phasegate 0.191.0 → 0.222.0

package/scripts/harness/validator-system/composition-root.ts

@@ -6,77 +6,93 @@
  * @work-item-id WI-110 / WI-111 / WI-132 / WI-133 / WI-136 / WI-137 / WI-138 / WI-156
  * @work-item-id WI-217
  */
-import { ValidatorId } from './domain/value-objects/validator-id.js';
-import { ValidatorDefinition } from './domain/value-objects/validator-definition.js';
-import { ValidationRule } from './domain/value-objects/validation-rule.js';
-import { ValidatorRegistry } from './domain/services/validator-registry.js';
-import { ValidatorExecutionService } from './domain/services/validator-execution-service.js';
-import { ValidationResultContractMapper } from './application/mappers/validation-result-contract-mapper.js';
-import { RunL2ValidatorsUseCase } from './application/use-cases/run-l2-validators-usecase.js';
-import { RunL3ValidatorsUseCase } from './application/use-cases/run-l3-validators-usecase.js';
-import { RunL4ValidatorsUseCase } from './application/use-cases/run-l4-validators-usecase.js';
-import { RunL1ValidatorsUseCase } from './application/use-cases/run-l1-validators-usecase.js';
-import { RunQuickModeUseCase } from './application/use-cases/run-quick-mode-usecase.js';
-import { AggregateValidationResultsUseCase } from './application/use-cases/aggregate-validation-results-usecase.js';
-import { RunFullValidationUseCase } from './application/use-cases/run-full-validation-usecase.js';
-import { HarnessConfigValidatorConfigAdapter } from './infrastructure/adapters/harness-config-validator-config-adapter.js';
-import { ItTestFileAnalyzerAdapter } from './infrastructure/adapters/it-test-file-analyzer-adapter.js';
-import { SourceFileTextScannerAdapter } from './infrastructure/adapters/source-file-text-scanner-adapter.js';
-import { E2eTestFileRegistryAdapter } from './infrastructure/adapters/e2e-test-file-registry-adapter.js';
-import { CliCommandRegistryAdapter } from './infrastructure/adapters/cli-command-registry-adapter.js';
-import { TraceabilityWorkItemStatusPolicyAdapter } from './infrastructure/adapters/traceability-work-item-status-policy-adapter.js';
-import { FileSystemContractTraceabilityPolicyAdapter } from './infrastructure/adapters/file-system-contract-traceability-policy-adapter.js';
-import { PhaseDependencyPhaseGatePolicyAdapter } from './infrastructure/adapters/phase-dependency-phase-gate-policy-adapter.js';
-import { TraceabilityMetadataPolicyAdapter } from './infrastructure/adapters/traceability-metadata-policy-adapter.js';
-import { NyquistAcCoveragePolicyAdapter } from './infrastructure/adapters/nyquist-ac-coverage-policy-adapter.js';
-import { NyquistAcBoundCoveragePolicyAdapter } from './infrastructure/adapters/nyquist-ac-bound-coverage-policy-adapter.js';
-import { JsonCoverageReportAdapter } from './infrastructure/adapters/json-coverage-report-adapter.js';
-import { BiomeAstTestQualityAnalyzerAdapter } from './infrastructure/adapters/biome-ast-test-quality-analyzer-adapter.js';
-import { FileSystemSecurityPatternScannerAdapter } from './infrastructure/adapters/file-system-security-pattern-scanner-adapter.js';
-import { AstPerformanceScannerAdapter } from './infrastructure/adapters/ast-performance-scanner-adapter.js';
-import { MarkdownDesignDocumentAdapter } from './infrastructure/adapters/markdown-design-document-adapter.js';
-import { BiomeAstSourceCodeAnalyzerAdapter } from './infrastructure/adapters/biome-ast-source-code-analyzer-adapter.js';
-import { AdrFoundationReferenceAdapter } from './infrastructure/adapters/adr-foundation-reference-adapter.js';
-import { ImportGraphSourceAnalysisAdapter } from './infrastructure/adapters/import-graph-source-analysis-adapter.js';
-import { FileSystemArchitectureSemanticSourceAdapter } from './infrastructure/adapters/file-system-architecture-semantic-source-adapter.js';
-import { FileSystemSkillCatalogDriftAdapter } from './infrastructure/adapters/file-system-skill-catalog-drift-adapter.js';
-import { NyquistAcLevelTraceabilityAdapter } from './infrastructure/adapters/nyquist-ac-level-traceability-adapter.js';
-import { FileSystemWorkItemReflectionAdapter } from './infrastructure/adapters/file-system-work-item-reflection-adapter.js';
-import { DriftDetectionService } from './domain/services/l4/drift-detection-service.js';
-import { ConsistencyCheckService } from './domain/services/l4/consistency-check-service.js';
-import { DeadCodeDetectionService } from './domain/services/l4/dead-code-detection-service.js';
-import { ArchitectureSemanticAnalysisService, type ArchitectureSemanticPolicy } from './domain/services/l4/architecture-semantic-analysis-service.js';
-import { buildPhase2Extensions } from '../phase2-extensions/composition-root.js';
-import { RunValidatorsHandler } from './presentation/handlers/run-validators-handler.js';
-import { RunQuickModeHandler } from './presentation/handlers/run-quick-mode-handler.js';
-import { ReportValidationResultsHandler } from './presentation/handlers/report-validation-results-handler.js';
-import { join } from 'node:path';
+
+import { join } from "node:path";
+import { buildPhase2Extensions } from "../phase2-extensions/composition-root.js";
+import { ValidationResultContractMapper } from "./application/mappers/validation-result-contract-mapper.js";
+import { AggregateValidationResultsUseCase } from "./application/use-cases/aggregate-validation-results-usecase.js";
+import { RunFullValidationUseCase } from "./application/use-cases/run-full-validation-usecase.js";
+import { RunL1ValidatorsUseCase } from "./application/use-cases/run-l1-validators-usecase.js";
+import { RunL2ValidatorsUseCase } from "./application/use-cases/run-l2-validators-usecase.js";
+import { RunL3ValidatorsUseCase } from "./application/use-cases/run-l3-validators-usecase.js";
+import { RunL4ValidatorsUseCase } from "./application/use-cases/run-l4-validators-usecase.js";
+import { RunQuickModeUseCase } from "./application/use-cases/run-quick-mode-usecase.js";
+import {
+  ArchitectureSemanticAnalysisService,
+  type ArchitectureSemanticPolicy,
+} from "./domain/services/l4/architecture-semantic-analysis-service.js";
+import { ConsistencyCheckService } from "./domain/services/l4/consistency-check-service.js";
+import { DeadCodeDetectionService } from "./domain/services/l4/dead-code-detection-service.js";
+import { DriftDetectionService } from "./domain/services/l4/drift-detection-service.js";
+import { ValidatorExecutionService } from "./domain/services/validator-execution-service.js";
+import { ValidatorRegistry } from "./domain/services/validator-registry.js";
+import { ValidationRule } from "./domain/value-objects/validation-rule.js";
+import { ValidatorDefinition } from "./domain/value-objects/validator-definition.js";
+import { ValidatorId } from "./domain/value-objects/validator-id.js";
+import { AdrFoundationReferenceAdapter } from "./infrastructure/adapters/adr-foundation-reference-adapter.js";
+import { AstPerformanceScannerAdapter } from "./infrastructure/adapters/ast-performance-scanner-adapter.js";
+import { BiomeAstSourceCodeAnalyzerAdapter } from "./infrastructure/adapters/biome-ast-source-code-analyzer-adapter.js";
+import { BiomeAstTestQualityAnalyzerAdapter } from "./infrastructure/adapters/biome-ast-test-quality-analyzer-adapter.js";
+import { CliCommandRegistryAdapter } from "./infrastructure/adapters/cli-command-registry-adapter.js";
+import { E2eTestFileRegistryAdapter } from "./infrastructure/adapters/e2e-test-file-registry-adapter.js";
+import { FileSystemArchitectureSemanticSourceAdapter } from "./infrastructure/adapters/file-system-architecture-semantic-source-adapter.js";
+import { FileSystemContractTraceabilityPolicyAdapter } from "./infrastructure/adapters/file-system-contract-traceability-policy-adapter.js";
+import { FileSystemCoverageAttestationGatingAdapter } from "./infrastructure/adapters/file-system-coverage-attestation-gating-adapter.js";
+import { FileSystemCoverageAttestationVerificationAdapter } from "./infrastructure/adapters/file-system-coverage-attestation-verification-adapter.js";
+import { FileSystemInjectionScanAdapter } from "./infrastructure/adapters/file-system-injection-scan-adapter.js";
+import { FileSystemSecurityPatternScannerAdapter } from "./infrastructure/adapters/file-system-security-pattern-scanner-adapter.js";
+import { FileSystemSkillCatalogDriftAdapter } from "./infrastructure/adapters/file-system-skill-catalog-drift-adapter.js";
+import { FileSystemWorkItemReflectionAdapter } from "./infrastructure/adapters/file-system-work-item-reflection-adapter.js";
+import { HarnessConfigValidatorConfigAdapter } from "./infrastructure/adapters/harness-config-validator-config-adapter.js";
+import { ImportGraphSourceAnalysisAdapter } from "./infrastructure/adapters/import-graph-source-analysis-adapter.js";
+import { ItTestFileAnalyzerAdapter } from "./infrastructure/adapters/it-test-file-analyzer-adapter.js";
+import { JsonCoverageReportAdapter } from "./infrastructure/adapters/json-coverage-report-adapter.js";
+import { MarkdownDesignDocumentAdapter } from "./infrastructure/adapters/markdown-design-document-adapter.js";
+import { NyquistAcBoundCoveragePolicyAdapter } from "./infrastructure/adapters/nyquist-ac-bound-coverage-policy-adapter.js";
+import { NyquistAcCoveragePolicyAdapter } from "./infrastructure/adapters/nyquist-ac-coverage-policy-adapter.js";
+import { NyquistAcLevelTraceabilityAdapter } from "./infrastructure/adapters/nyquist-ac-level-traceability-adapter.js";
+import { PhaseDependencyPhaseGatePolicyAdapter } from "./infrastructure/adapters/phase-dependency-phase-gate-policy-adapter.js";
+import { SourceFileTextScannerAdapter } from "./infrastructure/adapters/source-file-text-scanner-adapter.js";
+import { TraceabilityMetadataPolicyAdapter } from "./infrastructure/adapters/traceability-metadata-policy-adapter.js";
+import { TraceabilityWorkItemStatusPolicyAdapter } from "./infrastructure/adapters/traceability-work-item-status-policy-adapter.js";
+import { ReportValidationResultsHandler } from "./presentation/handlers/report-validation-results-handler.js";
+import { RunQuickModeHandler } from "./presentation/handlers/run-quick-mode-handler.js";
+import { RunValidatorsHandler } from "./presentation/handlers/run-validators-handler.js";
 
 /** デフォルト設定（ハードコード fallback） */
 const DEFAULT_CONFIG = {
-  preset: 'standard' as const,
+  preset: "standard" as const,
   layers: {
-    L2: { enabled: true, validators: ['L2-001', 'L2-002', 'L2-003', 'L2-013', 'L2-014', 'L2-015'] },
-    L3: { enabled: true, validators: ['L3-001', 'L3-002', 'L3-003', 'L3-004'], coverageThreshold: 90, bundleSizeLimit: 512000, requirementMatrixPath: '.harness/requirement-test-matrix.json' },
-    L4: { enabled: true, validators: ['L4-001', 'L4-002', 'L4-003', 'L4-004', 'L4-005', 'L4-006'] },
+    L2: { enabled: true, validators: ["L2-001", "L2-002", "L2-003", "L2-013", "L2-014", "L2-015", "L2-016"] },
+    L3: {
+      enabled: true,
+      validators: ["L3-001", "L3-002", "L3-003", "L3-004", "L3-006", "L3-007"],
+      coverageThreshold: 90,
+      bundleSizeLimit: 512000,
+      requirementMatrixPath: ".harness/requirement-test-matrix.json",
+    },
+    L4: { enabled: true, validators: ["L4-001", "L4-002", "L4-003", "L4-004", "L4-005", "L4-006"] },
   },
   paths: {
-    designDocs: 'docs/product/construction',
-    inceptionDocs: 'docs/inception',
+    designDocs: "docs/product/construction",
+    inceptionDocs: "docs/inception",
   },
   validate: { failOnWarning: false },
   architecture: {
     capabilityPolicies: {
-      domain: { allowed: [], denied: ['filesystem', 'network', 'database', 'process-env', 'subprocess', 'user-io'] },
-      application: { allowed: ['time', 'random'], denied: ['filesystem', 'network', 'database', 'subprocess'] },
-      infrastructure: { allowed: ['filesystem', 'network', 'database', 'process-env', 'time', 'random', 'subprocess', 'user-io'], denied: [] },
-      presentation: { allowed: ['user-io', 'time'], denied: ['database', 'subprocess'] },
+      domain: { allowed: [], denied: ["filesystem", "network", "database", "process-env", "subprocess", "user-io"] },
+      application: { allowed: ["time", "random"], denied: ["filesystem", "network", "database", "subprocess"] },
+      infrastructure: {
+        allowed: ["filesystem", "network", "database", "process-env", "time", "random", "subprocess", "user-io"],
+        denied: [],
+      },
+      presentation: { allowed: ["user-io", "time"], denied: ["database", "subprocess"] },
     },
     decisionPolicies: {
-      domain: { expected: ['business-rule-branch', 'validation-rule', 'state-transition'], advisoryOnly: true },
-      application: { expected: ['policy-selection', 'error-construction'], advisoryOnly: true },
-      infrastructure: { expected: ['error-construction'], advisoryOnly: true },
-      presentation: { expected: ['validation-rule', 'error-construction'], advisoryOnly: true },
+      domain: { expected: ["business-rule-branch", "validation-rule", "state-transition"], advisoryOnly: true },
+      application: { expected: ["policy-selection", "error-construction"], advisoryOnly: true },
+      infrastructure: { expected: ["error-construction"], advisoryOnly: true },
+      presentation: { expected: ["validation-rule", "error-construction"], advisoryOnly: true },
     },
   },
 };
@@ -84,47 +100,61 @@ const DEFAULT_CONFIG = {
 /** バリデータ定義カタログ */
 export function buildDefaultRegistry(): ValidatorRegistry {
   const defaultRule = ValidationRule.create({
-    ruleName: 'default-rule',
-    errorTemplate: { code: 'L2-001', severity: 'error', messageTemplate: '{{message}}' },
+    ruleName: "default-rule",
+    errorTemplate: { code: "L2-001", severity: "error", messageTemplate: "{{message}}" },
     fixExample: null,
   });
 
-  const createDef = (id: string, layer: 'L2' | 'L3' | 'L4', enabledCondition: 'always' | 'strictOnly' = 'always', externalPolicyRef: string | null = null) =>
+  const createDef = (
+    id: string,
+    layer: "L2" | "L3" | "L4",
+    enabledCondition: "always" | "strictOnly" = "always",
+    externalPolicyRef: string | null = null,
+  ) =>
     ValidatorDefinition.create({
       validatorId: ValidatorId.create(id),
       layer,
-      rules: [ValidationRule.create({
-        ruleName: `${id}-rule`,
-        errorTemplate: { code: id, severity: 'error', messageTemplate: '{{message}}' },
-        fixExample: null,
-      })],
+      rules: [
+        ValidationRule.create({
+          ruleName: `${id}-rule`,
+          errorTemplate: { code: id, severity: "error", messageTemplate: "{{message}}" },
+          fixExample: null,
+        }),
+      ],
       enabledCondition,
       externalPolicyRef,
     });
 
   const definitions = [
-    createDef('L2-001', 'L2', 'always', 'PhaseGatePolicyPort'),
-    createDef('L2-002', 'L2', 'always', 'MetadataPolicyPort'),
-    createDef('L2-003', 'L2', 'always'),
-    createDef('L2-013', 'L2', 'always', 'CliE2eTestExistenceService'),
-    createDef('L2-014', 'L2', 'always', 'WorkItemStatusPolicyPort'),
-    createDef('L2-015', 'L2', 'always', 'ContractTraceabilityPolicyPort'),
-    createDef('L3-001', 'L3', 'always'),
-    createDef('L3-002', 'L3', 'strictOnly'),
-    createDef('L3-003', 'L3', 'always'),
-    createDef('L3-004', 'L3', 'always', 'AcCoveragePolicyPort'),
+    createDef("L2-001", "L2", "always", "PhaseGatePolicyPort"),
+    createDef("L2-002", "L2", "always", "MetadataPolicyPort"),
+    createDef("L2-003", "L2", "always"),
+    createDef("L2-013", "L2", "always", "CliE2eTestExistenceService"),
+    createDef("L2-014", "L2", "always", "WorkItemStatusPolicyPort"),
+    createDef("L2-015", "L2", "always", "ContractTraceabilityPolicyPort"),
+    // WI-258 / ADR-030 §Decision.3.②: L2-016 (coverage-attestation-gating, fail-closed, default-ON)。
+    createDef("L2-016", "L2", "always", "CoverageAttestationGatingPolicyPort"),
+    createDef("L3-001", "L3", "always"),
+    createDef("L3-002", "L3", "strictOnly"),
+    createDef("L3-003", "L3", "always"),
+    createDef("L3-004", "L3", "always", "AcCoveragePolicyPort"),
     // WI-227 / H16-03: L3-005 (ac-bound-coverage) は registry には登録するが
     // default-OFF（DEFAULT_CONFIG.layers.L3.validators に含めない）。fail-closed / opt-in。
-    createDef('L3-005', 'L3', 'always', 'AcBoundCoveragePolicyPort'),
-    createDef('L4-001', 'L4', 'always'),
-    createDef('L4-002', 'L4', 'always'),
-    createDef('L4-003', 'L4', 'strictOnly'),
-    createDef('L4-004', 'L4', 'always'),
-    createDef('L4-005', 'L4', 'always'),
-    createDef('L4-006', 'L4', 'always', 'SkillCatalogDriftPort'),
+    createDef("L3-005", "L3", "always", "AcBoundCoveragePolicyPort"),
+    // WI-259 / ADR-030 §Decision.3.④: L3-006 (injection-scan) は advisory (warning-only, default-ON)。
+    createDef("L3-006", "L3", "always", "InjectionScanPolicyPort"),
+    // WI-268 / ADR-030 §Decision.1・§Decision.3.② 第2段: L3-007 (coverage-attestation-verification)
+    // は fail-closed / default-ON。L2-016 の authoritative 相棒。
+    createDef("L3-007", "L3", "always", "CoverageAttestationVerificationPolicyPort"),
+    createDef("L4-001", "L4", "always"),
+    createDef("L4-002", "L4", "always"),
+    createDef("L4-003", "L4", "strictOnly"),
+    createDef("L4-004", "L4", "always"),
+    createDef("L4-005", "L4", "always"),
+    createDef("L4-006", "L4", "always", "SkillCatalogDriftPort"),
     // WI-222 / HF2-05: L4-007 (ac-level-traceability) は registry には登録するが
     // default-OFF（DEFAULT_CONFIG.layers.L4.validators に含めない）。advisory-only。
-    createDef('L4-007', 'L4', 'always', 'AcLevelTraceabilityPort'),
+    createDef("L4-007", "L4", "always", "AcLevelTraceabilityPort"),
   ];
 
   return new ValidatorRegistry(definitions);
@@ -162,26 +192,47 @@ export function createValidatorSystemModule(config?: object): ValidatorSystemMod
   const acBoundCoveragePolicyPort = new NyquistAcBoundCoveragePolicyAdapter();
   // L3-003: テストカバレッジレポート（vitest --coverage の json-summary 出力）を読み取る。
   // 未配線だと L3-003 は装飾的な pass になり 90% 閾値が形骸化するため必ず配線する。
-  const coverageReportPort = new JsonCoverageReportAdapter(
-    join(process.cwd(), 'coverage', 'coverage-summary.json'),
-  );
+  const coverageReportPort = new JsonCoverageReportAdapter(join(process.cwd(), "coverage", "coverage-summary.json"));
   const testQualityAnalyzerPort = new BiomeAstTestQualityAnalyzerAdapter();
   const securityScannerPort = new FileSystemSecurityPatternScannerAdapter();
   const performanceScannerPort = new AstPerformanceScannerAdapter();
   const workItemStatusPolicyPort = new TraceabilityWorkItemStatusPolicyAdapter(process.cwd());
   const contractTraceabilityPolicyPort = new FileSystemContractTraceabilityPolicyAdapter();
+  // WI-258 / ADR-030 §Decision.3.②: L2-016 (coverage-attestation-gating) 用アダプタ。
+  // docs/product/construction/*​/coverage_report.md を cwd 起点で走査する（targetPaths 非依存）。
+  const coverageAttestationGatingPolicyPort = new FileSystemCoverageAttestationGatingAdapter(process.cwd());
+  // WI-259 / ADR-030 §Decision.3.④: L3-006 (injection-scan, advisory) 用アダプタ。
+  // 指示搭載ファイル群（skills/**​/SKILL.md / CLAUDE.md / AGENTS.md / agent-context / .claude/settings.json）を
+  // cwd 起点で走査する（targetPaths 非依存）。
+  const injectionScanPolicyPort = new FileSystemInjectionScanAdapter(process.cwd());
+  // WI-268 / ADR-030 §Decision.1・§Decision.3.② 第2段: L3-007 (coverage-attestation-verification) 用アダプタ。
+  // coverage_report の @attestation 参照を requirement-test-matrix に突合する（fail-closed）。
+  const coverageAttestationVerificationPolicyPort = new FileSystemCoverageAttestationVerificationAdapter(
+    process.cwd(),
+    (configData.layers?.L3 as { requirementMatrixPath?: string } | undefined)?.requirementMatrixPath ??
+      ".harness/requirement-test-matrix.json",
+  );
 
   const cwd = process.cwd();
-  const designDocsRoot = configData.paths?.designDocs ?? 'docs/product/construction';
-  const inceptionDocsRoot = configData.paths?.inceptionDocs ?? 'docs/inception';
+  const designDocsRoot = configData.paths?.designDocs ?? "docs/product/construction";
+  const inceptionDocsRoot = configData.paths?.inceptionDocs ?? "docs/inception";
   const docsRoot = join(cwd, designDocsRoot);
-  const e2eTestFileRegistryPort = new E2eTestFileRegistryAdapter({ e2eTestRoot: join(cwd, 'scripts/harness/__tests__/e2e') });
+  const e2eTestFileRegistryPort = new E2eTestFileRegistryAdapter({
+    e2eTestRoot: join(cwd, "scripts/harness/__tests__/e2e"),
+  });
   const cliCommandRegistryPort = new CliCommandRegistryAdapter({
     commands: [
-      'validate', 'lint', 'ci-check',
-      'phasegate:check-ready', 'phasegate:check-phase', 'phasegate:ci-check',
-      'phasegate:detect-drift', 'phasegate:lint', 'phasegate:complete-check',
-      'phasegate:impact-analysis', 'phasegate:status',
+      "validate",
+      "lint",
+      "ci-check",
+      "phasegate:check-ready",
+      "phasegate:check-phase",
+      "phasegate:ci-check",
+      "phasegate:detect-drift",
+      "phasegate:lint",
+      "phasegate:complete-check",
+      "phasegate:impact-analysis",
+      "phasegate:status",
     ],
   });
 
@@ -197,6 +248,7 @@ export function createValidatorSystemModule(config?: object): ValidatorSystemMod
     cliCommandRegistryPort,
     workItemStatusPolicyPort,
     contractTraceabilityPolicyPort,
+    coverageAttestationGatingPolicyPort,
   });
 
   // WI-227 / H16-03: L3-005 のスコープ対象 story-id を config から取得（既定 []）。
@@ -213,19 +265,21 @@ export function createValidatorSystemModule(config?: object): ValidatorSystemMod
     coverageReportPort,
     securityScannerPort,
     performanceScannerPort,
+    injectionScanPolicyPort,
+    coverageAttestationVerificationPolicyPort,
     acBoundStories,
   });
 
   const markdownDesignDocumentPort = new MarkdownDesignDocumentAdapter(docsRoot);
   const sourceCodeAnalyzerAdapter = new BiomeAstSourceCodeAnalyzerAdapter();
-  const adrReferencePort = new AdrFoundationReferenceAdapter();
+  const adrReferencePort = new AdrFoundationReferenceAdapter(cwd);
   const sourceAnalysisPort = new ImportGraphSourceAnalysisAdapter();
   const architectureSemanticSourcePort = new FileSystemArchitectureSemanticSourceAdapter();
   const skillCatalogDriftPort = new FileSystemSkillCatalogDriftAdapter(cwd);
   // WI-222 / HF2-05: L4-007 (advisory) 用の AC 単位トレーサビリティ port。
   // matrix path は L3-004 と同じ config キーを参照する。
   const acLevelTraceabilityPort = new NyquistAcLevelTraceabilityAdapter({
-    matrixFilePath: configData.layers?.L3?.requirementMatrixPath ?? '.harness/requirement-test-matrix.json',
+    matrixFilePath: configData.layers?.L3?.requirementMatrixPath ?? ".harness/requirement-test-matrix.json",
   });
   const workItemReflectionPort = new FileSystemWorkItemReflectionAdapter(cwd);
 
@@ -275,11 +329,11 @@ export function createValidatorSystemModule(config?: object): ValidatorSystemMod
 
   const aggregateValidationResultsUseCase = new AggregateValidationResultsUseCase();
   const itTestFileAnalyzerPort = new ItTestFileAnalyzerAdapter({
-    itTestRoot: join(cwd, 'scripts/harness/__tests__/integration'),
+    itTestRoot: join(cwd, "scripts/harness/__tests__/integration"),
     // アダプター自体のテストファイルは vi.mock() を使用しているため誤検知防止で除外
     excludePattern: /it-test-file-analyzer-adapter\.test\.ts$/,
   });
-  const sourceFileTextScannerPort = new SourceFileTextScannerAdapter({ sourceRoot: join(cwd, 'scripts/harness') });
+  const sourceFileTextScannerPort = new SourceFileTextScannerAdapter({ sourceRoot: join(cwd, "scripts/harness") });
   const runL1ValidatorsUseCase = new RunL1ValidatorsUseCase({
     itTestFileAnalyzerPort,
     sourceFileTextScannerPort,

package/scripts/harness/validator-system/domain/ports/coverage-attestation-gating-policy-port.ts

@@ -0,0 +1,14 @@
+// @unit validator-system
+// @layer domain
+// @work-item-id WI-258
+
+import type { CoverageReportGatingModel } from "../value-objects/coverage-gating-report.js";
+
+/**
+ * WI-258 / ADR-030 §Decision.3.② — coverage_report 走査結果の供給ポート。
+ * 走査対象（docs/product/construction/*​/coverage_report.md）の解決は infrastructure が担う
+ * （cwd 起点・targetPaths 非依存の corpus 走査）。
+ */
+export interface CoverageAttestationGatingPolicyPort {
+  collect(): Promise<readonly CoverageReportGatingModel[]>;
+}

package/scripts/harness/validator-system/domain/ports/coverage-attestation-verification-policy-port.ts

@@ -0,0 +1,30 @@
+// @unit validator-system
+// @layer domain
+// @work-item-id WI-268
+
+import type {
+  AttestationReference,
+  AttestationScopeEvidence,
+} from "../value-objects/attestation-verification-report.js";
+
+/**
+ * WI-268 / ADR-030 §Decision.1・§Decision.3.②（第2段） — L3-007 の走査・解決結果供給ポート。
+ *
+ * 参照走査（ungated-legacy 免除込み）と matrix 由来の解決可能スコープ解決は infrastructure が担う
+ * （cwd 起点・targetPaths 非依存の corpus 走査）。
+ */
+export interface CoverageAttestationVerificationCollectResult {
+  /** ungated-legacy を除いた coverage_report から抽出した attestation 参照。 */
+  readonly references: readonly AttestationReference[];
+  /** matrix 由来の解決可能スコープ。references が空のときは空集合でよい（matrix 未読）。 */
+  readonly evidence: AttestationScopeEvidence;
+  /**
+   * 参照ありで matrix を読めなかった fail-closed シグナル。
+   * null なら matrix 読み込みは問題なし（または参照 0 件で matrix 未読）。
+   */
+  readonly matrixError: string | null;
+}
+
+export interface CoverageAttestationVerificationPolicyPort {
+  collect(): Promise<CoverageAttestationVerificationCollectResult>;
+}

package/scripts/harness/validator-system/domain/ports/injection-scan-policy-port.ts

@@ -0,0 +1,14 @@
+// @unit validator-system
+// @layer domain
+// @work-item-id WI-259
+
+import type { InjectionScanTarget } from "../value-objects/injection-scan-report.js";
+
+/**
+ * WI-259 / ADR-030 §Decision.3.④ — 指示搭載ファイルの供給ポート。
+ * 走査対象（skills/**​/SKILL.md / CLAUDE.md / AGENTS.md / docs/templates/agent-context/** /
+ * .claude/settings.json）の解決は infrastructure が担う（cwd 起点・targetPaths 非依存の corpus 走査）。
+ */
+export interface InjectionScanPolicyPort {
+  collect(): Promise<readonly InjectionScanTarget[]>;
+}

package/scripts/harness/validator-system/domain/services/coverage-attestation-gating-service.ts

@@ -0,0 +1,56 @@
+// @unit validator-system
+// @layer domain
+// @work-item-id WI-258
+
+/**
+ * WI-258 / ADR-030 §Decision.3.② — coverage-attestation-gating (L2-016) の判定ドメインサービス。
+ *
+ * INV-A: hasLegacyMarker のファイルは error を生成せず legacyCount に計上し warning を 1 件生成（見える負債）。
+ * INV-B: マーカー無しファイルで attestation 参照を持たない ✅ claim は error violation（fail-closed）。
+ * INV-C: ✅ を持たないファイルは violation も warning も生成しない（対象外）。
+ */
+
+import {
+  type CoverageGatingFinding,
+  CoverageGatingReport,
+  type CoverageReportGatingModel,
+} from "../value-objects/coverage-gating-report.js";
+
+export class CoverageAttestationGatingService {
+  check(models: readonly CoverageReportGatingModel[]): CoverageGatingReport {
+    const violations: CoverageGatingFinding[] = [];
+    const warnings: CoverageGatingFinding[] = [];
+    let legacyCount = 0;
+
+    for (const model of models) {
+      if (model.hasLegacyMarker) {
+        // INV-A: 免除だが可視化。claim の有無に関わらず legacy として計上する
+        // （マーカーは「このファイルはまだゲートされていない負債」の宣言であるため）。
+        legacyCount += 1;
+        warnings.push({
+          severity: "warning",
+          sourcePath: model.path,
+          message: `ungated-legacy coverage_report (attestation ゲート未適用の負債): ${model.path}`,
+          suggestion:
+            "各 ✅ 主張に <!-- @attestation <id> --> を付与し、@coverage-gating: ungated-legacy マーカーを除去して段階返済すること。",
+        });
+        continue;
+      }
+
+      // INV-B / INV-C: マーカー無しファイルの各 ✅ claim を検査する。
+      for (const claim of model.claims) {
+        if (!claim.hasAttestationRef) {
+          violations.push({
+            severity: "error",
+            sourcePath: model.path,
+            message: `${model.path}:${claim.lineNumber} の ✅ 主張に attestation 参照がありません（bare ✅ は fail-closed）。`,
+            suggestion:
+              "✅ 主張に <!-- @attestation <id> --> を付与するか、未返済なら <!-- @coverage-gating: ungated-legacy --> マーカーで免除（負債可視化）すること。",
+          });
+        }
+      }
+    }
+
+    return CoverageGatingReport.create(violations, warnings, legacyCount);
+  }
+}

package/scripts/harness/validator-system/domain/services/coverage-attestation-verification-service.ts

@@ -0,0 +1,45 @@
+// @unit validator-system
+// @layer domain
+// @work-item-id WI-268
+
+/**
+ * WI-268 / ADR-030 §Decision.1・§Decision.3.②（第2段） — coverage-attestation-verification
+ * (L3-007) の突合ドメインサービス。
+ *
+ * INV-A: 各 reference の id が evidence.resolvableScopeIds に含まれなければ error finding を生成
+ *        （fail-closed。空手形の attestation を遮断）。
+ * INV-B: references が空なら report は空（検査対象なし → pass）。
+ * INV-C: 生成 finding は必ず severity='error'（advisory ではなく blocking tier）。
+ */
+
+import {
+  type AttestationReference,
+  type AttestationScopeEvidence,
+  type AttestationVerificationFinding,
+  AttestationVerificationReport,
+} from "../value-objects/attestation-verification-report.js";
+
+export class CoverageAttestationVerificationService {
+  verify(
+    references: readonly AttestationReference[],
+    evidence: AttestationScopeEvidence,
+  ): AttestationVerificationReport {
+    const findings: AttestationVerificationFinding[] = [];
+
+    for (const reference of references) {
+      // INV-A: matrix 由来の解決可能スコープに存在しない参照は fail-closed の error。
+      if (!evidence.resolvableScopeIds.has(reference.id)) {
+        findings.push({
+          severity: "error",
+          sourcePath: reference.sourcePath,
+          lineNumber: reference.lineNumber,
+          message: `${reference.sourcePath}:${reference.lineNumber} の @attestation "${reference.id}" は requirement-test-matrix 上のテスト参照に解決できません（空手形 attestation は fail-closed）。`,
+          suggestion:
+            "@attestation <id> の id を、matrix 上に存在し testReferences を 1 件以上持つ story-id にしてください（phasegate:generate-matrix で最新化）。返済前なら <!-- @coverage-gating: ungated-legacy --> マーカーで免除（負債可視化）すること。",
+        });
+      }
+    }
+
+    return AttestationVerificationReport.create(findings);
+  }
+}