qfai 0.5.0 → 0.5.2

package/dist/cli/index.mjs

@@ -116,6 +116,10 @@ function info(message) {
   process.stdout.write(`${message}
 `);
 }
+function warn(message) {
+  process.stdout.write(`${message}
+`);
+}
 function error(message) {
   process.stderr.write(`${message}
 `);
@@ -155,10 +159,10 @@ function report(copied, skipped, dryRun, label) {
 
 // src/cli/commands/report.ts
 import { mkdir as mkdir2, readFile as readFile12, writeFile } from "fs/promises";
-import path15 from "path";
+import path16 from "path";
 
 // src/core/config.ts
-import { readFile } from "fs/promises";
+import { access as access2, readFile } from "fs/promises";
 import path4 from "path";
 import { parse as parseYaml } from "yaml";
 var defaultConfig = {
@@ -190,7 +194,7 @@ var defaultConfig = {
       testFileGlobs: [],
       testFileExcludeGlobs: [],
       scNoTestSeverity: "error",
-      allowOrphanContracts: false,
+      orphanContractsPolicy: "error",
       unknownContractIdSeverity: "error"
     }
   },
@@ -201,6 +205,26 @@ var defaultConfig = {
 function getConfigPath(root) {
   return path4.join(root, "qfai.config.yaml");
 }
+async function findConfigRoot(startDir) {
+  const resolvedStart = path4.resolve(startDir);
+  let current = resolvedStart;
+  while (true) {
+    const configPath = getConfigPath(current);
+    if (await exists2(configPath)) {
+      return { root: current, configPath, found: true };
+    }
+    const parent = path4.dirname(current);
+    if (parent === current) {
+      break;
+    }
+    current = parent;
+  }
+  return {
+    root: resolvedStart,
+    configPath: getConfigPath(resolvedStart),
+    found: false
+  };
+}
 async function loadConfig(root) {
   const configPath = getConfigPath(root);
   const issues = [];
@@ -390,10 +414,10 @@ function normalizeValidation(raw, configPath, issues) {
         configPath,
         issues
       ),
-      allowOrphanContracts: readBoolean(
-        traceabilityRaw?.allowOrphanContracts,
-        base.traceability.allowOrphanContracts,
-        "validation.traceability.allowOrphanContracts",
+      orphanContractsPolicy: readOrphanContractsPolicy(
+        traceabilityRaw?.orphanContractsPolicy,
+        base.traceability.orphanContractsPolicy,
+        "validation.traceability.orphanContractsPolicy",
         configPath,
         issues
       ),
@@ -489,6 +513,20 @@ function readTraceabilitySeverity(value, fallback, label, configPath, issues) {
   }
   return fallback;
 }
+function readOrphanContractsPolicy(value, fallback, label, configPath, issues) {
+  if (value === "error" || value === "warning" || value === "allow") {
+    return value;
+  }
+  if (value !== void 0) {
+    issues.push(
+      configIssue(
+        configPath,
+        `${label} \u306F error|warning|allow \u306E\u3044\u305A\u308C\u304B\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002`
+      )
+    );
+  }
+  return fallback;
+}
 function configIssue(file, message) {
   return {
     code: "QFAI_CONFIG_INVALID",
@@ -504,6 +542,14 @@ function isMissingFile(error2) {
   }
   return false;
 }
+async function exists2(target) {
+  try {
+    await access2(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function formatError(error2) {
   if (error2 instanceof Error) {
     return error2.message;
@@ -514,20 +560,76 @@ function isRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
+// src/core/paths.ts
+import path5 from "path";
+function toRelativePath(root, target) {
+  if (!target) {
+    return target;
+  }
+  if (!path5.isAbsolute(target)) {
+    return toPosixPath(target);
+  }
+  const relative = path5.relative(root, target);
+  if (!relative) {
+    return ".";
+  }
+  return toPosixPath(relative);
+}
+function toPosixPath(value) {
+  return value.replace(/\\/g, "/");
+}
+
+// src/core/normalize.ts
+function normalizeIssuePaths(root, issues) {
+  return issues.map((issue7) => {
+    if (!issue7.file) {
+      return issue7;
+    }
+    const normalized = toRelativePath(root, issue7.file);
+    if (normalized === issue7.file) {
+      return issue7;
+    }
+    return {
+      ...issue7,
+      file: normalized
+    };
+  });
+}
+function normalizeScCoverage(root, sc) {
+  const refs = {};
+  for (const [scId, files] of Object.entries(sc.refs)) {
+    refs[scId] = files.map((file) => toRelativePath(root, file));
+  }
+  return {
+    ...sc,
+    refs
+  };
+}
+function normalizeValidationResult(root, result) {
+  return {
+    ...result,
+    issues: normalizeIssuePaths(root, result.issues),
+    traceability: {
+      ...result.traceability,
+      sc: normalizeScCoverage(root, result.traceability.sc)
+    }
+  };
+}
+
 // src/core/report.ts
 import { readFile as readFile11 } from "fs/promises";
-import path14 from "path";
+import path15 from "path";
 
 // src/core/contractIndex.ts
 import { readFile as readFile2 } from "fs/promises";
-import path7 from "path";
+import path8 from "path";
 
 // src/core/discovery.ts
-import { access as access3 } from "fs/promises";
+import { access as access4 } from "fs/promises";
 
 // src/core/fs.ts
-import { access as access2, readdir as readdir2 } from "fs/promises";
-import path5 from "path";
+import { access as access3, readdir as readdir2 } from "fs/promises";
+import path6 from "path";
 import fg from "fast-glob";
 var DEFAULT_IGNORE_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
@@ -539,7 +641,7 @@ var DEFAULT_IGNORE_DIRS = /* @__PURE__ */ new Set([
 ]);
 async function collectFiles(root, options = {}) {
   const entries = [];
-  if (!await exists2(root)) {
+  if (!await exists3(root)) {
     return entries;
   }
   const ignoreDirs = /* @__PURE__ */ new Set([
@@ -565,7 +667,7 @@ async function collectFilesByGlobs(root, options) {
 async function walk(base, current, ignoreDirs, extensions, out) {
   const items = await readdir2(current, { withFileTypes: true });
   for (const item of items) {
-    const fullPath = path5.join(current, item.name);
+    const fullPath = path6.join(current, item.name);
     if (item.isDirectory()) {
       if (ignoreDirs.has(item.name)) {
         continue;
@@ -575,7 +677,7 @@ async function walk(base, current, ignoreDirs, extensions, out) {
     }
     if (item.isFile()) {
       if (extensions.length > 0) {
-        const ext = path5.extname(item.name).toLowerCase();
+        const ext = path6.extname(item.name).toLowerCase();
         if (!extensions.includes(ext)) {
           continue;
         }
@@ -584,9 +686,9 @@ async function walk(base, current, ignoreDirs, extensions, out) {
     }
   }
 }
-async function exists2(target) {
+async function exists3(target) {
   try {
-    await access2(target);
+    await access3(target);
     return true;
   } catch {
     return false;
@@ -595,22 +697,22 @@ async function exists2(target) {
 
 // src/core/specLayout.ts
 import { readdir as readdir3 } from "fs/promises";
-import path6 from "path";
+import path7 from "path";
 var SPEC_DIR_RE = /^spec-\d{4}$/;
 async function collectSpecEntries(specsRoot) {
   const dirs = await listSpecDirs(specsRoot);
   const entries = dirs.map((dir) => ({
     dir,
-    specPath: path6.join(dir, "spec.md"),
-    deltaPath: path6.join(dir, "delta.md"),
-    scenarioPath: path6.join(dir, "scenario.md")
+    specPath: path7.join(dir, "spec.md"),
+    deltaPath: path7.join(dir, "delta.md"),
+    scenarioPath: path7.join(dir, "scenario.md")
   }));
   return entries.sort((a, b) => a.dir.localeCompare(b.dir));
 }
 async function listSpecDirs(specsRoot) {
   try {
     const items = await readdir3(specsRoot, { withFileTypes: true });
-    return items.filter((item) => item.isDirectory()).map((item) => item.name).filter((name) => SPEC_DIR_RE.test(name.toLowerCase())).map((name) => path6.join(specsRoot, name));
+    return items.filter((item) => item.isDirectory()).map((item) => item.name).filter((name) => SPEC_DIR_RE.test(name.toLowerCase())).map((name) => path7.join(specsRoot, name));
   } catch (error2) {
     if (isMissingFileError(error2)) {
       return [];
@@ -658,15 +760,15 @@ async function collectContractFiles(uiRoot, apiRoot, dbRoot) {
 async function filterExisting(files) {
   const existing = [];
   for (const file of files) {
-    if (await exists3(file)) {
+    if (await exists4(file)) {
       existing.push(file);
     }
   }
   return existing;
 }
-async function exists3(target) {
+async function exists4(target) {
   try {
-    await access3(target);
+    await access4(target);
     return true;
   } catch {
     return false;
@@ -693,9 +795,9 @@ function stripContractDeclarationLines(text) {
 // src/core/contractIndex.ts
 async function buildContractIndex(root, config) {
   const contractsRoot = resolvePath(root, config, "contractsDir");
-  const uiRoot = path7.join(contractsRoot, "ui");
-  const apiRoot = path7.join(contractsRoot, "api");
-  const dbRoot = path7.join(contractsRoot, "db");
+  const uiRoot = path8.join(contractsRoot, "ui");
+  const apiRoot = path8.join(contractsRoot, "api");
+  const dbRoot = path8.join(contractsRoot, "db");
   const [uiFiles, apiFiles, dbFiles] = await Promise.all([
     collectUiContractFiles(uiRoot),
     collectApiContractFiles(apiRoot),
@@ -777,6 +879,57 @@ function isValidId(value, prefix) {
   return strict.test(value);
 }
 
+// src/core/parse/contractRefs.ts
+var CONTRACT_REF_ID_RE = /^(?:API|UI|DB)-\d{4}$/;
+function parseContractRefs(text, options = {}) {
+  const linePattern = buildLinePattern(options);
+  const lines = [];
+  for (const match of text.matchAll(linePattern)) {
+    lines.push((match[1] ?? "").trim());
+  }
+  const ids = [];
+  const invalidTokens = [];
+  let hasNone = false;
+  for (const line of lines) {
+    if (line.length === 0) {
+      invalidTokens.push("(empty)");
+      continue;
+    }
+    const tokens = line.split(",").map((token) => token.trim());
+    for (const token of tokens) {
+      if (token.length === 0) {
+        invalidTokens.push("(empty)");
+        continue;
+      }
+      if (token === "none") {
+        hasNone = true;
+        continue;
+      }
+      if (CONTRACT_REF_ID_RE.test(token)) {
+        ids.push(token);
+        continue;
+      }
+      invalidTokens.push(token);
+    }
+  }
+  return {
+    lines,
+    ids: unique2(ids),
+    invalidTokens: unique2(invalidTokens),
+    hasNone
+  };
+}
+function buildLinePattern(options) {
+  const prefix = options.allowCommentPrefix ? "#" : "";
+  return new RegExp(
+    `^[ \\t]*${prefix}[ \\t]*QFAI-CONTRACT-REF:[ \\t]*([^\\r\\n]*)[ \\t]*$`,
+    "gm"
+  );
+}
+function unique2(values) {
+  return Array.from(new Set(values));
+}
+
 // src/core/parse/markdown.ts
 var HEADING_RE = /^(#{1,6})\s+(.+?)\s*$/;
 function parseHeadings(md) {
@@ -823,8 +976,6 @@ var SPEC_ID_RE = /\bSPEC-\d{4}\b/;
 var BR_LINE_RE = /^\s*(?:[-*]\s*)?\[(BR-\d{4})\]\[(P[0-3])\]\s*(.+)$/;
 var BR_LINE_ANY_PRIORITY_RE = /^\s*(?:[-*]\s*)?\[(BR-\d{4})\]\[(P[^\]]+)\]\s*(.+)$/;
 var BR_LINE_NO_PRIORITY_RE = /^\s*(?:[-*]\s*)?\[(BR-\d{4})\](?!\s*\[P)\s*(.*\S.*)$/;
-var CONTRACT_REF_LINE_RE = /^[ \t]*QFAI-CONTRACT-REF:[ \t]*([^\r\n]*)[ \t]*$/gm;
-var CONTRACT_REF_ID_RE = /^(?:API|UI|DB)-\d{4}$/;
 var BR_SECTION_TITLE = "\u696D\u52D9\u30EB\u30FC\u30EB";
 var VALID_PRIORITIES = /* @__PURE__ */ new Set(["P0", "P1", "P2", "P3"]);
 function parseSpec(md, file) {
@@ -897,50 +1048,10 @@ function parseSpec(md, file) {
   }
   return parsed;
 }
-function parseContractRefs(md) {
-  const lines = [];
-  for (const match of md.matchAll(CONTRACT_REF_LINE_RE)) {
-    lines.push((match[1] ?? "").trim());
-  }
-  const ids = [];
-  const invalidTokens = [];
-  let hasNone = false;
-  for (const line of lines) {
-    if (line.length === 0) {
-      invalidTokens.push("(empty)");
-      continue;
-    }
-    const tokens = line.split(",").map((token) => token.trim());
-    for (const token of tokens) {
-      if (token.length === 0) {
-        invalidTokens.push("(empty)");
-        continue;
-      }
-      if (token === "none") {
-        hasNone = true;
-        continue;
-      }
-      if (CONTRACT_REF_ID_RE.test(token)) {
-        ids.push(token);
-        continue;
-      }
-      invalidTokens.push(token);
-    }
-  }
-  return {
-    lines,
-    ids: unique2(ids),
-    invalidTokens: unique2(invalidTokens),
-    hasNone
-  };
-}
-function unique2(values) {
-  return Array.from(new Set(values));
-}
 
 // src/core/traceability.ts
 import { readFile as readFile3 } from "fs/promises";
-import path8 from "path";
+import path9 from "path";
 
 // src/core/gherkin/parse.ts
 import {
@@ -975,9 +1086,6 @@ function formatError2(error2) {
 var SPEC_TAG_RE = /^SPEC-\d{4}$/;
 var SC_TAG_RE = /^SC-\d{4}$/;
 var BR_TAG_RE = /^BR-\d{4}$/;
-var UI_TAG_RE = /^UI-\d{4}$/;
-var API_TAG_RE = /^API-\d{4}$/;
-var DB_TAG_RE = /^DB-\d{4}$/;
 function parseScenarioDocument(text, uri) {
   const { gherkinDocument, errors } = parseGherkin(text, uri);
   if (!gherkinDocument) {
@@ -1002,31 +1110,21 @@ function parseScenarioDocument(text, uri) {
     errors
   };
 }
-function buildScenarioAtoms(document) {
+function buildScenarioAtoms(document, contractIds = []) {
+  const uniqueContractIds = unique3(contractIds).sort(
+    (a, b) => a.localeCompare(b)
+  );
   return document.scenarios.map((scenario) => {
     const specIds = scenario.tags.filter((tag) => SPEC_TAG_RE.test(tag));
     const scIds = scenario.tags.filter((tag) => SC_TAG_RE.test(tag));
     const brIds = unique3(scenario.tags.filter((tag) => BR_TAG_RE.test(tag)));
-    const contractIds = /* @__PURE__ */ new Set();
-    scenario.tags.forEach((tag) => {
-      if (UI_TAG_RE.test(tag) || API_TAG_RE.test(tag) || DB_TAG_RE.test(tag)) {
-        contractIds.add(tag);
-      }
-    });
-    for (const step of scenario.steps) {
-      for (const text of collectStepTexts(step)) {
-        extractIds(text, "UI").forEach((id) => contractIds.add(id));
-        extractIds(text, "API").forEach((id) => contractIds.add(id));
-        extractIds(text, "DB").forEach((id) => contractIds.add(id));
-      }
-    }
     const atom = {
       uri: document.uri,
       featureName: document.featureName ?? "",
       scenarioName: scenario.name,
       kind: scenario.kind,
       brIds,
-      contractIds: Array.from(contractIds).sort()
+      contractIds: uniqueContractIds
     };
     if (scenario.line !== void 0) {
       atom.line = scenario.line;
@@ -1079,23 +1177,6 @@ function buildScenarioNode(scenario, featureTags, ruleTags) {
 function collectTagNames(tags) {
   return tags.map((tag) => tag.name.replace(/^@/, ""));
 }
-function collectStepTexts(step) {
-  const texts = [];
-  if (step.text) {
-    texts.push(step.text);
-  }
-  if (step.docString?.content) {
-    texts.push(step.docString.content);
-  }
-  if (step.dataTable?.rows) {
-    for (const row of step.dataTable.rows) {
-      for (const cell of row.cells) {
-        texts.push(cell.value);
-      }
-    }
-  }
-  return texts;
-}
 function unique3(values) {
   return Array.from(new Set(values));
 }
@@ -1197,7 +1278,7 @@ async function collectScTestReferences(root, globs, excludeGlobs) {
     };
   }
   const normalizedFiles = Array.from(
-    new Set(files.map((file) => path8.normalize(file)))
+    new Set(files.map((file) => path9.normalize(file)))
   );
   for (const file of normalizedFiles) {
     const text = await readFile3(file, "utf-8");
@@ -1258,11 +1339,11 @@ function formatError3(error2) {
 
 // src/core/version.ts
 import { readFile as readFile4 } from "fs/promises";
-import path9 from "path";
+import path10 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 async function resolveToolVersion() {
-  if ("0.5.0".length > 0) {
-    return "0.5.0";
+  if ("0.5.2".length > 0) {
+    return "0.5.2";
   }
   try {
     const packagePath = resolvePackageJsonPath();
@@ -1277,18 +1358,18 @@ async function resolveToolVersion() {
 function resolvePackageJsonPath() {
   const base = import.meta.url;
   const basePath = base.startsWith("file:") ? fileURLToPath2(base) : base;
-  return path9.resolve(path9.dirname(basePath), "../../package.json");
+  return path10.resolve(path10.dirname(basePath), "../../package.json");
 }
 
 // src/core/validators/contracts.ts
 import { readFile as readFile5 } from "fs/promises";
-import path11 from "path";
+import path12 from "path";
 
 // src/core/contracts.ts
-import path10 from "path";
+import path11 from "path";
 import { parse as parseYaml2 } from "yaml";
 function parseStructuredContract(file, text) {
-  const ext = path10.extname(file).toLowerCase();
+  const ext = path11.extname(file).toLowerCase();
   if (ext === ".json") {
     return JSON.parse(text);
   }
@@ -1308,9 +1389,9 @@ var SQL_DANGEROUS_PATTERNS = [
 async function validateContracts(root, config) {
   const issues = [];
   const contractsRoot = resolvePath(root, config, "contractsDir");
-  issues.push(...await validateUiContracts(path11.join(contractsRoot, "ui")));
-  issues.push(...await validateApiContracts(path11.join(contractsRoot, "api")));
-  issues.push(...await validateDbContracts(path11.join(contractsRoot, "db")));
+  issues.push(...await validateUiContracts(path12.join(contractsRoot, "ui")));
+  issues.push(...await validateApiContracts(path12.join(contractsRoot, "api")));
+  issues.push(...await validateDbContracts(path12.join(contractsRoot, "db")));
   const contractIndex = await buildContractIndex(root, config);
   issues.push(...validateDuplicateContractIds(contractIndex));
   return issues;
@@ -1593,7 +1674,7 @@ function issue(code, message, severity, file, rule, refs) {
 
 // src/core/validators/delta.ts
 import { readFile as readFile6 } from "fs/promises";
-import path12 from "path";
+import path13 from "path";
 var SECTION_RE = /^##\s+変更区分/m;
 var COMPAT_LINE_RE = /^\s*-\s*\[[ xX]\]\s*Compatibility\b/m;
 var CHANGE_LINE_RE = /^\s*-\s*\[[ xX]\]\s*Change\/Improvement\b/m;
@@ -1607,7 +1688,7 @@ async function validateDeltas(root, config) {
   }
   const issues = [];
   for (const pack of packs) {
-    const deltaPath = path12.join(pack, "delta.md");
+    const deltaPath = path13.join(pack, "delta.md");
     let text;
     try {
       text = await readFile6(deltaPath, "utf-8");
@@ -1683,7 +1764,7 @@ function issue2(code, message, severity, file, rule, refs) {
 
 // src/core/validators/ids.ts
 import { readFile as readFile7 } from "fs/promises";
-import path13 from "path";
+import path14 from "path";
 var SC_TAG_RE3 = /^SC-\d{4}$/;
 async function validateDefinedIds(root, config) {
   const issues = [];
@@ -1749,7 +1830,7 @@ function recordId(out, id, file) {
 }
 function formatFileList(files, root) {
   return files.map((file) => {
-    const relative = path13.relative(root, file);
+    const relative = path14.relative(root, file);
     return relative.length > 0 ? relative : file;
   }).join(", ");
 }
@@ -2186,7 +2267,7 @@ async function validateTraceability(root, config) {
       if (contractRefs.hasNone && contractRefs.ids.length > 0) {
         issues.push(
           issue6(
-            "QFAI-TRACE-021",
+            "QFAI-TRACE-023",
             "Spec \u306E QFAI-CONTRACT-REF \u306B none \u3068\u5951\u7D04 ID \u304C\u6DF7\u5728\u3057\u3066\u3044\u307E\u3059\u3002",
             "error",
             file,
@@ -2218,7 +2299,7 @@ async function validateTraceability(root, config) {
     if (unknownContractIds.length > 0) {
       issues.push(
         issue6(
-          "QFAI-TRACE-021",
+          "QFAI-TRACE-024",
           `Spec \u304C\u672A\u77E5\u306E\u5951\u7D04 ID \u3092\u53C2\u7167\u3057\u3066\u3044\u307E\u3059: ${unknownContractIds.join(
             ", "
           )}`,
@@ -2233,11 +2314,62 @@ async function validateTraceability(root, config) {
   for (const file of scenarioFiles) {
     const text = await readFile10(file, "utf-8");
     extractAllIds(text).forEach((id) => upstreamIds.add(id));
+    const scenarioContractRefs = parseContractRefs(text, {
+      allowCommentPrefix: true
+    });
+    if (scenarioContractRefs.lines.length === 0) {
+      issues.push(
+        issue6(
+          "QFAI-TRACE-031",
+          "Scenario \u306B QFAI-CONTRACT-REF \u304C\u3042\u308A\u307E\u305B\u3093\u3002",
+          "error",
+          file,
+          "traceability.scenarioContractRefRequired"
+        )
+      );
+    } else {
+      if (scenarioContractRefs.hasNone && scenarioContractRefs.ids.length > 0) {
+        issues.push(
+          issue6(
+            "QFAI-TRACE-033",
+            "Scenario \u306E QFAI-CONTRACT-REF \u306B none \u3068\u5951\u7D04 ID \u304C\u6DF7\u5728\u3057\u3066\u3044\u307E\u3059\u3002",
+            "error",
+            file,
+            "traceability.scenarioContractRefFormat"
+          )
+        );
+      }
+      if (scenarioContractRefs.invalidTokens.length > 0) {
+        issues.push(
+          issue6(
+            "QFAI-TRACE-032",
+            `Scenario \u306E\u5951\u7D04 ID \u304C\u4E0D\u6B63\u3067\u3059: ${scenarioContractRefs.invalidTokens.join(
+              ", "
+            )}`,
+            "error",
+            file,
+            "traceability.scenarioContractRefFormat",
+            scenarioContractRefs.invalidTokens
+          )
+        );
+      }
+    }
     const { document, errors } = parseScenarioDocument(text, file);
     if (!document || errors.length > 0) {
       continue;
     }
-    const atoms = buildScenarioAtoms(document);
+    if (document.scenarios.length !== 1) {
+      issues.push(
+        issue6(
+          "QFAI-TRACE-030",
+          `Scenario \u30D5\u30A1\u30A4\u30EB\u306F 1\u30D5\u30A1\u30A4\u30EB=1\u30B7\u30CA\u30EA\u30AA\u3067\u3059\u3002\u73FE\u5728: ${document.scenarios.length}\u4EF6 (file=${file})`,
+          "error",
+          file,
+          "traceability.scenarioOnePerFile"
+        )
+      );
+    }
+    const atoms = buildScenarioAtoms(document, scenarioContractRefs.ids);
     const scIdsInFile = /* @__PURE__ */ new Set();
     for (const [index, scenario] of document.scenarios.entries()) {
       const atom = atoms[index];
@@ -2382,7 +2514,7 @@ async function validateTraceability(root, config) {
     if (orphanBrIds.length > 0) {
       issues.push(
         issue6(
-          "QFAI_TRACE_BR_ORPHAN",
+          "QFAI-TRACE-009",
           `BR \u304C SC \u306B\u7D10\u3065\u3044\u3066\u3044\u307E\u305B\u3093: ${orphanBrIds.join(", ")}`,
           "error",
           specsRoot,
@@ -2452,17 +2584,19 @@ async function validateTraceability(root, config) {
       );
     }
   }
-  if (!config.validation.traceability.allowOrphanContracts) {
+  const orphanPolicy = config.validation.traceability.orphanContractsPolicy;
+  if (orphanPolicy !== "allow") {
     if (contractIds.size > 0) {
       const orphanContracts = Array.from(contractIds).filter(
         (id) => !specContractIds.has(id)
       );
       if (orphanContracts.length > 0) {
+        const severity = orphanPolicy === "warning" ? "warning" : "error";
         issues.push(
           issue6(
             "QFAI-TRACE-022",
             `\u5951\u7D04\u304C Spec \u304B\u3089\u53C2\u7167\u3055\u308C\u3066\u3044\u307E\u305B\u3093: ${orphanContracts.join(", ")}`,
-            "error",
+            severity,
             specsRoot,
             "traceability.contractCoverage",
             orphanContracts
@@ -2587,16 +2721,17 @@ function countIssues(issues) {
 // src/core/report.ts
 var ID_PREFIXES2 = ["SPEC", "BR", "SC", "UI", "API", "DB"];
 async function createReportData(root, validation, configResult) {
-  const resolved = configResult ?? await loadConfig(root);
+  const resolvedRoot = path15.resolve(root);
+  const resolved = configResult ?? await loadConfig(resolvedRoot);
   const config = resolved.config;
   const configPath = resolved.configPath;
-  const specsRoot = resolvePath(root, config, "specsDir");
-  const contractsRoot = resolvePath(root, config, "contractsDir");
-  const apiRoot = path14.join(contractsRoot, "api");
-  const uiRoot = path14.join(contractsRoot, "ui");
-  const dbRoot = path14.join(contractsRoot, "db");
-  const srcRoot = resolvePath(root, config, "srcDir");
-  const testsRoot = resolvePath(root, config, "testsDir");
+  const specsRoot = resolvePath(resolvedRoot, config, "specsDir");
+  const contractsRoot = resolvePath(resolvedRoot, config, "contractsDir");
+  const apiRoot = path15.join(contractsRoot, "api");
+  const uiRoot = path15.join(contractsRoot, "ui");
+  const dbRoot = path15.join(contractsRoot, "db");
+  const srcRoot = resolvePath(resolvedRoot, config, "srcDir");
+  const testsRoot = resolvePath(resolvedRoot, config, "testsDir");
   const specFiles = await collectSpecFiles(specsRoot);
   const scenarioFiles = await collectScenarioFiles(specsRoot);
   const {
@@ -2604,15 +2739,15 @@ async function createReportData(root, validation, configResult) {
     ui: uiFiles,
     db: dbFiles
   } = await collectContractFiles(uiRoot, apiRoot, dbRoot);
-  const contractIndex = await buildContractIndex(root, config);
+  const contractIndex = await buildContractIndex(resolvedRoot, config);
   const contractIdList = Array.from(contractIndex.ids);
   const specContractRefs = await collectSpecContractRefs(
     specFiles,
     contractIdList
   );
   const referencedContracts = /* @__PURE__ */ new Set();
-  for (const ids of specContractRefs.specToContractIds.values()) {
-    ids.forEach((id) => referencedContracts.add(id));
+  for (const entry of specContractRefs.specToContracts.values()) {
+    entry.ids.forEach((id) => referencedContracts.add(id));
   }
   const referencedContractCount = contractIdList.filter(
     (id) => referencedContracts.has(id)
@@ -2621,8 +2756,8 @@ async function createReportData(root, validation, configResult) {
     (id) => !referencedContracts.has(id)
   ).length;
   const contractIdToSpecsRecord = mapToSortedRecord(specContractRefs.idToSpecs);
-  const specToContractIdsRecord = mapToSortedRecord(
-    specContractRefs.specToContractIds
+  const specToContractsRecord = mapToSpecContractRecord(
+    specContractRefs.specToContracts
   );
   const idsByPrefix = await collectIds([
     ...specFiles,
@@ -2640,24 +2775,26 @@ async function createReportData(root, validation, configResult) {
     srcRoot,
     testsRoot
   );
-  const scIds = await collectScIdsFromScenarioFiles(scenarioFiles);
-  const scRefsResult = await collectScTestReferences(
-    root,
-    config.validation.traceability.testFileGlobs,
-    config.validation.traceability.testFileExcludeGlobs
+  const resolvedValidationRaw = validation ?? await validateProject(resolvedRoot, resolved);
+  const normalizedValidation = normalizeValidationResult(
+    resolvedRoot,
+    resolvedValidationRaw
   );
-  const scCoverage = validation?.traceability?.sc ?? buildScCoverage(scIds, scRefsResult.refs);
-  const testFiles = validation?.traceability?.testFiles ?? scRefsResult.scan;
+  const scCoverage = normalizedValidation.traceability.sc;
+  const testFiles = normalizedValidation.traceability.testFiles;
   const scSources = await collectScIdSourcesFromScenarioFiles(scenarioFiles);
-  const scSourceRecord = mapToSortedRecord(scSources);
-  const resolvedValidation = validation ?? await validateProject(root, resolved);
+  const scSourceRecord = mapToSortedRecord(
+    normalizeScSources(resolvedRoot, scSources)
+  );
   const version = await resolveToolVersion();
+  const displayRoot = toRelativePath(resolvedRoot, resolvedRoot);
+  const displayConfigPath = toRelativePath(resolvedRoot, configPath);
   return {
     tool: "qfai",
     version,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    root,
-    configPath,
+    root: displayRoot,
+    configPath: displayConfigPath,
     summary: {
       specs: specFiles.length,
       scenarios: scenarioFiles.length,
@@ -2666,7 +2803,7 @@ async function createReportData(root, validation, configResult) {
         ui: uiFiles.length,
         db: dbFiles.length
       },
-      counts: resolvedValidation.counts
+      counts: normalizedValidation.counts
     },
     ids: {
       spec: idsByPrefix.SPEC,
@@ -2691,21 +2828,23 @@ async function createReportData(root, validation, configResult) {
       specs: {
         contractRefMissing: specContractRefs.missingRefSpecs.size,
         missingRefSpecs: toSortedArray2(specContractRefs.missingRefSpecs),
-        specToContractIds: specToContractIdsRecord
+        specToContracts: specToContractsRecord
       }
     },
-    issues: resolvedValidation.issues
+    issues: normalizedValidation.issues
   };
 }
 function formatReportMarkdown(data) {
   const lines = [];
   lines.push("# QFAI Report");
+  lines.push("");
   lines.push(`- \u751F\u6210\u65E5\u6642: ${data.generatedAt}`);
   lines.push(`- \u30EB\u30FC\u30C8: ${data.root}`);
   lines.push(`- \u8A2D\u5B9A: ${data.configPath}`);
   lines.push(`- \u7248: ${data.version}`);
   lines.push("");
   lines.push("## \u6982\u8981");
+  lines.push("");
   lines.push(`- specs: ${data.summary.specs}`);
   lines.push(`- scenarios: ${data.summary.scenarios}`);
   lines.push(
@@ -2716,6 +2855,7 @@ function formatReportMarkdown(data) {
   );
   lines.push("");
   lines.push("## ID\u96C6\u8A08");
+  lines.push("");
   lines.push(formatIdLine("SPEC", data.ids.spec));
   lines.push(formatIdLine("BR", data.ids.br));
   lines.push(formatIdLine("SC", data.ids.sc));
@@ -2724,12 +2864,14 @@ function formatReportMarkdown(data) {
   lines.push(formatIdLine("DB", data.ids.db));
   lines.push("");
   lines.push("## \u30C8\u30EC\u30FC\u30B5\u30D3\u30EA\u30C6\u30A3");
+  lines.push("");
   lines.push(`- \u4E0A\u6D41ID\u691C\u51FA\u6570: ${data.traceability.upstreamIdsFound}`);
   lines.push(
     `- \u30B3\u30FC\u30C9/\u30C6\u30B9\u30C8\u53C2\u7167: ${data.traceability.referencedInCodeOrTests ? "\u3042\u308A" : "\u306A\u3057"}`
   );
   lines.push("");
   lines.push("## \u5951\u7D04\u30AB\u30D0\u30EC\u30C3\u30B8");
+  lines.push("");
   lines.push(`- total: ${data.traceability.contracts.total}`);
   lines.push(`- referenced: ${data.traceability.contracts.referenced}`);
   lines.push(`- orphan: ${data.traceability.contracts.orphan}`);
@@ -2738,6 +2880,7 @@ function formatReportMarkdown(data) {
   );
   lines.push("");
   lines.push("## \u5951\u7D04\u2192Spec");
+  lines.push("");
   const contractToSpecs = data.traceability.contracts.idToSpecs;
   const contractIds = Object.keys(contractToSpecs).sort(
     (a, b) => a.localeCompare(b)
@@ -2756,24 +2899,25 @@ function formatReportMarkdown(data) {
   }
   lines.push("");
   lines.push("## Spec\u2192\u5951\u7D04");
-  const specToContracts = data.traceability.specs.specToContractIds;
+  lines.push("");
+  const specToContracts = data.traceability.specs.specToContracts;
   const specIds = Object.keys(specToContracts).sort(
     (a, b) => a.localeCompare(b)
   );
   if (specIds.length === 0) {
     lines.push("- (none)");
   } else {
-    for (const specId of specIds) {
-      const contractIds2 = specToContracts[specId] ?? [];
-      if (contractIds2.length === 0) {
-        lines.push(`- ${specId}: (none)`);
-      } else {
-        lines.push(`- ${specId}: ${contractIds2.join(", ")}`);
-      }
-    }
+    const rows = specIds.map((specId) => {
+      const entry = specToContracts[specId];
+      const contracts = entry?.status === "missing" ? "(missing)" : entry && entry.ids.length > 0 ? entry.ids.join(", ") : "(none)";
+      const status = entry?.status ?? "missing";
+      return [specId, status, contracts];
+    });
+    lines.push(...formatMarkdownTable(["Spec", "Status", "Contracts"], rows));
   }
   lines.push("");
   lines.push("## Spec\u3067 contract-ref \u672A\u5BA3\u8A00");
+  lines.push("");
   const missingRefSpecs = data.traceability.specs.missingRefSpecs;
   if (missingRefSpecs.length === 0) {
     lines.push("- (none)");
@@ -2784,6 +2928,7 @@ function formatReportMarkdown(data) {
   }
   lines.push("");
   lines.push("## SC\u30AB\u30D0\u30EC\u30C3\u30B8");
+  lines.push("");
   lines.push(`- total: ${data.traceability.sc.total}`);
   lines.push(`- covered: ${data.traceability.sc.covered}`);
   lines.push(`- missing: ${data.traceability.sc.missing}`);
@@ -2813,6 +2958,7 @@ function formatReportMarkdown(data) {
   }
   lines.push("");
   lines.push("## SC\u2192\u53C2\u7167\u30C6\u30B9\u30C8");
+  lines.push("");
   const scRefs = data.traceability.sc.refs;
   const scIds = Object.keys(scRefs).sort((a, b) => a.localeCompare(b));
   if (scIds.length === 0) {
@@ -2829,6 +2975,7 @@ function formatReportMarkdown(data) {
   }
   lines.push("");
   lines.push("## Spec:SC=1:1 \u9055\u53CD");
+  lines.push("");
   const specScIssues = data.issues.filter(
     (item) => item.code === "QFAI-TRACE-012"
   );
@@ -2843,6 +2990,7 @@ function formatReportMarkdown(data) {
   }
   lines.push("");
   lines.push("## Hotspots");
+  lines.push("");
   const hotspots = buildHotspots(data.issues);
   if (hotspots.length === 0) {
     lines.push("- (none)");
@@ -2855,6 +3003,7 @@ function formatReportMarkdown(data) {
   }
   lines.push("");
   lines.push("## \u30C8\u30EC\u30FC\u30B5\u30D3\u30EA\u30C6\u30A3\uFF08\u691C\u8A3C\uFF09");
+  lines.push("");
   const traceIssues = data.issues.filter(
     (item) => item.rule?.startsWith("traceability.") || item.code.startsWith("QFAI_TRACE") || item.code.startsWith("QFAI-TRACE-")
   );
@@ -2870,6 +3019,7 @@ function formatReportMarkdown(data) {
   }
   lines.push("");
   lines.push("## \u691C\u8A3C\u7D50\u679C");
+  lines.push("");
   if (data.issues.length === 0) {
     lines.push("- (none)");
   } else {
@@ -2887,7 +3037,7 @@ function formatReportJson(data) {
   return JSON.stringify(data, null, 2);
 }
 async function collectSpecContractRefs(specFiles, contractIdList) {
-  const specToContractIds = /* @__PURE__ */ new Map();
+  const specToContracts = /* @__PURE__ */ new Map();
   const idToSpecs = /* @__PURE__ */ new Map();
   const missingRefSpecs = /* @__PURE__ */ new Set();
   for (const contractId of contractIdList) {
@@ -2896,24 +3046,31 @@ async function collectSpecContractRefs(specFiles, contractIdList) {
   for (const file of specFiles) {
     const text = await readFile11(file, "utf-8");
     const parsed = parseSpec(text, file);
-    const specKey = parsed.specId ?? file;
+    const specKey = parsed.specId;
+    if (!specKey) {
+      continue;
+    }
     const refs = parsed.contractRefs;
     if (refs.lines.length === 0) {
       missingRefSpecs.add(specKey);
+      specToContracts.set(specKey, { status: "missing", ids: /* @__PURE__ */ new Set() });
       continue;
     }
-    const currentContracts = specToContractIds.get(specKey) ?? /* @__PURE__ */ new Set();
+    const current = specToContracts.get(specKey) ?? {
+      status: "declared",
+      ids: /* @__PURE__ */ new Set()
+    };
     for (const id of refs.ids) {
-      currentContracts.add(id);
+      current.ids.add(id);
       const specs = idToSpecs.get(id);
       if (specs) {
         specs.add(specKey);
       }
     }
-    specToContractIds.set(specKey, currentContracts);
+    specToContracts.set(specKey, current);
   }
   return {
-    specToContractIds,
+    specToContracts,
     idToSpecs,
     missingRefSpecs
   };
@@ -2990,6 +3147,20 @@ function formatList(values) {
   }
   return values.join(", ");
 }
+function formatMarkdownTable(headers, rows) {
+  const widths = headers.map((header, index) => {
+    const candidates = rows.map((row) => row[index] ?? "");
+    return Math.max(header.length, ...candidates.map((item) => item.length));
+  });
+  const formatRow = (cells) => {
+    const padded = cells.map(
+      (cell, index) => (cell ?? "").padEnd(widths[index] ?? 0)
+    );
+    return `| ${padded.join(" | ")} |`;
+  };
+  const separator = `| ${widths.map((width) => "-".repeat(width)).join(" | ")} |`;
+  return [formatRow(headers), separator, ...rows.map(formatRow)];
+}
 function toSortedArray2(values) {
   return Array.from(values).sort((a, b) => a.localeCompare(b));
 }
@@ -3000,6 +3171,27 @@ function mapToSortedRecord(values) {
   }
   return record2;
 }
+function mapToSpecContractRecord(values) {
+  const record2 = {};
+  for (const [key, entry] of values.entries()) {
+    record2[key] = {
+      status: entry.status,
+      ids: toSortedArray2(entry.ids)
+    };
+  }
+  return record2;
+}
+function normalizeScSources(root, sources) {
+  const normalized = /* @__PURE__ */ new Map();
+  for (const [id, files] of sources.entries()) {
+    const mapped = /* @__PURE__ */ new Set();
+    for (const file of files) {
+      mapped.add(toRelativePath(root, file));
+    }
+    normalized.set(id, mapped);
+  }
+  return normalized;
+}
 function buildHotspots(issues) {
   const map = /* @__PURE__ */ new Map();
   for (const issue7 of issues) {
@@ -3024,38 +3216,53 @@ function buildHotspots(issues) {
 
 // src/cli/commands/report.ts
 async function runReport(options) {
-  const root = path15.resolve(options.root);
+  const root = path16.resolve(options.root);
   const configResult = await loadConfig(root);
-  const input = configResult.config.output.validateJsonPath;
-  const inputPath = path15.isAbsolute(input) ? input : path15.resolve(root, input);
   let validation;
-  try {
-    validation = await readValidationResult(inputPath);
-  } catch (err) {
-    if (isMissingFileError5(err)) {
-      error(
-        [
-          `qfai report: \u5165\u529B\u30D5\u30A1\u30A4\u30EB\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093: ${inputPath}`,
-          "",
-          "\u307E\u305A qfai validate \u3092\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u4F8B:",
-          "  qfai validate",
-          "\uFF08\u30C7\u30D5\u30A9\u30EB\u30C8\u306E\u51FA\u529B\u5148: .qfai/out/validate.json\uFF09",
-          "",
-          "GitHub Actions \u30C6\u30F3\u30D7\u30EC\u3092\u4F7F\u3063\u3066\u3044\u308B\u5834\u5408\u306F\u3001workflow \u306E validate \u30B8\u30E7\u30D6\u3092\u5148\u306B\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
-        ].join("\n")
-      );
-      process.exitCode = 2;
-      return;
+  if (options.runValidate) {
+    if (options.inputPath) {
+      warn("report: --run-validate \u304C\u6307\u5B9A\u3055\u308C\u305F\u305F\u3081 --in \u306F\u7121\u8996\u3057\u307E\u3059\u3002");
+    }
+    const result = await validateProject(root, configResult);
+    const normalized = normalizeValidationResult(root, result);
+    await writeValidationResult(
+      root,
+      configResult.config.output.validateJsonPath,
+      normalized
+    );
+    validation = normalized;
+  } else {
+    const input = options.inputPath ?? configResult.config.output.validateJsonPath;
+    const inputPath = path16.isAbsolute(input) ? input : path16.resolve(root, input);
+    try {
+      validation = await readValidationResult(inputPath);
+    } catch (err) {
+      if (isMissingFileError5(err)) {
+        error(
+          [
+            `qfai report: \u5165\u529B\u30D5\u30A1\u30A4\u30EB\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093: ${inputPath}`,
+            "",
+            "\u307E\u305A qfai validate \u3092\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u4F8B:",
+            "  qfai validate",
+            "\uFF08\u30C7\u30D5\u30A9\u30EB\u30C8\u306E\u51FA\u529B\u5148: .qfai/out/validate.json\uFF09",
+            "",
+            "\u307E\u305F\u306F report \u306B --run-validate \u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+            "GitHub Actions \u30C6\u30F3\u30D7\u30EC\u3092\u4F7F\u3063\u3066\u3044\u308B\u5834\u5408\u306F\u3001workflow \u306E validate \u30B8\u30E7\u30D6\u3092\u5148\u306B\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
+          ].join("\n")
+        );
+        process.exitCode = 2;
+        return;
+      }
+      throw err;
     }
-    throw err;
   }
   const data = await createReportData(root, validation, configResult);
   const output = options.format === "json" ? formatReportJson(data) : formatReportMarkdown(data);
   const outRoot = resolvePath(root, configResult.config, "outDir");
-  const defaultOut = options.format === "json" ? path15.join(outRoot, "report.json") : path15.join(outRoot, "report.md");
+  const defaultOut = options.format === "json" ? path16.join(outRoot, "report.json") : path16.join(outRoot, "report.md");
   const out = options.outPath ?? defaultOut;
-  const outPath = path15.isAbsolute(out) ? out : path15.resolve(root, out);
-  await mkdir2(path15.dirname(outPath), { recursive: true });
+  const outPath = path16.isAbsolute(out) ? out : path16.resolve(root, out);
+  await mkdir2(path16.dirname(outPath), { recursive: true });
   await writeFile(outPath, `${output}
 `, "utf-8");
   info(
@@ -3119,10 +3326,16 @@ function isMissingFileError5(error2) {
   const record2 = error2;
   return record2.code === "ENOENT";
 }
+async function writeValidationResult(root, outputPath, result) {
+  const abs = path16.isAbsolute(outputPath) ? outputPath : path16.resolve(root, outputPath);
+  await mkdir2(path16.dirname(abs), { recursive: true });
+  await writeFile(abs, `${JSON.stringify(result, null, 2)}
+`, "utf-8");
+}
 
 // src/cli/commands/validate.ts
 import { mkdir as mkdir3, writeFile as writeFile2 } from "fs/promises";
-import path16 from "path";
+import path17 from "path";
 
 // src/cli/lib/failOn.ts
 function shouldFail(result, failOn) {
@@ -3137,19 +3350,24 @@ function shouldFail(result, failOn) {
 
 // src/cli/commands/validate.ts
 async function runValidate(options) {
-  const root = path16.resolve(options.root);
+  const root = path17.resolve(options.root);
   const configResult = await loadConfig(root);
   const result = await validateProject(root, configResult);
+  const normalized = normalizeValidationResult(root, result);
   const format = options.format ?? "text";
   if (format === "text") {
-    emitText(result);
+    emitText(normalized);
   }
   if (format === "github") {
-    result.issues.forEach(emitGitHub);
+    const jsonPath = resolveJsonPath(
+      root,
+      configResult.config.output.validateJsonPath
+    );
+    emitGitHubOutput(normalized, root, jsonPath);
   }
-  await emitJson(result, root, configResult.config.output.validateJsonPath);
+  await emitJson(normalized, root, configResult.config.output.validateJsonPath);
   const failOn = resolveFailOn(options, configResult.config.validation.failOn);
-  return shouldFail(result, failOn) ? 1 : 0;
+  return shouldFail(normalized, failOn) ? 1 : 0;
 }
 function resolveFailOn(options, fallback) {
   if (options.failOn) {
@@ -3174,6 +3392,22 @@ function emitText(result) {
 `
   );
 }
+function emitGitHubOutput(result, root, jsonPath) {
+  const deduped = dedupeIssues(result.issues);
+  const omitted = Math.max(deduped.length - GITHUB_ANNOTATION_LIMIT, 0);
+  const dropped = Math.max(result.issues.length - deduped.length, 0);
+  emitGitHubSummary(result, {
+    total: deduped.length,
+    omitted,
+    dropped,
+    jsonPath,
+    root
+  });
+  const issues = deduped.slice(0, GITHUB_ANNOTATION_LIMIT);
+  for (const issue7 of issues) {
+    emitGitHub(issue7);
+  }
+}
 function emitGitHub(issue7) {
   const level = issue7.severity === "error" ? "error" : issue7.severity === "warning" ? "warning" : "notice";
   const file = issue7.file ? `file=${issue7.file}` : "";
@@ -3185,22 +3419,74 @@ function emitGitHub(issue7) {
 `
   );
 }
+function emitGitHubSummary(result, options) {
+  const summary = [
+    "qfai validate summary:",
+    `error=${result.counts.error}`,
+    `warning=${result.counts.warning}`,
+    `info=${result.counts.info}`,
+    `annotations=${Math.min(options.total, GITHUB_ANNOTATION_LIMIT)}/${options.total}`
+  ].join(" ");
+  process.stdout.write(`${summary}
+`);
+  if (options.dropped > 0 || options.omitted > 0) {
+    const details = [
+      "qfai validate note:",
+      options.dropped > 0 ? `\u91CD\u8907\u9664\u5916=${options.dropped}` : null,
+      options.omitted > 0 ? `\u4E0A\u9650\u7701\u7565=${options.omitted}` : null
+    ].filter(Boolean).join(" ");
+    process.stdout.write(`${details}
+`);
+  }
+  const relative = toRelativePath(options.root, options.jsonPath);
+  process.stdout.write(
+    `qfai validate note: \u8A73\u7D30\u306F ${relative} \u307E\u305F\u306F --format text \u3092\u53C2\u7167\u3057\u3066\u304F\u3060\u3055\u3044\u3002
+`
+  );
+}
+function dedupeIssues(issues) {
+  const seen = /* @__PURE__ */ new Set();
+  const deduped = [];
+  for (const issue7 of issues) {
+    const key = issueKey(issue7);
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    deduped.push(issue7);
+  }
+  return deduped;
+}
+function issueKey(issue7) {
+  const file = issue7.file ?? "";
+  const line = issue7.loc?.line ?? "";
+  const column = issue7.loc?.column ?? "";
+  return [issue7.code, issue7.severity, issue7.message, file, line, column].join(
+    "|"
+  );
+}
 async function emitJson(result, root, jsonPath) {
-  const abs = path16.isAbsolute(jsonPath) ? jsonPath : path16.resolve(root, jsonPath);
-  await mkdir3(path16.dirname(abs), { recursive: true });
+  const abs = resolveJsonPath(root, jsonPath);
+  await mkdir3(path17.dirname(abs), { recursive: true });
   await writeFile2(abs, `${JSON.stringify(result, null, 2)}
 `, "utf-8");
 }
+function resolveJsonPath(root, jsonPath) {
+  return path17.isAbsolute(jsonPath) ? jsonPath : path17.resolve(root, jsonPath);
+}
+var GITHUB_ANNOTATION_LIMIT = 100;
 
 // src/cli/lib/args.ts
 function parseArgs(argv, cwd) {
   const options = {
     root: cwd,
+    rootExplicit: false,
     dir: cwd,
     force: false,
     yes: false,
     dryRun: false,
     reportFormat: "md",
+    reportRunValidate: false,
     validateFormat: "text",
     strict: false,
     help: false
@@ -3216,6 +3502,7 @@ function parseArgs(argv, cwd) {
     switch (arg) {
       case "--root":
         options.root = args[i + 1] ?? options.root;
+        options.rootExplicit = true;
         i += 1;
         break;
       case "--dir":
@@ -3257,6 +3544,18 @@ function parseArgs(argv, cwd) {
         }
         i += 1;
         break;
+      case "--in":
+        {
+          const next = args[i + 1];
+          if (next) {
+            options.reportIn = next;
+          }
+        }
+        i += 1;
+        break;
+      case "--run-validate":
+        options.reportRunValidate = true;
+        break;
       case "--help":
       case "-h":
         options.help = true;
@@ -3308,19 +3607,27 @@ async function run(argv, cwd) {
       });
       return;
     case "validate":
-      process.exitCode = await runValidate({
-        root: options.root,
-        strict: options.strict,
-        format: options.validateFormat,
-        ...options.failOn !== void 0 ? { failOn: options.failOn } : {}
-      });
+      {
+        const resolvedRoot = await resolveRoot(options);
+        process.exitCode = await runValidate({
+          root: resolvedRoot,
+          strict: options.strict,
+          format: options.validateFormat,
+          ...options.failOn !== void 0 ? { failOn: options.failOn } : {}
+        });
+      }
       return;
     case "report":
-      await runReport({
-        root: options.root,
-        format: options.reportFormat,
-        ...options.reportOut !== void 0 ? { outPath: options.reportOut } : {}
-      });
+      {
+        const resolvedRoot = await resolveRoot(options);
+        await runReport({
+          root: resolvedRoot,
+          format: options.reportFormat,
+          ...options.reportOut !== void 0 ? { outPath: options.reportOut } : {},
+          ...options.reportIn !== void 0 ? { inputPath: options.reportIn } : {},
+          ...options.reportRunValidate ? { runValidate: true } : {}
+        });
+      }
       return;
     default:
       error(`Unknown command: ${command}`);
@@ -3347,9 +3654,23 @@ Options:
   --strict                     validate: warning \u4EE5\u4E0A\u3067 exit 1
   --fail-on <error|warning|never>  validate: \u5931\u6557\u6761\u4EF6
   --out <path>                  report: \u51FA\u529B\u5148
+  --in <path>                   report: validate.json \u306E\u5165\u529B\u5148\uFF08config\u3088\u308A\u512A\u5148\uFF09
+  --run-validate                report: validate \u3092\u5B9F\u884C\u3057\u3066\u304B\u3089 report \u3092\u751F\u6210
   -h, --help      \u30D8\u30EB\u30D7\u8868\u793A
 `;
 }
+async function resolveRoot(options) {
+  if (options.rootExplicit) {
+    return options.root;
+  }
+  const search = await findConfigRoot(options.root);
+  if (!search.found) {
+    warn(
+      `qfai: qfai.config.yaml \u304C\u898B\u3064\u304B\u3089\u306A\u3044\u305F\u3081 defaultConfig \u3092\u4F7F\u7528\u3057\u307E\u3059 (root=${search.root})`
+    );
+  }
+  return search.root;
+}
 
 // src/cli/index.ts
 run(process.argv.slice(2), process.cwd()).catch((err) => {