phasegate 0.254.0 → 0.283.0

package/scripts/harness/attestation/application/mappers/attestation-record-mapper.ts

@@ -1,5 +1,6 @@
 // @unit attestation
 // @layer application
+// @work-item-id WI-306
 
 import {
   AttestationRecord,
@@ -44,15 +45,20 @@ function requireBoolean(v: unknown, field: string): boolean {
   return v;
 }
 
+function rejectUnknownFields(value: Record<string, unknown>, allowed: readonly string[], field: string): void {
+  const unsupported = Object.keys(value).filter((key) => !allowed.includes(key));
+  if (unsupported.length > 0) {
+    throw new MalformedAttestationError(`${field} contains unsupported fields: ${unsupported.sort().join(", ")}`);
+  }
+}
+
 /**
  * AttestationRecord（domain）↔ AttestationDocument（application DTO）の双方向変換。
  */
 export class AttestationRecordMapper {
   /** 集約を plain object へ射影（VO をプリミティブ展開）。 */
   toDocument(record: AttestationRecord): AttestationDocument {
-    return {
-      schemaVersion: record.schemaVersion as "phasegate-attestation/v1",
-      predicateType: record.predicateType,
+    const common = {
       subject: {
         command: record.subject.command,
         gateResult: record.subject.gateResult,
@@ -63,7 +69,7 @@ export class AttestationRecordMapper {
         })),
       },
       inputs: {
-        digestAlgorithm: "sha256",
+        digestAlgorithm: "sha256" as const,
         sources: record.inputs.sources.map((s) => ({ path: s.path, digest: s.digest.value })),
         inputDigest: record.inputs.inputDigest.value,
       },
@@ -89,6 +95,19 @@ export class AttestationRecordMapper {
         value: record.signature.value,
       },
     };
+    if (record.worldSnapshotRoot !== null) {
+      return {
+        ...common,
+        schemaVersion: "phasegate-attestation/v2",
+        predicateType: "https://phasegate.dev/attestation/gate-run/v2",
+        worldSnapshotRoot: record.worldSnapshotRoot.value,
+      };
+    }
+    return {
+      ...common,
+      schemaVersion: "phasegate-attestation/v1",
+      predicateType: "https://phasegate.dev/attestation/gate-run/v1",
+    };
   }
 
   /**
@@ -102,6 +121,37 @@ export class AttestationRecordMapper {
 
     const schemaVersion = requireString(doc.schemaVersion, "schemaVersion");
     const predicateType = requireString(doc.predicateType, "predicateType");
+    let worldSnapshotRoot: Digest | undefined;
+    if (schemaVersion === "phasegate-attestation/v1") {
+      if (predicateType !== "https://phasegate.dev/attestation/gate-run/v1") {
+        throw new MalformedAttestationError("v1 predicateType does not match schemaVersion");
+      }
+      if (doc.worldSnapshotRoot !== undefined) {
+        throw new MalformedAttestationError("v1 must not contain worldSnapshotRoot");
+      }
+    } else if (schemaVersion === "phasegate-attestation/v2") {
+      if (predicateType !== "https://phasegate.dev/attestation/gate-run/v2") {
+        throw new MalformedAttestationError("v2 predicateType does not match schemaVersion");
+      }
+      worldSnapshotRoot = this.toDigest(doc.worldSnapshotRoot, "worldSnapshotRoot");
+      rejectUnknownFields(
+        doc,
+        [
+          "schemaVersion",
+          "predicateType",
+          "subject",
+          "inputs",
+          "granularity",
+          "acBoundScope",
+          "worldSnapshotRoot",
+          "metadata",
+          "signature",
+        ],
+        "v2 attestation",
+      );
+    } else {
+      throw new MalformedAttestationError(`unsupported schemaVersion: ${schemaVersion}`);
+    }
 
     const subject = doc.subject;
     if (!isObject(subject)) {
@@ -185,6 +235,7 @@ export class AttestationRecordMapper {
       },
       signature: this.toSignatureBlock(mode, attestationDigest, signature),
       acBoundScope,
+      ...(worldSnapshotRoot === undefined ? {} : { worldSnapshotRoot }),
     };
 
     // verify 用の再構築: INV-1/INV-3 は verify usecase が機械的チェックとして検出するため

package/scripts/harness/attestation/application/ports/world-snapshot-root-provider.ts

@@ -0,0 +1,10 @@
+// @unit attestation
+// @layer application
+// @work-item-id WI-306
+
+/**
+ * attestationが所有するconsumer port。providerのWorld domain型を公開しない。
+ */
+export interface WorldSnapshotRootProvider {
+  getWorldSnapshotRoot(): Promise<string>;
+}

package/scripts/harness/attestation/application/usecases/produce-attestation-usecase.ts

@@ -1,23 +1,28 @@
 // @unit attestation
 // @layer application
+// @work-item-id WI-306
 
 import { AttestationRecord, type GateResult, type SourceEntry } from "../../domain/entities/attestation-record.js";
 import type { ContentHasherPort } from "../../domain/ports/content-hasher-port.js";
-import type { GranularityDerivationService } from "../../domain/services/granularity-derivation-service.js";
 import type { AcBoundScopeService } from "../../domain/services/ac-bound-scope-service.js";
+import type { GranularityDerivationService } from "../../domain/services/granularity-derivation-service.js";
+import { Digest } from "../../domain/value-objects/digest.js";
 import { SignatureBlock } from "../../domain/value-objects/signature-block.js";
 import { ValidatorOutcome } from "../../domain/value-objects/validator-outcome.js";
 import type { AttestationDocument } from "../dto/attestation-document.js";
 import type { ProduceAttestationInput } from "../dto/produce-attestation-input.js";
 import type { AttestationRecordMapper } from "../mappers/attestation-record-mapper.js";
+import type { AcBoundAllowlistPort } from "../ports/ac-bound-allowlist-port.js";
 import type { AttestationRepositoryPort } from "../ports/attestation-repository-port.js";
 import type { GateResultSourcePort } from "../ports/gate-result-source-port.js";
-import type { SourceDigesterPort } from "../ports/source-digester-port.js";
 import type { MatrixSourcePort } from "../ports/matrix-source-port.js";
-import type { AcBoundAllowlistPort } from "../ports/ac-bound-allowlist-port.js";
+import type { SourceDigesterPort } from "../ports/source-digester-port.js";
+import type { WorldSnapshotRootProvider } from "../ports/world-snapshot-root-provider.js";
 
-const SCHEMA_VERSION = "phasegate-attestation/v1";
-const PREDICATE_TYPE = "https://phasegate.dev/attestation/gate-run/v1";
+const V1_SCHEMA_VERSION = "phasegate-attestation/v1";
+const V1_PREDICATE_TYPE = "https://phasegate.dev/attestation/gate-run/v1";
+const V2_SCHEMA_VERSION = "phasegate-attestation/v2";
+const V2_PREDICATE_TYPE = "https://phasegate.dev/attestation/gate-run/v2";
 const DEFAULT_INPUT_SOURCES: readonly string[] = Object.freeze([
   "phasegate.config.json",
   ".harness/requirement-test-matrix.json",
@@ -46,11 +51,14 @@ export interface ProduceAttestationDeps {
   readonly acBoundScopeService?: AcBoundScopeService;
   /** H16-03: matrix 供給元パス（inputSourcePaths のうち matrix にあたるもの。既定は 2 番目の source）。 */
   readonly matrixFilePath?: string;
+  /** WI-306: 配線時はv2、未配線時は既存v1を生成する。 */
+  readonly worldSnapshotRootProvider?: WorldSnapshotRootProvider;
 }
 
 export interface ProduceAttestationResult {
   readonly document: AttestationDocument | null;
   readonly exitCode: 0 | 1 | 2;
+  readonly error?: string;
 }
 
 /**
@@ -77,6 +85,20 @@ export class ProduceAttestationUseCase {
       return { document: null, exitCode: 1 };
     }
 
+    // 3b. World root providerはv2 opt-in。失敗や不正digestをv1へdowngradeしない。
+    let worldSnapshotRoot: Digest | undefined;
+    if (this.deps.worldSnapshotRootProvider) {
+      try {
+        worldSnapshotRoot = Digest.create(await this.deps.worldSnapshotRootProvider.getWorldSnapshotRoot());
+      } catch (error) {
+        return {
+          document: null,
+          exitCode: 2,
+          error: `cannot obtain worldSnapshotRoot: ${error instanceof Error ? error.message : String(error)}`,
+        };
+      }
+    }
+
     // 4. inputs.sources 構築（config / matrix の sha256 + git commit SHA）と inputDigest 算出
     const sources = await this.buildSources();
     const preInputRecord = this.assembleRecord({
@@ -88,6 +110,7 @@ export class ProduceAttestationUseCase {
       producer: `phasegate-attestation/${this.deps.pkgVersion}`,
       gitCommit: null,
       acBoundScope: [],
+      worldSnapshotRoot,
     });
     const inputDigest = preInputRecord.computeInputDigest(this.deps.hasher);
 
@@ -110,6 +133,7 @@ export class ProduceAttestationUseCase {
       producer: `phasegate-attestation/${this.deps.pkgVersion}`,
       gitCommit,
       acBoundScope,
+      worldSnapshotRoot,
     });
     const sealed = record.seal(this.deps.hasher);
 
@@ -130,11 +154,12 @@ export class ProduceAttestationUseCase {
     producer: string;
     gitCommit: string | null;
     acBoundScope: readonly string[];
+    worldSnapshotRoot?: Digest;
   }): AttestationRecord {
     const granularity = this.deps.granularityService.derive(args.validatorSet);
     return AttestationRecord.create({
-      schemaVersion: SCHEMA_VERSION,
-      predicateType: PREDICATE_TYPE,
+      schemaVersion: args.worldSnapshotRoot ? V2_SCHEMA_VERSION : V1_SCHEMA_VERSION,
+      predicateType: args.worldSnapshotRoot ? V2_PREDICATE_TYPE : V1_PREDICATE_TYPE,
       subject: {
         command: "phasegate:ci-check",
         gateResult: args.gateResult,
@@ -154,6 +179,7 @@ export class ProduceAttestationUseCase {
       // 仮の unsigned-poc block（seal 前）。seal が正しい digest で置換する。
       signature: SignatureBlock.unsignedPoc(args.inputDigest),
       acBoundScope: args.acBoundScope,
+      ...(args.worldSnapshotRoot ? { worldSnapshotRoot: args.worldSnapshotRoot } : {}),
     });
   }
 

package/scripts/harness/attestation/composition-root.ts

@@ -1,6 +1,7 @@
 /**
  * @layer infrastructure
  * @unit attestation
+ * @work-item-id WI-306
  *
  * Composition Root — attestation Unit の依存性組み立て。
  * createAttestationModule() は adapters + usecases + handlers を組み立て、
@@ -11,6 +12,7 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { AttestationRecordMapper } from "./application/mappers/attestation-record-mapper.js";
 import type { Sha256Capability } from "./application/ports/sha256-capability.js";
+import type { WorldSnapshotRootProvider } from "./application/ports/world-snapshot-root-provider.js";
 import { ProduceAttestationUseCase } from "./application/usecases/produce-attestation-usecase.js";
 import { VerifyAttestationUseCase } from "./application/usecases/verify-attestation-usecase.js";
 import { AcBoundScopeService } from "./domain/services/ac-bound-scope-service.js";
@@ -41,6 +43,8 @@ export interface AttestationModuleOptions {
   readonly mainTsPath?: string;
   /** metadata.producedAt 用クロックのオーバーライド（テスト用）。 */
   readonly clock?: () => Date;
+  /** WI-306: 配線時はv2 recordへplain World corpus rootを注入する。 */
+  readonly worldSnapshotRootProvider?: WorldSnapshotRootProvider;
 }
 
 /**
@@ -87,6 +91,7 @@ export function createAttestationModule(rootDir: string, options?: AttestationMo
     matrixSource,
     allowlist,
     acBoundScopeService,
+    worldSnapshotRootProvider: options?.worldSnapshotRootProvider,
   });
   const verifyUseCase = new VerifyAttestationUseCase({
     repository,

package/scripts/harness/attestation/domain/entities/attestation-record.ts

@@ -1,5 +1,6 @@
 // @unit attestation
 // @layer domain
+// @work-item-id WI-306
 
 import type { ContentHasherPort } from "../ports/content-hasher-port.js";
 import { GranularityDerivationService } from "../services/granularity-derivation-service.js";
@@ -47,6 +48,8 @@ export interface AttestationRecordProps {
    * 省略時は [] として扱う（additive-safe）。
    */
   readonly acBoundScope?: readonly string[];
+  /** v2だけが持つ実行時World corpus root。 */
+  readonly worldSnapshotRoot?: Digest;
 }
 
 /**
@@ -94,6 +97,7 @@ export class AttestationRecord {
   readonly metadata: MetadataSection;
   readonly signature: SignatureBlock;
   readonly acBoundScope: readonly string[];
+  readonly worldSnapshotRoot: Digest | null;
 
   private constructor(props: AttestationRecordProps) {
     this.schemaVersion = props.schemaVersion;
@@ -104,10 +108,12 @@ export class AttestationRecord {
     this.metadata = props.metadata;
     this.signature = props.signature;
     this.acBoundScope = Object.freeze([...(props.acBoundScope ?? [])]);
+    this.worldSnapshotRoot = props.worldSnapshotRoot ?? null;
     Object.freeze(this);
   }
 
   static create(props: AttestationRecordProps): AttestationRecord {
+    AttestationRecord.assertVersionContract(props);
     // INV-1: gateResult == "pass" iff validatorSet.every(passed || skipped)
     const allGreen = props.subject.validatorSet.every((o) => o.isGreen());
     const expectedGateResult: GateResult = allGreen ? "pass" : "fail";
@@ -149,6 +155,22 @@ export class AttestationRecord {
     return new AttestationRecord(props);
   }
 
+  private static assertVersionContract(props: AttestationRecordProps): void {
+    const v1 =
+      props.schemaVersion === "phasegate-attestation/v1" &&
+      props.predicateType === "https://phasegate.dev/attestation/gate-run/v1" &&
+      props.worldSnapshotRoot === undefined;
+    const v2 =
+      props.schemaVersion === "phasegate-attestation/v2" &&
+      props.predicateType === "https://phasegate.dev/attestation/gate-run/v2" &&
+      props.worldSnapshotRoot !== undefined;
+    if (!v1 && !v2) {
+      throw new AttestationInvariantError(
+        "version contract violated: schema, predicate, and worldSnapshotRoot disagree",
+      );
+    }
+  }
+
   gateResult(): GateResult {
     return this.subject.gateResult;
   }
@@ -165,10 +187,9 @@ export class AttestationRecord {
 
   /**
    * §1.4.1 step1-3: signature ブロック全体と volatile metadata（producedAt/gitCommit）を
-   * 除去した plain object を返す（producer は決定論的なので残す）。
    */
   toCanonicalPayload(): Record<string, unknown> {
-    return {
+    const payload: Record<string, unknown> = {
       schemaVersion: this.schemaVersion,
       predicateType: this.predicateType,
       subject: {
@@ -199,6 +220,10 @@ export class AttestationRecord {
         producer: this.metadata.producer,
       },
     };
+    if (this.worldSnapshotRoot !== null) {
+      payload.worldSnapshotRoot = this.worldSnapshotRoot.value;
+    }
+    return payload;
   }
 
   /**
@@ -222,6 +247,7 @@ export class AttestationRecord {
       metadata: this.metadata,
       signature: SignatureBlock.unsignedPoc(digest),
       acBoundScope: this.acBoundScope,
+      ...(this.worldSnapshotRoot === null ? {} : { worldSnapshotRoot: this.worldSnapshotRoot }),
     });
   }
 
@@ -247,6 +273,15 @@ export class AttestationRecord {
     if (!this.granularity.traceability.equals(other.granularity.traceability)) return false;
     if (this.acBoundScope.length !== other.acBoundScope.length) return false;
     if (!this.acBoundScope.every((s, i) => s === other.acBoundScope[i])) return false;
+    if (this.worldSnapshotRoot === null && other.worldSnapshotRoot !== null) return false;
+    if (this.worldSnapshotRoot !== null && other.worldSnapshotRoot === null) return false;
+    if (
+      this.worldSnapshotRoot !== null &&
+      other.worldSnapshotRoot !== null &&
+      !this.worldSnapshotRoot.equals(other.worldSnapshotRoot)
+    ) {
+      return false;
+    }
     if (!this.signature.equals(other.signature)) return false;
     return true;
   }

package/scripts/harness/attestation/index.ts

@@ -1,15 +1,21 @@
 // @layer infrastructure
 // @unit attestation
+// @work-item-id WI-306
 // index.ts — attestation Unit の公開バレルエクスポート
 
 // Public DTO types
-export type { AttestationDocument } from "./application/dto/attestation-document.js";
+export type {
+  AttestationDocument,
+  AttestationDocumentV1,
+  AttestationDocumentV2,
+} from "./application/dto/attestation-document.js";
 export type { VerifyAttestationOutput } from "./application/dto/verify-attestation-output.js";
 export {
   hashUtf8,
   type Sha256Capability,
   type Sha256DigestString,
 } from "./application/ports/sha256-capability.js";
+export type { WorldSnapshotRootProvider } from "./application/ports/world-snapshot-root-provider.js";
 export type { AttestationModule, AttestationModuleOptions } from "./composition-root.js";
 // Composition Root
 export { createAttestationModule, createSha256Capability } from "./composition-root.js";

package/scripts/harness/attestation/presentation/handlers/attest-handler.ts

@@ -1,5 +1,6 @@
 // @unit attestation
 // @layer presentation
+// @work-item-id WI-306
 
 import type { ProduceAttestationInput } from "../../application/dto/produce-attestation-input.js";
 import type { ProduceAttestationUseCase } from "../../application/usecases/produce-attestation-usecase.js";
@@ -46,8 +47,10 @@ export class AttestHandler {
     const result = await this.useCase.execute(input);
 
     if (result.exitCode === 2) {
-      // 唯一の usecase 由来 2 は mode === "signed"。
-      return { output: 'Error: --mode "signed" is not yet implemented (only unsigned-poc is supported)', exitCode: 2 };
+      const output = result.error
+        ? `Error: ${result.error}`
+        : 'Error: --mode "signed" is not yet implemented (only unsigned-poc is supported)';
+      return { output, exitCode: 2 };
     }
 
     if (result.exitCode === 1) {

package/scripts/harness/config-foundation/application/mappers/validator-system-config-mapper.ts

@@ -7,6 +7,10 @@
  * @work-item-id WI-258
  * @work-item-id WI-259
  * @work-item-id WI-268
+ * @work-item-id WI-300
+ * @work-item-id WI-301
+ * @work-item-id WI-302
+ * @work-item-id WI-320
  */
 import type { HarnessConfigV2 } from "../../domain/harness-config.js";
 
@@ -23,6 +27,7 @@ export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefi
       "ac-bound-coverage": "L3-005",
       "injection-scan": "L3-006",
       "coverage-attestation-verification": "L3-007",
+      "world-constraint-rederivation": "L3-008",
     },
     /^L3-\d{3}$/,
   );
@@ -50,7 +55,10 @@ export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefi
   return {
     project: {
       preset: resolvedConfig.project.preset,
-      languages: resolvedConfig.project.languages ?? ["typescript"],
+      // WI-320 (github#39): 未宣言時に ["typescript"] を注入せず undefined のまま渡す。
+      // HarnessConfigValidatorConfigAdapter.getProjectLanguages() が未宣言時のみ
+      // ファイルシステム検出（WI-319）にフォールバックできるようにするため。
+      ...(resolvedConfig.project.languages === undefined ? {} : { languages: resolvedConfig.project.languages }),
     },
     paths: {
       designDocs: resolvedConfig.paths.designDocs,
@@ -60,7 +68,10 @@ export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefi
       // WI-258 / ADR-030 §Decision.3.②: L2-016 (coverage-attestation-gating) を default-ON でリストに含める。
       L2: {
         enabled: resolvedConfig.layers.L2.enabled,
-        validators: ["L2-001", "L2-002", "L2-003", "L2-013", "L2-014", "L2-015", "L2-016"],
+        validators:
+          resolvedConfig.world?.enabled === true
+            ? ["L2-001", "L2-002", "L2-003", "L2-013", "L2-014", "L2-015", "L2-016", "L2-017"]
+            : ["L2-001", "L2-002", "L2-003", "L2-013", "L2-014", "L2-015", "L2-016"],
       },
       L3: {
         enabled: resolvedConfig.layers.L3.enabled,
@@ -68,13 +79,28 @@ export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefi
         // WI-268 / ADR-030 §Decision.1・§Decision.3.② 第2段: L3-007 (coverage-attestation-verification)
         // は fail-closed default-ON。いずれも fallback 判定の後に force-include し、normalize 結果でも
         // fallback でも常に含める（L3-007 は fail-closed だが現 corpus は実参照 0 件ゆえ緑）。
-        validators: includeValidator(
-          includeValidator(
-            l3Validators.length > 0 ? l3Validators : ["L3-001", "L3-002", "L3-003", "L3-004"],
-            "L3-006",
-          ),
-          "L3-007",
-        ),
+        validators:
+          resolvedConfig.world?.enabled === true
+            ? includeValidator(
+                includeValidator(
+                  includeValidator(
+                    l3Validators.length > 0 ? l3Validators : ["L3-001", "L3-002", "L3-003", "L3-004"],
+                    "L3-006",
+                  ),
+                  "L3-007",
+                ),
+                "L3-008",
+              )
+            : excludeValidator(
+                includeValidator(
+                  includeValidator(
+                    l3Validators.length > 0 ? l3Validators : ["L3-001", "L3-002", "L3-003", "L3-004"],
+                    "L3-006",
+                  ),
+                  "L3-007",
+                ),
+                "L3-008",
+              ),
         coverageThreshold: resolvedConfig.layers.L3.coverageThreshold,
         requirementMatrixPath: resolvedConfig.layers.L3.requirementMatrixPath,
         // WI-227 / H16-03: L3-005 のスコープ（additive-safe。未設定は []）
@@ -96,6 +122,7 @@ export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefi
     validate: {
       failOnWarning: resolvedConfig.validate.failOnWarning,
     },
+    ...(resolvedConfig.world === undefined ? {} : { world: structuredClone(resolvedConfig.world) }),
   };
 }
 
@@ -110,6 +137,10 @@ function includeValidator(validators: readonly string[], validatorId: string): r
   return validators.includes(validatorId) ? validators : [...validators, validatorId];
 }
 
+function excludeValidator(validators: readonly string[], validatorId: string): readonly string[] {
+  return validators.filter((candidate) => candidate !== validatorId);
+}
+
 function normalizeValidators(
   validators: readonly string[],
   aliases: Readonly<Record<string, string>>,

package/scripts/harness/config-foundation/application/mappers/world-model-config-mapper.ts

@@ -0,0 +1,15 @@
+// @unit config-foundation
+// @layer application
+// @work-item-id WI-300
+
+import type { HarnessConfigV2 } from "../../domain/harness-config.js";
+import {
+  WORLD_CONFIG_DEFAULTS,
+  WorldConfig,
+  type WorldConfigDocument,
+} from "../../domain/value-objects/world-config.js";
+
+export function toWorldModelConfig(resolvedConfig: HarnessConfigV2 | undefined): WorldConfigDocument | undefined {
+  if (!resolvedConfig) return undefined;
+  return WorldConfig.create(resolvedConfig.world ?? WORLD_CONFIG_DEFAULTS).toDocument();
+}