project-tiny-context-harness 0.2.81 → 0.2.83

package/dist/lib/superpowers-task-evidence.js

@@ -0,0 +1,141 @@
+import { createHash } from "node:crypto";
+import { spawn } from "node:child_process";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { pathExists, readText } from "./fs.js";
+import { appendSuperpowersEvent } from "./superpowers-task-events.js";
+import { computeSourceBundleHash } from "./superpowers-task-attempt.js";
+import { normalizeAssertionResult, normalizeNegativeEvidenceScan } from "./superpowers-task-assertions.js";
+import { normalizeProofLayerId, normalizeProofLayerName } from "./superpowers-task-fields.js";
+import { loadSuperpowersState, saveSuperpowersState, sha256 } from "./superpowers-task-state.js";
+import { asStringArray, isRecord } from "./superpowers-task-state-schema.js";
+export async function runSuperpowersAssertion(workdir, options) {
+    if (!options.acId || !options.proofLayer) {
+        throw new Error("run-assertion requires --ac <AC-ID> and --proof-layer <layer>");
+    }
+    if (options.commandArgs.length === 0) {
+        throw new Error("run-assertion requires a command after --");
+    }
+    const state = await loadSuperpowersState(workdir);
+    const proofLayer = normalizeProofLayerName(options.proofLayer);
+    const spec = (state.required_command_specs ?? []).find((item) => item.ac_id === options.acId && item.proof_layers.map(normalizeProofLayerName).includes(proofLayer));
+    if (!spec) {
+        throw new Error(`no required command spec for ${options.acId}.${proofLayer}`);
+    }
+    const startedAt = new Date().toISOString();
+    const exitCode = await runCommand(options.commandArgs);
+    const endedAt = new Date().toISOString();
+    const commandLine = options.commandArgs.join(" ");
+    const commandRun = {
+        command_run_id: `CR-${compactDate(startedAt)}-${sha256(commandLine).slice(0, 8)}`,
+        task_attempt_id: state.current_attempt_id,
+        command_spec_id: spec.command_spec_id,
+        ac_id: options.acId,
+        proof_layer: proofLayer,
+        command_line: commandLine,
+        exit_code: exitCode,
+        started_at: startedAt,
+        ended_at: endedAt,
+        artifact_paths: []
+    };
+    state.command_runs = [...(state.command_runs ?? []), commandRun];
+    await saveSuperpowersState(workdir, state);
+    await appendSuperpowersEvent(workdir, "assertion_command_run", {
+        command_run_id: commandRun.command_run_id,
+        command_spec_id: commandRun.command_spec_id,
+        exit_code: commandRun.exit_code
+    });
+    return commandRun;
+}
+export async function recordSuperpowersEvidence(workdir, options) {
+    const state = await loadSuperpowersState(workdir);
+    const commandRun = (state.command_runs ?? []).find((item) => item.command_run_id === options.commandRunId);
+    if (!commandRun) {
+        throw new Error(`command run not found: ${options.commandRunId}`);
+    }
+    const artifactPath = path.resolve(options.artifactPath);
+    if (!(await pathExists(artifactPath))) {
+        throw new Error(`evidence artifact not found: ${options.artifactPath}`);
+    }
+    const artifactText = await readText(artifactPath);
+    const artifact = JSON.parse(artifactText);
+    const artifactRecord = isRecord(artifact) ? artifact : {};
+    const assertion = normalizeAssertionResult(artifactRecord.assertion_result ?? artifactRecord);
+    if (!assertion) {
+        throw new Error(`evidence artifact is missing assertion_result: ${options.artifactPath}`);
+    }
+    const stats = await fs.stat(artifactPath);
+    const attempt = (state.attempts ?? []).find((item) => item.task_attempt_id === commandRun.task_attempt_id);
+    const commandSpec = (state.required_command_specs ?? []).find((item) => item.command_spec_id === commandRun.command_spec_id);
+    const layerId = normalizeProofLayerId(`${commandRun.ac_id}.${commandRun.proof_layer}`);
+    const relativeArtifactPath = slash(path.relative(workdir, artifactPath));
+    const targetPiIds = commandSpec ? (state.graph.acceptance_criteria[commandSpec.ac_id]?.related_plan_items ?? []) : [];
+    const negativeScan = normalizeNegativeEvidenceScan(artifactRecord.negative_evidence_scan);
+    if (assertion.schema_version === "assertion-result-v2") {
+        assertion.target_pi_ids = assertion.target_pi_ids ?? targetPiIds;
+        assertion.invalid_completion_signals = assertion.invalid_completion_signals ?? [];
+        assertion.required_test_ids = assertion.required_test_ids ?? commandSpec?.required_test_ids ?? [];
+        assertion.negative_evidence_scan = assertion.negative_evidence_scan ?? negativeScan;
+    }
+    const evidence = {
+        schema_version: "evidence-record-v2",
+        evidence_id: `EV2-${compactDate(new Date().toISOString())}-${sha256(options.commandRunId + artifactText).slice(0, 8)}`,
+        task_attempt_id: commandRun.task_attempt_id,
+        source_bundle_hash: attempt?.source_bundle_hash ?? computeSourceBundleHash(state),
+        product_source_hash: attempt?.product_source_hash ?? state.sources.product_architecture_source?.sha256 ?? "",
+        technical_plan_hash: attempt?.technical_plan_hash ?? state.sources.technical_realization_plan?.sha256 ?? "",
+        acceptance_checklist_hash: attempt?.acceptance_checklist_hash ?? state.sources.acceptance_checklist?.sha256 ?? "",
+        git_head: attempt?.git_head ?? "",
+        worktree_fingerprint: attempt?.worktree_fingerprint ?? "",
+        command_spec_id: commandRun.command_spec_id,
+        command_run_id: commandRun.command_run_id,
+        command_line: commandRun.command_line,
+        command_exit_code: commandRun.exit_code,
+        artifact_path: relativeArtifactPath,
+        artifact_sha256: createHash("sha256").update(artifactText).digest("hex"),
+        artifact_mtime: stats.mtime.toISOString(),
+        target_ac_ids: [commandRun.ac_id],
+        target_pi_ids: targetPiIds,
+        target_proof_layers: [layerId],
+        slice_id: String(artifactRecord.slice_id ?? "attempt-evidence"),
+        type: String(artifactRecord.type ?? `${commandRun.proof_layer}_assertion`),
+        freshness: { created_at: commandRun.ended_at, valid_for: "current_attempt", stale_after: null },
+        command: commandRun.command_line,
+        artifact_paths: [relativeArtifactPath],
+        proves: [layerId],
+        does_not_prove: asStringArray(artifactRecord.does_not_prove).length > 0 ? asStringArray(artifactRecord.does_not_prove) : ["unrelated proof layer"],
+        redaction: isRecord(artifactRecord.redaction)
+            ? { checked: artifactRecord.redaction.checked === true, contains_secret: artifactRecord.redaction.contains_secret === true }
+            : { checked: true, contains_secret: false },
+        reviewability: isRecord(artifactRecord.reviewability)
+            ? {
+                external_reviewer_can_reproduce: artifactRecord.reviewability.external_reviewer_can_reproduce === true,
+                reproduction_steps: String(artifactRecord.reviewability.reproduction_steps ?? commandRun.command_line)
+            }
+            : { external_reviewer_can_reproduce: true, reproduction_steps: commandRun.command_line },
+        assertion_result: assertion,
+        negative_evidence_scan: negativeScan
+    };
+    state.evidence = [...(state.evidence ?? []), evidence];
+    const proofLayer = state.graph.proof_layers[layerId];
+    if (proofLayer && commandRun.exit_code === 0 && assertion.status === "passed") {
+        proofLayer.status = "satisfied";
+        proofLayer.evidence_ids = [...new Set([...(proofLayer.evidence_ids ?? []), evidence.evidence_id])];
+    }
+    await saveSuperpowersState(workdir, state);
+    await appendSuperpowersEvent(workdir, "evidence_recorded", { evidence_id: evidence.evidence_id, command_run_id: commandRun.command_run_id });
+    return evidence;
+}
+function runCommand(args) {
+    return new Promise((resolve) => {
+        const child = spawn(args[0], args.slice(1), { cwd: process.cwd(), stdio: "ignore", windowsHide: true });
+        child.on("error", () => resolve(1));
+        child.on("exit", (code) => resolve(code ?? 1));
+    });
+}
+function compactDate(value) {
+    return value.replace(/[-:.TZ]/g, "").slice(0, 17);
+}
+function slash(value) {
+    return value.split(path.sep).join("/");
+}

package/dist/lib/superpowers-task-fields.d.ts

@@ -0,0 +1,22 @@
+export declare const PRODUCT_FIELDS: readonly ["delivery_scope", "full_population_required", "representative_samples_validate", "representative_samples_do_not_validate", "out_of_scope_backlog", "scope_fit_decision", "selected_scope_fit_slice", "owner_boundary", "primary_capability_path", "non_completing_outcomes", "assertion_policy", "source_authority", "product_goal", "surface_ia_lock", "decision_lock", "context_delta", "source_to_context_coverage", "acceptance_semantics", "impact"];
+export declare const PLAN_FIELDS: readonly ["delivery_scope", "capability_target", "representative_samples", "full_population_boundary", "non_required_population", "owner_surfaces", "forbidden_surfaces", "owner_boundary", "primary_capability_path", "trigger_contract", "state_transition_contract", "observable_result_contract", "assertion_support", "required_assertion_commands", "invalid_implementation_shortcuts", "implementation_paths", "required_tests", "related_acs", "requirement_ref", "decision_id", "proof_layer_ids", "api_schema_changes", "state_machine", "data_flow", "worker_runtime_behavior", "ui_ia_changes", "migration_plan", "evidence_artifacts", "explicit_no_test_scope", "non_completing_shortcuts", "substitution_policy", "drift_severity", "partial_conditions", "blockers", "context_fact_refs"];
+export declare const ACCEPTANCE_FIELDS: readonly ["acceptance_scope", "ac_validates", "ac_does_not_validate", "sample_boundary", "full_population_required", "related_plan_items", "required_proof_layers", "assertion_command", "assertion_artifacts", "positive_assertions", "negative_assertions", "machine_blocking", "invalid_completion_signals", "assertion_result_required", "ac_type", "proof_chain", "verification_method", "fail_conditions", "invalid_evidence", "substitution_policy", "missing_layer_downgrade", "auditor_expectation", "out_of_scope_na_approval_source", "required_test_ids", "explicit_no_test_scope", "hard_blockers", "validates_explanation", "does_not_validate_explanation", "final_evidence_expected", "test_cases"];
+export declare const PRODUCT_REQUIRED_FIELDS: readonly ["delivery_scope", "full_population_required", "representative_samples_validate", "representative_samples_do_not_validate", "out_of_scope_backlog", "scope_fit_decision", "selected_scope_fit_slice", "owner_boundary", "primary_capability_path", "non_completing_outcomes", "assertion_policy", "source_authority", "product_goal"];
+export declare const PLAN_REQUIRED_FIELDS: readonly ["delivery_scope", "capability_target", "representative_samples", "full_population_boundary", "non_required_population", "owner_boundary", "primary_capability_path", "trigger_contract", "state_transition_contract", "observable_result_contract", "assertion_support", "required_assertion_commands", "invalid_implementation_shortcuts", "implementation_paths"];
+export declare const ACCEPTANCE_REQUIRED_FIELDS: readonly ["acceptance_scope", "ac_validates", "ac_does_not_validate", "sample_boundary", "full_population_required", "related_plan_items", "required_proof_layers", "assertion_command", "assertion_artifacts", "positive_assertions", "negative_assertions", "machine_blocking", "invalid_completion_signals", "assertion_result_required"];
+type FieldType = "array" | "boolean" | "enum" | "text";
+export declare const PRODUCT_FIELD_TYPES: Record<(typeof PRODUCT_FIELDS)[number], FieldType>;
+export declare const PLAN_FIELD_TYPES: Record<(typeof PLAN_FIELDS)[number], FieldType>;
+export declare const ACCEPTANCE_FIELD_TYPES: Record<(typeof ACCEPTANCE_FIELDS)[number], FieldType>;
+export declare const PRODUCT_DELIVERY_SCOPES: Set<string>;
+export declare const PLAN_DELIVERY_SCOPES: Set<string>;
+export declare const ACCEPTANCE_SCOPES: Set<string>;
+export declare const SCOPE_FIT_DECISIONS: Set<string>;
+export declare const CANONICAL_PROOF_LAYERS: readonly ["code", "api_schema", "worker_runtime", "data_artifact", "integration", "ui_browser", "security_redaction", "all_provider_all_runner", "cleanup_stale_scan", "test"];
+export declare const LEGACY_PROOF_LAYER_ALIASES: Record<string, string>;
+export declare const MACHINE_VERIFIABLE_LAYER_NAMES: Set<string>;
+export declare function fieldSet(fields: readonly string[]): Set<string>;
+export declare function normalizeProofLayerName(layer: string): string;
+export declare function normalizeProofLayerId(layerId: string): string;
+export declare function isSelectedScopeFitSlice(value: string): boolean;
+export {};

package/dist/lib/superpowers-task-fields.js

@@ -0,0 +1,276 @@
+export const PRODUCT_FIELDS = [
+    "delivery_scope",
+    "full_population_required",
+    "representative_samples_validate",
+    "representative_samples_do_not_validate",
+    "out_of_scope_backlog",
+    "scope_fit_decision",
+    "selected_scope_fit_slice",
+    "owner_boundary",
+    "primary_capability_path",
+    "non_completing_outcomes",
+    "assertion_policy",
+    "source_authority",
+    "product_goal",
+    "surface_ia_lock",
+    "decision_lock",
+    "context_delta",
+    "source_to_context_coverage",
+    "acceptance_semantics",
+    "impact"
+];
+export const PLAN_FIELDS = [
+    "delivery_scope",
+    "capability_target",
+    "representative_samples",
+    "full_population_boundary",
+    "non_required_population",
+    "owner_surfaces",
+    "forbidden_surfaces",
+    "owner_boundary",
+    "primary_capability_path",
+    "trigger_contract",
+    "state_transition_contract",
+    "observable_result_contract",
+    "assertion_support",
+    "required_assertion_commands",
+    "invalid_implementation_shortcuts",
+    "implementation_paths",
+    "required_tests",
+    "related_acs",
+    "requirement_ref",
+    "decision_id",
+    "proof_layer_ids",
+    "api_schema_changes",
+    "state_machine",
+    "data_flow",
+    "worker_runtime_behavior",
+    "ui_ia_changes",
+    "migration_plan",
+    "evidence_artifacts",
+    "explicit_no_test_scope",
+    "non_completing_shortcuts",
+    "substitution_policy",
+    "drift_severity",
+    "partial_conditions",
+    "blockers",
+    "context_fact_refs"
+];
+export const ACCEPTANCE_FIELDS = [
+    "acceptance_scope",
+    "ac_validates",
+    "ac_does_not_validate",
+    "sample_boundary",
+    "full_population_required",
+    "related_plan_items",
+    "required_proof_layers",
+    "assertion_command",
+    "assertion_artifacts",
+    "positive_assertions",
+    "negative_assertions",
+    "machine_blocking",
+    "invalid_completion_signals",
+    "assertion_result_required",
+    "ac_type",
+    "proof_chain",
+    "verification_method",
+    "fail_conditions",
+    "invalid_evidence",
+    "substitution_policy",
+    "missing_layer_downgrade",
+    "auditor_expectation",
+    "out_of_scope_na_approval_source",
+    "required_test_ids",
+    "explicit_no_test_scope",
+    "hard_blockers",
+    "validates_explanation",
+    "does_not_validate_explanation",
+    "final_evidence_expected",
+    "test_cases"
+];
+export const PRODUCT_REQUIRED_FIELDS = [
+    "delivery_scope",
+    "full_population_required",
+    "representative_samples_validate",
+    "representative_samples_do_not_validate",
+    "out_of_scope_backlog",
+    "scope_fit_decision",
+    "selected_scope_fit_slice",
+    "owner_boundary",
+    "primary_capability_path",
+    "non_completing_outcomes",
+    "assertion_policy",
+    "source_authority",
+    "product_goal"
+];
+export const PLAN_REQUIRED_FIELDS = [
+    "delivery_scope",
+    "capability_target",
+    "representative_samples",
+    "full_population_boundary",
+    "non_required_population",
+    "owner_boundary",
+    "primary_capability_path",
+    "trigger_contract",
+    "state_transition_contract",
+    "observable_result_contract",
+    "assertion_support",
+    "required_assertion_commands",
+    "invalid_implementation_shortcuts",
+    "implementation_paths"
+];
+export const ACCEPTANCE_REQUIRED_FIELDS = [
+    "acceptance_scope",
+    "ac_validates",
+    "ac_does_not_validate",
+    "sample_boundary",
+    "full_population_required",
+    "related_plan_items",
+    "required_proof_layers",
+    "assertion_command",
+    "assertion_artifacts",
+    "positive_assertions",
+    "negative_assertions",
+    "machine_blocking",
+    "invalid_completion_signals",
+    "assertion_result_required"
+];
+export const PRODUCT_FIELD_TYPES = {
+    delivery_scope: "enum",
+    full_population_required: "boolean",
+    representative_samples_validate: "array",
+    representative_samples_do_not_validate: "array",
+    out_of_scope_backlog: "array",
+    scope_fit_decision: "enum",
+    selected_scope_fit_slice: "text",
+    owner_boundary: "text",
+    primary_capability_path: "text",
+    non_completing_outcomes: "array",
+    assertion_policy: "text",
+    source_authority: "text",
+    product_goal: "text",
+    surface_ia_lock: "text",
+    decision_lock: "text",
+    context_delta: "text",
+    source_to_context_coverage: "text",
+    acceptance_semantics: "text",
+    impact: "text"
+};
+export const PLAN_FIELD_TYPES = {
+    delivery_scope: "enum",
+    capability_target: "text",
+    representative_samples: "array",
+    full_population_boundary: "text",
+    non_required_population: "array",
+    owner_surfaces: "array",
+    forbidden_surfaces: "array",
+    owner_boundary: "text",
+    primary_capability_path: "text",
+    trigger_contract: "text",
+    state_transition_contract: "text",
+    observable_result_contract: "text",
+    assertion_support: "text",
+    required_assertion_commands: "array",
+    invalid_implementation_shortcuts: "array",
+    implementation_paths: "array",
+    required_tests: "array",
+    related_acs: "array",
+    requirement_ref: "text",
+    decision_id: "text",
+    proof_layer_ids: "array",
+    api_schema_changes: "text",
+    state_machine: "text",
+    data_flow: "text",
+    worker_runtime_behavior: "text",
+    ui_ia_changes: "text",
+    migration_plan: "text",
+    evidence_artifacts: "array",
+    explicit_no_test_scope: "boolean",
+    non_completing_shortcuts: "array",
+    substitution_policy: "array",
+    drift_severity: "text",
+    partial_conditions: "array",
+    blockers: "array",
+    context_fact_refs: "array"
+};
+export const ACCEPTANCE_FIELD_TYPES = {
+    acceptance_scope: "enum",
+    ac_validates: "array",
+    ac_does_not_validate: "array",
+    sample_boundary: "text",
+    full_population_required: "boolean",
+    related_plan_items: "array",
+    required_proof_layers: "array",
+    assertion_command: "text",
+    assertion_artifacts: "array",
+    positive_assertions: "array",
+    negative_assertions: "array",
+    machine_blocking: "boolean",
+    invalid_completion_signals: "array",
+    assertion_result_required: "boolean",
+    ac_type: "text",
+    proof_chain: "array",
+    verification_method: "array",
+    fail_conditions: "array",
+    invalid_evidence: "array",
+    substitution_policy: "array",
+    missing_layer_downgrade: "text",
+    auditor_expectation: "text",
+    out_of_scope_na_approval_source: "text",
+    required_test_ids: "array",
+    explicit_no_test_scope: "boolean",
+    hard_blockers: "array",
+    validates_explanation: "text",
+    does_not_validate_explanation: "text",
+    final_evidence_expected: "array",
+    test_cases: "array"
+};
+export const PRODUCT_DELIVERY_SCOPES = new Set([
+    "system_capability_build", "representative_sample_validation", "full_population_operation", "mixed_scope_requires_boundary"
+]);
+export const PLAN_DELIVERY_SCOPES = new Set([
+    "system_capability_build", "representative_sample_validation", "full_population_operation", "out_of_scope_backlog"
+]);
+export const ACCEPTANCE_SCOPES = new Set([
+    "system_capability_build", "representative_sample_validation", "full_population_operation", "full_population_not_required"
+]);
+export const SCOPE_FIT_DECISIONS = new Set(["fit_for_three_inputs", "selected_from_split", "blocked_for_decision"]);
+export const CANONICAL_PROOF_LAYERS = [
+    "code",
+    "api_schema",
+    "worker_runtime",
+    "data_artifact",
+    "integration",
+    "ui_browser",
+    "security_redaction",
+    "all_provider_all_runner",
+    "cleanup_stale_scan",
+    "test"
+];
+export const LEGACY_PROOF_LAYER_ALIASES = {
+    runtime: "worker_runtime",
+    browser: "ui_browser",
+    api: "api_schema",
+    data: "data_artifact",
+    security: "security_redaction"
+};
+export const MACHINE_VERIFIABLE_LAYER_NAMES = new Set(CANONICAL_PROOF_LAYERS.filter((layer) => layer !== "code"));
+export function fieldSet(fields) {
+    return new Set(fields);
+}
+export function normalizeProofLayerName(layer) {
+    const normalized = layer.trim().toLowerCase().replace(/[- ]+/g, "_");
+    return LEGACY_PROOF_LAYER_ALIASES[normalized] ?? normalized;
+}
+export function normalizeProofLayerId(layerId) {
+    const value = layerId.trim();
+    if (!value.includes(".")) {
+        return normalizeProofLayerName(value);
+    }
+    const acId = value.slice(0, value.lastIndexOf("."));
+    const layer = value.slice(value.lastIndexOf(".") + 1);
+    return `${acId}.${normalizeProofLayerName(layer)}`;
+}
+export function isSelectedScopeFitSlice(value) {
+    return value === "none" || /^SFC-\d{3,}$/i.test(value);
+}

package/dist/lib/superpowers-task-gates.js

@@ -1,8 +1,9 @@
 import { appendSuperpowersEvent } from "./superpowers-task-events.js";
 import { deriveSuperpowersArtifacts } from "./superpowers-task-derive.js";
 import { validatePlanAcceptance } from "./plan-acceptance-validator.js";
-import { loadSuperpowersState, recomputeStatuses, saveSuperpowersState } from "./superpowers-task-state.js";
-import { completionConditionErrors, validateSuperpowersState } from "./superpowers-task-validator.js";
+import { loadSuperpowersState, saveSuperpowersState } from "./superpowers-task-state.js";
+import { applyTrustedEvidenceKernelResult, evaluateTrustedEvidenceKernel } from "./superpowers-task-evidence-kernel.js";
+import { validateSuperpowersState } from "./superpowers-task-validator.js";
 export async function runSliceGate(workdir, sliceId) {
     const state = await loadSuperpowersState(workdir);
     const slice = state.slices.find((item) => item.slice_id === sliceId);
@@ -24,19 +25,17 @@ export async function runEpochGate(workdir, epochId) {
 }
 export async function runFinalGate(workdir) {
     const state = await loadSuperpowersState(workdir);
-    recomputeStatuses(state);
-    state.final.audit_task_complete = true;
-    state.meta.audit_task_complete = true;
-    state.gates.validator = { status: "not_run" };
+    const kernel = await evaluateTrustedEvidenceKernel(workdir, state);
+    applyTrustedEvidenceKernelResult(state, kernel);
+    state.gates.validator = { status: "not_run", kernel: "trusted_evidence_kernel" };
     await saveSuperpowersState(workdir, state);
     await deriveSuperpowersArtifacts(workdir);
     const report = await validateSuperpowersState(workdir, [workdir]);
     const acceptanceReport = await validatePlanAcceptance(workdir, [workdir]);
     const latest = await loadSuperpowersState(workdir);
-    const completionErrors = completionConditionErrors(latest);
-    const errors = [...new Set([...report.errors, ...acceptanceReport.errors, ...completionErrors])];
-    const complete = errors.length === 0;
-    const acceptanceStatus = complete ? "complete" : acceptanceStatusForErrors(errors);
+    const errors = [...new Set([...kernel.errors, ...report.errors, ...acceptanceReport.errors])];
+    const complete = kernel.product_goal_complete && errors.length === 0;
+    const acceptanceStatus = complete ? "complete" : acceptanceStatusForErrors(errors, kernel);
     const nextRequiredActions = complete ? [] : nextActionsForErrors(errors);
     latest.final.product_goal_complete = complete;
     latest.meta.product_goal_complete = complete;
@@ -45,25 +44,32 @@ export async function runFinalGate(workdir) {
     latest.final.audit_task_complete = true;
     latest.meta.audit_task_complete = true;
     latest.final.completion_basis = complete
-        ? ["all_required_acs_complete", "validator_passed", "assertion_evidence_passed", "negative_evidence_scan_passed", "auditor_no_blocker"]
+        ? ["trusted_evidence_kernel", "current_attempt_evidence", "negative_evidence_scan_passed", "harness_drift_lock_passed"]
         : [];
     latest.final.next_required_actions = nextRequiredActions;
     latest.gates.validator = { status: errors.length === 0 ? "pass" : "blocked", errors };
     latest.gates.final_gate = {
         status: complete ? "pass" : acceptanceStatus,
+        kernel: "trusted_evidence_kernel",
         order: [
-            "derive",
-            "verification_before_completion_expected",
-            "validate_state",
-            "validate_derived",
-            "validate_plan_acceptance",
-            "auditor_blocker_scan",
-            "stale_overclaim_scope_scan",
-            "ac_evidence_assertion_gate",
-            "negative_evidence_scan_gate",
-            "compute_completion"
+            "load_three_inputs",
+            "recompute_source_hashes",
+            "load_task_state",
+            "load_current_attempt",
+            "load_command_run_records",
+            "load_registered_evidence_records",
+            "discard_stale_evidence",
+            "contradiction_scan",
+            "recompute_every_ac",
+            "recompute_every_pi",
+            "recompute_acceptance_target_status",
+            "recompute_product_goal_complete",
+            "regenerate_derived",
+            "append_event"
         ],
         errors,
+        stale_evidence_ids: kernel.stale_evidence_ids,
+        harness_task_final_verdict: kernel.harness_task_final_verdict,
         next_required_actions: nextRequiredActions
     };
     await saveSuperpowersState(workdir, latest);
@@ -71,12 +77,15 @@ export async function runFinalGate(workdir) {
     await appendSuperpowersEvent(workdir, "final_gate", { product_goal_complete: complete });
     return { product_goal_complete: complete, errors };
 }
-function acceptanceStatusForErrors(errors) {
+function acceptanceStatusForErrors(errors, kernel) {
     const text = errors.join("\n");
-    if (/source hash mismatch|source_changed_requires_recompile|scope_conflict_requires_decision|auditor blocker|Context Delta coverage is unresolved/i.test(text)) {
+    if (kernel?.acceptance_target_status === "under_specified" || /under_specified/i.test(text)) {
+        return "under_specified";
+    }
+    if (/source hash mismatch|source_changed_requires_recompile|scope_conflict_requires_decision|auditor blocker|Context Delta coverage is unresolved|harness_drift|protected_baseline|harness_task_missing|required_command_specs_hash/i.test(text)) {
         return "blocked";
     }
-    if (/invalid evidence|forbidden shortcut|negative evidence|stale evidence|raw secret|contains_secret|sibling substitution|assertion_result\.status=failed|assertion exit_code=|command_exit_code=|forbidden text/i.test(text)) {
+    if (/invalid evidence|forbidden shortcut|negative evidence|stale evidence|raw secret|contains_secret|sibling substitution|assertion_result\.status=failed|assertion exit_code=|command_exit_code=|forbidden text|current contradiction|workflow_gate_bug_prevented|playwright_last_run_failed|owner_dom_forbidden_state|failed_test_result_artifact/i.test(text)) {
         return "invalidated";
     }
     return "partial";
@@ -95,6 +104,9 @@ function nextActionsForErrors(errors) {
         if (/negative evidence|forbidden/i.test(error)) {
             return `${error}; rerun the negative evidence scan and fix the contradictory owner-surface state`;
         }
+        if (/current contradiction|playwright_last_run_failed|owner_dom_forbidden_state|failed_test_result_artifact/i.test(error)) {
+            return `${error}; rerun the required current assertion command after fixing the current failure`;
+        }
         if (/derived\/.*does not match/i.test(error)) {
             return `${error}; rerun ty-context composite-long-task derive <workdir>`;
         }

package/dist/lib/superpowers-task-harness-drift.d.ts

@@ -0,0 +1,11 @@
+import { type SuperpowersTaskState } from "./superpowers-task-state-schema.js";
+export interface HarnessDriftResult {
+    harness_drift_detected: boolean;
+    acceptance_target_status: "complete" | "partial" | "blocked";
+    product_goal_complete: boolean;
+    harness_task_final_verdict?: "passed" | "failed";
+    changed_files: string[];
+    errors: string[];
+}
+export declare function detectHarnessDrift(state: SuperpowersTaskState): HarnessDriftResult;
+export declare function isHarnessPath(file: string): boolean;

package/dist/lib/superpowers-task-harness-drift.js

@@ -0,0 +1,86 @@
+import { isRecord } from "./superpowers-task-state-schema.js";
+const HARNESS_PATH_PATTERNS = [
+    /(^|\/)tests\/.*\.(spec|test)\.[cm]?[jt]sx?$/i,
+    /(^|\/)playwright\.config\./i,
+    /(^|\/).*\.spec\.[cm]?[jt]sx?$/i,
+    /(^|\/).*\.test\.[cm]?[jt]sx?$/i,
+    /superpowers-task-(assertions|evidence|evidence-kernel|current-evidence|command-specs|ac010|gates|validator|derive|state|state-schema|state-shape|under-specified|protected-baseline|harness-drift)\.ts$/i,
+    /(^|\/)(\.codex\/ty-context-managed|packages\/ty-context\/assets)\/skills\/composite-long-task-workflow\//i,
+    /composite-long-task-workflow-protocol\.md$/i,
+    /(^|\/)Makefile$/i,
+    /(^|\/)package\.json$/i
+];
+const REQUIRED_NEGATIVE_FIXTURES = [
+    "stale_evidence",
+    "historical_complete",
+    "derived_contradiction",
+    "ac010_summary_only",
+    "target_mismatch",
+    "api_only_for_ui",
+    "negative_evidence_after_pass",
+    "source_hash_mismatch",
+    "dirty_worktree_mismatch",
+    "missing_assertion_result",
+    "test_weakening"
+];
+export function detectHarnessDrift(state) {
+    const attempt = currentAttempt(state);
+    const changedFiles = changedFilesFor(attempt);
+    const harnessFiles = changedFiles.filter(isHarnessPath);
+    const mode = attempt?.mode ?? "product_task";
+    if (mode === "product_task" && harnessFiles.length > 0) {
+        return {
+            harness_drift_detected: true,
+            acceptance_target_status: "blocked",
+            product_goal_complete: false,
+            changed_files: harnessFiles,
+            errors: [
+                `harness_drift_detected: ${harnessFiles.join(", ")}`,
+                "本轮修改了验收工具链或测试本身，不能用被修改后的验收证明同一轮产品完成。请拆成独立 harness_task。"
+            ]
+        };
+    }
+    if (mode === "harness_task") {
+        return harnessTaskFixtureVerdict(state, changedFiles);
+    }
+    return { harness_drift_detected: false, acceptance_target_status: "complete", product_goal_complete: true, changed_files: [], errors: [] };
+}
+export function isHarnessPath(file) {
+    const normalized = file.replace(/\\/g, "/");
+    return HARNESS_PATH_PATTERNS.some((pattern) => pattern.test(normalized));
+}
+function harnessTaskFixtureVerdict(state, changedFiles) {
+    const fixtureState = isRecord(state.gates?.harness_task_fixtures) ? state.gates.harness_task_fixtures : undefined;
+    const errors = [];
+    if (!fixtureState) {
+        errors.push("harness_task_missing_adversarial_fixtures: harness_task must declare adversarial fixture outcomes");
+    }
+    else {
+        for (const fixture of REQUIRED_NEGATIVE_FIXTURES) {
+            if (fixtureState[fixture] !== false) {
+                errors.push(`harness_task_missing_adversarial_fixtures: ${fixture} must have expected product_goal_complete=false`);
+            }
+        }
+        if (fixtureState.happy_path !== true) {
+            errors.push("harness_task_missing_happy_path_fixture: happy_path must have expected product_goal_complete=true");
+        }
+    }
+    const fixtureChanges = changedFiles.filter((file) => /(^|\/)tests\/ty-context\/.*fixture/i.test(file.replace(/\\/g, "/")));
+    if (fixtureChanges.length > 0) {
+        errors.push(`fixture_changed_requires_review: ${fixtureChanges.join(", ")}`);
+    }
+    return {
+        harness_drift_detected: false,
+        acceptance_target_status: errors.length > 0 ? "blocked" : "complete",
+        product_goal_complete: false,
+        harness_task_final_verdict: errors.length > 0 ? "failed" : "passed",
+        changed_files: changedFiles,
+        errors
+    };
+}
+function currentAttempt(state) {
+    return (state.attempts ?? []).find((item) => item.task_attempt_id === state.current_attempt_id) ?? (state.attempts ?? []).at(-1);
+}
+function changedFilesFor(attempt) {
+    return [...new Set((attempt?.changed_files ?? []).map((file) => file.replace(/\\/g, "/")).filter(Boolean))];
+}

package/dist/lib/superpowers-task-protected-baseline.d.ts

@@ -0,0 +1,10 @@
+import { type SuperpowersTaskState } from "./superpowers-task-state-schema.js";
+export interface ProtectedBaselineResult {
+    protected_baseline_changed: boolean;
+    product_goal_complete: boolean;
+    changed_files: string[];
+    errors: string[];
+}
+export declare const PROTECTED_BASELINE_PATHS: string[];
+export declare function evaluateProtectedBaseline(state: SuperpowersTaskState): ProtectedBaselineResult;
+export declare function isProtectedBaselinePath(file: string): boolean;