phasegate 0.63.0 → 0.65.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phasegate",
-  "version": "0.63.0",
+  "version": "0.65.0",
   "packageManager": "pnpm@10.30.1",
   "description": "Phasegate — AI-agnostic quality defense toolkit. Enforces structural integrity between design intent and code.",
   "license": "Apache-2.0",

package/scripts/harness/agent-integration/application/dto/handle-pre-tool-use-dto.ts

@@ -11,10 +11,12 @@ export interface HandlePreToolUseInput {
 export interface HandlePreToolUseOutput {
   shouldBlock: boolean;
   blockedFilePath?: string;
-  blockReason?: 'PROTECTED_FILE' | 'PHASE_GATE' | 'STORY_REFLECTION';
+  blockReason?: 'PROTECTED_FILE' | 'PHASE_GATE' | 'STORY_REFLECTION' | 'FULL_MODE_REQUIRED';
   error?: { message: string };
   phaseGateBlockers?: string[];
   storyReflectionBlockers?: string[];
   storyReflectionWarnings?: string[];
+  fullModeRejectionRule?: 'MIXED_CHANGES' | 'NEW_DOMAIN' | 'API_CONTRACT';
+  fullModeDominantCategory?: string;
   nextAction?: string;
 }

package/scripts/harness/agent-integration/application/usecases/handle-pre-tool-use-usecase.ts

@@ -13,6 +13,7 @@ import type { BlockMetadata } from '../../domain/value-objects/hook-translation-
 import type { ConfigQueryPort } from '../../domain/ports/config-query-port.js';
 import type { PhaseGateQueryPort } from '../../domain/ports/phase-gate-query-port.js';
 import type { StoryReflectionQueryPort } from '../../domain/ports/story-reflection-query-port.js';
+import type { FullModeRequirementQueryPort } from '../../domain/ports/full-mode-requirement-query-port.js';
 import { WriteTargetScope } from '../../domain/value-objects/write-target-scope.js';
 import type { HandlePreToolUseInput, HandlePreToolUseOutput } from '../dto/handle-pre-tool-use-dto.js';
 
@@ -20,6 +21,7 @@ export interface HandlePreToolUseUseCasePorts {
   configQueryPort: ConfigQueryPort;
   phaseGateQueryPort: PhaseGateQueryPort;
   storyReflectionQueryPort?: StoryReflectionQueryPort;
+  fullModeRequirementQueryPort?: FullModeRequirementQueryPort;
 }
 
 export class HandlePreToolUseInputValidationError extends Error {
@@ -38,10 +40,12 @@ export class HandlePreToolUseUseCase {
   private readonly translator: AsyncHookToCliTranslator;
   private readonly configQueryPort: ConfigQueryPort;
   private readonly storyReflectionQueryPort?: StoryReflectionQueryPort;
+  private readonly fullModeRequirementQueryPort?: FullModeRequirementQueryPort;
 
   constructor(ports: HandlePreToolUseUseCasePorts) {
     this.configQueryPort = ports.configQueryPort;
     this.storyReflectionQueryPort = ports.storyReflectionQueryPort;
+    this.fullModeRequirementQueryPort = ports.fullModeRequirementQueryPort;
     this.translator = new AsyncHookToCliTranslator({
       configQueryPort: ports.configQueryPort,
       reentryGuard: { isActive: () => false } as never,
@@ -79,6 +83,18 @@ export class HandlePreToolUseUseCase {
       };
     }
 
+    if (HandlePreToolUseUseCase.WRITE_TOOLS.has(input.toolName)
+        && this.fullModeRequirementQueryPort !== undefined
+        && input.targetFilePaths.length > 0) {
+      const fullModeResult = await this.fullModeRequirementQueryPort.check(input.targetFilePaths);
+      if (fullModeResult.requiresFullMode) {
+        return HandlePreToolUseUseCase.buildFullModeRequiredBlockOutput(
+          input.targetFilePaths[0],
+          fullModeResult,
+        );
+      }
+    }
+
     const scope = this.resolveStoryReflectionScope(input);
     if (scope === null || this.storyReflectionQueryPort === undefined) {
       return { shouldBlock: false };
@@ -97,6 +113,41 @@ export class HandlePreToolUseUseCase {
     );
   }
 
+  private static buildFullModeRequiredBlockOutput(
+    blockedFilePath: string | undefined,
+    result: {
+      requiresFullMode: boolean;
+      rejectionRule?: 'MIXED_CHANGES' | 'NEW_DOMAIN' | 'API_CONTRACT';
+      rejectionReason?: string;
+      dominantCategory?: string;
+    },
+  ): HandlePreToolUseOutput {
+    const fp = blockedFilePath ?? '不明なファイル';
+    const lines: string[] = [
+      `Full mode 必須変更が検出されました: ${fp}`,
+    ];
+    if (result.dominantCategory) {
+      lines.push(`カテゴリ: ${result.dominantCategory}`);
+    }
+    if (result.rejectionRule) {
+      lines.push(`判定ルール: ${result.rejectionRule}`);
+    }
+    if (result.rejectionReason) {
+      lines.push(`理由: ${result.rejectionReason}`);
+    }
+    lines.push('次のアクション: /story-implementor スキルを使用して設計フェーズから開始してください。');
+
+    return {
+      shouldBlock: true,
+      blockedFilePath,
+      blockReason: 'FULL_MODE_REQUIRED',
+      error: { message: lines.join('\n') },
+      fullModeRejectionRule: result.rejectionRule,
+      fullModeDominantCategory: result.dominantCategory,
+      nextAction: '/story-implementor',
+    };
+  }
+
   private resolveStoryReflectionScope(input: HandlePreToolUseInput): WriteTargetScope | null {
     if (!HandlePreToolUseUseCase.WRITE_TOOLS.has(input.toolName)) {
       return null;

package/scripts/harness/agent-integration/domain/ports/full-mode-requirement-query-port.ts

@@ -0,0 +1,13 @@
+// @unit agent-integration
+// @layer domain
+
+export interface FullModeRequirementQueryResult {
+  readonly requiresFullMode: boolean;
+  readonly rejectionRule?: 'MIXED_CHANGES' | 'NEW_DOMAIN' | 'API_CONTRACT';
+  readonly rejectionReason?: string;
+  readonly dominantCategory?: string;
+}
+
+export interface FullModeRequirementQueryPort {
+  check(targetFilePaths: readonly string[]): Promise<FullModeRequirementQueryResult>;
+}

package/scripts/harness/agent-integration/domain/value-objects/hook-translation-result.ts

@@ -8,7 +8,7 @@
 
 export type SkipReason = 'REENTRY_DETECTED' | 'HOOK_DISABLED' | 'TIMEOUT_EXCEEDED';
 
-export type BlockReason = 'PROTECTED_FILE' | 'PHASE_GATE';
+export type BlockReason = 'PROTECTED_FILE' | 'PHASE_GATE' | 'FULL_MODE_REQUIRED';
 
 export interface BlockMetadata {
   readonly reason: BlockReason;
@@ -18,6 +18,9 @@ export interface BlockMetadata {
   readonly scopeLevel?: 1 | 2 | 3;
   readonly unitId?: string;
   readonly storyId?: string;
+  readonly fullModeRejectionRule?: 'MIXED_CHANGES' | 'NEW_DOMAIN' | 'API_CONTRACT';
+  readonly fullModeRejectionReason?: string;
+  readonly fullModeDominantCategory?: string;
 }
 
 export class HookTranslationResultInvariantError extends Error {

package/scripts/harness/agent-integration/infrastructure/adapters/quick-mode-full-mode-requirement-adapter.ts

@@ -0,0 +1,45 @@
+// @unit agent-integration
+// @layer infrastructure
+
+import type {
+  FullModeRequirementQueryPort,
+  FullModeRequirementQueryResult,
+} from '../../domain/ports/full-mode-requirement-query-port.js';
+import type { ClassifyChangeCategoryUseCase } from '../../../quick-mode/application/usecases/classify-change-category-usecase.js';
+
+export interface QuickModeFullModeRequirementAdapterDeps {
+  classifyUseCaseFactory: () => ClassifyChangeCategoryUseCase;
+}
+
+export class QuickModeFullModeRequirementAdapter implements FullModeRequirementQueryPort {
+  private readonly classifyUseCaseFactory: () => ClassifyChangeCategoryUseCase;
+
+  constructor(deps: QuickModeFullModeRequirementAdapterDeps) {
+    this.classifyUseCaseFactory = deps.classifyUseCaseFactory;
+  }
+
+  async check(targetFilePaths: readonly string[]): Promise<FullModeRequirementQueryResult> {
+    if (targetFilePaths.length === 0) {
+      return { requiresFullMode: false };
+    }
+
+    try {
+      const useCase = this.classifyUseCaseFactory();
+      const contract = await useCase.execute({ paths: [...targetFilePaths] });
+      if (!contract.fullModeRequired) {
+        return {
+          requiresFullMode: false,
+          dominantCategory: contract.dominantCategory ?? undefined,
+        };
+      }
+      return {
+        requiresFullMode: true,
+        rejectionRule: contract.rejectionRule,
+        rejectionReason: contract.rejectionReason,
+        dominantCategory: contract.dominantCategory ?? undefined,
+      };
+    } catch {
+      return { requiresFullMode: false };
+    }
+  }
+}

package/scripts/harness/agent-integration/presentation/pre-tool-use-hook.ts

@@ -12,6 +12,8 @@ import { BashWriteTargetExtractor } from '../domain/services/bash-write-target-e
 import { HarnessConfigConfigQueryAdapter } from '../infrastructure/adapters/harness-config-config-query-adapter.js';
 import { PhaseGateQueryAdapter } from '../infrastructure/adapters/phase-gate-query-adapter.js';
 import { FileSystemStoryReflectionQueryAdapter } from '../infrastructure/adapters/file-system-story-reflection-query-adapter.js';
+import { QuickModeFullModeRequirementAdapter } from '../infrastructure/adapters/quick-mode-full-mode-requirement-adapter.js';
+import { createQuickModeCompositionRoot } from '../../quick-mode/composition-root.js';
 import * as path from 'node:path';
 import * as fs from 'node:fs/promises';
 
@@ -118,10 +120,14 @@ async function main(): Promise<void> {
       rootDir: path.dirname(configPath),
       configPath,
     });
+    const fullModeRequirementQueryPort = new QuickModeFullModeRequirementAdapter({
+      classifyUseCaseFactory: () => createQuickModeCompositionRoot().classifyUseCase,
+    });
     const useCase = new HandlePreToolUseUseCase({
       configQueryPort,
       phaseGateQueryPort,
       storyReflectionQueryPort,
+      fullModeRequirementQueryPort,
     });
 
     const output = await useCase.execute({ toolName: effectiveToolName, targetFilePaths });

package/scripts/harness/ci-governance/application/dto/create-baseline-input.ts

@@ -0,0 +1,9 @@
+// @unit ci-governance
+// @layer application
+
+export interface CreateBaselineInput {
+  readonly include?: readonly string[];
+  readonly exclude?: readonly string[];
+  readonly dryRun?: boolean;
+  readonly force?: boolean;
+}

package/scripts/harness/ci-governance/application/dto/create-baseline-output.ts

@@ -0,0 +1,15 @@
+// @unit ci-governance
+// @layer application
+
+export interface CreateBaselineOutputEntry {
+  readonly path: string;
+  readonly sha1: string;
+}
+
+export interface CreateBaselineOutput {
+  readonly savedPath: string;
+  readonly entryCount: number;
+  readonly dryRun: boolean;
+  readonly overwriteBlocked: boolean;
+  readonly entries: readonly CreateBaselineOutputEntry[];
+}

package/scripts/harness/ci-governance/application/usecases/create-baseline-usecase.ts

@@ -0,0 +1,95 @@
+// @unit ci-governance
+// @layer application
+
+import type { FileScannerPort } from '../../domain/ports/file-scanner-port.js';
+import type { FileHasherPort } from '../../domain/ports/file-hasher-port.js';
+import type { BaselineRepositoryPort } from '../../domain/ports/baseline-repository-port.js';
+import { BaselineEntry } from '../../domain/value-objects/baseline-entry.js';
+import { BaselineSnapshot } from '../../domain/value-objects/baseline-snapshot.js';
+import type { CreateBaselineInput } from '../dto/create-baseline-input.js';
+import type { CreateBaselineOutput } from '../dto/create-baseline-output.js';
+
+export const DEFAULT_BASELINE_INCLUDE: readonly string[] = Object.freeze([
+  'scripts/**/*.ts',
+  'src/**/*.ts',
+  'src/**/*.tsx',
+  'src/**/*.js',
+  'src/**/*.jsx',
+  'docs/product/construction/**/*.md',
+  'docs/inception/**/*.md',
+]);
+
+export const DEFAULT_BASELINE_EXCLUDE: readonly string[] = Object.freeze([
+  'node_modules/**',
+  'dist/**',
+  'build/**',
+  '.next/**',
+  'coverage/**',
+  '**/__tests__/**',
+  '**/*.test.ts',
+  '**/*.spec.ts',
+]);
+
+export class CreateBaselineUseCase {
+  constructor(
+    private readonly scanner: FileScannerPort,
+    private readonly hasher: FileHasherPort,
+    private readonly repository: BaselineRepositoryPort,
+    private readonly clock: () => Date = () => new Date(),
+  ) {}
+
+  async execute(input: CreateBaselineInput = {}): Promise<CreateBaselineOutput> {
+    const include = input.include ?? DEFAULT_BASELINE_INCLUDE;
+    const exclude = input.exclude ?? DEFAULT_BASELINE_EXCLUDE;
+    const dryRun = input.dryRun === true;
+    const force = input.force === true;
+
+    const savedPath = this.repository.getPath();
+
+    if (!dryRun && !force && (await this.repository.exists())) {
+      return {
+        savedPath,
+        entryCount: 0,
+        dryRun: false,
+        overwriteBlocked: true,
+        entries: [],
+      };
+    }
+
+    const scanned = await this.scanner.scan({ include, exclude });
+    const sortedPaths = [...scanned].sort();
+
+    const entries: BaselineEntry[] = [];
+    for (const p of sortedPaths) {
+      const sha1 = await this.hasher.hashFile(p);
+      entries.push(BaselineEntry.create({ path: p, sha1 }));
+    }
+
+    const snapshot = BaselineSnapshot.create({
+      createdAt: this.clock().toISOString(),
+      algorithm: 'sha1',
+      entries,
+    });
+
+    const outputEntries = entries.map((e) => ({ path: e.path, sha1: e.sha1 }));
+
+    if (dryRun) {
+      return {
+        savedPath,
+        entryCount: snapshot.entryCount,
+        dryRun: true,
+        overwriteBlocked: false,
+        entries: outputEntries,
+      };
+    }
+
+    const writtenPath = await this.repository.save(snapshot);
+    return {
+      savedPath: writtenPath,
+      entryCount: snapshot.entryCount,
+      dryRun: false,
+      overwriteBlocked: false,
+      entries: outputEntries,
+    };
+  }
+}

package/scripts/harness/ci-governance/composition-root.ts

@@ -33,17 +33,25 @@ import { AdrFoundationExistenceAdapter } from './infrastructure/adapters/adr-fou
 import { GenerateCiTemplateHandler } from './presentation/handlers/generate-ci-template-handler.js';
 import { MigrateAgentsMdHandler } from './presentation/handlers/migrate-agents-md-handler.js';
 import { CheckRepetitionHandler } from './presentation/handlers/check-repetition-handler.js';
+import { CreateBaselineHandler } from './presentation/handlers/create-baseline-handler.js';
+
+import { CreateBaselineUseCase } from './application/usecases/create-baseline-usecase.js';
+import { GlobFileScannerAdapter } from './infrastructure/adapters/glob-file-scanner-adapter.js';
+import { FileSystemSha1HasherAdapter } from './infrastructure/adapters/file-system-sha1-hasher-adapter.js';
+import { BaselineJsonRepositoryAdapter } from './infrastructure/adapters/baseline-json-repository-adapter.js';
 
 export interface CiGovernanceCompositionRoot {
   generateCiTemplateHandler: GenerateCiTemplateHandler;
   migrateAgentsMdHandler: MigrateAgentsMdHandler;
   checkRepetitionHandler: CheckRepetitionHandler;
+  createBaselineHandler: CreateBaselineHandler;
   // Use cases exposed for direct access
   recordErrorOccurrenceUseCase: RecordErrorOccurrenceUseCase;
   checkEscalationUseCase: CheckEscalationUseCase;
   resetRepetitionUseCase: ResetRepetitionUseCase;
   aggregateLessonsUseCase: AggregateLessonsUseCase;
   validatePointersUseCase: ValidatePointersUseCase;
+  createBaselineUseCase: CreateBaselineUseCase;
 }
 
 export function buildCiGovernance(baseDir: string): CiGovernanceCompositionRoot {
@@ -80,6 +88,16 @@ export function buildCiGovernance(baseDir: string): CiGovernanceCompositionRoot
   const aggregateLessonsUseCase = new AggregateLessonsUseCase(lessonArtifactReaderPort, lessonAggregator);
   const validatePointersUseCase = new ValidatePointersUseCase(agentsMdPort, pointerValidator);
 
+  // Baseline adapters & use case (ISSUE-007 Wave 1)
+  const fileScanner = new GlobFileScannerAdapter(baseDir);
+  const fileHasher = new FileSystemSha1HasherAdapter(baseDir);
+  const baselineRepository = new BaselineJsonRepositoryAdapter(baseDir);
+  const createBaselineUseCase = new CreateBaselineUseCase(
+    fileScanner,
+    fileHasher,
+    baselineRepository,
+  );
+
   // Handlers
   const generateCiTemplateHandler = new GenerateCiTemplateHandler(
     generateCiTemplateUseCase,
@@ -87,15 +105,18 @@ export function buildCiGovernance(baseDir: string): CiGovernanceCompositionRoot
   );
   const migrateAgentsMdHandler = new MigrateAgentsMdHandler(migrateAgentsMdUseCase);
   const checkRepetitionHandler = new CheckRepetitionHandler(checkEscalationUseCase);
+  const createBaselineHandler = new CreateBaselineHandler(createBaselineUseCase);
 
   return {
     generateCiTemplateHandler,
     migrateAgentsMdHandler,
     checkRepetitionHandler,
+    createBaselineHandler,
     recordErrorOccurrenceUseCase,
     checkEscalationUseCase,
     resetRepetitionUseCase,
     aggregateLessonsUseCase,
     validatePointersUseCase,
+    createBaselineUseCase,
   };
 }

package/scripts/harness/ci-governance/domain/ports/baseline-repository-port.ts

@@ -0,0 +1,11 @@
+// @unit ci-governance
+// @layer domain
+
+import type { BaselineSnapshot } from '../value-objects/baseline-snapshot.js';
+
+export interface BaselineRepositoryPort {
+  save(snapshot: BaselineSnapshot): Promise<string>;
+  load(): Promise<BaselineSnapshot | null>;
+  exists(): Promise<boolean>;
+  getPath(): string;
+}

package/scripts/harness/ci-governance/domain/ports/file-hasher-port.ts

@@ -0,0 +1,6 @@
+// @unit ci-governance
+// @layer domain
+
+export interface FileHasherPort {
+  hashFile(relativePath: string): Promise<string>;
+}

package/scripts/harness/ci-governance/domain/ports/file-scanner-port.ts

@@ -0,0 +1,11 @@
+// @unit ci-governance
+// @layer domain
+
+export interface FileScanOptions {
+  readonly include: readonly string[];
+  readonly exclude: readonly string[];
+}
+
+export interface FileScannerPort {
+  scan(options: FileScanOptions): Promise<readonly string[]>;
+}

package/scripts/harness/ci-governance/domain/value-objects/baseline-entry.ts

@@ -0,0 +1,34 @@
+// @unit ci-governance
+// @layer domain
+
+export interface BaselineEntryProps {
+  readonly path: string;
+  readonly sha1: string;
+}
+
+export class BaselineEntry {
+  readonly path: string;
+  readonly sha1: string;
+
+  private constructor(props: BaselineEntryProps) {
+    this.path = props.path;
+    this.sha1 = props.sha1;
+    Object.freeze(this);
+  }
+
+  static create(props: BaselineEntryProps): BaselineEntry {
+    if (props.path.length === 0) {
+      throw new Error('BaselineEntry: path must not be empty');
+    }
+    if (!/^[0-9a-f]{40}$/.test(props.sha1)) {
+      throw new Error(
+        `BaselineEntry: sha1 must be 40 lowercase hex chars, got: ${props.sha1}`,
+      );
+    }
+    return new BaselineEntry(props);
+  }
+
+  equals(other: BaselineEntry): boolean {
+    return this.path === other.path && this.sha1 === other.sha1;
+  }
+}

package/scripts/harness/ci-governance/domain/value-objects/baseline-snapshot.ts

@@ -0,0 +1,55 @@
+// @unit ci-governance
+// @layer domain
+
+import { BaselineEntry } from './baseline-entry.js';
+
+export interface BaselineSnapshotProps {
+  readonly createdAt: string;
+  readonly algorithm: 'sha1';
+  readonly entries: readonly BaselineEntry[];
+}
+
+const ISO_8601_UTC_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/;
+
+export class BaselineSnapshot {
+  readonly createdAt: string;
+  readonly algorithm: 'sha1';
+  readonly entries: readonly BaselineEntry[];
+  private readonly pathIndex: ReadonlySet<string>;
+
+  private constructor(props: BaselineSnapshotProps) {
+    this.createdAt = props.createdAt;
+    this.algorithm = props.algorithm;
+    this.entries = Object.freeze([...props.entries]);
+    this.pathIndex = new Set(props.entries.map((e) => e.path));
+  }
+
+  static create(props: BaselineSnapshotProps): BaselineSnapshot {
+    if (!ISO_8601_UTC_RE.test(props.createdAt)) {
+      throw new Error(
+        `BaselineSnapshot: createdAt must be ISO 8601 UTC, got: ${props.createdAt}`,
+      );
+    }
+    if (props.algorithm !== 'sha1') {
+      throw new Error(
+        `BaselineSnapshot: algorithm must be 'sha1', got: ${props.algorithm}`,
+      );
+    }
+    const seen = new Set<string>();
+    for (const e of props.entries) {
+      if (seen.has(e.path)) {
+        throw new Error(`BaselineSnapshot: duplicate path ${e.path}`);
+      }
+      seen.add(e.path);
+    }
+    return new BaselineSnapshot(props);
+  }
+
+  contains(path: string): boolean {
+    return this.pathIndex.has(path);
+  }
+
+  get entryCount(): number {
+    return this.entries.length;
+  }
+}

package/scripts/harness/ci-governance/infrastructure/adapters/baseline-json-repository-adapter.ts

@@ -0,0 +1,91 @@
+// @unit ci-governance
+// @layer infrastructure
+
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import type { BaselineRepositoryPort } from '../../domain/ports/baseline-repository-port.js';
+import { BaselineSnapshot } from '../../domain/value-objects/baseline-snapshot.js';
+import { BaselineEntry } from '../../domain/value-objects/baseline-entry.js';
+
+interface BaselineJsonV1 {
+  readonly version: '1.0';
+  readonly createdAt: string;
+  readonly algorithm: 'sha1';
+  readonly files: ReadonlyArray<{ readonly path: string; readonly sha1: string }>;
+}
+
+export class BaselineJsonRepositoryAdapter implements BaselineRepositoryPort {
+  private readonly filePath: string;
+
+  constructor(baseDir: string, relativePath = '.phasegate/baseline.json') {
+    this.filePath = path.isAbsolute(relativePath)
+      ? relativePath
+      : path.join(baseDir, relativePath);
+  }
+
+  getPath(): string {
+    return this.filePath;
+  }
+
+  async exists(): Promise<boolean> {
+    try {
+      await fs.access(this.filePath);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  async save(snapshot: BaselineSnapshot): Promise<string> {
+    const data: BaselineJsonV1 = {
+      version: '1.0',
+      createdAt: snapshot.createdAt,
+      algorithm: snapshot.algorithm,
+      files: snapshot.entries.map((e) => ({ path: e.path, sha1: e.sha1 })),
+    };
+    await fs.mkdir(path.dirname(this.filePath), { recursive: true });
+    await fs.writeFile(
+      this.filePath,
+      `${JSON.stringify(data, null, 2)}\n`,
+      'utf-8',
+    );
+    return this.filePath;
+  }
+
+  async load(): Promise<BaselineSnapshot | null> {
+    let content: string;
+    try {
+      content = await fs.readFile(this.filePath, 'utf-8');
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code === 'ENOENT') return null;
+      throw err;
+    }
+
+    let parsed: BaselineJsonV1;
+    try {
+      parsed = JSON.parse(content) as BaselineJsonV1;
+    } catch (err) {
+      throw new Error(
+        `Invalid baseline JSON at ${this.filePath}: ${String(err)}`,
+      );
+    }
+
+    if (
+      !parsed ||
+      parsed.version !== '1.0' ||
+      parsed.algorithm !== 'sha1' ||
+      !Array.isArray(parsed.files)
+    ) {
+      throw new Error(`Invalid baseline JSON schema at ${this.filePath}`);
+    }
+
+    const entries = parsed.files.map((f) =>
+      BaselineEntry.create({ path: f.path, sha1: f.sha1 }),
+    );
+    return BaselineSnapshot.create({
+      createdAt: parsed.createdAt,
+      algorithm: parsed.algorithm,
+      entries,
+    });
+  }
+}

package/scripts/harness/ci-governance/infrastructure/adapters/file-system-sha1-hasher-adapter.ts

@@ -0,0 +1,19 @@
+// @unit ci-governance
+// @layer infrastructure
+
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as crypto from 'node:crypto';
+import type { FileHasherPort } from '../../domain/ports/file-hasher-port.js';
+
+export class FileSystemSha1HasherAdapter implements FileHasherPort {
+  constructor(private readonly baseDir: string) {}
+
+  async hashFile(relativePath: string): Promise<string> {
+    const absPath = path.isAbsolute(relativePath)
+      ? relativePath
+      : path.join(this.baseDir, relativePath);
+    const content = await fs.readFile(absPath);
+    return crypto.createHash('sha1').update(content).digest('hex');
+  }
+}

package/scripts/harness/ci-governance/infrastructure/adapters/glob-file-scanner-adapter.ts

@@ -0,0 +1,79 @@
+// @unit ci-governance
+// @layer infrastructure
+
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { createRequire } from 'node:module';
+import type {
+  FileScannerPort,
+  FileScanOptions,
+} from '../../domain/ports/file-scanner-port.js';
+
+const require = createRequire(import.meta.url);
+const picomatch = require('picomatch') as (
+  pattern: string,
+  options?: { dot?: boolean },
+) => (p: string) => boolean;
+
+const HARD_SKIP_DIRS: ReadonlySet<string> = new Set([
+  'node_modules',
+  '.git',
+  'dist',
+  'build',
+  '.next',
+  'coverage',
+  '.phasegate',
+]);
+
+export class GlobFileScannerAdapter implements FileScannerPort {
+  constructor(private readonly baseDir: string) {}
+
+  async scan(options: FileScanOptions): Promise<readonly string[]> {
+    const includeMatchers = options.include.map((p) =>
+      picomatch(p, { dot: true }),
+    );
+    const excludeMatchers = options.exclude.map((p) =>
+      picomatch(p, { dot: true }),
+    );
+    const collected: string[] = [];
+    await this.walk(this.baseDir, '', includeMatchers, excludeMatchers, collected);
+    return collected.sort();
+  }
+
+  private async walk(
+    absDir: string,
+    relDir: string,
+    includeMatchers: Array<(p: string) => boolean>,
+    excludeMatchers: Array<(p: string) => boolean>,
+    out: string[],
+  ): Promise<void> {
+    let entries: Array<{
+      name: string;
+      isDirectory: () => boolean;
+      isFile: () => boolean;
+    }>;
+    try {
+      entries = (await fs.readdir(absDir, {
+        withFileTypes: true,
+      })) as unknown as typeof entries;
+    } catch {
+      return;
+    }
+
+    for (const ent of entries) {
+      if (ent.isDirectory() && HARD_SKIP_DIRS.has(ent.name)) continue;
+      const relPath = relDir === '' ? ent.name : `${relDir}/${ent.name}`;
+      const absPath = path.join(absDir, ent.name);
+
+      if (ent.isDirectory()) {
+        await this.walk(absPath, relPath, includeMatchers, excludeMatchers, out);
+        continue;
+      }
+
+      if (!ent.isFile()) continue;
+      if (!includeMatchers.some((m) => m(relPath))) continue;
+      if (excludeMatchers.some((m) => m(relPath))) continue;
+      out.push(relPath);
+    }
+  }
+}

package/scripts/harness/ci-governance/presentation/handlers/create-baseline-handler.ts

@@ -0,0 +1,57 @@
+// @unit ci-governance
+// @layer presentation
+
+import type { CreateBaselineUseCase } from '../../application/usecases/create-baseline-usecase.js';
+
+export interface CreateBaselineHandlerArgs {
+  readonly include?: readonly string[];
+  readonly exclude?: readonly string[];
+  readonly dryRun?: boolean;
+  readonly force?: boolean;
+  readonly format?: 'human' | 'json';
+}
+
+export interface CreateBaselineHandlerResult {
+  readonly exitCode: number;
+  readonly output: string;
+}
+
+export class CreateBaselineHandler {
+  constructor(private readonly useCase: CreateBaselineUseCase) {}
+
+  async handle(args: CreateBaselineHandlerArgs): Promise<CreateBaselineHandlerResult> {
+    const format = args.format ?? 'human';
+    const result = await this.useCase.execute({
+      include: args.include,
+      exclude: args.exclude,
+      dryRun: args.dryRun,
+      force: args.force,
+    });
+
+    if (format === 'json') {
+      return {
+        exitCode: result.overwriteBlocked ? 2 : 0,
+        output: JSON.stringify(result, null, 2),
+      };
+    }
+
+    if (result.overwriteBlocked) {
+      return {
+        exitCode: 2,
+        output: [
+          `baseline は既に存在します: ${result.savedPath}`,
+          '上書きするには --force を指定してください。',
+          '生成内容のみを確認したい場合は --dry-run を指定してください。',
+        ].join('\n'),
+      };
+    }
+
+    const header = result.dryRun
+      ? `[dry run] baseline を生成しました（保存先想定: ${result.savedPath}）`
+      : `baseline を保存しました: ${result.savedPath}`;
+    return {
+      exitCode: 0,
+      output: [header, `エントリ数: ${result.entryCount}`].join('\n'),
+    };
+  }
+}

package/scripts/harness/config-foundation/infrastructure/schemas/harness-config-v2.schema.json

@@ -439,6 +439,19 @@
           "uniqueItems": true
         }
       }
+    },
+    "baseline": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": {
+          "type": "boolean"
+        },
+        "path": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
     }
   }
 }

package/scripts/harness/main.ts

@@ -88,6 +88,7 @@ Commands:
   ci:generate-template         Generate CI template (--preset <id>, --type <aidlc-gate|consistency-check|pre-commit>, --render, --json)
   ci:migrate-agents-md         Migrate AGENTS.md (--dry-run, --validate-only, --json)
   ci:check-repetition          Check error repetition (--code <errorCode>, --reset, --json)
+  baseline                     Create retrofit baseline snapshot (--dry-run, --force, --paths <glob,glob,...>, --json)
 
   skill:execute-tdd-cycle      Execute TDD cycle (--unit, --story, --desc, --phase RED|GREEN|REFACTOR, --passed)
   skill:check-coverage         Check coverage (--story <storyId>, --json)
@@ -896,6 +897,26 @@ Examples:
         break;
       }
 
+      case 'baseline': {
+        const mod = buildCiGovernance(rootDir);
+        const dryRun = hasFlag(args, '--dry-run');
+        const force = hasFlag(args, '--force');
+        const pathsFlag = parseFlag(args, '--paths');
+        const include = pathsFlag
+          ? pathsFlag.split(',').map((s) => s.trim()).filter(Boolean)
+          : undefined;
+        const format = json ? 'json' : 'human';
+        const result = await mod.createBaselineHandler.handle({
+          include,
+          dryRun,
+          force,
+          format,
+        });
+        console.log(result.output);
+        process.exit(result.exitCode);
+        break;
+      }
+
       // ── skill-quality ──
       case 'skill:execute-tdd-cycle': {
         const mod = createSkillQualityHandlers();