phasegate 0.191.0 → 0.212.0

package/scripts/harness/validator-system/composition-root.ts

@@ -6,77 +6,92 @@
  * @work-item-id WI-110 / WI-111 / WI-132 / WI-133 / WI-136 / WI-137 / WI-138 / WI-156
  * @work-item-id WI-217
  */
-import { ValidatorId } from './domain/value-objects/validator-id.js';
-import { ValidatorDefinition } from './domain/value-objects/validator-definition.js';
-import { ValidationRule } from './domain/value-objects/validation-rule.js';
-import { ValidatorRegistry } from './domain/services/validator-registry.js';
-import { ValidatorExecutionService } from './domain/services/validator-execution-service.js';
-import { ValidationResultContractMapper } from './application/mappers/validation-result-contract-mapper.js';
-import { RunL2ValidatorsUseCase } from './application/use-cases/run-l2-validators-usecase.js';
-import { RunL3ValidatorsUseCase } from './application/use-cases/run-l3-validators-usecase.js';
-import { RunL4ValidatorsUseCase } from './application/use-cases/run-l4-validators-usecase.js';
-import { RunL1ValidatorsUseCase } from './application/use-cases/run-l1-validators-usecase.js';
-import { RunQuickModeUseCase } from './application/use-cases/run-quick-mode-usecase.js';
-import { AggregateValidationResultsUseCase } from './application/use-cases/aggregate-validation-results-usecase.js';
-import { RunFullValidationUseCase } from './application/use-cases/run-full-validation-usecase.js';
-import { HarnessConfigValidatorConfigAdapter } from './infrastructure/adapters/harness-config-validator-config-adapter.js';
-import { ItTestFileAnalyzerAdapter } from './infrastructure/adapters/it-test-file-analyzer-adapter.js';
-import { SourceFileTextScannerAdapter } from './infrastructure/adapters/source-file-text-scanner-adapter.js';
-import { E2eTestFileRegistryAdapter } from './infrastructure/adapters/e2e-test-file-registry-adapter.js';
-import { CliCommandRegistryAdapter } from './infrastructure/adapters/cli-command-registry-adapter.js';
-import { TraceabilityWorkItemStatusPolicyAdapter } from './infrastructure/adapters/traceability-work-item-status-policy-adapter.js';
-import { FileSystemContractTraceabilityPolicyAdapter } from './infrastructure/adapters/file-system-contract-traceability-policy-adapter.js';
-import { PhaseDependencyPhaseGatePolicyAdapter } from './infrastructure/adapters/phase-dependency-phase-gate-policy-adapter.js';
-import { TraceabilityMetadataPolicyAdapter } from './infrastructure/adapters/traceability-metadata-policy-adapter.js';
-import { NyquistAcCoveragePolicyAdapter } from './infrastructure/adapters/nyquist-ac-coverage-policy-adapter.js';
-import { NyquistAcBoundCoveragePolicyAdapter } from './infrastructure/adapters/nyquist-ac-bound-coverage-policy-adapter.js';
-import { JsonCoverageReportAdapter } from './infrastructure/adapters/json-coverage-report-adapter.js';
-import { BiomeAstTestQualityAnalyzerAdapter } from './infrastructure/adapters/biome-ast-test-quality-analyzer-adapter.js';
-import { FileSystemSecurityPatternScannerAdapter } from './infrastructure/adapters/file-system-security-pattern-scanner-adapter.js';
-import { AstPerformanceScannerAdapter } from './infrastructure/adapters/ast-performance-scanner-adapter.js';
-import { MarkdownDesignDocumentAdapter } from './infrastructure/adapters/markdown-design-document-adapter.js';
-import { BiomeAstSourceCodeAnalyzerAdapter } from './infrastructure/adapters/biome-ast-source-code-analyzer-adapter.js';
-import { AdrFoundationReferenceAdapter } from './infrastructure/adapters/adr-foundation-reference-adapter.js';
-import { ImportGraphSourceAnalysisAdapter } from './infrastructure/adapters/import-graph-source-analysis-adapter.js';
-import { FileSystemArchitectureSemanticSourceAdapter } from './infrastructure/adapters/file-system-architecture-semantic-source-adapter.js';
-import { FileSystemSkillCatalogDriftAdapter } from './infrastructure/adapters/file-system-skill-catalog-drift-adapter.js';
-import { NyquistAcLevelTraceabilityAdapter } from './infrastructure/adapters/nyquist-ac-level-traceability-adapter.js';
-import { FileSystemWorkItemReflectionAdapter } from './infrastructure/adapters/file-system-work-item-reflection-adapter.js';
-import { DriftDetectionService } from './domain/services/l4/drift-detection-service.js';
-import { ConsistencyCheckService } from './domain/services/l4/consistency-check-service.js';
-import { DeadCodeDetectionService } from './domain/services/l4/dead-code-detection-service.js';
-import { ArchitectureSemanticAnalysisService, type ArchitectureSemanticPolicy } from './domain/services/l4/architecture-semantic-analysis-service.js';
-import { buildPhase2Extensions } from '../phase2-extensions/composition-root.js';
-import { RunValidatorsHandler } from './presentation/handlers/run-validators-handler.js';
-import { RunQuickModeHandler } from './presentation/handlers/run-quick-mode-handler.js';
-import { ReportValidationResultsHandler } from './presentation/handlers/report-validation-results-handler.js';
-import { join } from 'node:path';
+
+import { join } from "node:path";
+import { buildPhase2Extensions } from "../phase2-extensions/composition-root.js";
+import { ValidationResultContractMapper } from "./application/mappers/validation-result-contract-mapper.js";
+import { AggregateValidationResultsUseCase } from "./application/use-cases/aggregate-validation-results-usecase.js";
+import { RunFullValidationUseCase } from "./application/use-cases/run-full-validation-usecase.js";
+import { RunL1ValidatorsUseCase } from "./application/use-cases/run-l1-validators-usecase.js";
+import { RunL2ValidatorsUseCase } from "./application/use-cases/run-l2-validators-usecase.js";
+import { RunL3ValidatorsUseCase } from "./application/use-cases/run-l3-validators-usecase.js";
+import { RunL4ValidatorsUseCase } from "./application/use-cases/run-l4-validators-usecase.js";
+import { RunQuickModeUseCase } from "./application/use-cases/run-quick-mode-usecase.js";
+import {
+  ArchitectureSemanticAnalysisService,
+  type ArchitectureSemanticPolicy,
+} from "./domain/services/l4/architecture-semantic-analysis-service.js";
+import { ConsistencyCheckService } from "./domain/services/l4/consistency-check-service.js";
+import { DeadCodeDetectionService } from "./domain/services/l4/dead-code-detection-service.js";
+import { DriftDetectionService } from "./domain/services/l4/drift-detection-service.js";
+import { ValidatorExecutionService } from "./domain/services/validator-execution-service.js";
+import { ValidatorRegistry } from "./domain/services/validator-registry.js";
+import { ValidationRule } from "./domain/value-objects/validation-rule.js";
+import { ValidatorDefinition } from "./domain/value-objects/validator-definition.js";
+import { ValidatorId } from "./domain/value-objects/validator-id.js";
+import { AdrFoundationReferenceAdapter } from "./infrastructure/adapters/adr-foundation-reference-adapter.js";
+import { AstPerformanceScannerAdapter } from "./infrastructure/adapters/ast-performance-scanner-adapter.js";
+import { BiomeAstSourceCodeAnalyzerAdapter } from "./infrastructure/adapters/biome-ast-source-code-analyzer-adapter.js";
+import { BiomeAstTestQualityAnalyzerAdapter } from "./infrastructure/adapters/biome-ast-test-quality-analyzer-adapter.js";
+import { CliCommandRegistryAdapter } from "./infrastructure/adapters/cli-command-registry-adapter.js";
+import { E2eTestFileRegistryAdapter } from "./infrastructure/adapters/e2e-test-file-registry-adapter.js";
+import { FileSystemArchitectureSemanticSourceAdapter } from "./infrastructure/adapters/file-system-architecture-semantic-source-adapter.js";
+import { FileSystemContractTraceabilityPolicyAdapter } from "./infrastructure/adapters/file-system-contract-traceability-policy-adapter.js";
+import { FileSystemCoverageAttestationGatingAdapter } from "./infrastructure/adapters/file-system-coverage-attestation-gating-adapter.js";
+import { FileSystemInjectionScanAdapter } from "./infrastructure/adapters/file-system-injection-scan-adapter.js";
+import { FileSystemSecurityPatternScannerAdapter } from "./infrastructure/adapters/file-system-security-pattern-scanner-adapter.js";
+import { FileSystemSkillCatalogDriftAdapter } from "./infrastructure/adapters/file-system-skill-catalog-drift-adapter.js";
+import { FileSystemWorkItemReflectionAdapter } from "./infrastructure/adapters/file-system-work-item-reflection-adapter.js";
+import { HarnessConfigValidatorConfigAdapter } from "./infrastructure/adapters/harness-config-validator-config-adapter.js";
+import { ImportGraphSourceAnalysisAdapter } from "./infrastructure/adapters/import-graph-source-analysis-adapter.js";
+import { ItTestFileAnalyzerAdapter } from "./infrastructure/adapters/it-test-file-analyzer-adapter.js";
+import { JsonCoverageReportAdapter } from "./infrastructure/adapters/json-coverage-report-adapter.js";
+import { MarkdownDesignDocumentAdapter } from "./infrastructure/adapters/markdown-design-document-adapter.js";
+import { NyquistAcBoundCoveragePolicyAdapter } from "./infrastructure/adapters/nyquist-ac-bound-coverage-policy-adapter.js";
+import { NyquistAcCoveragePolicyAdapter } from "./infrastructure/adapters/nyquist-ac-coverage-policy-adapter.js";
+import { NyquistAcLevelTraceabilityAdapter } from "./infrastructure/adapters/nyquist-ac-level-traceability-adapter.js";
+import { PhaseDependencyPhaseGatePolicyAdapter } from "./infrastructure/adapters/phase-dependency-phase-gate-policy-adapter.js";
+import { SourceFileTextScannerAdapter } from "./infrastructure/adapters/source-file-text-scanner-adapter.js";
+import { TraceabilityMetadataPolicyAdapter } from "./infrastructure/adapters/traceability-metadata-policy-adapter.js";
+import { TraceabilityWorkItemStatusPolicyAdapter } from "./infrastructure/adapters/traceability-work-item-status-policy-adapter.js";
+import { ReportValidationResultsHandler } from "./presentation/handlers/report-validation-results-handler.js";
+import { RunQuickModeHandler } from "./presentation/handlers/run-quick-mode-handler.js";
+import { RunValidatorsHandler } from "./presentation/handlers/run-validators-handler.js";
 
 /** デフォルト設定（ハードコード fallback） */
 const DEFAULT_CONFIG = {
-  preset: 'standard' as const,
+  preset: "standard" as const,
   layers: {
-    L2: { enabled: true, validators: ['L2-001', 'L2-002', 'L2-003', 'L2-013', 'L2-014', 'L2-015'] },
-    L3: { enabled: true, validators: ['L3-001', 'L3-002', 'L3-003', 'L3-004'], coverageThreshold: 90, bundleSizeLimit: 512000, requirementMatrixPath: '.harness/requirement-test-matrix.json' },
-    L4: { enabled: true, validators: ['L4-001', 'L4-002', 'L4-003', 'L4-004', 'L4-005', 'L4-006'] },
+    L2: { enabled: true, validators: ["L2-001", "L2-002", "L2-003", "L2-013", "L2-014", "L2-015", "L2-016"] },
+    L3: {
+      enabled: true,
+      validators: ["L3-001", "L3-002", "L3-003", "L3-004", "L3-006"],
+      coverageThreshold: 90,
+      bundleSizeLimit: 512000,
+      requirementMatrixPath: ".harness/requirement-test-matrix.json",
+    },
+    L4: { enabled: true, validators: ["L4-001", "L4-002", "L4-003", "L4-004", "L4-005", "L4-006"] },
   },
   paths: {
-    designDocs: 'docs/product/construction',
-    inceptionDocs: 'docs/inception',
+    designDocs: "docs/product/construction",
+    inceptionDocs: "docs/inception",
   },
   validate: { failOnWarning: false },
   architecture: {
     capabilityPolicies: {
-      domain: { allowed: [], denied: ['filesystem', 'network', 'database', 'process-env', 'subprocess', 'user-io'] },
-      application: { allowed: ['time', 'random'], denied: ['filesystem', 'network', 'database', 'subprocess'] },
-      infrastructure: { allowed: ['filesystem', 'network', 'database', 'process-env', 'time', 'random', 'subprocess', 'user-io'], denied: [] },
-      presentation: { allowed: ['user-io', 'time'], denied: ['database', 'subprocess'] },
+      domain: { allowed: [], denied: ["filesystem", "network", "database", "process-env", "subprocess", "user-io"] },
+      application: { allowed: ["time", "random"], denied: ["filesystem", "network", "database", "subprocess"] },
+      infrastructure: {
+        allowed: ["filesystem", "network", "database", "process-env", "time", "random", "subprocess", "user-io"],
+        denied: [],
+      },
+      presentation: { allowed: ["user-io", "time"], denied: ["database", "subprocess"] },
     },
     decisionPolicies: {
-      domain: { expected: ['business-rule-branch', 'validation-rule', 'state-transition'], advisoryOnly: true },
-      application: { expected: ['policy-selection', 'error-construction'], advisoryOnly: true },
-      infrastructure: { expected: ['error-construction'], advisoryOnly: true },
-      presentation: { expected: ['validation-rule', 'error-construction'], advisoryOnly: true },
+      domain: { expected: ["business-rule-branch", "validation-rule", "state-transition"], advisoryOnly: true },
+      application: { expected: ["policy-selection", "error-construction"], advisoryOnly: true },
+      infrastructure: { expected: ["error-construction"], advisoryOnly: true },
+      presentation: { expected: ["validation-rule", "error-construction"], advisoryOnly: true },
     },
   },
 };
@@ -84,47 +99,58 @@ const DEFAULT_CONFIG = {
 /** バリデータ定義カタログ */
 export function buildDefaultRegistry(): ValidatorRegistry {
   const defaultRule = ValidationRule.create({
-    ruleName: 'default-rule',
-    errorTemplate: { code: 'L2-001', severity: 'error', messageTemplate: '{{message}}' },
+    ruleName: "default-rule",
+    errorTemplate: { code: "L2-001", severity: "error", messageTemplate: "{{message}}" },
     fixExample: null,
   });
 
-  const createDef = (id: string, layer: 'L2' | 'L3' | 'L4', enabledCondition: 'always' | 'strictOnly' = 'always', externalPolicyRef: string | null = null) =>
+  const createDef = (
+    id: string,
+    layer: "L2" | "L3" | "L4",
+    enabledCondition: "always" | "strictOnly" = "always",
+    externalPolicyRef: string | null = null,
+  ) =>
     ValidatorDefinition.create({
       validatorId: ValidatorId.create(id),
       layer,
-      rules: [ValidationRule.create({
-        ruleName: `${id}-rule`,
-        errorTemplate: { code: id, severity: 'error', messageTemplate: '{{message}}' },
-        fixExample: null,
-      })],
+      rules: [
+        ValidationRule.create({
+          ruleName: `${id}-rule`,
+          errorTemplate: { code: id, severity: "error", messageTemplate: "{{message}}" },
+          fixExample: null,
+        }),
+      ],
       enabledCondition,
       externalPolicyRef,
     });
 
   const definitions = [
-    createDef('L2-001', 'L2', 'always', 'PhaseGatePolicyPort'),
-    createDef('L2-002', 'L2', 'always', 'MetadataPolicyPort'),
-    createDef('L2-003', 'L2', 'always'),
-    createDef('L2-013', 'L2', 'always', 'CliE2eTestExistenceService'),
-    createDef('L2-014', 'L2', 'always', 'WorkItemStatusPolicyPort'),
-    createDef('L2-015', 'L2', 'always', 'ContractTraceabilityPolicyPort'),
-    createDef('L3-001', 'L3', 'always'),
-    createDef('L3-002', 'L3', 'strictOnly'),
-    createDef('L3-003', 'L3', 'always'),
-    createDef('L3-004', 'L3', 'always', 'AcCoveragePolicyPort'),
+    createDef("L2-001", "L2", "always", "PhaseGatePolicyPort"),
+    createDef("L2-002", "L2", "always", "MetadataPolicyPort"),
+    createDef("L2-003", "L2", "always"),
+    createDef("L2-013", "L2", "always", "CliE2eTestExistenceService"),
+    createDef("L2-014", "L2", "always", "WorkItemStatusPolicyPort"),
+    createDef("L2-015", "L2", "always", "ContractTraceabilityPolicyPort"),
+    // WI-258 / ADR-030 §Decision.3.②: L2-016 (coverage-attestation-gating, fail-closed, default-ON)。
+    createDef("L2-016", "L2", "always", "CoverageAttestationGatingPolicyPort"),
+    createDef("L3-001", "L3", "always"),
+    createDef("L3-002", "L3", "strictOnly"),
+    createDef("L3-003", "L3", "always"),
+    createDef("L3-004", "L3", "always", "AcCoveragePolicyPort"),
     // WI-227 / H16-03: L3-005 (ac-bound-coverage) は registry には登録するが
     // default-OFF（DEFAULT_CONFIG.layers.L3.validators に含めない）。fail-closed / opt-in。
-    createDef('L3-005', 'L3', 'always', 'AcBoundCoveragePolicyPort'),
-    createDef('L4-001', 'L4', 'always'),
-    createDef('L4-002', 'L4', 'always'),
-    createDef('L4-003', 'L4', 'strictOnly'),
-    createDef('L4-004', 'L4', 'always'),
-    createDef('L4-005', 'L4', 'always'),
-    createDef('L4-006', 'L4', 'always', 'SkillCatalogDriftPort'),
+    createDef("L3-005", "L3", "always", "AcBoundCoveragePolicyPort"),
+    // WI-259 / ADR-030 §Decision.3.④: L3-006 (injection-scan) は advisory (warning-only, default-ON)。
+    createDef("L3-006", "L3", "always", "InjectionScanPolicyPort"),
+    createDef("L4-001", "L4", "always"),
+    createDef("L4-002", "L4", "always"),
+    createDef("L4-003", "L4", "strictOnly"),
+    createDef("L4-004", "L4", "always"),
+    createDef("L4-005", "L4", "always"),
+    createDef("L4-006", "L4", "always", "SkillCatalogDriftPort"),
     // WI-222 / HF2-05: L4-007 (ac-level-traceability) は registry には登録するが
     // default-OFF（DEFAULT_CONFIG.layers.L4.validators に含めない）。advisory-only。
-    createDef('L4-007', 'L4', 'always', 'AcLevelTraceabilityPort'),
+    createDef("L4-007", "L4", "always", "AcLevelTraceabilityPort"),
   ];
 
   return new ValidatorRegistry(definitions);
@@ -162,26 +188,40 @@ export function createValidatorSystemModule(config?: object): ValidatorSystemMod
   const acBoundCoveragePolicyPort = new NyquistAcBoundCoveragePolicyAdapter();
   // L3-003: テストカバレッジレポート（vitest --coverage の json-summary 出力）を読み取る。
   // 未配線だと L3-003 は装飾的な pass になり 90% 閾値が形骸化するため必ず配線する。
-  const coverageReportPort = new JsonCoverageReportAdapter(
-    join(process.cwd(), 'coverage', 'coverage-summary.json'),
-  );
+  const coverageReportPort = new JsonCoverageReportAdapter(join(process.cwd(), "coverage", "coverage-summary.json"));
   const testQualityAnalyzerPort = new BiomeAstTestQualityAnalyzerAdapter();
   const securityScannerPort = new FileSystemSecurityPatternScannerAdapter();
   const performanceScannerPort = new AstPerformanceScannerAdapter();
   const workItemStatusPolicyPort = new TraceabilityWorkItemStatusPolicyAdapter(process.cwd());
   const contractTraceabilityPolicyPort = new FileSystemContractTraceabilityPolicyAdapter();
+  // WI-258 / ADR-030 §Decision.3.②: L2-016 (coverage-attestation-gating) 用アダプタ。
+  // docs/product/construction/*​/coverage_report.md を cwd 起点で走査する（targetPaths 非依存）。
+  const coverageAttestationGatingPolicyPort = new FileSystemCoverageAttestationGatingAdapter(process.cwd());
+  // WI-259 / ADR-030 §Decision.3.④: L3-006 (injection-scan, advisory) 用アダプタ。
+  // 指示搭載ファイル群（skills/**​/SKILL.md / CLAUDE.md / AGENTS.md / agent-context / .claude/settings.json）を
+  // cwd 起点で走査する（targetPaths 非依存）。
+  const injectionScanPolicyPort = new FileSystemInjectionScanAdapter(process.cwd());
 
   const cwd = process.cwd();
-  const designDocsRoot = configData.paths?.designDocs ?? 'docs/product/construction';
-  const inceptionDocsRoot = configData.paths?.inceptionDocs ?? 'docs/inception';
+  const designDocsRoot = configData.paths?.designDocs ?? "docs/product/construction";
+  const inceptionDocsRoot = configData.paths?.inceptionDocs ?? "docs/inception";
   const docsRoot = join(cwd, designDocsRoot);
-  const e2eTestFileRegistryPort = new E2eTestFileRegistryAdapter({ e2eTestRoot: join(cwd, 'scripts/harness/__tests__/e2e') });
+  const e2eTestFileRegistryPort = new E2eTestFileRegistryAdapter({
+    e2eTestRoot: join(cwd, "scripts/harness/__tests__/e2e"),
+  });
   const cliCommandRegistryPort = new CliCommandRegistryAdapter({
     commands: [
-      'validate', 'lint', 'ci-check',
-      'phasegate:check-ready', 'phasegate:check-phase', 'phasegate:ci-check',
-      'phasegate:detect-drift', 'phasegate:lint', 'phasegate:complete-check',
-      'phasegate:impact-analysis', 'phasegate:status',
+      "validate",
+      "lint",
+      "ci-check",
+      "phasegate:check-ready",
+      "phasegate:check-phase",
+      "phasegate:ci-check",
+      "phasegate:detect-drift",
+      "phasegate:lint",
+      "phasegate:complete-check",
+      "phasegate:impact-analysis",
+      "phasegate:status",
     ],
   });
 
@@ -197,6 +237,7 @@ export function createValidatorSystemModule(config?: object): ValidatorSystemMod
     cliCommandRegistryPort,
     workItemStatusPolicyPort,
     contractTraceabilityPolicyPort,
+    coverageAttestationGatingPolicyPort,
   });
 
   // WI-227 / H16-03: L3-005 のスコープ対象 story-id を config から取得（既定 []）。
@@ -213,19 +254,20 @@ export function createValidatorSystemModule(config?: object): ValidatorSystemMod
     coverageReportPort,
     securityScannerPort,
     performanceScannerPort,
+    injectionScanPolicyPort,
     acBoundStories,
   });
 
   const markdownDesignDocumentPort = new MarkdownDesignDocumentAdapter(docsRoot);
   const sourceCodeAnalyzerAdapter = new BiomeAstSourceCodeAnalyzerAdapter();
-  const adrReferencePort = new AdrFoundationReferenceAdapter();
+  const adrReferencePort = new AdrFoundationReferenceAdapter(cwd);
   const sourceAnalysisPort = new ImportGraphSourceAnalysisAdapter();
   const architectureSemanticSourcePort = new FileSystemArchitectureSemanticSourceAdapter();
   const skillCatalogDriftPort = new FileSystemSkillCatalogDriftAdapter(cwd);
   // WI-222 / HF2-05: L4-007 (advisory) 用の AC 単位トレーサビリティ port。
   // matrix path は L3-004 と同じ config キーを参照する。
   const acLevelTraceabilityPort = new NyquistAcLevelTraceabilityAdapter({
-    matrixFilePath: configData.layers?.L3?.requirementMatrixPath ?? '.harness/requirement-test-matrix.json',
+    matrixFilePath: configData.layers?.L3?.requirementMatrixPath ?? ".harness/requirement-test-matrix.json",
   });
   const workItemReflectionPort = new FileSystemWorkItemReflectionAdapter(cwd);
 
@@ -275,11 +317,11 @@ export function createValidatorSystemModule(config?: object): ValidatorSystemMod
 
   const aggregateValidationResultsUseCase = new AggregateValidationResultsUseCase();
   const itTestFileAnalyzerPort = new ItTestFileAnalyzerAdapter({
-    itTestRoot: join(cwd, 'scripts/harness/__tests__/integration'),
+    itTestRoot: join(cwd, "scripts/harness/__tests__/integration"),
     // アダプター自体のテストファイルは vi.mock() を使用しているため誤検知防止で除外
     excludePattern: /it-test-file-analyzer-adapter\.test\.ts$/,
   });
-  const sourceFileTextScannerPort = new SourceFileTextScannerAdapter({ sourceRoot: join(cwd, 'scripts/harness') });
+  const sourceFileTextScannerPort = new SourceFileTextScannerAdapter({ sourceRoot: join(cwd, "scripts/harness") });
   const runL1ValidatorsUseCase = new RunL1ValidatorsUseCase({
     itTestFileAnalyzerPort,
     sourceFileTextScannerPort,

package/scripts/harness/validator-system/domain/ports/coverage-attestation-gating-policy-port.ts

@@ -0,0 +1,14 @@
+// @unit validator-system
+// @layer domain
+// @work-item-id WI-258
+
+import type { CoverageReportGatingModel } from "../value-objects/coverage-gating-report.js";
+
+/**
+ * WI-258 / ADR-030 §Decision.3.② — coverage_report 走査結果の供給ポート。
+ * 走査対象（docs/product/construction/*​/coverage_report.md）の解決は infrastructure が担う
+ * （cwd 起点・targetPaths 非依存の corpus 走査）。
+ */
+export interface CoverageAttestationGatingPolicyPort {
+  collect(): Promise<readonly CoverageReportGatingModel[]>;
+}

package/scripts/harness/validator-system/domain/ports/injection-scan-policy-port.ts

@@ -0,0 +1,14 @@
+// @unit validator-system
+// @layer domain
+// @work-item-id WI-259
+
+import type { InjectionScanTarget } from "../value-objects/injection-scan-report.js";
+
+/**
+ * WI-259 / ADR-030 §Decision.3.④ — 指示搭載ファイルの供給ポート。
+ * 走査対象（skills/**​/SKILL.md / CLAUDE.md / AGENTS.md / docs/templates/agent-context/** /
+ * .claude/settings.json）の解決は infrastructure が担う（cwd 起点・targetPaths 非依存の corpus 走査）。
+ */
+export interface InjectionScanPolicyPort {
+  collect(): Promise<readonly InjectionScanTarget[]>;
+}

package/scripts/harness/validator-system/domain/services/coverage-attestation-gating-service.ts

@@ -0,0 +1,56 @@
+// @unit validator-system
+// @layer domain
+// @work-item-id WI-258
+
+/**
+ * WI-258 / ADR-030 §Decision.3.② — coverage-attestation-gating (L2-016) の判定ドメインサービス。
+ *
+ * INV-A: hasLegacyMarker のファイルは error を生成せず legacyCount に計上し warning を 1 件生成（見える負債）。
+ * INV-B: マーカー無しファイルで attestation 参照を持たない ✅ claim は error violation（fail-closed）。
+ * INV-C: ✅ を持たないファイルは violation も warning も生成しない（対象外）。
+ */
+
+import {
+  type CoverageGatingFinding,
+  CoverageGatingReport,
+  type CoverageReportGatingModel,
+} from "../value-objects/coverage-gating-report.js";
+
+export class CoverageAttestationGatingService {
+  check(models: readonly CoverageReportGatingModel[]): CoverageGatingReport {
+    const violations: CoverageGatingFinding[] = [];
+    const warnings: CoverageGatingFinding[] = [];
+    let legacyCount = 0;
+
+    for (const model of models) {
+      if (model.hasLegacyMarker) {
+        // INV-A: 免除だが可視化。claim の有無に関わらず legacy として計上する
+        // （マーカーは「このファイルはまだゲートされていない負債」の宣言であるため）。
+        legacyCount += 1;
+        warnings.push({
+          severity: "warning",
+          sourcePath: model.path,
+          message: `ungated-legacy coverage_report (attestation ゲート未適用の負債): ${model.path}`,
+          suggestion:
+            "各 ✅ 主張に <!-- @attestation <id> --> を付与し、@coverage-gating: ungated-legacy マーカーを除去して段階返済すること。",
+        });
+        continue;
+      }
+
+      // INV-B / INV-C: マーカー無しファイルの各 ✅ claim を検査する。
+      for (const claim of model.claims) {
+        if (!claim.hasAttestationRef) {
+          violations.push({
+            severity: "error",
+            sourcePath: model.path,
+            message: `${model.path}:${claim.lineNumber} の ✅ 主張に attestation 参照がありません（bare ✅ は fail-closed）。`,
+            suggestion:
+              "✅ 主張に <!-- @attestation <id> --> を付与するか、未返済なら <!-- @coverage-gating: ungated-legacy --> マーカーで免除（負債可視化）すること。",
+          });
+        }
+      }
+    }
+
+    return CoverageGatingReport.create(violations, warnings, legacyCount);
+  }
+}

package/scripts/harness/validator-system/domain/services/injection-pattern-scan-service.ts

@@ -0,0 +1,118 @@
+// @unit validator-system
+// @layer domain
+// @work-item-id WI-259
+
+/**
+ * WI-259 / ADR-030 §Decision.3.④ — advisory インジェクションスキャナ（L3-006）の判定ドメインサービス。
+ *
+ * 指示搭載ファイル群に対し既知のインジェクションパターンを行単位で照合する純粋サービス。
+ * INV-A: 生成する finding は必ず severity='warning'（error / violation を一切生成しない — §4.(b)）。
+ * INV-B: HTML コメント内の指示上書きは html-comment-instruction に一本化し instruction-override として二重報告しない。
+ * INV-C: どのパターンにも該当しない対象は finding を生成しない（無音 → pass）。
+ *
+ * パターンは narrow に設計し、自リポジトリの正当な文書（散文）に誤検知しないことを実 corpus で実証する。
+ */
+
+import {
+  type InjectionFinding,
+  InjectionScanReport,
+  type InjectionScanTarget,
+} from "../value-objects/injection-scan-report.js";
+
+/** 指示上書きフレーズ（英/日）。narrow な定型のみ。 */
+const OVERRIDE_PATTERNS: readonly RegExp[] = [
+  /ignore\s+(?:all\s+|any\s+)?(?:previous|prior|above)\s+(?:instructions|rules)/i,
+  /disregard\s+(?:your|all)\s+(?:instructions|training)/i,
+  /これまでの指示を無視/,
+  /以前の指示を無視/,
+  /上記の指示を無視/,
+  /指示を(?:全て|すべて)無視/,
+  /システムプロンプトを無視/,
+];
+
+/** HTML コメントを含む行か（`<!--` の存在で判定。行内コメント・複数行コメント開始のいずれも拾う）。 */
+const HTML_COMMENT_LINE = /<!--/;
+
+/** 不可視 Unicode: zero-width (U+200B-U+200D, U+FEFF) + bidi 制御 (U+202A-U+202E, U+2066-U+2069)。 */
+// biome-ignore lint/suspicious/noControlCharactersInRegex: bidi/zero-width 制御文字の検出が目的
+const INVISIBLE_UNICODE = /[​-‍‪-‮⁦-⁩]/;
+
+/** 連続 200 文字以上の base64 文字列塊。 */
+const BASE64_BLOB = /[A-Za-z0-9+/]{200,}={0,2}/;
+
+export class InjectionPatternScanService {
+  scan(targets: readonly InjectionScanTarget[]): InjectionScanReport {
+    const findings: InjectionFinding[] = [];
+
+    for (const target of targets) {
+      const lines = target.content.split(/\r?\n/);
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const lineNumber = i + 1;
+
+        const hasOverride = OVERRIDE_PATTERNS.some((pattern) => pattern.test(line));
+        if (hasOverride) {
+          // INV-B: HTML コメント内の指示上書きは html-comment-instruction に一本化する。
+          if (HTML_COMMENT_LINE.test(line)) {
+            findings.push(
+              this.finding(
+                "html-comment-instruction",
+                target.path,
+                lineNumber,
+                "HTML コメント内にエージェント宛ての指示上書きフレーズが埋め込まれています。",
+                "隠蔽された指示の可能性があります。人間レビューで意図を確認してください（advisory）。",
+              ),
+            );
+          } else {
+            findings.push(
+              this.finding(
+                "instruction-override",
+                target.path,
+                lineNumber,
+                "指示上書きフレーズ（例: ignore previous instructions / これまでの指示を無視）を検出しました。",
+                "インジェクションの可能性があります。人間レビューで意図を確認してください（advisory）。",
+              ),
+            );
+          }
+        }
+
+        if (INVISIBLE_UNICODE.test(line)) {
+          findings.push(
+            this.finding(
+              "invisible-unicode",
+              target.path,
+              lineNumber,
+              "不可視 Unicode 文字（zero-width / bidi 制御）を検出しました。",
+              "見えない文字で指示を隠蔽している可能性があります。人間レビューで確認してください（advisory）。",
+            ),
+          );
+        }
+
+        if (BASE64_BLOB.test(line)) {
+          findings.push(
+            this.finding(
+              "base64-blob",
+              target.path,
+              lineNumber,
+              "連続 200 文字以上の base64 らしき塊を検出しました。",
+              "エンコードされた指示・ペイロードの可能性があります。人間レビューで確認してください（advisory）。",
+            ),
+          );
+        }
+      }
+    }
+
+    return InjectionScanReport.create(findings);
+  }
+
+  private finding(
+    kind: InjectionFinding["kind"],
+    sourcePath: string,
+    lineNumber: number,
+    message: string,
+    suggestion: string,
+  ): InjectionFinding {
+    // INV-A: severity は必ず 'warning'。
+    return { kind, severity: "warning", sourcePath, lineNumber, message, suggestion };
+  }
+}

package/scripts/harness/validator-system/domain/value-objects/coverage-gating-report.ts

@@ -0,0 +1,67 @@
+// @unit validator-system
+// @layer domain
+// @work-item-id WI-258
+
+/**
+ * WI-258 / ADR-030 §Decision.3.② — coverage_report の attestation ゲート（L2-016）用ドメインモデル。
+ *
+ * coverage_report.md の ✅ 主張に attestation 参照（`<!-- @attestation <id> -->`）を要求する
+ * anti-laundering の value-object 群。L2 は参照の存在・形状のみを検証し（bare ✅ を fail-closed で遮断）、
+ * attestation レコードとの authoritative 突合は L3 が担う（ADR-030）。
+ */
+
+/** 1 件の ✅ 主張（AC が「達成」と主張する行）。 */
+export interface CoverageClaim {
+  /** ✅ を含む行番号（1 起点）。 */
+  readonly lineNumber: number;
+  /** 同一行 or 直前の連続コメント行に `@attestation` 参照があるか。 */
+  readonly hasAttestationRef: boolean;
+}
+
+/** 1 coverage_report ファイルの走査結果。 */
+export interface CoverageReportGatingModel {
+  readonly path: string;
+  /** `<!-- @coverage-gating: ungated-legacy -->` マーカー（ファイル全体免除）の有無。 */
+  readonly hasLegacyMarker: boolean;
+  readonly claims: readonly CoverageClaim[];
+}
+
+/** ゲート判定の 1 finding。 */
+export interface CoverageGatingFinding {
+  readonly severity: "error" | "warning";
+  readonly sourcePath: string;
+  readonly message: string;
+  readonly suggestion: string;
+}
+
+/**
+ * ゲート判定レポート。violations は fail-closed の error、warnings は legacy 可視化。
+ */
+export class CoverageGatingReport {
+  readonly violations: readonly CoverageGatingFinding[];
+  readonly warnings: readonly CoverageGatingFinding[];
+  readonly legacyCount: number;
+
+  private constructor(
+    violations: readonly CoverageGatingFinding[],
+    warnings: readonly CoverageGatingFinding[],
+    legacyCount: number,
+  ) {
+    this.violations = Object.freeze([...violations]);
+    this.warnings = Object.freeze([...warnings]);
+    this.legacyCount = legacyCount;
+    Object.freeze(this);
+  }
+
+  static create(
+    violations: readonly CoverageGatingFinding[],
+    warnings: readonly CoverageGatingFinding[],
+    legacyCount: number,
+  ): CoverageGatingReport {
+    return new CoverageGatingReport(violations, warnings, legacyCount);
+  }
+
+  hasViolations(): boolean {
+    return this.violations.length > 0;
+  }
+}