phasegate 0.254.0 → 0.264.0

package/scripts/harness/agent-integration/presentation/session-start-hook.ts

@@ -1,13 +1,18 @@
 // @unit agent-integration
 // @layer presentation
+// @work-item-id WI-304
 
 import { buildCiGovernance } from "../../ci-governance/composition-root.js";
+import { createConfigFoundationModule, toWorldModelConfig } from "../../config-foundation/index.js";
+import { GetOpenWorldObligationsContextUseCase } from "../application/usecases/get-open-world-obligations-context-usecase.js";
+import { WorldModelOpenObligationsQueryAdapter } from "../infrastructure/adapters/world-model-open-obligations-query-adapter.js";
 import {
   buildIntegrityUnverifiableWarning,
   buildIntegrityWarning,
   buildSessionStartContext,
   collectPhasegateStatus,
 } from "./phasegate-status-context.js";
+import { buildWorldObligationsSessionContext } from "./world-obligations-session-context.js";
 
 async function readStdin(): Promise<string> {
   const chunks: Buffer[] = [];
@@ -36,6 +41,36 @@ async function buildIntegrityContext(cwd: string): Promise<string | null> {
   }
 }
 
+/**
+ * World の保存済み report は読まず、公開 facade の pure derive から現在の open obligation を要約する。
+ * config/derive の失敗は固定 warning へ縮退し、repository 由来のエラー文字列は中継しない。
+ */
+async function buildWorldContext(cwd: string): Promise<string | null> {
+  try {
+    const configModule = createConfigFoundationModule();
+    const resolved = await configModule.usecases.loadResolvedConfigUseCase.execute();
+    const worldConfig = toWorldModelConfig(resolved.config);
+    if (worldConfig === undefined) return null;
+
+    const contextUseCase = new GetOpenWorldObligationsContextUseCase({
+      worldObligationsQueryPort: new WorldModelOpenObligationsQueryAdapter({
+        rootDir: cwd,
+        resolvedConfig: worldConfig,
+      }),
+    });
+    const context = await contextUseCase.execute({
+      enabled: worldConfig.enabled && worldConfig.sessionStart.enabled,
+    });
+    return buildWorldObligationsSessionContext(context, {
+      maxItems: worldConfig.sessionStart.maxItems,
+      maxChars: worldConfig.sessionStart.maxChars,
+    });
+  } catch (error) {
+    if (error instanceof Error && error.name === "ConfigNotFoundError") return null;
+    return buildWorldObligationsSessionContext({ status: "unavailable" }, { maxItems: 5, maxChars: 2000 });
+  }
+}
+
 async function main(): Promise<void> {
   try {
     await readStdin();
@@ -46,7 +81,8 @@ async function main(): Promise<void> {
   const status = await collectPhasegateStatus(process.cwd());
   const baseContext = buildSessionStartContext(status);
   const integrityContext = await buildIntegrityContext(process.cwd());
-  const additionalContext = integrityContext === null ? baseContext : `${integrityContext}\n\n${baseContext}`;
+  const worldContext = await buildWorldContext(process.cwd());
+  const additionalContext = [integrityContext, worldContext, baseContext].filter((item) => item !== null).join("\n\n");
 
   const output = {
     hookSpecificOutput: {

package/scripts/harness/agent-integration/presentation/world-obligations-session-context.ts

@@ -0,0 +1,60 @@
+// @unit agent-integration
+// @layer presentation
+// @work-item-id WI-304
+
+import type {
+  OpenWorldObligationContextItemDto,
+  OpenWorldObligationsContextDto,
+} from "../application/dto/open-world-obligations-context-dto.js";
+
+const UNAVAILABLE_WARNING =
+  "⚠ World obligations unavailable at SessionStart; continuing fail-open. Run phasegate world:derive.";
+const HEADER = "## World open obligations (SessionStart)";
+const HARD_MAX_ITEMS = 5;
+const HARD_MAX_CHARS = 2000;
+
+export const countUnicodeScalars = (value: string): number => [...value].length;
+
+const renderEntry = (entry: OpenWorldObligationContextItemDto): string => {
+  if (entry.kind === "policy-diagnostic") {
+    return `- [BLOCKING ${entry.classification}] subject=${entry.subjectId ?? "unknown"}`;
+  }
+  const label =
+    entry.classification === "cleanup-required"
+      ? "CLEANUP"
+      : entry.classification === "waived"
+        ? "WAIVED"
+        : `BLOCKING ${entry.classification}`;
+  return `- [${label}] ${entry.ruleId ?? "unknown-rule"} constraint=${entry.constraintId ?? "implicit"} fingerprint=${entry.violationFingerprint ?? "none"}`;
+};
+
+const renderAvailable = (
+  input: Extract<OpenWorldObligationsContextDto, { status: "available" }>,
+  shown: number,
+): string => {
+  const lines = [HEADER, ...input.entries.slice(0, shown).map(renderEntry)];
+  if (input.adoptedLegacyCount > 0) lines.push(`- Adopted legacy: ${input.adoptedLegacyCount} (summary only)`);
+  if (input.entries.length === 0 && input.adoptedLegacyCount === 0) lines.push("- None.");
+  const omitted = input.entries.length - shown;
+  if (omitted > 0) lines.push(`... ${omitted} more; run phasegate world:derive`);
+  return lines.join("\n");
+};
+
+export function buildWorldObligationsSessionContext(
+  input: OpenWorldObligationsContextDto,
+  limits: { readonly maxItems: number; readonly maxChars: number },
+): string | null {
+  const maxItems = Math.min(limits.maxItems, HARD_MAX_ITEMS);
+  const maxChars = Math.min(limits.maxChars, HARD_MAX_CHARS);
+  if (input.status === "disabled") return null;
+  if (input.status === "unavailable") {
+    return countUnicodeScalars(UNAVAILABLE_WARNING) <= maxChars ? UNAVAILABLE_WARNING : null;
+  }
+
+  const maximumShown = Math.min(input.entries.length, maxItems);
+  for (let shown = maximumShown; shown >= 0; shown -= 1) {
+    const candidate = renderAvailable(input, shown);
+    if (countUnicodeScalars(candidate) <= maxChars) return candidate;
+  }
+  return null;
+}

package/scripts/harness/attestation/application/dto/attestation-document.ts

@@ -1,8 +1,9 @@
 // @unit attestation
 // @layer application
+// @work-item-id WI-306
 
 /**
- * record format `phasegate-attestation/v1` の plain object 表現（logical_design §1.4.3）。
+ * versioned record formatのplain object表現（logical_design §1.4.3 / WI-306）。
  * ファイル入出力・stdout エコー・mapper の境界で用いる契約型。VO はプリミティブ展開する。
  */
 export interface AttestationDocumentValidatorOutcome {
@@ -23,9 +24,7 @@ export interface AttestationDocumentGranularityClaim {
   readonly knownLimitations: string[];
 }
 
-export interface AttestationDocument {
-  readonly schemaVersion: "phasegate-attestation/v1";
-  readonly predicateType: string;
+interface AttestationDocumentBase {
   readonly subject: {
     readonly command: string;
     readonly gateResult: "pass" | "fail";
@@ -54,3 +53,17 @@ export interface AttestationDocument {
     readonly value: string | null;
   };
 }
+
+export interface AttestationDocumentV1 extends AttestationDocumentBase {
+  readonly schemaVersion: "phasegate-attestation/v1";
+  readonly predicateType: "https://phasegate.dev/attestation/gate-run/v1";
+}
+
+export interface AttestationDocumentV2 extends AttestationDocumentBase {
+  readonly schemaVersion: "phasegate-attestation/v2";
+  readonly predicateType: "https://phasegate.dev/attestation/gate-run/v2";
+  /** 実行時のWorld canonical corpusRoot。個別fragment digestは保持しない。 */
+  readonly worldSnapshotRoot: string;
+}
+
+export type AttestationDocument = AttestationDocumentV1 | AttestationDocumentV2;

package/scripts/harness/attestation/application/mappers/attestation-record-mapper.ts

@@ -1,5 +1,6 @@
 // @unit attestation
 // @layer application
+// @work-item-id WI-306
 
 import {
   AttestationRecord,
@@ -44,15 +45,20 @@ function requireBoolean(v: unknown, field: string): boolean {
   return v;
 }
 
+function rejectUnknownFields(value: Record<string, unknown>, allowed: readonly string[], field: string): void {
+  const unsupported = Object.keys(value).filter((key) => !allowed.includes(key));
+  if (unsupported.length > 0) {
+    throw new MalformedAttestationError(`${field} contains unsupported fields: ${unsupported.sort().join(", ")}`);
+  }
+}
+
 /**
  * AttestationRecord（domain）↔ AttestationDocument（application DTO）の双方向変換。
  */
 export class AttestationRecordMapper {
   /** 集約を plain object へ射影（VO をプリミティブ展開）。 */
   toDocument(record: AttestationRecord): AttestationDocument {
-    return {
-      schemaVersion: record.schemaVersion as "phasegate-attestation/v1",
-      predicateType: record.predicateType,
+    const common = {
       subject: {
         command: record.subject.command,
         gateResult: record.subject.gateResult,
@@ -63,7 +69,7 @@ export class AttestationRecordMapper {
         })),
       },
       inputs: {
-        digestAlgorithm: "sha256",
+        digestAlgorithm: "sha256" as const,
         sources: record.inputs.sources.map((s) => ({ path: s.path, digest: s.digest.value })),
         inputDigest: record.inputs.inputDigest.value,
       },
@@ -89,6 +95,19 @@ export class AttestationRecordMapper {
         value: record.signature.value,
       },
     };
+    if (record.worldSnapshotRoot !== null) {
+      return {
+        ...common,
+        schemaVersion: "phasegate-attestation/v2",
+        predicateType: "https://phasegate.dev/attestation/gate-run/v2",
+        worldSnapshotRoot: record.worldSnapshotRoot.value,
+      };
+    }
+    return {
+      ...common,
+      schemaVersion: "phasegate-attestation/v1",
+      predicateType: "https://phasegate.dev/attestation/gate-run/v1",
+    };
   }
 
   /**
@@ -102,6 +121,37 @@ export class AttestationRecordMapper {
 
     const schemaVersion = requireString(doc.schemaVersion, "schemaVersion");
     const predicateType = requireString(doc.predicateType, "predicateType");
+    let worldSnapshotRoot: Digest | undefined;
+    if (schemaVersion === "phasegate-attestation/v1") {
+      if (predicateType !== "https://phasegate.dev/attestation/gate-run/v1") {
+        throw new MalformedAttestationError("v1 predicateType does not match schemaVersion");
+      }
+      if (doc.worldSnapshotRoot !== undefined) {
+        throw new MalformedAttestationError("v1 must not contain worldSnapshotRoot");
+      }
+    } else if (schemaVersion === "phasegate-attestation/v2") {
+      if (predicateType !== "https://phasegate.dev/attestation/gate-run/v2") {
+        throw new MalformedAttestationError("v2 predicateType does not match schemaVersion");
+      }
+      worldSnapshotRoot = this.toDigest(doc.worldSnapshotRoot, "worldSnapshotRoot");
+      rejectUnknownFields(
+        doc,
+        [
+          "schemaVersion",
+          "predicateType",
+          "subject",
+          "inputs",
+          "granularity",
+          "acBoundScope",
+          "worldSnapshotRoot",
+          "metadata",
+          "signature",
+        ],
+        "v2 attestation",
+      );
+    } else {
+      throw new MalformedAttestationError(`unsupported schemaVersion: ${schemaVersion}`);
+    }
 
     const subject = doc.subject;
     if (!isObject(subject)) {
@@ -185,6 +235,7 @@ export class AttestationRecordMapper {
       },
       signature: this.toSignatureBlock(mode, attestationDigest, signature),
       acBoundScope,
+      ...(worldSnapshotRoot === undefined ? {} : { worldSnapshotRoot }),
     };
 
     // verify 用の再構築: INV-1/INV-3 は verify usecase が機械的チェックとして検出するため

package/scripts/harness/attestation/application/ports/world-snapshot-root-provider.ts

@@ -0,0 +1,10 @@
+// @unit attestation
+// @layer application
+// @work-item-id WI-306
+
+/**
+ * attestationが所有するconsumer port。providerのWorld domain型を公開しない。
+ */
+export interface WorldSnapshotRootProvider {
+  getWorldSnapshotRoot(): Promise<string>;
+}

package/scripts/harness/attestation/application/usecases/produce-attestation-usecase.ts

@@ -1,23 +1,28 @@
 // @unit attestation
 // @layer application
+// @work-item-id WI-306
 
 import { AttestationRecord, type GateResult, type SourceEntry } from "../../domain/entities/attestation-record.js";
 import type { ContentHasherPort } from "../../domain/ports/content-hasher-port.js";
-import type { GranularityDerivationService } from "../../domain/services/granularity-derivation-service.js";
 import type { AcBoundScopeService } from "../../domain/services/ac-bound-scope-service.js";
+import type { GranularityDerivationService } from "../../domain/services/granularity-derivation-service.js";
+import { Digest } from "../../domain/value-objects/digest.js";
 import { SignatureBlock } from "../../domain/value-objects/signature-block.js";
 import { ValidatorOutcome } from "../../domain/value-objects/validator-outcome.js";
 import type { AttestationDocument } from "../dto/attestation-document.js";
 import type { ProduceAttestationInput } from "../dto/produce-attestation-input.js";
 import type { AttestationRecordMapper } from "../mappers/attestation-record-mapper.js";
+import type { AcBoundAllowlistPort } from "../ports/ac-bound-allowlist-port.js";
 import type { AttestationRepositoryPort } from "../ports/attestation-repository-port.js";
 import type { GateResultSourcePort } from "../ports/gate-result-source-port.js";
-import type { SourceDigesterPort } from "../ports/source-digester-port.js";
 import type { MatrixSourcePort } from "../ports/matrix-source-port.js";
-import type { AcBoundAllowlistPort } from "../ports/ac-bound-allowlist-port.js";
+import type { SourceDigesterPort } from "../ports/source-digester-port.js";
+import type { WorldSnapshotRootProvider } from "../ports/world-snapshot-root-provider.js";
 
-const SCHEMA_VERSION = "phasegate-attestation/v1";
-const PREDICATE_TYPE = "https://phasegate.dev/attestation/gate-run/v1";
+const V1_SCHEMA_VERSION = "phasegate-attestation/v1";
+const V1_PREDICATE_TYPE = "https://phasegate.dev/attestation/gate-run/v1";
+const V2_SCHEMA_VERSION = "phasegate-attestation/v2";
+const V2_PREDICATE_TYPE = "https://phasegate.dev/attestation/gate-run/v2";
 const DEFAULT_INPUT_SOURCES: readonly string[] = Object.freeze([
   "phasegate.config.json",
   ".harness/requirement-test-matrix.json",
@@ -46,11 +51,14 @@ export interface ProduceAttestationDeps {
   readonly acBoundScopeService?: AcBoundScopeService;
   /** H16-03: matrix 供給元パス（inputSourcePaths のうち matrix にあたるもの。既定は 2 番目の source）。 */
   readonly matrixFilePath?: string;
+  /** WI-306: 配線時はv2、未配線時は既存v1を生成する。 */
+  readonly worldSnapshotRootProvider?: WorldSnapshotRootProvider;
 }
 
 export interface ProduceAttestationResult {
   readonly document: AttestationDocument | null;
   readonly exitCode: 0 | 1 | 2;
+  readonly error?: string;
 }
 
 /**
@@ -77,6 +85,20 @@ export class ProduceAttestationUseCase {
       return { document: null, exitCode: 1 };
     }
 
+    // 3b. World root providerはv2 opt-in。失敗や不正digestをv1へdowngradeしない。
+    let worldSnapshotRoot: Digest | undefined;
+    if (this.deps.worldSnapshotRootProvider) {
+      try {
+        worldSnapshotRoot = Digest.create(await this.deps.worldSnapshotRootProvider.getWorldSnapshotRoot());
+      } catch (error) {
+        return {
+          document: null,
+          exitCode: 2,
+          error: `cannot obtain worldSnapshotRoot: ${error instanceof Error ? error.message : String(error)}`,
+        };
+      }
+    }
+
     // 4. inputs.sources 構築（config / matrix の sha256 + git commit SHA）と inputDigest 算出
     const sources = await this.buildSources();
     const preInputRecord = this.assembleRecord({
@@ -88,6 +110,7 @@ export class ProduceAttestationUseCase {
       producer: `phasegate-attestation/${this.deps.pkgVersion}`,
       gitCommit: null,
       acBoundScope: [],
+      worldSnapshotRoot,
     });
     const inputDigest = preInputRecord.computeInputDigest(this.deps.hasher);
 
@@ -110,6 +133,7 @@ export class ProduceAttestationUseCase {
       producer: `phasegate-attestation/${this.deps.pkgVersion}`,
       gitCommit,
       acBoundScope,
+      worldSnapshotRoot,
     });
     const sealed = record.seal(this.deps.hasher);
 
@@ -130,11 +154,12 @@ export class ProduceAttestationUseCase {
     producer: string;
     gitCommit: string | null;
     acBoundScope: readonly string[];
+    worldSnapshotRoot?: Digest;
   }): AttestationRecord {
     const granularity = this.deps.granularityService.derive(args.validatorSet);
     return AttestationRecord.create({
-      schemaVersion: SCHEMA_VERSION,
-      predicateType: PREDICATE_TYPE,
+      schemaVersion: args.worldSnapshotRoot ? V2_SCHEMA_VERSION : V1_SCHEMA_VERSION,
+      predicateType: args.worldSnapshotRoot ? V2_PREDICATE_TYPE : V1_PREDICATE_TYPE,
       subject: {
         command: "phasegate:ci-check",
         gateResult: args.gateResult,
@@ -154,6 +179,7 @@ export class ProduceAttestationUseCase {
       // 仮の unsigned-poc block（seal 前）。seal が正しい digest で置換する。
       signature: SignatureBlock.unsignedPoc(args.inputDigest),
       acBoundScope: args.acBoundScope,
+      ...(args.worldSnapshotRoot ? { worldSnapshotRoot: args.worldSnapshotRoot } : {}),
     });
   }
 

package/scripts/harness/attestation/composition-root.ts

@@ -1,6 +1,7 @@
 /**
  * @layer infrastructure
  * @unit attestation
+ * @work-item-id WI-306
  *
  * Composition Root — attestation Unit の依存性組み立て。
  * createAttestationModule() は adapters + usecases + handlers を組み立て、
@@ -11,6 +12,7 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { AttestationRecordMapper } from "./application/mappers/attestation-record-mapper.js";
 import type { Sha256Capability } from "./application/ports/sha256-capability.js";
+import type { WorldSnapshotRootProvider } from "./application/ports/world-snapshot-root-provider.js";
 import { ProduceAttestationUseCase } from "./application/usecases/produce-attestation-usecase.js";
 import { VerifyAttestationUseCase } from "./application/usecases/verify-attestation-usecase.js";
 import { AcBoundScopeService } from "./domain/services/ac-bound-scope-service.js";
@@ -41,6 +43,8 @@ export interface AttestationModuleOptions {
   readonly mainTsPath?: string;
   /** metadata.producedAt 用クロックのオーバーライド（テスト用）。 */
   readonly clock?: () => Date;
+  /** WI-306: 配線時はv2 recordへplain World corpus rootを注入する。 */
+  readonly worldSnapshotRootProvider?: WorldSnapshotRootProvider;
 }
 
 /**
@@ -87,6 +91,7 @@ export function createAttestationModule(rootDir: string, options?: AttestationMo
     matrixSource,
     allowlist,
     acBoundScopeService,
+    worldSnapshotRootProvider: options?.worldSnapshotRootProvider,
   });
   const verifyUseCase = new VerifyAttestationUseCase({
     repository,

package/scripts/harness/attestation/domain/entities/attestation-record.ts

@@ -1,5 +1,6 @@
 // @unit attestation
 // @layer domain
+// @work-item-id WI-306
 
 import type { ContentHasherPort } from "../ports/content-hasher-port.js";
 import { GranularityDerivationService } from "../services/granularity-derivation-service.js";
@@ -47,6 +48,8 @@ export interface AttestationRecordProps {
    * 省略時は [] として扱う（additive-safe）。
    */
   readonly acBoundScope?: readonly string[];
+  /** v2だけが持つ実行時World corpus root。 */
+  readonly worldSnapshotRoot?: Digest;
 }
 
 /**
@@ -94,6 +97,7 @@ export class AttestationRecord {
   readonly metadata: MetadataSection;
   readonly signature: SignatureBlock;
   readonly acBoundScope: readonly string[];
+  readonly worldSnapshotRoot: Digest | null;
 
   private constructor(props: AttestationRecordProps) {
     this.schemaVersion = props.schemaVersion;
@@ -104,10 +108,12 @@ export class AttestationRecord {
     this.metadata = props.metadata;
     this.signature = props.signature;
     this.acBoundScope = Object.freeze([...(props.acBoundScope ?? [])]);
+    this.worldSnapshotRoot = props.worldSnapshotRoot ?? null;
     Object.freeze(this);
   }
 
   static create(props: AttestationRecordProps): AttestationRecord {
+    AttestationRecord.assertVersionContract(props);
     // INV-1: gateResult == "pass" iff validatorSet.every(passed || skipped)
     const allGreen = props.subject.validatorSet.every((o) => o.isGreen());
     const expectedGateResult: GateResult = allGreen ? "pass" : "fail";
@@ -149,6 +155,22 @@ export class AttestationRecord {
     return new AttestationRecord(props);
   }
 
+  private static assertVersionContract(props: AttestationRecordProps): void {
+    const v1 =
+      props.schemaVersion === "phasegate-attestation/v1" &&
+      props.predicateType === "https://phasegate.dev/attestation/gate-run/v1" &&
+      props.worldSnapshotRoot === undefined;
+    const v2 =
+      props.schemaVersion === "phasegate-attestation/v2" &&
+      props.predicateType === "https://phasegate.dev/attestation/gate-run/v2" &&
+      props.worldSnapshotRoot !== undefined;
+    if (!v1 && !v2) {
+      throw new AttestationInvariantError(
+        "version contract violated: schema, predicate, and worldSnapshotRoot disagree",
+      );
+    }
+  }
+
   gateResult(): GateResult {
     return this.subject.gateResult;
   }
@@ -165,10 +187,9 @@ export class AttestationRecord {
 
   /**
    * §1.4.1 step1-3: signature ブロック全体と volatile metadata（producedAt/gitCommit）を
-   * 除去した plain object を返す（producer は決定論的なので残す）。
    */
   toCanonicalPayload(): Record<string, unknown> {
-    return {
+    const payload: Record<string, unknown> = {
       schemaVersion: this.schemaVersion,
       predicateType: this.predicateType,
       subject: {
@@ -199,6 +220,10 @@ export class AttestationRecord {
         producer: this.metadata.producer,
       },
     };
+    if (this.worldSnapshotRoot !== null) {
+      payload.worldSnapshotRoot = this.worldSnapshotRoot.value;
+    }
+    return payload;
   }
 
   /**
@@ -222,6 +247,7 @@ export class AttestationRecord {
       metadata: this.metadata,
       signature: SignatureBlock.unsignedPoc(digest),
       acBoundScope: this.acBoundScope,
+      ...(this.worldSnapshotRoot === null ? {} : { worldSnapshotRoot: this.worldSnapshotRoot }),
     });
   }
 
@@ -247,6 +273,15 @@ export class AttestationRecord {
     if (!this.granularity.traceability.equals(other.granularity.traceability)) return false;
     if (this.acBoundScope.length !== other.acBoundScope.length) return false;
     if (!this.acBoundScope.every((s, i) => s === other.acBoundScope[i])) return false;
+    if (this.worldSnapshotRoot === null && other.worldSnapshotRoot !== null) return false;
+    if (this.worldSnapshotRoot !== null && other.worldSnapshotRoot === null) return false;
+    if (
+      this.worldSnapshotRoot !== null &&
+      other.worldSnapshotRoot !== null &&
+      !this.worldSnapshotRoot.equals(other.worldSnapshotRoot)
+    ) {
+      return false;
+    }
     if (!this.signature.equals(other.signature)) return false;
     return true;
   }

package/scripts/harness/attestation/index.ts

@@ -1,15 +1,21 @@
 // @layer infrastructure
 // @unit attestation
+// @work-item-id WI-306
 // index.ts — attestation Unit の公開バレルエクスポート
 
 // Public DTO types
-export type { AttestationDocument } from "./application/dto/attestation-document.js";
+export type {
+  AttestationDocument,
+  AttestationDocumentV1,
+  AttestationDocumentV2,
+} from "./application/dto/attestation-document.js";
 export type { VerifyAttestationOutput } from "./application/dto/verify-attestation-output.js";
 export {
   hashUtf8,
   type Sha256Capability,
   type Sha256DigestString,
 } from "./application/ports/sha256-capability.js";
+export type { WorldSnapshotRootProvider } from "./application/ports/world-snapshot-root-provider.js";
 export type { AttestationModule, AttestationModuleOptions } from "./composition-root.js";
 // Composition Root
 export { createAttestationModule, createSha256Capability } from "./composition-root.js";

package/scripts/harness/attestation/presentation/handlers/attest-handler.ts

@@ -1,5 +1,6 @@
 // @unit attestation
 // @layer presentation
+// @work-item-id WI-306
 
 import type { ProduceAttestationInput } from "../../application/dto/produce-attestation-input.js";
 import type { ProduceAttestationUseCase } from "../../application/usecases/produce-attestation-usecase.js";
@@ -46,8 +47,10 @@ export class AttestHandler {
     const result = await this.useCase.execute(input);
 
     if (result.exitCode === 2) {
-      // 唯一の usecase 由来 2 は mode === "signed"。
-      return { output: 'Error: --mode "signed" is not yet implemented (only unsigned-poc is supported)', exitCode: 2 };
+      const output = result.error
+        ? `Error: ${result.error}`
+        : 'Error: --mode "signed" is not yet implemented (only unsigned-poc is supported)';
+      return { output, exitCode: 2 };
     }
 
     if (result.exitCode === 1) {

package/scripts/harness/config-foundation/application/mappers/validator-system-config-mapper.ts

@@ -7,6 +7,9 @@
  * @work-item-id WI-258
  * @work-item-id WI-259
  * @work-item-id WI-268
+ * @work-item-id WI-300
+ * @work-item-id WI-301
+ * @work-item-id WI-302
  */
 import type { HarnessConfigV2 } from "../../domain/harness-config.js";
 
@@ -23,6 +26,7 @@ export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefi
       "ac-bound-coverage": "L3-005",
       "injection-scan": "L3-006",
       "coverage-attestation-verification": "L3-007",
+      "world-constraint-rederivation": "L3-008",
     },
     /^L3-\d{3}$/,
   );
@@ -60,7 +64,10 @@ export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefi
       // WI-258 / ADR-030 §Decision.3.②: L2-016 (coverage-attestation-gating) を default-ON でリストに含める。
       L2: {
         enabled: resolvedConfig.layers.L2.enabled,
-        validators: ["L2-001", "L2-002", "L2-003", "L2-013", "L2-014", "L2-015", "L2-016"],
+        validators:
+          resolvedConfig.world?.enabled === true
+            ? ["L2-001", "L2-002", "L2-003", "L2-013", "L2-014", "L2-015", "L2-016", "L2-017"]
+            : ["L2-001", "L2-002", "L2-003", "L2-013", "L2-014", "L2-015", "L2-016"],
       },
       L3: {
         enabled: resolvedConfig.layers.L3.enabled,
@@ -68,13 +75,28 @@ export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefi
         // WI-268 / ADR-030 §Decision.1・§Decision.3.② 第2段: L3-007 (coverage-attestation-verification)
         // は fail-closed default-ON。いずれも fallback 判定の後に force-include し、normalize 結果でも
         // fallback でも常に含める（L3-007 は fail-closed だが現 corpus は実参照 0 件ゆえ緑）。
-        validators: includeValidator(
-          includeValidator(
-            l3Validators.length > 0 ? l3Validators : ["L3-001", "L3-002", "L3-003", "L3-004"],
-            "L3-006",
-          ),
-          "L3-007",
-        ),
+        validators:
+          resolvedConfig.world?.enabled === true
+            ? includeValidator(
+                includeValidator(
+                  includeValidator(
+                    l3Validators.length > 0 ? l3Validators : ["L3-001", "L3-002", "L3-003", "L3-004"],
+                    "L3-006",
+                  ),
+                  "L3-007",
+                ),
+                "L3-008",
+              )
+            : excludeValidator(
+                includeValidator(
+                  includeValidator(
+                    l3Validators.length > 0 ? l3Validators : ["L3-001", "L3-002", "L3-003", "L3-004"],
+                    "L3-006",
+                  ),
+                  "L3-007",
+                ),
+                "L3-008",
+              ),
         coverageThreshold: resolvedConfig.layers.L3.coverageThreshold,
         requirementMatrixPath: resolvedConfig.layers.L3.requirementMatrixPath,
         // WI-227 / H16-03: L3-005 のスコープ（additive-safe。未設定は []）
@@ -96,6 +118,7 @@ export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefi
     validate: {
       failOnWarning: resolvedConfig.validate.failOnWarning,
     },
+    ...(resolvedConfig.world === undefined ? {} : { world: structuredClone(resolvedConfig.world) }),
   };
 }
 
@@ -110,6 +133,10 @@ function includeValidator(validators: readonly string[], validatorId: string): r
   return validators.includes(validatorId) ? validators : [...validators, validatorId];
 }
 
+function excludeValidator(validators: readonly string[], validatorId: string): readonly string[] {
+  return validators.filter((candidate) => candidate !== validatorId);
+}
+
 function normalizeValidators(
   validators: readonly string[],
   aliases: Readonly<Record<string, string>>,

package/scripts/harness/config-foundation/application/mappers/world-model-config-mapper.ts

@@ -0,0 +1,15 @@
+// @unit config-foundation
+// @layer application
+// @work-item-id WI-300
+
+import type { HarnessConfigV2 } from "../../domain/harness-config.js";
+import {
+  WORLD_CONFIG_DEFAULTS,
+  WorldConfig,
+  type WorldConfigDocument,
+} from "../../domain/value-objects/world-config.js";
+
+export function toWorldModelConfig(resolvedConfig: HarnessConfigV2 | undefined): WorldConfigDocument | undefined {
+  if (!resolvedConfig) return undefined;
+  return WorldConfig.create(resolvedConfig.world ?? WORLD_CONFIG_DEFAULTS).toDocument();
+}