phasegate 0.64.0 → 0.66.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phasegate",
-  "version": "0.64.0",
+  "version": "0.66.0",
   "packageManager": "pnpm@10.30.1",
   "description": "Phasegate — AI-agnostic quality defense toolkit. Enforces structural integrity between design intent and code.",
   "license": "Apache-2.0",

package/scripts/harness/agent-integration/application/usecases/handle-pre-tool-use-usecase.ts

@@ -14,6 +14,10 @@ import type { ConfigQueryPort } from '../../domain/ports/config-query-port.js';
 import type { PhaseGateQueryPort } from '../../domain/ports/phase-gate-query-port.js';
 import type { StoryReflectionQueryPort } from '../../domain/ports/story-reflection-query-port.js';
 import type { FullModeRequirementQueryPort } from '../../domain/ports/full-mode-requirement-query-port.js';
+import type {
+  BaselineGrandfatherCheckResult,
+  BaselineGrandfatherQueryPort,
+} from '../../domain/ports/baseline-grandfather-query-port.js';
 import { WriteTargetScope } from '../../domain/value-objects/write-target-scope.js';
 import type { HandlePreToolUseInput, HandlePreToolUseOutput } from '../dto/handle-pre-tool-use-dto.js';
 
@@ -22,6 +26,8 @@ export interface HandlePreToolUseUseCasePorts {
   phaseGateQueryPort: PhaseGateQueryPort;
   storyReflectionQueryPort?: StoryReflectionQueryPort;
   fullModeRequirementQueryPort?: FullModeRequirementQueryPort;
+  baselineGrandfatherQueryPort?: BaselineGrandfatherQueryPort;
+  grandfatherLogger?: (reason: string, targetFilePaths: readonly string[]) => void;
 }
 
 export class HandlePreToolUseInputValidationError extends Error {
@@ -41,11 +47,23 @@ export class HandlePreToolUseUseCase {
   private readonly configQueryPort: ConfigQueryPort;
   private readonly storyReflectionQueryPort?: StoryReflectionQueryPort;
   private readonly fullModeRequirementQueryPort?: FullModeRequirementQueryPort;
+  private readonly baselineGrandfatherQueryPort?: BaselineGrandfatherQueryPort;
+  private readonly grandfatherLogger: (
+    reason: string,
+    targetFilePaths: readonly string[],
+  ) => void;
 
   constructor(ports: HandlePreToolUseUseCasePorts) {
     this.configQueryPort = ports.configQueryPort;
     this.storyReflectionQueryPort = ports.storyReflectionQueryPort;
     this.fullModeRequirementQueryPort = ports.fullModeRequirementQueryPort;
+    this.baselineGrandfatherQueryPort = ports.baselineGrandfatherQueryPort;
+    this.grandfatherLogger =
+      ports.grandfatherLogger ??
+      ((reason, paths) =>
+        process.stderr.write(
+          `[baseline] grandfather skip (${reason}): ${paths.join(', ')}\n`,
+        ));
     this.translator = new AsyncHookToCliTranslator({
       configQueryPort: ports.configQueryPort,
       reentryGuard: { isActive: () => false } as never,
@@ -59,6 +77,8 @@ export class HandlePreToolUseUseCase {
       throw new HandlePreToolUseInputValidationError('toolNameは必須です（空文字不可）');
     }
 
+    const grandfather = await this.checkGrandfather(input.targetFilePaths);
+
     const hookEvent = HookEvent.createPreToolUse(input.toolName, input.targetFilePaths);
     const result = await this.translator.translate(hookEvent);
 
@@ -66,32 +86,41 @@ export class HandlePreToolUseUseCase {
       const metadata = result.blockMetadata;
       const blockedFilePath = metadata?.blockedFilePath ?? input.targetFilePaths[0];
 
-      if (metadata?.reason === 'PHASE_GATE') {
-        return HandlePreToolUseUseCase.buildPhaseGateBlockOutput(blockedFilePath, metadata);
-      }
-
       if (metadata?.reason === 'PROTECTED_FILE') {
         return HandlePreToolUseUseCase.buildProtectedFileBlockOutput(blockedFilePath);
       }
 
-      return {
-        shouldBlock: true,
-        blockedFilePath,
-        error: {
-          message: `ブロックされました: ${blockedFilePath ?? '不明なファイル'}`,
-        },
-      };
+      if (metadata?.reason === 'PHASE_GATE') {
+        if (grandfather.allGrandfathered) {
+          this.grandfatherLogger('phase-gate', input.targetFilePaths);
+          // fallthrough: continue to full-mode / story-reflection checks (which may also grandfather)
+        } else {
+          return HandlePreToolUseUseCase.buildPhaseGateBlockOutput(blockedFilePath, metadata);
+        }
+      } else {
+        return {
+          shouldBlock: true,
+          blockedFilePath,
+          error: {
+            message: `ブロックされました: ${blockedFilePath ?? '不明なファイル'}`,
+          },
+        };
+      }
     }
 
     if (HandlePreToolUseUseCase.WRITE_TOOLS.has(input.toolName)
         && this.fullModeRequirementQueryPort !== undefined
         && input.targetFilePaths.length > 0) {
-      const fullModeResult = await this.fullModeRequirementQueryPort.check(input.targetFilePaths);
-      if (fullModeResult.requiresFullMode) {
-        return HandlePreToolUseUseCase.buildFullModeRequiredBlockOutput(
-          input.targetFilePaths[0],
-          fullModeResult,
-        );
+      if (grandfather.allGrandfathered) {
+        this.grandfatherLogger('full-mode', input.targetFilePaths);
+      } else {
+        const fullModeResult = await this.fullModeRequirementQueryPort.check(input.targetFilePaths);
+        if (fullModeResult.requiresFullMode) {
+          return HandlePreToolUseUseCase.buildFullModeRequiredBlockOutput(
+            input.targetFilePaths[0],
+            fullModeResult,
+          );
+        }
       }
     }
 
@@ -100,6 +129,11 @@ export class HandlePreToolUseUseCase {
       return { shouldBlock: false };
     }
 
+    if (grandfather.allGrandfathered) {
+      this.grandfatherLogger('story-reflection', input.targetFilePaths);
+      return { shouldBlock: false };
+    }
+
     const reflectionResult = await this.storyReflectionQueryPort.checkReflection(scope.unitId!);
 
     if (reflectionResult.skipped || reflectionResult.passed) {
@@ -113,6 +147,27 @@ export class HandlePreToolUseUseCase {
     );
   }
 
+  private async checkGrandfather(
+    targetFilePaths: readonly string[],
+  ): Promise<BaselineGrandfatherCheckResult> {
+    if (this.baselineGrandfatherQueryPort === undefined) {
+      return {
+        allGrandfathered: false,
+        baselineEnabled: false,
+        grandfatheredPaths: [],
+      };
+    }
+    try {
+      return await this.baselineGrandfatherQueryPort.check(targetFilePaths);
+    } catch {
+      return {
+        allGrandfathered: false,
+        baselineEnabled: false,
+        grandfatheredPaths: [],
+      };
+    }
+  }
+
   private static buildFullModeRequiredBlockOutput(
     blockedFilePath: string | undefined,
     result: {

package/scripts/harness/agent-integration/domain/ports/baseline-grandfather-query-port.ts

@@ -0,0 +1,12 @@
+// @unit agent-integration
+// @layer domain
+
+export interface BaselineGrandfatherCheckResult {
+  readonly allGrandfathered: boolean;
+  readonly baselineEnabled: boolean;
+  readonly grandfatheredPaths: readonly string[];
+}
+
+export interface BaselineGrandfatherQueryPort {
+  check(targetFilePaths: readonly string[]): Promise<BaselineGrandfatherCheckResult>;
+}

package/scripts/harness/agent-integration/domain/ports/config-query-port.ts

@@ -5,10 +5,16 @@ import type { ProjectPaths } from '../value-objects/project-paths.js';
 
 export type HookType = 'pre-tool-use' | 'post-tool-use' | 'stop';
 
+export interface BaselineConfig {
+  readonly enabled: boolean;
+  readonly path: string;
+}
+
 export interface ConfigQueryPort {
   isHookEnabled(hookType: HookType): Promise<boolean>;
   getProtectedFilePatterns(): Promise<string[]>;
   getProtectedFileExclusions(): Promise<string[]>;
   getRelaxedGates(): Promise<readonly string[]>;
   getProjectPaths(): ProjectPaths;
+  getBaselineConfig(): Promise<BaselineConfig>;
 }

package/scripts/harness/agent-integration/infrastructure/adapters/ci-governance-baseline-grandfather-adapter.ts

@@ -0,0 +1,90 @@
+// @unit agent-integration
+// @layer infrastructure
+
+import type {
+  BaselineGrandfatherQueryPort,
+  BaselineGrandfatherCheckResult,
+} from '../../domain/ports/baseline-grandfather-query-port.js';
+import type { ConfigQueryPort } from '../../domain/ports/config-query-port.js';
+import type { BaselineRepositoryPort } from '../../../ci-governance/domain/ports/baseline-repository-port.js';
+import { BaselineJsonRepositoryAdapter } from '../../../ci-governance/infrastructure/adapters/baseline-json-repository-adapter.js';
+
+export interface CiGovernanceBaselineGrandfatherAdapterDeps {
+  readonly baseDir: string;
+  readonly configQueryPort: ConfigQueryPort;
+  readonly baselineRepositoryFactory?: (
+    baseDir: string,
+    relativePath: string,
+  ) => BaselineRepositoryPort;
+}
+
+export class CiGovernanceBaselineGrandfatherAdapter
+  implements BaselineGrandfatherQueryPort
+{
+  constructor(private readonly deps: CiGovernanceBaselineGrandfatherAdapterDeps) {}
+
+  async check(
+    targetFilePaths: readonly string[],
+  ): Promise<BaselineGrandfatherCheckResult> {
+    try {
+      const baselineConfig = await this.deps.configQueryPort.getBaselineConfig();
+
+      if (!baselineConfig.enabled) {
+        return {
+          allGrandfathered: false,
+          baselineEnabled: false,
+          grandfatheredPaths: [],
+        };
+      }
+
+      if (targetFilePaths.length === 0) {
+        return {
+          allGrandfathered: false,
+          baselineEnabled: true,
+          grandfatheredPaths: [],
+        };
+      }
+
+      const factory =
+        this.deps.baselineRepositoryFactory ??
+        ((baseDir, relativePath) =>
+          new BaselineJsonRepositoryAdapter(baseDir, relativePath));
+      const repository = factory(this.deps.baseDir, baselineConfig.path);
+
+      if (!(await repository.exists())) {
+        return {
+          allGrandfathered: false,
+          baselineEnabled: true,
+          grandfatheredPaths: [],
+        };
+      }
+
+      const snapshot = await repository.load();
+      if (snapshot === null) {
+        return {
+          allGrandfathered: false,
+          baselineEnabled: true,
+          grandfatheredPaths: [],
+        };
+      }
+
+      const grandfathered: string[] = [];
+      for (const p of targetFilePaths) {
+        if (snapshot.contains(p)) grandfathered.push(p);
+      }
+      const allGrandfathered = grandfathered.length === targetFilePaths.length;
+
+      return {
+        allGrandfathered,
+        baselineEnabled: true,
+        grandfatheredPaths: grandfathered,
+      };
+    } catch {
+      return {
+        allGrandfathered: false,
+        baselineEnabled: false,
+        grandfatheredPaths: [],
+      };
+    }
+  }
+}

package/scripts/harness/agent-integration/infrastructure/adapters/harness-config-config-query-adapter.ts

@@ -7,7 +7,11 @@
  */
 
 import * as fs from 'node:fs';
-import type { ConfigQueryPort, HookType } from '../../domain/ports/config-query-port.js';
+import type {
+  BaselineConfig,
+  ConfigQueryPort,
+  HookType,
+} from '../../domain/ports/config-query-port.js';
 import { ProjectPaths } from '../../domain/value-objects/project-paths.js';
 
 interface ProjectDocsSection {
@@ -39,11 +43,17 @@ interface QuickModeSection {
   relaxedGates?: string[];
 }
 
+interface BaselineSection {
+  enabled?: boolean;
+  path?: string;
+}
+
 interface HarnessConfigDocument {
   harnesses?: HarnessesSection;
   project?: ProjectSection;
   protectedFiles?: ProtectedFilesSection;
   quickMode?: QuickModeSection;
+  baseline?: BaselineSection;
 }
 
 export class HarnessConfigConfigQueryAdapter implements ConfigQueryPort {
@@ -109,4 +119,13 @@ export class HarnessConfigConfigQueryAdapter implements ConfigQueryPort {
       },
     );
   }
+
+  async getBaselineConfig(): Promise<BaselineConfig> {
+    const config = this.loadConfig();
+    const baseline = config.baseline ?? {};
+    return {
+      enabled: baseline.enabled ?? false,
+      path: baseline.path ?? '.phasegate/baseline.json',
+    };
+  }
 }

package/scripts/harness/agent-integration/presentation/pre-tool-use-hook.ts

@@ -13,6 +13,7 @@ import { HarnessConfigConfigQueryAdapter } from '../infrastructure/adapters/harn
 import { PhaseGateQueryAdapter } from '../infrastructure/adapters/phase-gate-query-adapter.js';
 import { FileSystemStoryReflectionQueryAdapter } from '../infrastructure/adapters/file-system-story-reflection-query-adapter.js';
 import { QuickModeFullModeRequirementAdapter } from '../infrastructure/adapters/quick-mode-full-mode-requirement-adapter.js';
+import { CiGovernanceBaselineGrandfatherAdapter } from '../infrastructure/adapters/ci-governance-baseline-grandfather-adapter.js';
 import { createQuickModeCompositionRoot } from '../../quick-mode/composition-root.js';
 import * as path from 'node:path';
 import * as fs from 'node:fs/promises';
@@ -123,11 +124,16 @@ async function main(): Promise<void> {
     const fullModeRequirementQueryPort = new QuickModeFullModeRequirementAdapter({
       classifyUseCaseFactory: () => createQuickModeCompositionRoot().classifyUseCase,
     });
+    const baselineGrandfatherQueryPort = new CiGovernanceBaselineGrandfatherAdapter({
+      baseDir: path.dirname(configPath),
+      configQueryPort,
+    });
     const useCase = new HandlePreToolUseUseCase({
       configQueryPort,
       phaseGateQueryPort,
       storyReflectionQueryPort,
       fullModeRequirementQueryPort,
+      baselineGrandfatherQueryPort,
     });
 
     const output = await useCase.execute({ toolName: effectiveToolName, targetFilePaths });

package/scripts/harness/ci-governance/application/dto/create-baseline-input.ts

@@ -0,0 +1,9 @@
+// @unit ci-governance
+// @layer application
+
+export interface CreateBaselineInput {
+  readonly include?: readonly string[];
+  readonly exclude?: readonly string[];
+  readonly dryRun?: boolean;
+  readonly force?: boolean;
+}

package/scripts/harness/ci-governance/application/dto/create-baseline-output.ts

@@ -0,0 +1,15 @@
+// @unit ci-governance
+// @layer application
+
+export interface CreateBaselineOutputEntry {
+  readonly path: string;
+  readonly sha1: string;
+}
+
+export interface CreateBaselineOutput {
+  readonly savedPath: string;
+  readonly entryCount: number;
+  readonly dryRun: boolean;
+  readonly overwriteBlocked: boolean;
+  readonly entries: readonly CreateBaselineOutputEntry[];
+}

package/scripts/harness/ci-governance/application/usecases/create-baseline-usecase.ts

@@ -0,0 +1,95 @@
+// @unit ci-governance
+// @layer application
+
+import type { FileScannerPort } from '../../domain/ports/file-scanner-port.js';
+import type { FileHasherPort } from '../../domain/ports/file-hasher-port.js';
+import type { BaselineRepositoryPort } from '../../domain/ports/baseline-repository-port.js';
+import { BaselineEntry } from '../../domain/value-objects/baseline-entry.js';
+import { BaselineSnapshot } from '../../domain/value-objects/baseline-snapshot.js';
+import type { CreateBaselineInput } from '../dto/create-baseline-input.js';
+import type { CreateBaselineOutput } from '../dto/create-baseline-output.js';
+
+export const DEFAULT_BASELINE_INCLUDE: readonly string[] = Object.freeze([
+  'scripts/**/*.ts',
+  'src/**/*.ts',
+  'src/**/*.tsx',
+  'src/**/*.js',
+  'src/**/*.jsx',
+  'docs/product/construction/**/*.md',
+  'docs/inception/**/*.md',
+]);
+
+export const DEFAULT_BASELINE_EXCLUDE: readonly string[] = Object.freeze([
+  'node_modules/**',
+  'dist/**',
+  'build/**',
+  '.next/**',
+  'coverage/**',
+  '**/__tests__/**',
+  '**/*.test.ts',
+  '**/*.spec.ts',
+]);
+
+export class CreateBaselineUseCase {
+  constructor(
+    private readonly scanner: FileScannerPort,
+    private readonly hasher: FileHasherPort,
+    private readonly repository: BaselineRepositoryPort,
+    private readonly clock: () => Date = () => new Date(),
+  ) {}
+
+  async execute(input: CreateBaselineInput = {}): Promise<CreateBaselineOutput> {
+    const include = input.include ?? DEFAULT_BASELINE_INCLUDE;
+    const exclude = input.exclude ?? DEFAULT_BASELINE_EXCLUDE;
+    const dryRun = input.dryRun === true;
+    const force = input.force === true;
+
+    const savedPath = this.repository.getPath();
+
+    if (!dryRun && !force && (await this.repository.exists())) {
+      return {
+        savedPath,
+        entryCount: 0,
+        dryRun: false,
+        overwriteBlocked: true,
+        entries: [],
+      };
+    }
+
+    const scanned = await this.scanner.scan({ include, exclude });
+    const sortedPaths = [...scanned].sort();
+
+    const entries: BaselineEntry[] = [];
+    for (const p of sortedPaths) {
+      const sha1 = await this.hasher.hashFile(p);
+      entries.push(BaselineEntry.create({ path: p, sha1 }));
+    }
+
+    const snapshot = BaselineSnapshot.create({
+      createdAt: this.clock().toISOString(),
+      algorithm: 'sha1',
+      entries,
+    });
+
+    const outputEntries = entries.map((e) => ({ path: e.path, sha1: e.sha1 }));
+
+    if (dryRun) {
+      return {
+        savedPath,
+        entryCount: snapshot.entryCount,
+        dryRun: true,
+        overwriteBlocked: false,
+        entries: outputEntries,
+      };
+    }
+
+    const writtenPath = await this.repository.save(snapshot);
+    return {
+      savedPath: writtenPath,
+      entryCount: snapshot.entryCount,
+      dryRun: false,
+      overwriteBlocked: false,
+      entries: outputEntries,
+    };
+  }
+}

package/scripts/harness/ci-governance/composition-root.ts

@@ -33,17 +33,25 @@ import { AdrFoundationExistenceAdapter } from './infrastructure/adapters/adr-fou
 import { GenerateCiTemplateHandler } from './presentation/handlers/generate-ci-template-handler.js';
 import { MigrateAgentsMdHandler } from './presentation/handlers/migrate-agents-md-handler.js';
 import { CheckRepetitionHandler } from './presentation/handlers/check-repetition-handler.js';
+import { CreateBaselineHandler } from './presentation/handlers/create-baseline-handler.js';
+
+import { CreateBaselineUseCase } from './application/usecases/create-baseline-usecase.js';
+import { GlobFileScannerAdapter } from './infrastructure/adapters/glob-file-scanner-adapter.js';
+import { FileSystemSha1HasherAdapter } from './infrastructure/adapters/file-system-sha1-hasher-adapter.js';
+import { BaselineJsonRepositoryAdapter } from './infrastructure/adapters/baseline-json-repository-adapter.js';
 
 export interface CiGovernanceCompositionRoot {
   generateCiTemplateHandler: GenerateCiTemplateHandler;
   migrateAgentsMdHandler: MigrateAgentsMdHandler;
   checkRepetitionHandler: CheckRepetitionHandler;
+  createBaselineHandler: CreateBaselineHandler;
   // Use cases exposed for direct access
   recordErrorOccurrenceUseCase: RecordErrorOccurrenceUseCase;
   checkEscalationUseCase: CheckEscalationUseCase;
   resetRepetitionUseCase: ResetRepetitionUseCase;
   aggregateLessonsUseCase: AggregateLessonsUseCase;
   validatePointersUseCase: ValidatePointersUseCase;
+  createBaselineUseCase: CreateBaselineUseCase;
 }
 
 export function buildCiGovernance(baseDir: string): CiGovernanceCompositionRoot {
@@ -80,6 +88,16 @@ export function buildCiGovernance(baseDir: string): CiGovernanceCompositionRoot
   const aggregateLessonsUseCase = new AggregateLessonsUseCase(lessonArtifactReaderPort, lessonAggregator);
   const validatePointersUseCase = new ValidatePointersUseCase(agentsMdPort, pointerValidator);
 
+  // Baseline adapters & use case (ISSUE-007 Wave 1)
+  const fileScanner = new GlobFileScannerAdapter(baseDir);
+  const fileHasher = new FileSystemSha1HasherAdapter(baseDir);
+  const baselineRepository = new BaselineJsonRepositoryAdapter(baseDir);
+  const createBaselineUseCase = new CreateBaselineUseCase(
+    fileScanner,
+    fileHasher,
+    baselineRepository,
+  );
+
   // Handlers
   const generateCiTemplateHandler = new GenerateCiTemplateHandler(
     generateCiTemplateUseCase,
@@ -87,15 +105,18 @@ export function buildCiGovernance(baseDir: string): CiGovernanceCompositionRoot
   );
   const migrateAgentsMdHandler = new MigrateAgentsMdHandler(migrateAgentsMdUseCase);
   const checkRepetitionHandler = new CheckRepetitionHandler(checkEscalationUseCase);
+  const createBaselineHandler = new CreateBaselineHandler(createBaselineUseCase);
 
   return {
     generateCiTemplateHandler,
     migrateAgentsMdHandler,
     checkRepetitionHandler,
+    createBaselineHandler,
     recordErrorOccurrenceUseCase,
     checkEscalationUseCase,
     resetRepetitionUseCase,
     aggregateLessonsUseCase,
     validatePointersUseCase,
+    createBaselineUseCase,
   };
 }

package/scripts/harness/ci-governance/domain/ports/baseline-repository-port.ts

@@ -0,0 +1,11 @@
+// @unit ci-governance
+// @layer domain
+
+import type { BaselineSnapshot } from '../value-objects/baseline-snapshot.js';
+
+export interface BaselineRepositoryPort {
+  save(snapshot: BaselineSnapshot): Promise<string>;
+  load(): Promise<BaselineSnapshot | null>;
+  exists(): Promise<boolean>;
+  getPath(): string;
+}

package/scripts/harness/ci-governance/domain/ports/file-hasher-port.ts

@@ -0,0 +1,6 @@
+// @unit ci-governance
+// @layer domain
+
+export interface FileHasherPort {
+  hashFile(relativePath: string): Promise<string>;
+}

package/scripts/harness/ci-governance/domain/ports/file-scanner-port.ts

@@ -0,0 +1,11 @@
+// @unit ci-governance
+// @layer domain
+
+export interface FileScanOptions {
+  readonly include: readonly string[];
+  readonly exclude: readonly string[];
+}
+
+export interface FileScannerPort {
+  scan(options: FileScanOptions): Promise<readonly string[]>;
+}

package/scripts/harness/ci-governance/domain/value-objects/baseline-entry.ts

@@ -0,0 +1,34 @@
+// @unit ci-governance
+// @layer domain
+
+export interface BaselineEntryProps {
+  readonly path: string;
+  readonly sha1: string;
+}
+
+export class BaselineEntry {
+  readonly path: string;
+  readonly sha1: string;
+
+  private constructor(props: BaselineEntryProps) {
+    this.path = props.path;
+    this.sha1 = props.sha1;
+    Object.freeze(this);
+  }
+
+  static create(props: BaselineEntryProps): BaselineEntry {
+    if (props.path.length === 0) {
+      throw new Error('BaselineEntry: path must not be empty');
+    }
+    if (!/^[0-9a-f]{40}$/.test(props.sha1)) {
+      throw new Error(
+        `BaselineEntry: sha1 must be 40 lowercase hex chars, got: ${props.sha1}`,
+      );
+    }
+    return new BaselineEntry(props);
+  }
+
+  equals(other: BaselineEntry): boolean {
+    return this.path === other.path && this.sha1 === other.sha1;
+  }
+}

package/scripts/harness/ci-governance/domain/value-objects/baseline-snapshot.ts

@@ -0,0 +1,55 @@
+// @unit ci-governance
+// @layer domain
+
+import { BaselineEntry } from './baseline-entry.js';
+
+export interface BaselineSnapshotProps {
+  readonly createdAt: string;
+  readonly algorithm: 'sha1';
+  readonly entries: readonly BaselineEntry[];
+}
+
+const ISO_8601_UTC_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/;
+
+export class BaselineSnapshot {
+  readonly createdAt: string;
+  readonly algorithm: 'sha1';
+  readonly entries: readonly BaselineEntry[];
+  private readonly pathIndex: ReadonlySet<string>;
+
+  private constructor(props: BaselineSnapshotProps) {
+    this.createdAt = props.createdAt;
+    this.algorithm = props.algorithm;
+    this.entries = Object.freeze([...props.entries]);
+    this.pathIndex = new Set(props.entries.map((e) => e.path));
+  }
+
+  static create(props: BaselineSnapshotProps): BaselineSnapshot {
+    if (!ISO_8601_UTC_RE.test(props.createdAt)) {
+      throw new Error(
+        `BaselineSnapshot: createdAt must be ISO 8601 UTC, got: ${props.createdAt}`,
+      );
+    }
+    if (props.algorithm !== 'sha1') {
+      throw new Error(
+        `BaselineSnapshot: algorithm must be 'sha1', got: ${props.algorithm}`,
+      );
+    }
+    const seen = new Set<string>();
+    for (const e of props.entries) {
+      if (seen.has(e.path)) {
+        throw new Error(`BaselineSnapshot: duplicate path ${e.path}`);
+      }
+      seen.add(e.path);
+    }
+    return new BaselineSnapshot(props);
+  }
+
+  contains(path: string): boolean {
+    return this.pathIndex.has(path);
+  }
+
+  get entryCount(): number {
+    return this.entries.length;
+  }
+}

package/scripts/harness/ci-governance/infrastructure/adapters/baseline-json-repository-adapter.ts

@@ -0,0 +1,91 @@
+// @unit ci-governance
+// @layer infrastructure
+
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import type { BaselineRepositoryPort } from '../../domain/ports/baseline-repository-port.js';
+import { BaselineSnapshot } from '../../domain/value-objects/baseline-snapshot.js';
+import { BaselineEntry } from '../../domain/value-objects/baseline-entry.js';
+
+interface BaselineJsonV1 {
+  readonly version: '1.0';
+  readonly createdAt: string;
+  readonly algorithm: 'sha1';
+  readonly files: ReadonlyArray<{ readonly path: string; readonly sha1: string }>;
+}
+
+export class BaselineJsonRepositoryAdapter implements BaselineRepositoryPort {
+  private readonly filePath: string;
+
+  constructor(baseDir: string, relativePath = '.phasegate/baseline.json') {
+    this.filePath = path.isAbsolute(relativePath)
+      ? relativePath
+      : path.join(baseDir, relativePath);
+  }
+
+  getPath(): string {
+    return this.filePath;
+  }
+
+  async exists(): Promise<boolean> {
+    try {
+      await fs.access(this.filePath);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  async save(snapshot: BaselineSnapshot): Promise<string> {
+    const data: BaselineJsonV1 = {
+      version: '1.0',
+      createdAt: snapshot.createdAt,
+      algorithm: snapshot.algorithm,
+      files: snapshot.entries.map((e) => ({ path: e.path, sha1: e.sha1 })),
+    };
+    await fs.mkdir(path.dirname(this.filePath), { recursive: true });
+    await fs.writeFile(
+      this.filePath,
+      `${JSON.stringify(data, null, 2)}\n`,
+      'utf-8',
+    );
+    return this.filePath;
+  }
+
+  async load(): Promise<BaselineSnapshot | null> {
+    let content: string;
+    try {
+      content = await fs.readFile(this.filePath, 'utf-8');
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code === 'ENOENT') return null;
+      throw err;
+    }
+
+    let parsed: BaselineJsonV1;
+    try {
+      parsed = JSON.parse(content) as BaselineJsonV1;
+    } catch (err) {
+      throw new Error(
+        `Invalid baseline JSON at ${this.filePath}: ${String(err)}`,
+      );
+    }
+
+    if (
+      !parsed ||
+      parsed.version !== '1.0' ||
+      parsed.algorithm !== 'sha1' ||
+      !Array.isArray(parsed.files)
+    ) {
+      throw new Error(`Invalid baseline JSON schema at ${this.filePath}`);
+    }
+
+    const entries = parsed.files.map((f) =>
+      BaselineEntry.create({ path: f.path, sha1: f.sha1 }),
+    );
+    return BaselineSnapshot.create({
+      createdAt: parsed.createdAt,
+      algorithm: parsed.algorithm,
+      entries,
+    });
+  }
+}

package/scripts/harness/ci-governance/infrastructure/adapters/file-system-sha1-hasher-adapter.ts

@@ -0,0 +1,19 @@
+// @unit ci-governance
+// @layer infrastructure
+
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as crypto from 'node:crypto';
+import type { FileHasherPort } from '../../domain/ports/file-hasher-port.js';
+
+export class FileSystemSha1HasherAdapter implements FileHasherPort {
+  constructor(private readonly baseDir: string) {}
+
+  async hashFile(relativePath: string): Promise<string> {
+    const absPath = path.isAbsolute(relativePath)
+      ? relativePath
+      : path.join(this.baseDir, relativePath);
+    const content = await fs.readFile(absPath);
+    return crypto.createHash('sha1').update(content).digest('hex');
+  }
+}

package/scripts/harness/ci-governance/infrastructure/adapters/glob-file-scanner-adapter.ts

@@ -0,0 +1,79 @@
+// @unit ci-governance
+// @layer infrastructure
+
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { createRequire } from 'node:module';
+import type {
+  FileScannerPort,
+  FileScanOptions,
+} from '../../domain/ports/file-scanner-port.js';
+
+const require = createRequire(import.meta.url);
+const picomatch = require('picomatch') as (
+  pattern: string,
+  options?: { dot?: boolean },
+) => (p: string) => boolean;
+
+const HARD_SKIP_DIRS: ReadonlySet<string> = new Set([
+  'node_modules',
+  '.git',
+  'dist',
+  'build',
+  '.next',
+  'coverage',
+  '.phasegate',
+]);
+
+export class GlobFileScannerAdapter implements FileScannerPort {
+  constructor(private readonly baseDir: string) {}
+
+  async scan(options: FileScanOptions): Promise<readonly string[]> {
+    const includeMatchers = options.include.map((p) =>
+      picomatch(p, { dot: true }),
+    );
+    const excludeMatchers = options.exclude.map((p) =>
+      picomatch(p, { dot: true }),
+    );
+    const collected: string[] = [];
+    await this.walk(this.baseDir, '', includeMatchers, excludeMatchers, collected);
+    return collected.sort();
+  }
+
+  private async walk(
+    absDir: string,
+    relDir: string,
+    includeMatchers: Array<(p: string) => boolean>,
+    excludeMatchers: Array<(p: string) => boolean>,
+    out: string[],
+  ): Promise<void> {
+    let entries: Array<{
+      name: string;
+      isDirectory: () => boolean;
+      isFile: () => boolean;
+    }>;
+    try {
+      entries = (await fs.readdir(absDir, {
+        withFileTypes: true,
+      })) as unknown as typeof entries;
+    } catch {
+      return;
+    }
+
+    for (const ent of entries) {
+      if (ent.isDirectory() && HARD_SKIP_DIRS.has(ent.name)) continue;
+      const relPath = relDir === '' ? ent.name : `${relDir}/${ent.name}`;
+      const absPath = path.join(absDir, ent.name);
+
+      if (ent.isDirectory()) {
+        await this.walk(absPath, relPath, includeMatchers, excludeMatchers, out);
+        continue;
+      }
+
+      if (!ent.isFile()) continue;
+      if (!includeMatchers.some((m) => m(relPath))) continue;
+      if (excludeMatchers.some((m) => m(relPath))) continue;
+      out.push(relPath);
+    }
+  }
+}

package/scripts/harness/ci-governance/presentation/handlers/create-baseline-handler.ts

@@ -0,0 +1,57 @@
+// @unit ci-governance
+// @layer presentation
+
+import type { CreateBaselineUseCase } from '../../application/usecases/create-baseline-usecase.js';
+
+export interface CreateBaselineHandlerArgs {
+  readonly include?: readonly string[];
+  readonly exclude?: readonly string[];
+  readonly dryRun?: boolean;
+  readonly force?: boolean;
+  readonly format?: 'human' | 'json';
+}
+
+export interface CreateBaselineHandlerResult {
+  readonly exitCode: number;
+  readonly output: string;
+}
+
+export class CreateBaselineHandler {
+  constructor(private readonly useCase: CreateBaselineUseCase) {}
+
+  async handle(args: CreateBaselineHandlerArgs): Promise<CreateBaselineHandlerResult> {
+    const format = args.format ?? 'human';
+    const result = await this.useCase.execute({
+      include: args.include,
+      exclude: args.exclude,
+      dryRun: args.dryRun,
+      force: args.force,
+    });
+
+    if (format === 'json') {
+      return {
+        exitCode: result.overwriteBlocked ? 2 : 0,
+        output: JSON.stringify(result, null, 2),
+      };
+    }
+
+    if (result.overwriteBlocked) {
+      return {
+        exitCode: 2,
+        output: [
+          `baseline は既に存在します: ${result.savedPath}`,
+          '上書きするには --force を指定してください。',
+          '生成内容のみを確認したい場合は --dry-run を指定してください。',
+        ].join('\n'),
+      };
+    }
+
+    const header = result.dryRun
+      ? `[dry run] baseline を生成しました（保存先想定: ${result.savedPath}）`
+      : `baseline を保存しました: ${result.savedPath}`;
+    return {
+      exitCode: 0,
+      output: [header, `エントリ数: ${result.entryCount}`].join('\n'),
+    };
+  }
+}

package/scripts/harness/config-foundation/infrastructure/schemas/harness-config-v2.schema.json

@@ -439,6 +439,19 @@
           "uniqueItems": true
         }
       }
+    },
+    "baseline": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": {
+          "type": "boolean"
+        },
+        "path": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
     }
   }
 }

package/scripts/harness/main.ts

@@ -88,6 +88,7 @@ Commands:
   ci:generate-template         Generate CI template (--preset <id>, --type <aidlc-gate|consistency-check|pre-commit>, --render, --json)
   ci:migrate-agents-md         Migrate AGENTS.md (--dry-run, --validate-only, --json)
   ci:check-repetition          Check error repetition (--code <errorCode>, --reset, --json)
+  baseline                     Create retrofit baseline snapshot (--dry-run, --force, --paths <glob,glob,...>, --json)
 
   skill:execute-tdd-cycle      Execute TDD cycle (--unit, --story, --desc, --phase RED|GREEN|REFACTOR, --passed)
   skill:check-coverage         Check coverage (--story <storyId>, --json)
@@ -896,6 +897,26 @@ Examples:
         break;
       }
 
+      case 'baseline': {
+        const mod = buildCiGovernance(rootDir);
+        const dryRun = hasFlag(args, '--dry-run');
+        const force = hasFlag(args, '--force');
+        const pathsFlag = parseFlag(args, '--paths');
+        const include = pathsFlag
+          ? pathsFlag.split(',').map((s) => s.trim()).filter(Boolean)
+          : undefined;
+        const format = json ? 'json' : 'human';
+        const result = await mod.createBaselineHandler.handle({
+          include,
+          dryRun,
+          force,
+          format,
+        });
+        console.log(result.output);
+        process.exit(result.exitCode);
+        break;
+      }
+
       // ── skill-quality ──
       case 'skill:execute-tdd-cycle': {
         const mod = createSkillQualityHandlers();