phasegate 0.183.0 → 0.212.0

package/scripts/harness/validator-system/application/use-cases/run-l2-validators-usecase.ts

@@ -5,24 +5,29 @@
  * RunL2ValidatorsUseCase — H08-01: L2バリデータ実行
  * @work-item-id WI-110 / WI-111 / WI-140 / WI-132 / WI-133 / WI-136 / WI-137 / WI-138
  */
-import { readFile } from 'node:fs/promises';
-import { ValidatorId, InvalidValidatorIdError } from '../../domain/value-objects/validator-id.js';
-import { ValidationResult, type HarnessErrorLike } from '../../domain/value-objects/validation-result.js';
-import type { ValidatorRegistry } from '../../domain/services/validator-registry.js';
-import { type ValidatorExecutionService, ValidatorExecutionError } from '../../domain/services/validator-execution-service.js';
-import type { ValidationResultContractMapper } from '../mappers/validation-result-contract-mapper.js';
-import type { ValidationResultContract } from '../dto/validation-result-contract.js';
-import type { RunL2ValidatorsInput } from '../dto/run-l2-validators-input.js';
-import type { ValidatorConfigPort } from '../../domain/ports/validator-config-port.js';
-import type { PhaseGatePolicyPort } from '../../domain/ports/phase-gate-policy-port.js';
-import type { MetadataPolicyPort } from '../../domain/ports/metadata-policy-port.js';
-import type { TestQualityAnalyzerPort } from '../../domain/ports/test-quality-analyzer-port.js';
-import type { CliCommandRegistryPort } from '../../domain/ports/cli-command-registry-port.js';
-import type { E2eTestFileRegistryPort } from '../../domain/ports/e2e-test-file-registry-port.js';
-import { CliE2eTestExistenceService } from '../../domain/services/cli-e2e-test-existence-service.js';
-import type { WorkItemStatusPolicyPort } from '../../domain/ports/work-item-status-policy-port.js';
-import type { ContractTraceabilityPolicyPort } from '../../domain/ports/contract-traceability-policy-port.js';
-import { ContractTraceabilityCoverageService } from '../../domain/services/contract-traceability-coverage-service.js';
+import { readFile } from "node:fs/promises";
+import type { CliCommandRegistryPort } from "../../domain/ports/cli-command-registry-port.js";
+import type { ContractTraceabilityPolicyPort } from "../../domain/ports/contract-traceability-policy-port.js";
+import type { CoverageAttestationGatingPolicyPort } from "../../domain/ports/coverage-attestation-gating-policy-port.js";
+import type { E2eTestFileRegistryPort } from "../../domain/ports/e2e-test-file-registry-port.js";
+import type { MetadataPolicyPort } from "../../domain/ports/metadata-policy-port.js";
+import type { PhaseGatePolicyPort } from "../../domain/ports/phase-gate-policy-port.js";
+import type { TestQualityAnalyzerPort } from "../../domain/ports/test-quality-analyzer-port.js";
+import type { ValidatorConfigPort } from "../../domain/ports/validator-config-port.js";
+import type { WorkItemStatusPolicyPort } from "../../domain/ports/work-item-status-policy-port.js";
+import { CliE2eTestExistenceService } from "../../domain/services/cli-e2e-test-existence-service.js";
+import { ContractTraceabilityCoverageService } from "../../domain/services/contract-traceability-coverage-service.js";
+import { CoverageAttestationGatingService } from "../../domain/services/coverage-attestation-gating-service.js";
+import {
+  ValidatorExecutionError,
+  type ValidatorExecutionService,
+} from "../../domain/services/validator-execution-service.js";
+import type { ValidatorRegistry } from "../../domain/services/validator-registry.js";
+import { type HarnessErrorLike, ValidationResult } from "../../domain/value-objects/validation-result.js";
+import { ValidatorId } from "../../domain/value-objects/validator-id.js";
+import type { RunL2ValidatorsInput } from "../dto/run-l2-validators-input.js";
+import type { ValidationResultContract } from "../dto/validation-result-contract.js";
+import type { ValidationResultContractMapper } from "../mappers/validation-result-contract-mapper.js";
 
 export interface RunL2ValidatorsUseCaseDeps {
   validatorRegistry: ValidatorRegistry;
@@ -36,6 +41,7 @@ export interface RunL2ValidatorsUseCaseDeps {
   e2eTestFileRegistryPort?: E2eTestFileRegistryPort;
   workItemStatusPolicyPort?: WorkItemStatusPolicyPort;
   contractTraceabilityPolicyPort?: ContractTraceabilityPolicyPort;
+  coverageAttestationGatingPolicyPort?: CoverageAttestationGatingPolicyPort;
 }
 
 export class RunL2ValidatorsUseCase {
@@ -50,8 +56,10 @@ export class RunL2ValidatorsUseCase {
   private readonly e2eTestFileRegistryPort?: E2eTestFileRegistryPort;
   private readonly workItemStatusPolicyPort?: WorkItemStatusPolicyPort;
   private readonly contractTraceabilityPolicyPort?: ContractTraceabilityPolicyPort;
+  private readonly coverageAttestationGatingPolicyPort?: CoverageAttestationGatingPolicyPort;
   private readonly cliE2eTestExistenceService = new CliE2eTestExistenceService();
   private readonly contractTraceabilityCoverageService = new ContractTraceabilityCoverageService();
+  private readonly coverageAttestationGatingService = new CoverageAttestationGatingService();
 
   constructor(deps: RunL2ValidatorsUseCaseDeps) {
     this.registry = deps.validatorRegistry;
@@ -65,6 +73,7 @@ export class RunL2ValidatorsUseCase {
     this.e2eTestFileRegistryPort = deps.e2eTestFileRegistryPort;
     this.workItemStatusPolicyPort = deps.workItemStatusPolicyPort;
     this.contractTraceabilityPolicyPort = deps.contractTraceabilityPolicyPort;
+    this.coverageAttestationGatingPolicyPort = deps.coverageAttestationGatingPolicyPort;
   }
 
   async execute(input: RunL2ValidatorsInput): Promise<readonly ValidationResultContract[]> {
@@ -73,24 +82,27 @@ export class RunL2ValidatorsUseCase {
     if (input.validatorIds && input.validatorIds.length > 0) {
       validatorIds = input.validatorIds.map((id) => ValidatorId.create(id));
     } else {
-      validatorIds = this.registry.listByLayer('L2').map((d) => d.validatorId);
+      validatorIds = this.registry.listByLayer("L2").map((d) => d.validatorId);
     }
 
     const definitions = this.registry.select(validatorIds);
 
     // LayerConfig取得
-    let layerConfig;
+    let layerConfig: Awaited<ReturnType<ValidatorConfigPort["getLayerConfig"]>>;
     try {
-      layerConfig = await this.configPort.getLayerConfig('L2');
+      layerConfig = await this.configPort.getLayerConfig("L2");
     } catch (err) {
-      throw new ValidatorExecutionError(`Failed to get L2 LayerConfig: ${err instanceof Error ? err.message : String(err)}`, err);
+      throw new ValidatorExecutionError(
+        `Failed to get L2 LayerConfig: ${err instanceof Error ? err.message : String(err)}`,
+        err,
+      );
     }
 
     const results = this.executionService.execute(definitions, [layerConfig]);
     const overrideMap = new Map<string, ValidationResult>(results.map((result) => [result.validatorId.value, result]));
 
     if (this.phaseGatePolicyPort) {
-      const l2001Result = overrideMap.get('L2-001');
+      const l2001Result = overrideMap.get("L2-001");
       if (l2001Result && !l2001Result.skipped) {
         const policyResult = await this.phaseGatePolicyPort.checkPrerequisites({
           unitName: input.unitName,
@@ -98,24 +110,20 @@ export class RunL2ValidatorsUseCase {
         });
         if (!policyResult.satisfied) {
           overrideMap.set(
-            'L2-001',
-            ValidationResult.fail(
-              ValidatorId.create('L2-001'),
-              [...policyResult.violations],
-              0,
-            ),
+            "L2-001",
+            ValidationResult.fail(ValidatorId.create("L2-001"), [...policyResult.violations], 0),
           );
         }
       }
     }
 
     if (this.metadataPolicyPort) {
-      const l2002Result = overrideMap.get('L2-002');
+      const l2002Result = overrideMap.get("L2-002");
       if (l2002Result && !l2002Result.skipped) {
         const allErrors: HarnessErrorLike[] = [];
         for (const filePath of input.targetPaths) {
           try {
-            const fileContent = await readFile(filePath, 'utf-8');
+            const fileContent = await readFile(filePath, "utf-8");
             const policyResult = await this.metadataPolicyPort.validateMetadata({ filePath, fileContent });
             if (!policyResult.passed) {
               allErrors.push(...policyResult.errors);
@@ -125,52 +133,52 @@ export class RunL2ValidatorsUseCase {
           }
         }
         if (allErrors.length > 0) {
-          overrideMap.set('L2-002', ValidationResult.fail(ValidatorId.create('L2-002'), allErrors, 0));
+          overrideMap.set("L2-002", ValidationResult.fail(ValidatorId.create("L2-002"), allErrors, 0));
         }
       }
     }
 
     if (this.testQualityAnalyzerPort) {
-      const l2003Result = overrideMap.get('L2-003');
+      const l2003Result = overrideMap.get("L2-003");
       if (l2003Result && !l2003Result.skipped) {
         const analysisResult = await this.testQualityAnalyzerPort.analyzeTestFiles(input.targetPaths);
         const allViolations: HarnessErrorLike[] = analysisResult.results
           .filter((r) => !r.passed)
           .flatMap((r) => [...r.violations]);
         if (allViolations.length > 0) {
-          overrideMap.set('L2-003', ValidationResult.fail(ValidatorId.create('L2-003'), allViolations, 0));
+          overrideMap.set("L2-003", ValidationResult.fail(ValidatorId.create("L2-003"), allViolations, 0));
         }
       }
     }
 
     if (this.cliCommandRegistryPort && this.e2eTestFileRegistryPort) {
-      const l2013Result = overrideMap.get('L2-013');
+      const l2013Result = overrideMap.get("L2-013");
       if (l2013Result && !l2013Result.skipped) {
         const commands = await this.cliCommandRegistryPort.getRegisteredCommands();
         const e2eFiles = await this.e2eTestFileRegistryPort.getE2eTestFiles();
         const report = this.cliE2eTestExistenceService.check(commands, e2eFiles);
         if (report.hasViolations()) {
           const errors = report.toMessages().map((msg) => ({
-            code: { value: 'L2-013', toString: () => 'L2-013' },
-            severity: { value: 'error', toString: () => 'error' },
+            code: { value: "L2-013", toString: () => "L2-013" },
+            severity: { value: "error", toString: () => "error" },
             message: msg,
-            suggestion: 'Add an E2E test for each registered CLI command in cli-harness.test.ts.',
+            suggestion: "Add an E2E test for each registered CLI command in cli-harness.test.ts.",
           }));
-          overrideMap.set('L2-013', ValidationResult.fail(ValidatorId.create('L2-013'), errors, 0));
+          overrideMap.set("L2-013", ValidationResult.fail(ValidatorId.create("L2-013"), errors, 0));
         } else {
-          overrideMap.set('L2-013', ValidationResult.pass(ValidatorId.create('L2-013'), 0));
+          overrideMap.set("L2-013", ValidationResult.pass(ValidatorId.create("L2-013"), 0));
         }
       }
     }
 
     if (this.workItemStatusPolicyPort) {
-      const l2014Result = overrideMap.get('L2-014');
+      const l2014Result = overrideMap.get("L2-014");
       if (l2014Result && !l2014Result.skipped) {
         const staleReports = await this.workItemStatusPolicyPort.findStaleReports(input.targetPaths);
         if (staleReports.length > 0) {
           const errors = staleReports.map((report) => ({
-            code: { value: 'L2-014', toString: () => 'L2-014' },
-            severity: { value: 'error', toString: () => 'error' },
+            code: { value: "L2-014", toString: () => "L2-014" },
+            severity: { value: "error", toString: () => "error" },
             message: `${report.id} status is stale: current=${report.currentStatus}, derived=${report.derivedStatus}`,
             suggestion: report.nextAction,
             workItemId: report.id,
@@ -179,21 +187,21 @@ export class RunL2ValidatorsUseCase {
             derivedStatus: report.derivedStatus,
             evidence: report.evidence,
           }));
-          overrideMap.set('L2-014', ValidationResult.fail(ValidatorId.create('L2-014'), errors, 0));
+          overrideMap.set("L2-014", ValidationResult.fail(ValidatorId.create("L2-014"), errors, 0));
         } else {
-          overrideMap.set('L2-014', ValidationResult.pass(ValidatorId.create('L2-014'), 0));
+          overrideMap.set("L2-014", ValidationResult.pass(ValidatorId.create("L2-014"), 0));
         }
       }
     }
 
     if (this.contractTraceabilityPolicyPort) {
-      const l2015Result = overrideMap.get('L2-015');
+      const l2015Result = overrideMap.get("L2-015");
       if (l2015Result && !l2015Result.skipped) {
         const inputModel = await this.contractTraceabilityPolicyPort.collect(input.targetPaths);
         const report = this.contractTraceabilityCoverageService.check(inputModel);
         if (report.hasFindings()) {
           const errors = report.findings.map((finding) => ({
-            code: { value: 'L2-015', toString: () => 'L2-015' },
+            code: { value: "L2-015", toString: () => "L2-015" },
             severity: { value: finding.severity, toString: () => finding.severity },
             message: finding.message,
             suggestion: finding.suggestion,
@@ -201,9 +209,34 @@ export class RunL2ValidatorsUseCase {
             subject: finding.subject,
             sourcePath: finding.sourcePath,
           }));
-          overrideMap.set('L2-015', ValidationResult.fail(ValidatorId.create('L2-015'), errors, 0));
+          overrideMap.set("L2-015", ValidationResult.fail(ValidatorId.create("L2-015"), errors, 0));
         } else {
-          overrideMap.set('L2-015', ValidationResult.pass(ValidatorId.create('L2-015'), 0));
+          overrideMap.set("L2-015", ValidationResult.pass(ValidatorId.create("L2-015"), 0));
+        }
+      }
+    }
+
+    // WI-258 / ADR-030 §Decision.3.②: L2-016 coverage-attestation-gating。
+    // bare ✅（attestation 参照なし）は error violation（fail-closed）。ungated-legacy マーカーは
+    // 免除だが warning（見える負債）で件数報告する。warning-only の fail は ADR-017 の集約規則で
+    // failOnWarning=false のとき overall PASS 扱いとなる。
+    if (this.coverageAttestationGatingPolicyPort) {
+      const l2016Result = overrideMap.get("L2-016");
+      if (l2016Result && !l2016Result.skipped) {
+        const models = await this.coverageAttestationGatingPolicyPort.collect();
+        const report = this.coverageAttestationGatingService.check(models);
+        const findings = [...report.violations, ...report.warnings];
+        if (findings.length > 0) {
+          const errors: HarnessErrorLike[] = findings.map((finding) => ({
+            code: { value: "L2-016", toString: () => "L2-016" },
+            severity: { value: finding.severity, toString: () => finding.severity },
+            message: finding.message,
+            suggestion: finding.suggestion,
+            sourcePath: finding.sourcePath,
+          }));
+          overrideMap.set("L2-016", ValidationResult.fail(ValidatorId.create("L2-016"), errors, 0));
+        } else {
+          overrideMap.set("L2-016", ValidationResult.pass(ValidatorId.create("L2-016"), 0));
         }
       }
     }

package/scripts/harness/validator-system/application/use-cases/run-l3-validators-usecase.ts

@@ -5,24 +5,31 @@
  *
  * RunL3ValidatorsUseCase — H08-02: L3バリデータ実行
  */
-import { ValidatorId } from '../../domain/value-objects/validator-id.js';
-import { ValidationResult } from '../../domain/value-objects/validation-result.js';
-import type { ValidatorRegistry } from '../../domain/services/validator-registry.js';
-import { type ValidatorExecutionService, ValidatorExecutionError } from '../../domain/services/validator-execution-service.js';
-import { ValidatorLanguageCapabilityService } from '../../domain/services/validator-language-capability-service.js';
-import type { ValidationResultContractMapper } from '../mappers/validation-result-contract-mapper.js';
-import type { ValidationResultContract } from '../dto/validation-result-contract.js';
-import type { RunL3ValidatorsInput } from '../dto/run-l3-validators-input.js';
-import type { ValidatorConfigPort } from '../../domain/ports/validator-config-port.js';
-import type { AcCoveragePolicyPort } from '../../domain/ports/ac-coverage-policy-port.js';
-import type { AcBoundCoveragePolicyPort } from '../../domain/ports/ac-bound-coverage-policy-port.js';
-import type { SecurityPatternScannerPort } from '../../domain/ports/security-pattern-scanner-port.js';
-import type { PerformanceScannerPort } from '../../domain/ports/performance-scanner-port.js';
+
+import type { AcBoundCoveragePolicyPort } from "../../domain/ports/ac-bound-coverage-policy-port.js";
+import type { AcCoveragePolicyPort } from "../../domain/ports/ac-coverage-policy-port.js";
+import type { InjectionScanPolicyPort } from "../../domain/ports/injection-scan-policy-port.js";
+import type { PerformanceScannerPort } from "../../domain/ports/performance-scanner-port.js";
+import type { SecurityPatternScannerPort } from "../../domain/ports/security-pattern-scanner-port.js";
+import type { ValidatorConfigPort } from "../../domain/ports/validator-config-port.js";
+import { InjectionPatternScanService } from "../../domain/services/injection-pattern-scan-service.js";
+import {
+  ValidatorExecutionError,
+  type ValidatorExecutionService,
+} from "../../domain/services/validator-execution-service.js";
+import { ValidatorLanguageCapabilityService } from "../../domain/services/validator-language-capability-service.js";
+import type { ValidatorRegistry } from "../../domain/services/validator-registry.js";
+import type { HarnessErrorLike } from "../../domain/value-objects/validation-result.js";
+import { ValidationResult } from "../../domain/value-objects/validation-result.js";
+import { ValidatorId } from "../../domain/value-objects/validator-id.js";
+import type { RunL3ValidatorsInput } from "../dto/run-l3-validators-input.js";
+import type { ValidationResultContract } from "../dto/validation-result-contract.js";
+import type { ValidationResultContractMapper } from "../mappers/validation-result-contract-mapper.js";
 
 export class CoverageReportNotFoundError extends Error {
   constructor(path: string) {
     super(`Coverage report not found: ${path}`);
-    this.name = 'CoverageReportNotFoundError';
+    this.name = "CoverageReportNotFoundError";
   }
 }
 
@@ -33,9 +40,16 @@ export interface RunL3ValidatorsUseCaseDeps {
   contractMapper: ValidationResultContractMapper;
   acCoveragePolicyPort?: AcCoveragePolicyPort;
   acBoundCoveragePolicyPort?: AcBoundCoveragePolicyPort;
-  coverageReportPort?: { getCoverage(): Promise<{ overallCoverage: number; perFileCoverage: readonly { filePath: string; coverage: number }[] }> };
+  coverageReportPort?: {
+    getCoverage(): Promise<{
+      overallCoverage: number;
+      perFileCoverage: readonly { filePath: string; coverage: number }[];
+    }>;
+  };
   securityScannerPort?: SecurityPatternScannerPort;
   performanceScannerPort?: PerformanceScannerPort;
+  /** WI-259 / ADR-030 §Decision.3.④: L3-006 (injection-scan, advisory) 用ポート。 */
+  injectionScanPolicyPort?: InjectionScanPolicyPort;
   /** L3-005 のスコープ対象 story-id（config layers.L3.acBoundStories 由来。既定 []）。 */
   acBoundStories?: readonly string[];
 }
@@ -47,11 +61,13 @@ export class RunL3ValidatorsUseCase {
   private readonly mapper: ValidationResultContractMapper;
   private readonly acCoveragePolicyPort?: AcCoveragePolicyPort;
   private readonly acBoundCoveragePolicyPort?: AcBoundCoveragePolicyPort;
-  private readonly coverageReportPort?: RunL3ValidatorsUseCaseDeps['coverageReportPort'];
+  private readonly coverageReportPort?: RunL3ValidatorsUseCaseDeps["coverageReportPort"];
   private readonly securityScannerPort?: SecurityPatternScannerPort;
   private readonly performanceScannerPort?: PerformanceScannerPort;
+  private readonly injectionScanPolicyPort?: InjectionScanPolicyPort;
   private readonly acBoundStories: readonly string[];
   private readonly languageCapabilityService = new ValidatorLanguageCapabilityService();
+  private readonly injectionScanService = new InjectionPatternScanService();
 
   constructor(deps: RunL3ValidatorsUseCaseDeps) {
     this.registry = deps.validatorRegistry;
@@ -63,6 +79,7 @@ export class RunL3ValidatorsUseCase {
     this.coverageReportPort = deps.coverageReportPort;
     this.securityScannerPort = deps.securityScannerPort;
     this.performanceScannerPort = deps.performanceScannerPort;
+    this.injectionScanPolicyPort = deps.injectionScanPolicyPort;
     this.acBoundStories = deps.acBoundStories ?? [];
   }
 
@@ -71,16 +88,19 @@ export class RunL3ValidatorsUseCase {
     if (input.validatorIds && input.validatorIds.length > 0) {
       validatorIds = input.validatorIds.map((id) => ValidatorId.create(id));
     } else {
-      validatorIds = this.registry.listByLayer('L3').map((d) => d.validatorId);
+      validatorIds = this.registry.listByLayer("L3").map((d) => d.validatorId);
     }
 
     const definitions = this.registry.select(validatorIds);
 
-    let layerConfig;
+    let layerConfig: Awaited<ReturnType<ValidatorConfigPort["getLayerConfig"]>>;
     try {
-      layerConfig = await this.configPort.getLayerConfig('L3');
+      layerConfig = await this.configPort.getLayerConfig("L3");
     } catch (err) {
-      throw new ValidatorExecutionError(`Failed to get L3 LayerConfig: ${err instanceof Error ? err.message : String(err)}`, err);
+      throw new ValidatorExecutionError(
+        `Failed to get L3 LayerConfig: ${err instanceof Error ? err.message : String(err)}`,
+        err,
+      );
     }
 
     // LayerConfig.enabled === false の場合は空を返す
@@ -105,18 +125,17 @@ export class RunL3ValidatorsUseCase {
     // このブロックは例外を送出せず、L3-003 の per-validator 結果のみを差し替える。
     // これにより兄弟バリデータ（L3-001/002/004 および L2/L4 バッチ）は常に通常実行される。
     const l3003InScope =
-      !unsupportedValidatorIds.has('L3-003') &&
-      definitions.some((d) => d.validatorId.value === 'L3-003');
+      !unsupportedValidatorIds.has("L3-003") && definitions.some((d) => d.validatorId.value === "L3-003");
     if (this.coverageReportPort && l3003InScope) {
-      const l3003Id = ValidatorId.create('L3-003');
-      const threshold = layerConfig.getThreshold('coverageThreshold');
+      const l3003Id = ValidatorId.create("L3-003");
+      const threshold = layerConfig.getThreshold("coverageThreshold");
 
       if (threshold === null) {
         overrideMap.set(
-          'L3-003',
+          "L3-003",
           ValidationResult.skipWithReason(
             l3003Id,
-            'coverageThreshold が未設定のためカバレッジ判定をスキップ（カバレッジゲートはオプトイン）',
+            "coverageThreshold が未設定のためカバレッジ判定をスキップ（カバレッジゲートはオプトイン）",
           ),
         );
       } else {
@@ -124,13 +143,13 @@ export class RunL3ValidatorsUseCase {
           const coverageData = await this.coverageReportPort.getCoverage();
           if (coverageData.overallCoverage < threshold) {
             overrideMap.set(
-              'L3-003',
+              "L3-003",
               ValidationResult.fail(
                 l3003Id,
                 [
                   {
-                    code: 'L3-003',
-                    severity: 'error',
+                    code: "L3-003",
+                    severity: "error",
                     message: `カバレッジ不足: 現在値 ${coverageData.overallCoverage}%、不足 ${threshold - coverageData.overallCoverage}%`,
                     suggestion: `テストカバレッジを ${threshold}% 以上に引き上げてください`,
                   },
@@ -139,20 +158,20 @@ export class RunL3ValidatorsUseCase {
               ),
             );
           } else {
-            overrideMap.set('L3-003', ValidationResult.pass(l3003Id, 0));
+            overrideMap.set("L3-003", ValidationResult.pass(l3003Id, 0));
           }
         } catch {
           // レポート不在などで取得失敗 → FAIL-CLOSED（例外は握りつぶし per-validator FAIL に変換）
           overrideMap.set(
-            'L3-003',
+            "L3-003",
             ValidationResult.fail(
               l3003Id,
               [
                 {
-                  code: 'L3-003',
-                  severity: 'error',
+                  code: "L3-003",
+                  severity: "error",
                   message: `coverageThreshold=${threshold}% が設定されていますがカバレッジレポートが見つかりません（テストをカバレッジ付きで実行してください）`,
-                  suggestion: 'vitest --coverage 等でカバレッジレポートを生成してから再実行してください',
+                  suggestion: "vitest --coverage 等でカバレッジレポートを生成してから再実行してください",
                 },
               ],
               0,
@@ -163,42 +182,35 @@ export class RunL3ValidatorsUseCase {
     }
 
     if (this.securityScannerPort) {
-      const l3001Result = overrideMap.get('L3-001');
+      const l3001Result = overrideMap.get("L3-001");
       if (l3001Result && !l3001Result.skipped) {
         const scanResult = await this.securityScannerPort.scan(input.targetPaths);
         if (!scanResult.passed) {
-          overrideMap.set('L3-001', ValidationResult.fail(ValidatorId.create('L3-001'), [...scanResult.findings], 0));
+          overrideMap.set("L3-001", ValidationResult.fail(ValidatorId.create("L3-001"), [...scanResult.findings], 0));
         }
       }
     }
 
     if (this.performanceScannerPort) {
-      const l3002Result = overrideMap.get('L3-002');
+      const l3002Result = overrideMap.get("L3-002");
       if (l3002Result && !l3002Result.skipped) {
-        const bundleSizeLimit = layerConfig.getThreshold('bundleSizeLimit');
+        const bundleSizeLimit = layerConfig.getThreshold("bundleSizeLimit");
         const thresholds: Record<string, number> = bundleSizeLimit !== null ? { bundleSizeLimit } : {};
         const scanResult = await this.performanceScannerPort.scan(input.targetPaths, thresholds);
         if (!scanResult.passed) {
-          overrideMap.set('L3-002', ValidationResult.fail(ValidatorId.create('L3-002'), [...scanResult.findings], 0));
+          overrideMap.set("L3-002", ValidationResult.fail(ValidatorId.create("L3-002"), [...scanResult.findings], 0));
         }
       }
     }
 
     if (this.acCoveragePolicyPort) {
-      const l3004Result = overrideMap.get('L3-004');
+      const l3004Result = overrideMap.get("L3-004");
       if (l3004Result && !l3004Result.skipped) {
         const policyResult = await this.acCoveragePolicyPort.checkCoverage({
           matrixFilePath: input.requirementMatrixPath,
         });
         if (!policyResult.passed) {
-          overrideMap.set(
-            'L3-004',
-            ValidationResult.fail(
-              ValidatorId.create('L3-004'),
-              [...policyResult.errors],
-              0,
-            ),
-          );
+          overrideMap.set("L3-004", ValidationResult.fail(ValidatorId.create("L3-004"), [...policyResult.errors], 0));
         }
       }
     }
@@ -206,21 +218,38 @@ export class RunL3ValidatorsUseCase {
     // L3-005: AC-bound coverage（fail-closed, default-OFF）。
     // override map に unskipped な L3-005 がある場合のみ policy を呼ぶ（L3-004 と同じ方式）。
     if (this.acBoundCoveragePolicyPort) {
-      const l3005Result = overrideMap.get('L3-005');
+      const l3005Result = overrideMap.get("L3-005");
       if (l3005Result && !l3005Result.skipped) {
         const policyResult = await this.acBoundCoveragePolicyPort.checkAcBoundCoverage({
           matrixFilePath: input.requirementMatrixPath,
           acBoundStories: input.acBoundStories ?? this.acBoundStories,
         });
         if (!policyResult.passed) {
-          overrideMap.set(
-            'L3-005',
-            ValidationResult.fail(
-              ValidatorId.create('L3-005'),
-              [...policyResult.errors],
-              0,
-            ),
-          );
+          overrideMap.set("L3-005", ValidationResult.fail(ValidatorId.create("L3-005"), [...policyResult.errors], 0));
+        }
+      }
+    }
+
+    // WI-259 / ADR-030 §Decision.3.④: L3-006 advisory インジェクションスキャナ。
+    // 指示搭載ファイルの既知インジェクションパターンを検出し warning-only の finding として報告する。
+    // finding は必ず severity=warning のため ADR-017 集約規則（failOnWarning=false 既定）で overall PASS。
+    // blocking にしない（§4.(b): 「すり抜け＝安全」の誤信頼を避ける）。default-OFF/skip 時は override しない。
+    if (this.injectionScanPolicyPort) {
+      const l3006Result = overrideMap.get("L3-006");
+      if (l3006Result && !l3006Result.skipped) {
+        const targets = await this.injectionScanPolicyPort.collect();
+        const report = this.injectionScanService.scan(targets);
+        if (report.hasFindings()) {
+          const errors: HarnessErrorLike[] = report.findings.map((finding) => ({
+            code: { value: "L3-006", toString: () => "L3-006" },
+            severity: { value: "warning", toString: () => "warning" },
+            message: `${finding.sourcePath}:${finding.lineNumber} [${finding.kind}] ${finding.message}`,
+            suggestion: finding.suggestion,
+            sourcePath: finding.sourcePath,
+          }));
+          overrideMap.set("L3-006", ValidationResult.fail(ValidatorId.create("L3-006"), errors, 0));
+        } else {
+          overrideMap.set("L3-006", ValidationResult.pass(ValidatorId.create("L3-006"), 0));
         }
       }
     }
@@ -232,6 +261,6 @@ export class RunL3ValidatorsUseCase {
   }
 
   private async getProjectLanguages(): Promise<readonly string[]> {
-    return this.configPort.getProjectLanguages ? await this.configPort.getProjectLanguages() : ['typescript'];
+    return this.configPort.getProjectLanguages ? await this.configPort.getProjectLanguages() : ["typescript"];
   }
 }