phasegate 0.229.0 → 0.264.0

package/scripts/harness/attestation/application/usecases/produce-attestation-usecase.ts

@@ -1,23 +1,28 @@
 // @unit attestation
 // @layer application
+// @work-item-id WI-306
 
 import { AttestationRecord, type GateResult, type SourceEntry } from "../../domain/entities/attestation-record.js";
 import type { ContentHasherPort } from "../../domain/ports/content-hasher-port.js";
-import type { GranularityDerivationService } from "../../domain/services/granularity-derivation-service.js";
 import type { AcBoundScopeService } from "../../domain/services/ac-bound-scope-service.js";
+import type { GranularityDerivationService } from "../../domain/services/granularity-derivation-service.js";
+import { Digest } from "../../domain/value-objects/digest.js";
 import { SignatureBlock } from "../../domain/value-objects/signature-block.js";
 import { ValidatorOutcome } from "../../domain/value-objects/validator-outcome.js";
 import type { AttestationDocument } from "../dto/attestation-document.js";
 import type { ProduceAttestationInput } from "../dto/produce-attestation-input.js";
 import type { AttestationRecordMapper } from "../mappers/attestation-record-mapper.js";
+import type { AcBoundAllowlistPort } from "../ports/ac-bound-allowlist-port.js";
 import type { AttestationRepositoryPort } from "../ports/attestation-repository-port.js";
 import type { GateResultSourcePort } from "../ports/gate-result-source-port.js";
-import type { SourceDigesterPort } from "../ports/source-digester-port.js";
 import type { MatrixSourcePort } from "../ports/matrix-source-port.js";
-import type { AcBoundAllowlistPort } from "../ports/ac-bound-allowlist-port.js";
+import type { SourceDigesterPort } from "../ports/source-digester-port.js";
+import type { WorldSnapshotRootProvider } from "../ports/world-snapshot-root-provider.js";
 
-const SCHEMA_VERSION = "phasegate-attestation/v1";
-const PREDICATE_TYPE = "https://phasegate.dev/attestation/gate-run/v1";
+const V1_SCHEMA_VERSION = "phasegate-attestation/v1";
+const V1_PREDICATE_TYPE = "https://phasegate.dev/attestation/gate-run/v1";
+const V2_SCHEMA_VERSION = "phasegate-attestation/v2";
+const V2_PREDICATE_TYPE = "https://phasegate.dev/attestation/gate-run/v2";
 const DEFAULT_INPUT_SOURCES: readonly string[] = Object.freeze([
   "phasegate.config.json",
   ".harness/requirement-test-matrix.json",
@@ -46,11 +51,14 @@ export interface ProduceAttestationDeps {
   readonly acBoundScopeService?: AcBoundScopeService;
   /** H16-03: matrix 供給元パス（inputSourcePaths のうち matrix にあたるもの。既定は 2 番目の source）。 */
   readonly matrixFilePath?: string;
+  /** WI-306: 配線時はv2、未配線時は既存v1を生成する。 */
+  readonly worldSnapshotRootProvider?: WorldSnapshotRootProvider;
 }
 
 export interface ProduceAttestationResult {
   readonly document: AttestationDocument | null;
   readonly exitCode: 0 | 1 | 2;
+  readonly error?: string;
 }
 
 /**
@@ -77,6 +85,20 @@ export class ProduceAttestationUseCase {
       return { document: null, exitCode: 1 };
     }
 
+    // 3b. World root providerはv2 opt-in。失敗や不正digestをv1へdowngradeしない。
+    let worldSnapshotRoot: Digest | undefined;
+    if (this.deps.worldSnapshotRootProvider) {
+      try {
+        worldSnapshotRoot = Digest.create(await this.deps.worldSnapshotRootProvider.getWorldSnapshotRoot());
+      } catch (error) {
+        return {
+          document: null,
+          exitCode: 2,
+          error: `cannot obtain worldSnapshotRoot: ${error instanceof Error ? error.message : String(error)}`,
+        };
+      }
+    }
+
     // 4. inputs.sources 構築（config / matrix の sha256 + git commit SHA）と inputDigest 算出
     const sources = await this.buildSources();
     const preInputRecord = this.assembleRecord({
@@ -88,6 +110,7 @@ export class ProduceAttestationUseCase {
       producer: `phasegate-attestation/${this.deps.pkgVersion}`,
       gitCommit: null,
       acBoundScope: [],
+      worldSnapshotRoot,
     });
     const inputDigest = preInputRecord.computeInputDigest(this.deps.hasher);
 
@@ -110,6 +133,7 @@ export class ProduceAttestationUseCase {
       producer: `phasegate-attestation/${this.deps.pkgVersion}`,
       gitCommit,
       acBoundScope,
+      worldSnapshotRoot,
     });
     const sealed = record.seal(this.deps.hasher);
 
@@ -130,11 +154,12 @@ export class ProduceAttestationUseCase {
     producer: string;
     gitCommit: string | null;
     acBoundScope: readonly string[];
+    worldSnapshotRoot?: Digest;
   }): AttestationRecord {
     const granularity = this.deps.granularityService.derive(args.validatorSet);
     return AttestationRecord.create({
-      schemaVersion: SCHEMA_VERSION,
-      predicateType: PREDICATE_TYPE,
+      schemaVersion: args.worldSnapshotRoot ? V2_SCHEMA_VERSION : V1_SCHEMA_VERSION,
+      predicateType: args.worldSnapshotRoot ? V2_PREDICATE_TYPE : V1_PREDICATE_TYPE,
       subject: {
         command: "phasegate:ci-check",
         gateResult: args.gateResult,
@@ -154,6 +179,7 @@ export class ProduceAttestationUseCase {
       // 仮の unsigned-poc block（seal 前）。seal が正しい digest で置換する。
       signature: SignatureBlock.unsignedPoc(args.inputDigest),
       acBoundScope: args.acBoundScope,
+      ...(args.worldSnapshotRoot ? { worldSnapshotRoot: args.worldSnapshotRoot } : {}),
     });
   }
 

package/scripts/harness/attestation/composition-root.ts

@@ -1,6 +1,7 @@
 /**
  * @layer infrastructure
  * @unit attestation
+ * @work-item-id WI-306
  *
  * Composition Root — attestation Unit の依存性組み立て。
  * createAttestationModule() は adapters + usecases + handlers を組み立て、
@@ -10,16 +11,19 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { AttestationRecordMapper } from "./application/mappers/attestation-record-mapper.js";
+import type { Sha256Capability } from "./application/ports/sha256-capability.js";
+import type { WorldSnapshotRootProvider } from "./application/ports/world-snapshot-root-provider.js";
 import { ProduceAttestationUseCase } from "./application/usecases/produce-attestation-usecase.js";
 import { VerifyAttestationUseCase } from "./application/usecases/verify-attestation-usecase.js";
-import { GranularityDerivationService } from "./domain/services/granularity-derivation-service.js";
 import { AcBoundScopeService } from "./domain/services/ac-bound-scope-service.js";
+import { GranularityDerivationService } from "./domain/services/granularity-derivation-service.js";
 import { CiCheckGateResultAdapter } from "./infrastructure/adapters/ci-check-gate-result-adapter.js";
+import { ConfigAcBoundAllowlistAdapter } from "./infrastructure/adapters/config-ac-bound-allowlist-adapter.js";
 import { FileSystemAttestationRepositoryAdapter } from "./infrastructure/adapters/file-system-attestation-repository-adapter.js";
-import { FileSystemSourceDigesterAdapter } from "./infrastructure/adapters/file-system-source-digester-adapter.js";
 import { FileSystemMatrixSourceAdapter } from "./infrastructure/adapters/file-system-matrix-source-adapter.js";
-import { ConfigAcBoundAllowlistAdapter } from "./infrastructure/adapters/config-ac-bound-allowlist-adapter.js";
+import { FileSystemSourceDigesterAdapter } from "./infrastructure/adapters/file-system-source-digester-adapter.js";
 import { NodeCryptoContentHasherAdapter } from "./infrastructure/adapters/node-crypto-content-hasher-adapter.js";
+import { NodeCryptoSha256Capability } from "./infrastructure/adapters/node-crypto-sha256-capability.js";
 import { AttestHandler } from "./presentation/handlers/attest-handler.js";
 import { VerifyAttestationHandler } from "./presentation/handlers/verify-attestation-handler.js";
 
@@ -39,6 +43,15 @@ export interface AttestationModuleOptions {
   readonly mainTsPath?: string;
   /** metadata.producedAt 用クロックのオーバーライド（テスト用）。 */
   readonly clock?: () => Date;
+  /** WI-306: 配線時はv2 recordへplain World corpus rootを注入する。 */
+  readonly worldSnapshotRootProvider?: WorldSnapshotRootProvider;
+}
+
+/**
+ * Unit非依存のplain SHA-256 public capabilityを生成する。
+ */
+export function createSha256Capability(): Sha256Capability {
+  return new NodeCryptoSha256Capability();
 }
 
 /**
@@ -47,7 +60,8 @@ export interface AttestationModuleOptions {
  */
 export function createAttestationModule(rootDir: string, options?: AttestationModuleOptions): AttestationModule {
   // Infrastructure adapters
-  const hasher = new NodeCryptoContentHasherAdapter();
+  const sha256Capability = createSha256Capability();
+  const hasher = new NodeCryptoContentHasherAdapter(sha256Capability);
   const sourceDigester = new FileSystemSourceDigesterAdapter(rootDir);
   const gateResultSource = new CiCheckGateResultAdapter({ mainTsPath: options?.mainTsPath });
   const repository = new FileSystemAttestationRepositoryAdapter(rootDir);
@@ -77,6 +91,7 @@ export function createAttestationModule(rootDir: string, options?: AttestationMo
     matrixSource,
     allowlist,
     acBoundScopeService,
+    worldSnapshotRootProvider: options?.worldSnapshotRootProvider,
   });
   const verifyUseCase = new VerifyAttestationUseCase({
     repository,

package/scripts/harness/attestation/domain/entities/attestation-record.ts

@@ -1,5 +1,6 @@
 // @unit attestation
 // @layer domain
+// @work-item-id WI-306
 
 import type { ContentHasherPort } from "../ports/content-hasher-port.js";
 import { GranularityDerivationService } from "../services/granularity-derivation-service.js";
@@ -47,6 +48,8 @@ export interface AttestationRecordProps {
    * 省略時は [] として扱う（additive-safe）。
    */
   readonly acBoundScope?: readonly string[];
+  /** v2だけが持つ実行時World corpus root。 */
+  readonly worldSnapshotRoot?: Digest;
 }
 
 /**
@@ -94,6 +97,7 @@ export class AttestationRecord {
   readonly metadata: MetadataSection;
   readonly signature: SignatureBlock;
   readonly acBoundScope: readonly string[];
+  readonly worldSnapshotRoot: Digest | null;
 
   private constructor(props: AttestationRecordProps) {
     this.schemaVersion = props.schemaVersion;
@@ -104,10 +108,12 @@ export class AttestationRecord {
     this.metadata = props.metadata;
     this.signature = props.signature;
     this.acBoundScope = Object.freeze([...(props.acBoundScope ?? [])]);
+    this.worldSnapshotRoot = props.worldSnapshotRoot ?? null;
     Object.freeze(this);
   }
 
   static create(props: AttestationRecordProps): AttestationRecord {
+    AttestationRecord.assertVersionContract(props);
     // INV-1: gateResult == "pass" iff validatorSet.every(passed || skipped)
     const allGreen = props.subject.validatorSet.every((o) => o.isGreen());
     const expectedGateResult: GateResult = allGreen ? "pass" : "fail";
@@ -149,6 +155,22 @@ export class AttestationRecord {
     return new AttestationRecord(props);
   }
 
+  private static assertVersionContract(props: AttestationRecordProps): void {
+    const v1 =
+      props.schemaVersion === "phasegate-attestation/v1" &&
+      props.predicateType === "https://phasegate.dev/attestation/gate-run/v1" &&
+      props.worldSnapshotRoot === undefined;
+    const v2 =
+      props.schemaVersion === "phasegate-attestation/v2" &&
+      props.predicateType === "https://phasegate.dev/attestation/gate-run/v2" &&
+      props.worldSnapshotRoot !== undefined;
+    if (!v1 && !v2) {
+      throw new AttestationInvariantError(
+        "version contract violated: schema, predicate, and worldSnapshotRoot disagree",
+      );
+    }
+  }
+
   gateResult(): GateResult {
     return this.subject.gateResult;
   }
@@ -165,10 +187,9 @@ export class AttestationRecord {
 
   /**
    * §1.4.1 step1-3: signature ブロック全体と volatile metadata（producedAt/gitCommit）を
-   * 除去した plain object を返す（producer は決定論的なので残す）。
    */
   toCanonicalPayload(): Record<string, unknown> {
-    return {
+    const payload: Record<string, unknown> = {
       schemaVersion: this.schemaVersion,
       predicateType: this.predicateType,
       subject: {
@@ -199,6 +220,10 @@ export class AttestationRecord {
         producer: this.metadata.producer,
       },
     };
+    if (this.worldSnapshotRoot !== null) {
+      payload.worldSnapshotRoot = this.worldSnapshotRoot.value;
+    }
+    return payload;
   }
 
   /**
@@ -222,6 +247,7 @@ export class AttestationRecord {
       metadata: this.metadata,
       signature: SignatureBlock.unsignedPoc(digest),
       acBoundScope: this.acBoundScope,
+      ...(this.worldSnapshotRoot === null ? {} : { worldSnapshotRoot: this.worldSnapshotRoot }),
     });
   }
 
@@ -247,6 +273,15 @@ export class AttestationRecord {
     if (!this.granularity.traceability.equals(other.granularity.traceability)) return false;
     if (this.acBoundScope.length !== other.acBoundScope.length) return false;
     if (!this.acBoundScope.every((s, i) => s === other.acBoundScope[i])) return false;
+    if (this.worldSnapshotRoot === null && other.worldSnapshotRoot !== null) return false;
+    if (this.worldSnapshotRoot !== null && other.worldSnapshotRoot === null) return false;
+    if (
+      this.worldSnapshotRoot !== null &&
+      other.worldSnapshotRoot !== null &&
+      !this.worldSnapshotRoot.equals(other.worldSnapshotRoot)
+    ) {
+      return false;
+    }
     if (!this.signature.equals(other.signature)) return false;
     return true;
   }

package/scripts/harness/attestation/index.ts

@@ -1,13 +1,24 @@
 // @layer infrastructure
 // @unit attestation
+// @work-item-id WI-306
 // index.ts — attestation Unit の公開バレルエクスポート
 
 // Public DTO types
-export type { AttestationDocument } from "./application/dto/attestation-document.js";
+export type {
+  AttestationDocument,
+  AttestationDocumentV1,
+  AttestationDocumentV2,
+} from "./application/dto/attestation-document.js";
 export type { VerifyAttestationOutput } from "./application/dto/verify-attestation-output.js";
+export {
+  hashUtf8,
+  type Sha256Capability,
+  type Sha256DigestString,
+} from "./application/ports/sha256-capability.js";
+export type { WorldSnapshotRootProvider } from "./application/ports/world-snapshot-root-provider.js";
 export type { AttestationModule, AttestationModuleOptions } from "./composition-root.js";
 // Composition Root
-export { createAttestationModule } from "./composition-root.js";
+export { createAttestationModule, createSha256Capability } from "./composition-root.js";
 export type { AttestHandlerArgs, AttestHandlerResult } from "./presentation/handlers/attest-handler.js";
 // Presentation Handlers
 export { AttestHandler } from "./presentation/handlers/attest-handler.js";

package/scripts/harness/attestation/infrastructure/adapters/node-crypto-content-hasher-adapter.ts

@@ -1,18 +1,18 @@
 // @unit attestation
 // @layer infrastructure
 
-import { createHash } from "node:crypto";
+import { hashUtf8, type Sha256Capability } from "../../application/ports/sha256-capability.js";
 import type { ContentHasherPort } from "../../domain/ports/content-hasher-port.js";
 import { Digest } from "../../domain/value-objects/digest.js";
+import { NodeCryptoSha256Capability } from "./node-crypto-sha256-capability.js";
 
 /**
- * ContentHasherPort の node:crypto 実装。
- * canonical payload / source content の sha256 を `sha256:<64hex>` Digest として返す。
- * installation の node-crypto-hash-adapter をミラーし、アルゴリズムは sha256 に固定する。
+ * Public Sha256Capabilityをattestation-local ContentHasherPortへ変換するadapter。
  */
 export class NodeCryptoContentHasherAdapter implements ContentHasherPort {
+  constructor(private readonly capability: Sha256Capability = new NodeCryptoSha256Capability()) {}
+
   sha256(content: string): Digest {
-    const hex = createHash("sha256").update(content, "utf8").digest("hex");
-    return Digest.fromSha256Hex(hex);
+    return Digest.create(hashUtf8(this.capability, content));
   }
 }

package/scripts/harness/attestation/infrastructure/adapters/node-crypto-sha256-capability.ts

@@ -0,0 +1,19 @@
+// @unit attestation
+// @layer infrastructure
+// @work-item-id WI-286
+
+import { createHash } from "node:crypto";
+import type { Sha256Capability, Sha256DigestString } from "../../application/ports/sha256-capability.js";
+
+/**
+ * Attestation public SHA-256 capabilityのNode.js実装。
+ *
+ * 既存NodeCryptoContentHasherAdapterからprimitiveを移動し、
+ * World向けにnode:crypto call siteを増やさない。
+ */
+export class NodeCryptoSha256Capability implements Sha256Capability {
+  hashBytes(bytes: Uint8Array): Sha256DigestString {
+    const hex = createHash("sha256").update(bytes).digest("hex");
+    return `sha256:${hex}`;
+  }
+}

package/scripts/harness/attestation/presentation/handlers/attest-handler.ts

@@ -1,5 +1,6 @@
 // @unit attestation
 // @layer presentation
+// @work-item-id WI-306
 
 import type { ProduceAttestationInput } from "../../application/dto/produce-attestation-input.js";
 import type { ProduceAttestationUseCase } from "../../application/usecases/produce-attestation-usecase.js";
@@ -46,8 +47,10 @@ export class AttestHandler {
     const result = await this.useCase.execute(input);
 
     if (result.exitCode === 2) {
-      // 唯一の usecase 由来 2 は mode === "signed"。
-      return { output: 'Error: --mode "signed" is not yet implemented (only unsigned-poc is supported)', exitCode: 2 };
+      const output = result.error
+        ? `Error: ${result.error}`
+        : 'Error: --mode "signed" is not yet implemented (only unsigned-poc is supported)';
+      return { output, exitCode: 2 };
     }
 
     if (result.exitCode === 1) {

package/scripts/harness/config-foundation/application/mappers/validator-system-config-mapper.ts

@@ -7,6 +7,9 @@
  * @work-item-id WI-258
  * @work-item-id WI-259
  * @work-item-id WI-268
+ * @work-item-id WI-300
+ * @work-item-id WI-301
+ * @work-item-id WI-302
  */
 import type { HarnessConfigV2 } from "../../domain/harness-config.js";
 
@@ -23,6 +26,7 @@ export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefi
       "ac-bound-coverage": "L3-005",
       "injection-scan": "L3-006",
       "coverage-attestation-verification": "L3-007",
+      "world-constraint-rederivation": "L3-008",
     },
     /^L3-\d{3}$/,
   );
@@ -60,7 +64,10 @@ export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefi
       // WI-258 / ADR-030 §Decision.3.②: L2-016 (coverage-attestation-gating) を default-ON でリストに含める。
       L2: {
         enabled: resolvedConfig.layers.L2.enabled,
-        validators: ["L2-001", "L2-002", "L2-003", "L2-013", "L2-014", "L2-015", "L2-016"],
+        validators:
+          resolvedConfig.world?.enabled === true
+            ? ["L2-001", "L2-002", "L2-003", "L2-013", "L2-014", "L2-015", "L2-016", "L2-017"]
+            : ["L2-001", "L2-002", "L2-003", "L2-013", "L2-014", "L2-015", "L2-016"],
       },
       L3: {
         enabled: resolvedConfig.layers.L3.enabled,
@@ -68,13 +75,28 @@ export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefi
         // WI-268 / ADR-030 §Decision.1・§Decision.3.② 第2段: L3-007 (coverage-attestation-verification)
         // は fail-closed default-ON。いずれも fallback 判定の後に force-include し、normalize 結果でも
         // fallback でも常に含める（L3-007 は fail-closed だが現 corpus は実参照 0 件ゆえ緑）。
-        validators: includeValidator(
-          includeValidator(
-            l3Validators.length > 0 ? l3Validators : ["L3-001", "L3-002", "L3-003", "L3-004"],
-            "L3-006",
-          ),
-          "L3-007",
-        ),
+        validators:
+          resolvedConfig.world?.enabled === true
+            ? includeValidator(
+                includeValidator(
+                  includeValidator(
+                    l3Validators.length > 0 ? l3Validators : ["L3-001", "L3-002", "L3-003", "L3-004"],
+                    "L3-006",
+                  ),
+                  "L3-007",
+                ),
+                "L3-008",
+              )
+            : excludeValidator(
+                includeValidator(
+                  includeValidator(
+                    l3Validators.length > 0 ? l3Validators : ["L3-001", "L3-002", "L3-003", "L3-004"],
+                    "L3-006",
+                  ),
+                  "L3-007",
+                ),
+                "L3-008",
+              ),
         coverageThreshold: resolvedConfig.layers.L3.coverageThreshold,
         requirementMatrixPath: resolvedConfig.layers.L3.requirementMatrixPath,
         // WI-227 / H16-03: L3-005 のスコープ（additive-safe。未設定は []）
@@ -96,6 +118,7 @@ export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefi
     validate: {
       failOnWarning: resolvedConfig.validate.failOnWarning,
     },
+    ...(resolvedConfig.world === undefined ? {} : { world: structuredClone(resolvedConfig.world) }),
   };
 }
 
@@ -110,6 +133,10 @@ function includeValidator(validators: readonly string[], validatorId: string): r
   return validators.includes(validatorId) ? validators : [...validators, validatorId];
 }
 
+function excludeValidator(validators: readonly string[], validatorId: string): readonly string[] {
+  return validators.filter((candidate) => candidate !== validatorId);
+}
+
 function normalizeValidators(
   validators: readonly string[],
   aliases: Readonly<Record<string, string>>,

package/scripts/harness/config-foundation/application/mappers/world-model-config-mapper.ts

@@ -0,0 +1,15 @@
+// @unit config-foundation
+// @layer application
+// @work-item-id WI-300
+
+import type { HarnessConfigV2 } from "../../domain/harness-config.js";
+import {
+  WORLD_CONFIG_DEFAULTS,
+  WorldConfig,
+  type WorldConfigDocument,
+} from "../../domain/value-objects/world-config.js";
+
+export function toWorldModelConfig(resolvedConfig: HarnessConfigV2 | undefined): WorldConfigDocument | undefined {
+  if (!resolvedConfig) return undefined;
+  return WorldConfig.create(resolvedConfig.world ?? WORLD_CONFIG_DEFAULTS).toDocument();
+}