phasegate 0.191.0 → 0.212.0

package/scripts/harness/phase-dependency-model/infrastructure/filesystem/file-system-story-reflection-adapter.ts

@@ -15,6 +15,12 @@ const CROSS_WORK_ITEM_PATTERN = /^WI-\d+$/;
 const FRONTMATTER_PATTERN = /^---\r?\n([\s\S]*?)\r?\n---/;
 const AFFECTS_INLINE_PATTERN = /^affects:\s*\[([^\]]*)\]\s*$/m;
 const LEGACY_ID_PATTERN = /^legacy_id:\s*([A-Z][\w]+-\d+)\s*$/m;
+/** コミット本文の `Work-Item: WI-NNN` trailer 行から WI を抽出する */
+const WORK_ITEM_TRAILER_PATTERN = /^Work-Item:\s*(WI-\d+)\s*$/gm;
+/** ソースファイル先頭の `@work-item-id` / `@story` タグ配下の WI を抽出する */
+const SOURCE_TAG_PATTERN = /@(?:work-item-id|story)\b[^\n\r]*/g;
+/** harness ソースパスから unit / layer を切り出す（帰属フィルタ適用対象の判定） */
+const HARNESS_SOURCE_PATH_PATTERN = /^scripts\/harness\/[^/]+\/[^/]+\//;
 const execFileAsync = promisify(execFile);
 
 export interface FileSystemStoryReflectionAdapterDeps {
@@ -167,13 +173,13 @@ export class FileSystemStoryReflectionAdapter implements StoryReflectionFileSyst
         { cwd: this.rootDir, maxBuffer: 32 * 1024 * 1024 },
       );
 
-      return this.extractChangedPathsForStory(stdout, storyId);
+      return await this.extractChangedPathsForStory(stdout, storyId);
     } catch {
       return new Set<string>();
     }
   }
 
-  private extractChangedPathsForStory(output: string, storyId: string): ReadonlySet<string> {
+  private async extractChangedPathsForStory(output: string, storyId: string): Promise<ReadonlySet<string>> {
     const changedPaths = new Set<string>();
     const trailerPattern = new RegExp(`Work-Item:[^\\n]*\\b${storyId}\\b`);
 
@@ -186,10 +192,16 @@ export class FileSystemStoryReflectionAdapter implements StoryReflectionFileSyst
       const body = commitBlock.slice(0, bodyEnd);
       if (!trailerPattern.test(body)) continue;
 
+      // 複数 Work-Item trailer を同梱するバッチコミットでは、changed paths が
+      // 全 trailer WI に一律帰属してしまう（over-attribution）。ソースパスに限り
+      // ファイルの帰属タグで storyId への帰属を絞り込む（WI-251）。
+      const isMultiWorkItemCommit = this.countWorkItemTrailers(body) >= 2;
       const nameOnly = commitBlock.slice(bodyEnd + 1);
       for (const changedPath of nameOnly.split(/\r?\n/)) {
         const trimmedPath = changedPath.trim();
-        if (trimmedPath.length > 0 && trimmedPath !== "@@COMMIT@@") {
+        if (trimmedPath.length === 0 || trimmedPath === "@@COMMIT@@") continue;
+
+        if (await this.pathAttributesToStory(trimmedPath, storyId, isMultiWorkItemCommit)) {
           changedPaths.add(trimmedPath);
         }
       }
@@ -198,6 +210,56 @@ export class FileSystemStoryReflectionAdapter implements StoryReflectionFileSyst
     return changedPaths;
   }
 
+  private countWorkItemTrailers(body: string): number {
+    return body.match(WORK_ITEM_TRAILER_PATTERN)?.length ?? 0;
+  }
+
+  /**
+   * バッチコミットの changed path を storyId に帰属させてよいか判定する。
+   * - 単一 WI trailer コミット → 常に帰属（現行挙動を維持）
+   * - 複数 WI trailer × 非ソースパス → 帰属（絞り込み対象外）
+   * - 複数 WI trailer × ソースパス → ファイル内容(HEAD)のタグに storyId を含むときのみ帰属。
+   *   タグ無し / ファイルが読めない → fail-closed で帰属維持（反映要求を緩めない）。
+   */
+  private async pathAttributesToStory(
+    changedPath: string,
+    storyId: string,
+    isMultiWorkItemCommit: boolean,
+  ): Promise<boolean> {
+    if (!isMultiWorkItemCommit) {
+      return true;
+    }
+
+    if (!HARNESS_SOURCE_PATH_PATTERN.test(changedPath)) {
+      return true;
+    }
+
+    const tags = await this.readSourceWorkItemTags(changedPath);
+    if (tags === null || tags.size === 0) {
+      return true;
+    }
+
+    return tags.has(storyId);
+  }
+
+  private async readSourceWorkItemTags(relativePath: string): Promise<Set<string> | null> {
+    let content: string;
+    try {
+      content = await readFile(path.join(this.rootDir, relativePath), "utf8");
+    } catch {
+      return null;
+    }
+
+    const tags = new Set<string>();
+    for (const line of content.match(SOURCE_TAG_PATTERN) ?? []) {
+      for (const id of line.match(/WI-\d+/g) ?? []) {
+        tags.add(id);
+      }
+    }
+
+    return tags;
+  }
+
   async fileContainsStoryAnnotation(productPath: string, storyId: string): Promise<boolean> {
     const absolutePath = path.join(this.rootDir, productPath);
 

package/scripts/harness/quick-mode/domain/services/quick-mode-judgment-engine.ts

@@ -6,12 +6,12 @@
  * ChangedFile[]をChangeClassificationに変換し、3拒否ルールを評価してQuickModeEligibilityを返すドメインサービス
  */
 
-import { ChangeCategory } from '../value-objects/change-category.js';
-import { ChangeClassification } from '../value-objects/change-classification.js';
-import { QuickModeEligibility } from '../value-objects/quick-mode-eligibility.js';
-import { isCommentOnlyDiff } from './comment-only-diff-detector.js';
-import type { ChangedFile } from '../value-objects/changed-file.js';
-import type { QuickModeConfig } from '../value-objects/quick-mode-config.js';
+import { ChangeCategory } from "../value-objects/change-category.js";
+import { ChangeClassification } from "../value-objects/change-classification.js";
+import type { ChangedFile } from "../value-objects/changed-file.js";
+import type { QuickModeConfig } from "../value-objects/quick-mode-config.js";
+import { QuickModeEligibility } from "../value-objects/quick-mode-eligibility.js";
+import { isCommentOnlyDiff } from "./comment-only-diff-detector.js";
 
 // リスク順優先度（api > domain > feature > bugfix > test > config > docs）
 const RISK_PRIORITY: Record<string, number> = {
@@ -30,48 +30,54 @@ function categorizeFile(file: ChangedFile): ChangeCategory {
   // Config files must stay config even when Edit payload snippets look like
   // comment/whitespace-only diffs. Config recovery guidance depends on this.
   if (
-    filePath.endsWith('.config.json') ||
-    filePath.endsWith('.config.ts') ||
-    filePath.endsWith('phasegate.config.json')
+    filePath.endsWith(".config.json") ||
+    filePath.endsWith(".config.ts") ||
+    filePath.endsWith("phasegate.config.json")
   ) {
-    return ChangeCategory.fromString('config');
+    return ChangeCategory.fromString("config");
   }
 
   if (isCommentOnlyDiff(file)) {
-    return ChangeCategory.fromString('docs');
+    return ChangeCategory.fromString("docs");
   }
 
   // api: *port.ts or *adapter.ts（最高優先度）
-  if (filePath.endsWith('port.ts') || filePath.endsWith('adapter.ts')) {
-    return ChangeCategory.fromString('api');
+  if (filePath.endsWith("port.ts") || filePath.endsWith("adapter.ts")) {
+    return ChangeCategory.fromString("api");
   }
 
   // test: __tests__/ 配下 or *.test.ts or *.spec.ts（domainより優先）
-  if (
-    filePath.includes('__tests__/') ||
-    filePath.endsWith('.test.ts') ||
-    filePath.endsWith('.spec.ts')
-  ) {
-    return ChangeCategory.fromString('test');
+  if (filePath.includes("__tests__/") || filePath.endsWith(".test.ts") || filePath.endsWith(".spec.ts")) {
+    return ChangeCategory.fromString("test");
   }
 
   // domain: domain/ 配下
-  if (filePath.includes('/domain/') || filePath.startsWith('domain/')) {
-    return ChangeCategory.fromString('domain');
+  if (filePath.includes("/domain/") || filePath.startsWith("domain/")) {
+    return ChangeCategory.fromString("domain");
   }
 
   // docs: docs/ 配下
-  if (filePath.startsWith('docs/') || filePath.includes('/docs/')) {
-    return ChangeCategory.fromString('docs');
+  if (filePath.startsWith("docs/") || filePath.includes("/docs/")) {
+    return ChangeCategory.fromString("docs");
+  }
+
+  // docs: skills/ 配下の .md（指示文書。SKILL.md / references/*.md 等）は
+  // ソースコードのフェーズゲート対象外とし docs に分類する。品質・完全性は
+  // 専用防御（skill-quality corpus 適合テスト・advisory allowlist pin・
+  // integrity pin(WI-254)・L3-006 injection scanner(WI-259)）が担う。
+  // skills/ 配下の非 .md は下の feature/bugfix フォールバックに落ちて fail-closed を維持する。
+  // @work-item-id WI-261
+  if (filePath.startsWith("skills/") && filePath.endsWith(".md")) {
+    return ChangeCategory.fromString("docs");
   }
 
   // feature: domain/ 以外の CREATE
-  if (changeKind === 'CREATE') {
-    return ChangeCategory.fromString('feature');
+  if (changeKind === "CREATE") {
+    return ChangeCategory.fromString("feature");
   }
 
   // bugfix: domain/ 以外の MODIFY/DELETE
-  return ChangeCategory.fromString('bugfix');
+  return ChangeCategory.fromString("bugfix");
 }
 
 export class QuickModeJudgmentEngine {
@@ -107,7 +113,7 @@ export class QuickModeJudgmentEngine {
     const classification = this.classify(changedFiles, config);
 
     // 1. MIXED_CHANGES評価: allowedCategories 外のカテゴリが含まれる場合
-    if (config.isFullModeRequiredFor('mixedCategories')) {
+    if (config.isFullModeRequiredFor("mixedCategories")) {
       const notAllowedFiles: ChangedFile[] = [];
       classification.categorizedFiles.forEach((files, categoryKey) => {
         if (!config.isAllowed(categoryKey)) {
@@ -117,45 +123,43 @@ export class QuickModeJudgmentEngine {
 
       if (notAllowedFiles.length > 0) {
         return QuickModeEligibility.rejected(
-          'MIXED_CHANGES',
+          "MIXED_CHANGES",
           notAllowedFiles,
-          `allowedCategories外のファイルが含まれています: ${notAllowedFiles.map((f) => f.filePath).join(', ')}`
+          `allowedCategories外のファイルが含まれています: ${notAllowedFiles.map((f) => f.filePath).join(", ")}`,
         );
       }
     }
 
     // 2. NEW_DOMAIN評価: domain/ 配下かつ changeKind=CREATE
-    if (config.isFullModeRequiredFor('newDomainFile')) {
+    if (config.isFullModeRequiredFor("newDomainFile")) {
       const newDomainFiles = changedFiles.filter(
-        (f) =>
-          (f.filePath.includes('/domain/') || f.filePath.startsWith('domain/')) &&
-          f.changeKind === 'CREATE'
+        (f) => (f.filePath.includes("/domain/") || f.filePath.startsWith("domain/")) && f.changeKind === "CREATE",
       );
 
       if (newDomainFiles.length > 0) {
         return QuickModeEligibility.rejected(
-          'NEW_DOMAIN',
+          "NEW_DOMAIN",
           newDomainFiles,
-          `domain/配下に新規ファイルが追加されています: ${newDomainFiles.map((f) => f.filePath).join(', ')}`
+          `domain/配下に新規ファイルが追加されています: ${newDomainFiles.map((f) => f.filePath).join(", ")}`,
         );
       }
     }
 
     // 3. API_CONTRACT評価: *port.ts / *adapter.ts の変更
-    if (config.isFullModeRequiredFor('apiContractChange')) {
+    if (config.isFullModeRequiredFor("apiContractChange")) {
       const apiContractFiles = changedFiles.filter(
-        (f) => (f.filePath.endsWith('port.ts') || f.filePath.endsWith('adapter.ts')) && !isCommentOnlyDiff(f)
+        (f) => (f.filePath.endsWith("port.ts") || f.filePath.endsWith("adapter.ts")) && !isCommentOnlyDiff(f),
       );
 
       if (apiContractFiles.length > 0) {
         return QuickModeEligibility.rejected(
-          'API_CONTRACT',
+          "API_CONTRACT",
           apiContractFiles,
-          `Port/Adapterインターフェースファイルの変更が含まれています: ${apiContractFiles.map((f) => f.filePath).join(', ')}`
+          `Port/Adapterインターフェースファイルの変更が含まれています: ${apiContractFiles.map((f) => f.filePath).join(", ")}`,
         );
       }
     }
 
-    return QuickModeEligibility.eligible('すべてのファイルが許可カテゴリ内です');
+    return QuickModeEligibility.eligible("すべてのファイルが許可カテゴリ内です");
   }
 }

package/scripts/harness/setup/skill-deployer.ts

@@ -33,16 +33,14 @@ export const SKILL_CATEGORIES: Record<SkillCategory, readonly string[]> = {
     "cascade-updater",
     "codebase-mapper",
     "consistency-checker",
-    "doc-freshness-checker",
+    "doc-health-checker",
     "engineering-perspective",
     "implementation-readiness-checker",
-    "pointer-validator",
     "test-coverage-checker",
   ],
   aidlc: [
     "domain-designer",
     "environment-designer",
-    "implementation-planner",
     "it-test-designer",
     "it-test-logic-designer",
     "logical-designer",
@@ -60,7 +58,7 @@ export const SKILL_CATEGORIES: Record<SkillCategory, readonly string[]> = {
     "unit-test-logic-designer",
   ],
   utility: ["codex-delegator", "skill-creator"],
-  guidance: ["phasegate-toolkit-guide", "phasegate-config-doctor"],
+  guidance: ["phasegate-toolkit-guide", "phasegate-config-doctor", "release-publisher"],
 } as const;
 
 export function getSkillsForSet(skillSet: SkillSet): string[] {

package/scripts/harness/validator-system/application/use-cases/run-l2-validators-usecase.ts

@@ -5,24 +5,29 @@
  * RunL2ValidatorsUseCase — H08-01: L2バリデータ実行
  * @work-item-id WI-110 / WI-111 / WI-140 / WI-132 / WI-133 / WI-136 / WI-137 / WI-138
  */
-import { readFile } from 'node:fs/promises';
-import { ValidatorId, InvalidValidatorIdError } from '../../domain/value-objects/validator-id.js';
-import { ValidationResult, type HarnessErrorLike } from '../../domain/value-objects/validation-result.js';
-import type { ValidatorRegistry } from '../../domain/services/validator-registry.js';
-import { type ValidatorExecutionService, ValidatorExecutionError } from '../../domain/services/validator-execution-service.js';
-import type { ValidationResultContractMapper } from '../mappers/validation-result-contract-mapper.js';
-import type { ValidationResultContract } from '../dto/validation-result-contract.js';
-import type { RunL2ValidatorsInput } from '../dto/run-l2-validators-input.js';
-import type { ValidatorConfigPort } from '../../domain/ports/validator-config-port.js';
-import type { PhaseGatePolicyPort } from '../../domain/ports/phase-gate-policy-port.js';
-import type { MetadataPolicyPort } from '../../domain/ports/metadata-policy-port.js';
-import type { TestQualityAnalyzerPort } from '../../domain/ports/test-quality-analyzer-port.js';
-import type { CliCommandRegistryPort } from '../../domain/ports/cli-command-registry-port.js';
-import type { E2eTestFileRegistryPort } from '../../domain/ports/e2e-test-file-registry-port.js';
-import { CliE2eTestExistenceService } from '../../domain/services/cli-e2e-test-existence-service.js';
-import type { WorkItemStatusPolicyPort } from '../../domain/ports/work-item-status-policy-port.js';
-import type { ContractTraceabilityPolicyPort } from '../../domain/ports/contract-traceability-policy-port.js';
-import { ContractTraceabilityCoverageService } from '../../domain/services/contract-traceability-coverage-service.js';
+import { readFile } from "node:fs/promises";
+import type { CliCommandRegistryPort } from "../../domain/ports/cli-command-registry-port.js";
+import type { ContractTraceabilityPolicyPort } from "../../domain/ports/contract-traceability-policy-port.js";
+import type { CoverageAttestationGatingPolicyPort } from "../../domain/ports/coverage-attestation-gating-policy-port.js";
+import type { E2eTestFileRegistryPort } from "../../domain/ports/e2e-test-file-registry-port.js";
+import type { MetadataPolicyPort } from "../../domain/ports/metadata-policy-port.js";
+import type { PhaseGatePolicyPort } from "../../domain/ports/phase-gate-policy-port.js";
+import type { TestQualityAnalyzerPort } from "../../domain/ports/test-quality-analyzer-port.js";
+import type { ValidatorConfigPort } from "../../domain/ports/validator-config-port.js";
+import type { WorkItemStatusPolicyPort } from "../../domain/ports/work-item-status-policy-port.js";
+import { CliE2eTestExistenceService } from "../../domain/services/cli-e2e-test-existence-service.js";
+import { ContractTraceabilityCoverageService } from "../../domain/services/contract-traceability-coverage-service.js";
+import { CoverageAttestationGatingService } from "../../domain/services/coverage-attestation-gating-service.js";
+import {
+  ValidatorExecutionError,
+  type ValidatorExecutionService,
+} from "../../domain/services/validator-execution-service.js";
+import type { ValidatorRegistry } from "../../domain/services/validator-registry.js";
+import { type HarnessErrorLike, ValidationResult } from "../../domain/value-objects/validation-result.js";
+import { ValidatorId } from "../../domain/value-objects/validator-id.js";
+import type { RunL2ValidatorsInput } from "../dto/run-l2-validators-input.js";
+import type { ValidationResultContract } from "../dto/validation-result-contract.js";
+import type { ValidationResultContractMapper } from "../mappers/validation-result-contract-mapper.js";
 
 export interface RunL2ValidatorsUseCaseDeps {
   validatorRegistry: ValidatorRegistry;
@@ -36,6 +41,7 @@ export interface RunL2ValidatorsUseCaseDeps {
   e2eTestFileRegistryPort?: E2eTestFileRegistryPort;
   workItemStatusPolicyPort?: WorkItemStatusPolicyPort;
   contractTraceabilityPolicyPort?: ContractTraceabilityPolicyPort;
+  coverageAttestationGatingPolicyPort?: CoverageAttestationGatingPolicyPort;
 }
 
 export class RunL2ValidatorsUseCase {
@@ -50,8 +56,10 @@ export class RunL2ValidatorsUseCase {
   private readonly e2eTestFileRegistryPort?: E2eTestFileRegistryPort;
   private readonly workItemStatusPolicyPort?: WorkItemStatusPolicyPort;
   private readonly contractTraceabilityPolicyPort?: ContractTraceabilityPolicyPort;
+  private readonly coverageAttestationGatingPolicyPort?: CoverageAttestationGatingPolicyPort;
   private readonly cliE2eTestExistenceService = new CliE2eTestExistenceService();
   private readonly contractTraceabilityCoverageService = new ContractTraceabilityCoverageService();
+  private readonly coverageAttestationGatingService = new CoverageAttestationGatingService();
 
   constructor(deps: RunL2ValidatorsUseCaseDeps) {
     this.registry = deps.validatorRegistry;
@@ -65,6 +73,7 @@ export class RunL2ValidatorsUseCase {
     this.e2eTestFileRegistryPort = deps.e2eTestFileRegistryPort;
     this.workItemStatusPolicyPort = deps.workItemStatusPolicyPort;
     this.contractTraceabilityPolicyPort = deps.contractTraceabilityPolicyPort;
+    this.coverageAttestationGatingPolicyPort = deps.coverageAttestationGatingPolicyPort;
   }
 
   async execute(input: RunL2ValidatorsInput): Promise<readonly ValidationResultContract[]> {
@@ -73,24 +82,27 @@ export class RunL2ValidatorsUseCase {
     if (input.validatorIds && input.validatorIds.length > 0) {
       validatorIds = input.validatorIds.map((id) => ValidatorId.create(id));
     } else {
-      validatorIds = this.registry.listByLayer('L2').map((d) => d.validatorId);
+      validatorIds = this.registry.listByLayer("L2").map((d) => d.validatorId);
     }
 
     const definitions = this.registry.select(validatorIds);
 
     // LayerConfig取得
-    let layerConfig;
+    let layerConfig: Awaited<ReturnType<ValidatorConfigPort["getLayerConfig"]>>;
     try {
-      layerConfig = await this.configPort.getLayerConfig('L2');
+      layerConfig = await this.configPort.getLayerConfig("L2");
     } catch (err) {
-      throw new ValidatorExecutionError(`Failed to get L2 LayerConfig: ${err instanceof Error ? err.message : String(err)}`, err);
+      throw new ValidatorExecutionError(
+        `Failed to get L2 LayerConfig: ${err instanceof Error ? err.message : String(err)}`,
+        err,
+      );
     }
 
     const results = this.executionService.execute(definitions, [layerConfig]);
     const overrideMap = new Map<string, ValidationResult>(results.map((result) => [result.validatorId.value, result]));
 
     if (this.phaseGatePolicyPort) {
-      const l2001Result = overrideMap.get('L2-001');
+      const l2001Result = overrideMap.get("L2-001");
       if (l2001Result && !l2001Result.skipped) {
         const policyResult = await this.phaseGatePolicyPort.checkPrerequisites({
           unitName: input.unitName,
@@ -98,24 +110,20 @@ export class RunL2ValidatorsUseCase {
         });
         if (!policyResult.satisfied) {
           overrideMap.set(
-            'L2-001',
-            ValidationResult.fail(
-              ValidatorId.create('L2-001'),
-              [...policyResult.violations],
-              0,
-            ),
+            "L2-001",
+            ValidationResult.fail(ValidatorId.create("L2-001"), [...policyResult.violations], 0),
           );
         }
       }
     }
 
     if (this.metadataPolicyPort) {
-      const l2002Result = overrideMap.get('L2-002');
+      const l2002Result = overrideMap.get("L2-002");
       if (l2002Result && !l2002Result.skipped) {
         const allErrors: HarnessErrorLike[] = [];
         for (const filePath of input.targetPaths) {
           try {
-            const fileContent = await readFile(filePath, 'utf-8');
+            const fileContent = await readFile(filePath, "utf-8");
             const policyResult = await this.metadataPolicyPort.validateMetadata({ filePath, fileContent });
             if (!policyResult.passed) {
               allErrors.push(...policyResult.errors);
@@ -125,52 +133,52 @@ export class RunL2ValidatorsUseCase {
           }
         }
         if (allErrors.length > 0) {
-          overrideMap.set('L2-002', ValidationResult.fail(ValidatorId.create('L2-002'), allErrors, 0));
+          overrideMap.set("L2-002", ValidationResult.fail(ValidatorId.create("L2-002"), allErrors, 0));
         }
       }
     }
 
     if (this.testQualityAnalyzerPort) {
-      const l2003Result = overrideMap.get('L2-003');
+      const l2003Result = overrideMap.get("L2-003");
       if (l2003Result && !l2003Result.skipped) {
         const analysisResult = await this.testQualityAnalyzerPort.analyzeTestFiles(input.targetPaths);
         const allViolations: HarnessErrorLike[] = analysisResult.results
           .filter((r) => !r.passed)
           .flatMap((r) => [...r.violations]);
         if (allViolations.length > 0) {
-          overrideMap.set('L2-003', ValidationResult.fail(ValidatorId.create('L2-003'), allViolations, 0));
+          overrideMap.set("L2-003", ValidationResult.fail(ValidatorId.create("L2-003"), allViolations, 0));
         }
       }
     }
 
     if (this.cliCommandRegistryPort && this.e2eTestFileRegistryPort) {
-      const l2013Result = overrideMap.get('L2-013');
+      const l2013Result = overrideMap.get("L2-013");
       if (l2013Result && !l2013Result.skipped) {
         const commands = await this.cliCommandRegistryPort.getRegisteredCommands();
         const e2eFiles = await this.e2eTestFileRegistryPort.getE2eTestFiles();
         const report = this.cliE2eTestExistenceService.check(commands, e2eFiles);
         if (report.hasViolations()) {
           const errors = report.toMessages().map((msg) => ({
-            code: { value: 'L2-013', toString: () => 'L2-013' },
-            severity: { value: 'error', toString: () => 'error' },
+            code: { value: "L2-013", toString: () => "L2-013" },
+            severity: { value: "error", toString: () => "error" },
             message: msg,
-            suggestion: 'Add an E2E test for each registered CLI command in cli-harness.test.ts.',
+            suggestion: "Add an E2E test for each registered CLI command in cli-harness.test.ts.",
           }));
-          overrideMap.set('L2-013', ValidationResult.fail(ValidatorId.create('L2-013'), errors, 0));
+          overrideMap.set("L2-013", ValidationResult.fail(ValidatorId.create("L2-013"), errors, 0));
         } else {
-          overrideMap.set('L2-013', ValidationResult.pass(ValidatorId.create('L2-013'), 0));
+          overrideMap.set("L2-013", ValidationResult.pass(ValidatorId.create("L2-013"), 0));
         }
       }
     }
 
     if (this.workItemStatusPolicyPort) {
-      const l2014Result = overrideMap.get('L2-014');
+      const l2014Result = overrideMap.get("L2-014");
       if (l2014Result && !l2014Result.skipped) {
         const staleReports = await this.workItemStatusPolicyPort.findStaleReports(input.targetPaths);
         if (staleReports.length > 0) {
           const errors = staleReports.map((report) => ({
-            code: { value: 'L2-014', toString: () => 'L2-014' },
-            severity: { value: 'error', toString: () => 'error' },
+            code: { value: "L2-014", toString: () => "L2-014" },
+            severity: { value: "error", toString: () => "error" },
             message: `${report.id} status is stale: current=${report.currentStatus}, derived=${report.derivedStatus}`,
             suggestion: report.nextAction,
             workItemId: report.id,
@@ -179,21 +187,21 @@ export class RunL2ValidatorsUseCase {
             derivedStatus: report.derivedStatus,
             evidence: report.evidence,
           }));
-          overrideMap.set('L2-014', ValidationResult.fail(ValidatorId.create('L2-014'), errors, 0));
+          overrideMap.set("L2-014", ValidationResult.fail(ValidatorId.create("L2-014"), errors, 0));
         } else {
-          overrideMap.set('L2-014', ValidationResult.pass(ValidatorId.create('L2-014'), 0));
+          overrideMap.set("L2-014", ValidationResult.pass(ValidatorId.create("L2-014"), 0));
         }
       }
     }
 
     if (this.contractTraceabilityPolicyPort) {
-      const l2015Result = overrideMap.get('L2-015');
+      const l2015Result = overrideMap.get("L2-015");
       if (l2015Result && !l2015Result.skipped) {
         const inputModel = await this.contractTraceabilityPolicyPort.collect(input.targetPaths);
         const report = this.contractTraceabilityCoverageService.check(inputModel);
         if (report.hasFindings()) {
           const errors = report.findings.map((finding) => ({
-            code: { value: 'L2-015', toString: () => 'L2-015' },
+            code: { value: "L2-015", toString: () => "L2-015" },
             severity: { value: finding.severity, toString: () => finding.severity },
             message: finding.message,
             suggestion: finding.suggestion,
@@ -201,9 +209,34 @@ export class RunL2ValidatorsUseCase {
             subject: finding.subject,
             sourcePath: finding.sourcePath,
           }));
-          overrideMap.set('L2-015', ValidationResult.fail(ValidatorId.create('L2-015'), errors, 0));
+          overrideMap.set("L2-015", ValidationResult.fail(ValidatorId.create("L2-015"), errors, 0));
         } else {
-          overrideMap.set('L2-015', ValidationResult.pass(ValidatorId.create('L2-015'), 0));
+          overrideMap.set("L2-015", ValidationResult.pass(ValidatorId.create("L2-015"), 0));
+        }
+      }
+    }
+
+    // WI-258 / ADR-030 §Decision.3.②: L2-016 coverage-attestation-gating。
+    // bare ✅（attestation 参照なし）は error violation（fail-closed）。ungated-legacy マーカーは
+    // 免除だが warning（見える負債）で件数報告する。warning-only の fail は ADR-017 の集約規則で
+    // failOnWarning=false のとき overall PASS 扱いとなる。
+    if (this.coverageAttestationGatingPolicyPort) {
+      const l2016Result = overrideMap.get("L2-016");
+      if (l2016Result && !l2016Result.skipped) {
+        const models = await this.coverageAttestationGatingPolicyPort.collect();
+        const report = this.coverageAttestationGatingService.check(models);
+        const findings = [...report.violations, ...report.warnings];
+        if (findings.length > 0) {
+          const errors: HarnessErrorLike[] = findings.map((finding) => ({
+            code: { value: "L2-016", toString: () => "L2-016" },
+            severity: { value: finding.severity, toString: () => finding.severity },
+            message: finding.message,
+            suggestion: finding.suggestion,
+            sourcePath: finding.sourcePath,
+          }));
+          overrideMap.set("L2-016", ValidationResult.fail(ValidatorId.create("L2-016"), errors, 0));
+        } else {
+          overrideMap.set("L2-016", ValidationResult.pass(ValidatorId.create("L2-016"), 0));
         }
       }
     }