern" &>/dev/null; then
-        echo "[$(date '+%Y-%m-%d %H:%M:%S')] BLOCKED: '$COMMAND' matches '$pattern'" >> "$DEBUG_LOG"
-        echo "Security policy violation: command '$COMMAND' is denied by pattern '$pattern'" >&2
-        exit 2
-    fi
-done
+# Split a shell command line into individual command segments so that denied
+# commands smuggled behind chaining/grouping/substitution operators are still
+# inspected. Operators handled: ; && || | & newline $( ) ` { } ( )
+# We replace each operator with a newline, then treat each line as a segment.
+split_command_segments() {
+    local cmd="$1"
+    # Order matters: multi-char operators first.
+    cmd=${cmd//&&/$'\n'}
+    cmd=${cmd//||/$'\n'}
+    cmd=${cmd//|/$'\n'}
+    cmd=${cmd//;/$'\n'}
+    cmd=${cmd//&/$'\n'}
+    cmd=${cmd//\$(/$'\n'}
+    cmd=${cmd//\`/$'\n'}
+    cmd=${cmd//(/$'\n'}
+    cmd=${cmd//)/$'\n'}
+    cmd=${cmd//\{/$'\n'}
+    cmd=${cmd//\}/$'\n'}
+    # Trailing newline ensures the final segment is emitted as a complete line
+    # so that `while read` does not drop an unterminated last segment.
+    printf '%s\n' "$cmd"
+}
+
+# Convert a settings glob pattern to an anchored regex. ALL '*' become '.*'.
+glob_to_regex() {
+    printf '%s' "$1" | sed 's/\*/.*/g'
+}
+
+check_segment() {
+    local segment="$1"
+    # Strip leading whitespace so "^pattern" anchors match after operators.
+    segment="${segment#"${segment%%[![:space:]]*}"}"
+    [[ -z "$segment" ]] && return 0
+    for pattern in "${DENY_PATTERNS[@]}"; do
+        local regex_pattern
+        regex_pattern=$(glob_to_regex "$pattern")
+        if printf '%s' "$segment" | grep -E "^$regex_pattern" &>/dev/null; then
+            debug_log "BLOCKED segment '$segment' matches '$pattern'"
+            echo "Security policy violation: command segment '$segment' is denied by pattern '$pattern'" >&2
+            exit 2
+        fi
+    done
+    return 0
+}
+
+# Inspect the whole command AND each chained/substituted segment.
+check_segment "$COMMAND"
+while IFS= read -r segment; do
+    check_segment "$segment"
+done < <(split_command_segments "$COMMAND")
 
 exit 0