qfai 1.4.24 → 1.4.25

package/README.md

@@ -210,7 +210,7 @@ flowchart LR
 - Contracts SSOT: `.qfai/contracts/**`
 - Report outputs (`.qfai/report/**`) are derived artifacts and not SSOT.
 
-## Minimal tutorial (v1.4.24)
+## Minimal tutorial (v1.4.25)
 
 1. `npx qfai init`
 2. Run `/qfai-discuss` to structure scope and open questions.
@@ -237,7 +237,7 @@ Release gate behavior:
 
 ## Continuous integration
 
-QFAI v1.4.24 generates integration wrappers under `.agents/**`, `.claude/**`,
+QFAI v1.4.25 generates integration wrappers under `.agents/**`, `.claude/**`,
 `.github/**`, and `.codex/**`.
 It does not generate GitHub Actions workflows.
 Configure CI in your own platform and run:

package/assets/init/.qfai/assistant/agents/coverage-planner.md

@@ -3,21 +3,27 @@
 ## Mission
 
 - Define and maintain coverage ledgers to prevent silent gaps.
+- Convert coverage findings into actionable, perspective-based EX/TC planning.
 
 ## Inputs you must read
 
 - .qfai/assistant/instructions/\*
 - .qfai/assistant/steering/\*
-- .qfai/specs/spec-\*/delta.md (Decision Records; check rejected)
-- .qfai/specs/spec-\*/scenario.feature
-- .qfai/specs/spec-\*/spec.md
+- .qfai/specs/spec-\*/09_delta.md (Decision Records; check rejected)
+- .qfai/specs/spec-\*/04_Business-Rules.md
+- .qfai/specs/spec-\*/05_Examples.md
+- .qfai/specs/spec-\*/06_Test-Cases.md
+- .qfai/report/validate.log
+- .qfai/report/specs-coverage/spec-\*.md
 - Existing coverage ledgers and test files
 
 ## Deliverables (MANDATORY)
 
 - Decision Records referenced (DR-IDs) + rejected check (or RE-OPEN request)
+- Hard-gap list (`QFAI-COV-201/202/203/204/205/206`) with source-layer fixes
+- Density-smell list (for example `QFAI-COV-207`) with perspective-based improvement ideas
 - Scope ledger (what must be tested) with exclusions rationale
-- Coverage ledger mapped to scenarios and layers
+- Coverage ledger mapped to BR/EX/TC layers
 - Evidence summary for `.qfai/evidence/` (gitignored; do not commit)
 
 ## Stop conditions (Blockers)
@@ -25,7 +31,7 @@
 - Rejected option would be reintroduced without RE-OPEN DR
 - Hidden exclusions or silent gaps detected
 - Evidence is missing or incomplete
-- Scenario mapping is ambiguous
+- BR/EX/TC mapping is ambiguous
 
 ## Sign-off checklist (Check Last)
 
@@ -38,7 +44,10 @@
 
 - Decision Records (DR-IDs) / rejected check
 - Findings
+- Hard gaps (`QFAI-COV-201..206`)
+- Density smells (`QFAI-COV-207` and similar)
 - Coverage ledger
+- Perspective-based EX/TC proposal (boundary, negative, permission, state)
 - Exclusions rationale
 - Evidence summary
 - Open Questions / Risks

package/assets/init/.qfai/assistant/agents/qa-gatekeeper.md

@@ -9,8 +9,13 @@
 
 - .qfai/assistant/instructions/\*
 - .qfai/assistant/steering/\*
-- .qfai/specs/spec-\*/delta.md (Decision Records; check rejected)
+- .qfai/specs/spec-\*/09_delta.md (Decision Records; check rejected)
+- .qfai/specs/spec-\*/04_Business-Rules.md
+- .qfai/specs/spec-\*/05_Examples.md
+- .qfai/specs/spec-\*/06_Test-Cases.md
 - QA evidence summaries under `.qfai/evidence/` (gitignored)
+- .qfai/report/validate.log
+- .qfai/report/specs-coverage/spec-\*.md
 - Coverage ledgers and traceability reports
 - Gate command outputs
 
@@ -19,6 +24,8 @@
 - Decision Records referenced (DR-IDs) + rejected check (or RE-OPEN request)
 - DONE declaration check (inputs + DR-IDs + rejected guard)
 - Gate status (PASS/FAIL) with rationale
+- Hard gate result summary (`QFAI-COV-201..206`)
+- Density-smell review notes (`QFAI-COV-207` and related warnings)
 - Explicit gap list and required fixes
 - Evidence presence check summary
 
@@ -27,6 +34,7 @@
 - Rejected option would be reintroduced without RE-OPEN DR
 - Evidence is missing or incomplete
 - Coverage ledger is missing or inconsistent
+- Validate gate is missing/failing (`qfai validate --fail-on error --format github`)
 - Runtime or quality gates are not executed
 
 ## Sign-off checklist (Check Last)
@@ -41,6 +49,8 @@
 - Decision Records (DR-IDs) / rejected check
 - Gate decision (PASS/FAIL)
 - Findings
+- Hard gate status (`QFAI-COV-201..206`)
+- Density-smell review (`QFAI-COV-207`)
 - Required fixes
 - Evidence summary
 - Open Questions / Risks

package/assets/init/.qfai/assistant/agents/test-case-owner.md

@@ -8,15 +8,21 @@
 
 - .qfai/assistant/instructions/\*
 - .qfai/assistant/steering/\*
-- .qfai/specs/spec-\*/delta.md (Decision Records; check rejected)
-- .qfai/specs/spec-\*/spec.md
-- .qfai/specs/spec-\*/scenario.feature
+- .qfai/specs/spec-\*/09_delta.md (Decision Records; check rejected)
+- .qfai/specs/spec-\*/03_Acceptance-Criteria.md
+- .qfai/specs/spec-\*/04_Business-Rules.md
+- .qfai/specs/spec-\*/05_Examples.md
+- .qfai/specs/spec-\*/06_Test-Cases.md
+- .qfai/report/validate.log
+- .qfai/report/specs-coverage/spec-\*.md
 - Existing test cases and mappings
 
 ## Deliverables (MANDATORY)
 
 - Decision Records referenced (DR-IDs) + rejected check (or RE-OPEN request)
+- Minimal TC set proposal satisfying AC->TC and EX->TC coverage
 - Test case inventory mapped to requirements/contracts
+- Missing boundary/negative case recommendations (perspective-based)
 - Exclusions rationale for any missing coverage
 - Evidence summary for `.qfai/evidence/` (gitignored; do not commit)
 
@@ -25,7 +31,7 @@
 - Rejected option would be reintroduced without RE-OPEN DR
 - Traceability gaps without explicit rationale
 - Evidence is missing or incomplete
-- Test cases cannot be mapped to requirements
+- Test cases cannot be mapped to AC/EX requirements
 
 ## Sign-off checklist (Check Last)
 
@@ -39,6 +45,8 @@
 - Decision Records (DR-IDs) / rejected check
 - Findings
 - Test case mapping
+- Coverage gate status (`QFAI-COV-201..206`)
+- Perspective gaps (boundary, negative, permission, state)
 - Exclusions rationale
 - Evidence summary
 - Open Questions / Risks

package/assets/init/.qfai/assistant/agents/test-volume-estimator.md

@@ -2,44 +2,48 @@
 
 ## Mission
 
-- Compute ATDD floors (E2E/API/Integration) and detect underestimation.
+- Estimate test volume as a risk signal and detect thin areas.
 
 ## Inputs you must read
 
 - .qfai/assistant/instructions/\*
 - .qfai/assistant/steering/\*
-- .qfai/specs/spec-\*/delta.md (Decision Records; check rejected)
-- .qfai/specs/spec-\*/scenario.feature
-- .qfai/specs/spec-\*/case-catalogue.md
-- .qfai/specs/spec-\*/traceability-matrix.md
+- .qfai/specs/spec-\*/09_delta.md (Decision Records; check rejected)
+- .qfai/specs/spec-\*/04_Business-Rules.md
+- .qfai/specs/spec-\*/05_Examples.md
+- .qfai/specs/spec-\*/06_Test-Cases.md
+- .qfai/report/specs-coverage/spec-\*.md
+- .qfai/report/validate.log
 - .qfai/contracts/\*\*
 
 ## Deliverables (MANDATORY)
 
 - Decision Records referenced (DR-IDs) + rejected check (or RE-OPEN request)
-- Floor estimate table (Layer / Raw count / Multiplier / Floor / Evidence / Notes)
-- K rationale (3..5) with complexity signals
+- Risk-signal table (Layer / Raw count / Signal / Evidence / Notes)
+- Density-smell findings (for example multi-BR EX rows) and impact summary
+- Improvement proposals by perspective (boundary/negative/permission/state)
 - BLOCKED list when data is missing
 - Evidence summary for `.qfai/evidence/` (gitignored; do not commit)
 
 ## Stop conditions (Blockers)
 
 - Rejected option would be reintroduced without RE-OPEN DR
-- Endpoint count cannot be derived and no fallback is available
+- BR/EX/TC source counts cannot be derived and no fallback is available
 - Evidence is missing or incomplete
 
 ## Sign-off checklist (Check Last)
 
 - [ ] Deliverables are complete
 - [ ] Evidence is present (gitignored)
-- [ ] Floors are justified with evidence
+- [ ] Risk signals are justified with evidence
 - [ ] BLOCKED items are explicit
 
 ## Output format (structured)
 
 - Decision Records (DR-IDs) / rejected check
-- Floor table
-- K rationale
+- Risk-signal table
+- Density-smell findings
+- Perspective-based improvement proposals
 - BLOCKED list (if any)
 - Evidence summary
 - Open Questions / Risks

package/assets/init/.qfai/assistant/skills/qfai-discuss/SKILL.md

@@ -88,6 +88,8 @@ Every major artifact in this stage MUST include this table schema:
 - RCP wording must be sourced from `.qfai/assistant/templates/rcp_footer.md`.
 - Discuss artifacts are logs/rationale and must not duplicate spec SSOT.
 - If diagrams are written, Mermaid syntax must be in ` ```mermaid ` fences only.
+- Do not enforce fixed EX/BR or TC/EX ratios in this phase.
+- Example Mapping is mandatory and must be captured as `Example Seeds` sections.
 
 ## Goal
 
@@ -118,12 +120,32 @@ Produce a fixed discuss pack with explicit decisions and OQ states so downstream
 
 1. Run the core interview for product concept, scope, and policy.
 2. Run config hearing for steering, constraints, and test-layer readiness.
-3. Run deep dive for risks, boundary conditions, and alternatives.
-4. Update `05_OQ-Register.md` with all identified OQs.
-5. Run OQ resolution hearing repeatedly until open count is zero.
-6. Move deferred items to `07_Deferred.md` with mandatory metadata.
-7. Update `06_OQ-Resolution-Log.md`, `08_Review-Request.md`, and `09_delta.md`.
-8. Request review and record Reviewer result.
+3. Run Example Mapping pass for each BR/AC candidate and capture `Example Seeds` in:
+   - `02_Hearing.md` (requirements-oriented seeds)
+   - `03_Config-Hearing.md` (constraints/policy-oriented seeds)
+4. Run deep dive for risks, boundary conditions, and alternatives.
+5. Update `05_OQ-Register.md` with all identified OQs.
+6. Run OQ resolution hearing repeatedly until open count is zero.
+7. Move deferred items to `07_Deferred.md` with mandatory metadata.
+8. Update `06_OQ-Resolution-Log.md`, `08_Review-Request.md`, and `09_delta.md`.
+9. Request review and record Reviewer result.
+
+## Example Mapping Perspectives (Mandatory)
+
+For each BR/AC candidate, enumerate concrete example seeds with these perspectives:
+
+1. Happy path
+2. Negative path
+3. Edge / boundary
+4. Permission / role
+5. State transition (if stateful)
+6. Idempotency / retry (if external I/O exists)
+
+Rules:
+
+- Use perspective coverage as the gate, not raw case counts.
+- Mark intentionally skipped perspectives with reason and follow-up.
+- Feed unresolved seeds into OQ items with owner and decision point.
 
 ## OQ Data Model (Mandatory)
 
@@ -188,6 +210,7 @@ Before declaring completion, you MUST:
 - verify all mandatory output files exist and are populated;
 - ensure `Disposition: open` count is zero;
 - ensure every deferred item has full metadata;
+- ensure `Example Seeds` sections are present and perspective coverage is explicit;
 - avoid duplicating finalized spec content in discuss outputs.
 
 ## Evidence (MANDATORY)

package/assets/init/.qfai/assistant/skills/qfai-discuss/templates/02_Hearing.md

@@ -16,3 +16,14 @@
 - In scope:
 - Out of scope:
 - Key constraints:
+
+## Example Seeds (Requirements)
+
+| BR/AC Candidate   | Perspective         | Seed (concrete) | Notes |
+| ----------------- | ------------------- | --------------- | ----- |
+| BR-0001 / AC-0001 | Happy               | TBD             | TBD   |
+| BR-0001 / AC-0001 | Negative            | TBD             | TBD   |
+| BR-0001 / AC-0001 | Edge / Boundary     | TBD             | TBD   |
+| BR-0001 / AC-0001 | Permission / Role   | TBD             | TBD   |
+| BR-0001 / AC-0001 | State transition    | TBD             | TBD   |
+| BR-0001 / AC-0001 | Idempotency / Retry | TBD             | TBD   |

package/assets/init/.qfai/assistant/skills/qfai-discuss/templates/03_Config-Hearing.md

@@ -18,3 +18,11 @@
 ## Open Gaps to Resolve in Discuss
 
 - OQ candidate:
+
+## Example Seeds (Constraints / Policy)
+
+| BR/AC Candidate   | Perspective         | Constraint-aware seed | Policy / gate note |
+| ----------------- | ------------------- | --------------------- | ------------------ |
+| BR-0001 / AC-0001 | Permission / Role   | TBD                   | TBD                |
+| BR-0001 / AC-0001 | State transition    | TBD                   | TBD                |
+| BR-0001 / AC-0001 | Idempotency / Retry | TBD                   | TBD                |

package/assets/init/.qfai/assistant/skills/qfai-discuss/templates/08_Review-Request.md

@@ -23,3 +23,6 @@
 - OQ state integrity (`open` must be zero at completion)
 - Deferred metadata completeness and risk handling
 - Traceability of decisions and rationale
+- Validate evidence availability (`.qfai/report/validate.log`)
+- Hard gate status (`QFAI-COV-201/202/203/204/205/206` should be zero)
+- Coverage report observations from `.qfai/report/specs-coverage/spec-*.md` (perspective gaps over raw count requests)

package/assets/init/.qfai/assistant/skills/qfai-discuss/templates/review/review_request.md

@@ -19,6 +19,9 @@
 - Operational and security risks
 - Mermaid diagrams use ` ```mermaid ` fences only (no ` ```text ` or language-less fences)
 - Business Flow artifacts include required `flowchart` or `sequenceDiagram` where applicable
+- Validate hard gate evidence exists (`.qfai/report/validate.log`).
+- Coverage hard gates are clear (`QFAI-COV-201/202/203/204/205/206` = 0).
+- `specs-coverage/spec-*.md` was reviewed and density-smell findings (for example `QFAI-COV-207`) are called out as perspective gaps.
 
 ## Required Reviewers
 

package/assets/init/.qfai/assistant/skills/qfai-require/templates/review/review_request.md

@@ -19,6 +19,9 @@
 - Operational and security risks
 - Mermaid diagrams use ` ```mermaid ` fences only (no ` ```text ` or language-less fences)
 - Business Flow artifacts include required `flowchart` or `sequenceDiagram` where applicable
+- Validate hard gate evidence exists (`.qfai/report/validate.log`).
+- Coverage hard gates are clear (`QFAI-COV-201/202/203/204/205/206` = 0).
+- `specs-coverage/spec-*.md` was reviewed and density-smell findings (for example `QFAI-COV-207`) are called out as perspective gaps.
 
 ## Required Reviewers
 

package/assets/init/.qfai/assistant/skills/qfai-sdd/SKILL.md

@@ -98,6 +98,12 @@ Every major artifact in this stage MUST include a `## Work Orders Summary` secti
 - Reviewer checks (minimum):
   - Required roles were delegated (no orchestrator self-authoring).
   - DoD satisfied (coverage ledger, gates, evidence, DR-IDs).
+  - Validate gate evidence exists and is fresh:
+    - `qfai validate --fail-on error --format github` completed with `error=0`.
+    - `.qfai/report/validate.log` and `.qfai/report/specs-coverage/spec-*.md` are present.
+  - Layer coverage hard gates are all clear:
+    - `QFAI-COV-201/202/203/204/205/206` are `0`.
+    - `QFAI-COV-207` warnings are reviewed as density-smell signals.
   - **Drift Protocol enforced**:
     - No upstream artifact edits were made without an explicit user-approved Change Request.
     - If upstream changes exist, the correct owner skill was re-run after approval; downstream did not patch upstream directly.
@@ -203,6 +209,9 @@ Rules:
 - If diagrams are written in discuss/require/spec/evidence artifacts, Mermaid syntax must be inside ` ```mermaid ` fences only.
 - `05_Examples.md` must include `EX-ID` and `BR-Ref` mappings.
 - `06_Test-Cases.md` must include `TC-ID`, `EX-Ref`, and `AC-Refs`.
+- Do not complete this stage until:
+  - `qfai validate --fail-on error --format github | tee .qfai/report/validate.log` exits successfully.
+  - `.qfai/report/specs-coverage/spec-*.md` has been read for density review.
 - Reference direction rules from `.qfai/specs/README.md` must be enforced:
   - upper-to-lower references are forbidden
   - lower-to-upper references are allowed
@@ -305,6 +314,11 @@ Before declaring completion, you MUST:
 - Deliverable completeness: verify all required artifacts and sections are present.
 - OQ / placeholder scan: remove unresolved placeholders (`TBD`, `TODO`, `???`, `OPEN QUESTION`, etc.) unless explicitly deferred.
 - Run static checks proving the pack is reviewable.
+- Run validate gate and keep evidence:
+  - `qfai validate --fail-on error --format github | tee .qfai/report/validate.log`
+  - `.qfai/report/specs-coverage/spec-*.md`
+- If validate fails, fix spec-layer sources and rerun validate until `error=0`.
+- Do not patch upstream intent from downstream artifacts (Drift Protocol applies).
 
 ## Goal
 
@@ -353,7 +367,10 @@ Create or update layered SDD artifacts in one run so downstream execution phases
 7. Execute Phase 2 (Slice) for at least one user-story slice and pass slice gate.
 8. Execute Phase 3 (Plan finalize) and make `10_Plan.md` actionable as How-only.
 9. Execute Phase 4 (Delta update) and record adoption/rejection rationale.
-10. Run static checks and record outcomes in evidence.
+10. Run `qfai validate --fail-on error --format github | tee .qfai/report/validate.log`.
+11. Run Density Review Pass using `.qfai/report/specs-coverage/spec-*.md` and `QFAI-COV-207` warnings.
+12. If any validate error exists, fix the source layer table(s) and repeat steps 10-11 until `error=0`.
+13. Record static checks, validate evidence, and density review outcomes in evidence.
 
 ## Unified SDD Quality Gate
 
@@ -367,6 +384,8 @@ Run static checks:
 - Confirm reference direction follows lower-to-upper only.
 - Confirm required edges `US -> AC -> BR -> EX -> TC`.
 - Confirm BR/Examples/Test-cases contain non-empty IDs and coverage mapping.
+- Confirm `QFAI-COV-201/202/203/204/205/206` are zero.
+- Confirm `.qfai/report/specs-coverage/spec-*.md` was reviewed and `QFAI-COV-207` warnings were triaged.
 - Confirm `10_Plan.md` exists and contains implementation/test strategy as How-only.
 - Confirm `specs/plan.md` does not exist.
 - Confirm `09_delta.md` (or `*_delta.md`) includes rejected guardrails (`DO NOT`, `Temptation`) when rejections exist.
@@ -384,6 +403,7 @@ Required sections:
 - Decisions made (with rationale)
 - Work performed (what changed, where)
 - Commands executed + key outputs
+- Validate evidence paths (`.qfai/report/validate.log`, `.qfai/report/specs-coverage/spec-*.md`)
 - Gaps / Open risks
 - Final status (PASS/FAIL) + who confirmed
 
@@ -411,6 +431,9 @@ When declaring DONE, include:
 - [ ] `10_Plan.md` is finalized with implementation/test strategy (How-only).
 - [ ] `specs/plan.md` was not created.
 - [ ] `09_delta.md` (or `*_delta.md`) contains adoption/rejection rationale.
+- [ ] `qfai validate --fail-on error --format github` ran and produced `error=0`.
+- [ ] `QFAI-COV-201/202/203/204/205/206` are all zero.
+- [ ] `.qfai/report/specs-coverage/spec-*.md` was reviewed for density-smell signals (`QFAI-COV-207`).
 - [ ] Unresolved items are tracked in shared/spec Open Questions files.
 - [ ] Quality gate checks are recorded in evidence.
 - [ ] Evidence file exists and is complete.

package/assets/init/.qfai/assistant/steering/review-gate.rules.yml

@@ -51,6 +51,20 @@ reviewers:
       role: Design Review Lead
     - id: runtime-gatekeeper
       role: Runtime Gatekeeper
+
+quality_gates:
+  validate:
+    required_codes:
+      - QFAI-COV-201
+      - QFAI-COV-202
+      - QFAI-COV-203
+      - QFAI-COV-204
+      - QFAI-COV-205
+      - QFAI-COV-206
+  coverage_report:
+    required_path: .qfai/report/specs-coverage/spec-*.md
+    warning_signal:
+      - QFAI-COV-207
   defaults:
     - id: qa-lead
       role: Quality Lead

package/assets/init/.qfai/assistant/templates/rcp_footer.md

@@ -36,6 +36,23 @@ For each review cycle, create:
 - `.qfai/review/review-<timestamp>/R01_<reviewer>.md`, `R02_<reviewer>.md`, ...
 - `.qfai/review/review-<timestamp>/summary.json`
 
+## Validate Hard Gate Checks (Mandatory)
+
+- Confirm `qfai validate --fail-on error --format github` ran in the latest cycle.
+- Confirm `.qfai/report/validate.log` exists and corresponds to current artifacts.
+- Confirm hard gates are all zero:
+  - `QFAI-COV-201`
+  - `QFAI-COV-202`
+  - `QFAI-COV-203`
+  - `QFAI-COV-204`
+  - `QFAI-COV-205`
+  - `QFAI-COV-206`
+
+## Coverage Report Review (Mandatory)
+
+- Review `.qfai/report/specs-coverage/spec-*.md` before marking fixed.
+- Treat `QFAI-COV-207` as a density-smell signal and request perspective-based improvements (boundary/negative/permission/state), not raw count inflation.
+
 `summary.json` minimum schema:
 
 - `version`

package/dist/cli/index.cjs

@@ -1589,8 +1589,8 @@ var import_promises7 = require("fs/promises");
 var import_node_path8 = __toESM(require("path"), 1);
 var import_node_url2 = require("url");
 async function resolveToolVersion() {
-  if ("1.4.24".length > 0) {
-    return "1.4.24";
+  if ("1.4.25".length > 0) {
+    return "1.4.25";
   }
   try {
     const packagePath = resolvePackageJsonPath();
@@ -7940,7 +7940,7 @@ async function validateDiscussPack(root) {
     issues.push(
       issue(
         "QFAI-DISCUSS-028",
-        `legacy discuss pack \u3092\u691C\u51FA\u3057\u307E\u3057\u305F\uFF08v1.4.24 \u306F warning\uFF09: ${legacyPacks.join(", ")}`,
+        `legacy discuss pack \u3092\u691C\u51FA\u3057\u307E\u3057\u305F\uFF08v1.4.25 \u306F warning\uFF09: ${legacyPacks.join(", ")}`,
         "warning",
         discussRoot,
         "discussPack.legacy",
@@ -8438,10 +8438,70 @@ async function validateV1421Coverage(entry) {
   const acCoverage = buildCoverageCounts(acIds, tcToAcRefs);
   const brCoverage = buildCoverageCounts(brIds, exToBrRefs);
   const exCoverage = buildCoverageCounts(exIds, tcToExRefs);
+  const brWithoutAcRefs = findSourcesWithEmptyRefs(brToAcRefs);
+  const exWithoutBrRefs = findSourcesWithEmptyRefs(exToBrRefs);
+  const tcWithoutRefs = findTcWithoutAnyRefs(tcToAcRefs, tcToExRefs);
+  const exWithMultipleBrRefs = findSourcesWithMultipleRefs(exToBrRefs);
   const missingAc = findUncoveredIds(acCoverage);
   const missingBr = findUncoveredIds(brCoverage);
   const missingEx = findUncoveredIds(exCoverage);
   const issues = [];
+  if (brWithoutAcRefs.length > 0) {
+    issues.push(
+      issue(
+        "QFAI-COV-204",
+        `AC-Refs \u304C\u7A7A\u306E BR \u304C\u3042\u308A\u307E\u3059: ${brWithoutAcRefs.join(", ")}`,
+        "error",
+        entry.businessRulesPath,
+        "layerCoverage.brRequiresAcRefs",
+        brWithoutAcRefs,
+        "change",
+        "04_Business-Rules.md \u306E `AC-Refs` \u306B\u3001\u5404 BR \u304C\u53C2\u7167\u3059\u308B AC \u30921\u4EF6\u4EE5\u4E0A\u8A2D\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
+      )
+    );
+  }
+  if (exWithoutBrRefs.length > 0) {
+    issues.push(
+      issue(
+        "QFAI-COV-205",
+        `BR-Ref \u304C\u7A7A\u306E EX \u304C\u3042\u308A\u307E\u3059: ${exWithoutBrRefs.join(", ")}`,
+        "error",
+        entry.examplesPath,
+        "layerCoverage.exRequiresBrRef",
+        exWithoutBrRefs,
+        "change",
+        "05_Examples.md \u306E `BR-Ref` \u306B\u3001\u5404 EX \u304C\u5177\u4F53\u5316\u3059\u308B BR \u30921\u4EF6\u4EE5\u4E0A\u8A2D\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
+      )
+    );
+  }
+  if (tcWithoutRefs.length > 0) {
+    issues.push(
+      issue(
+        "QFAI-COV-206",
+        `AC-Refs \u3068 EX-Ref \u304C\u7A7A\u306E TC \u304C\u3042\u308A\u307E\u3059: ${tcWithoutRefs.join(", ")}`,
+        "error",
+        entry.testCasesPath,
+        "layerCoverage.tcRequiresAnyRef",
+        tcWithoutRefs,
+        "change",
+        "06_Test-Cases.md \u306E\u5404 TC \u306B `AC-Refs` \u307E\u305F\u306F `EX-Ref` \u306E\u3069\u3061\u3089\u304B\uFF08\u63A8\u5968: \u4E21\u65B9\uFF09\u3092\u8A2D\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
+      )
+    );
+  }
+  if (exWithMultipleBrRefs.length > 0) {
+    issues.push(
+      issue(
+        "QFAI-COV-207",
+        `1\u3064\u306E EX \u304C\u8907\u6570 BR \u3092\u53C2\u7167\u3057\u3066\u3044\u307E\u3059: ${formatMultiRefSignals(exWithMultipleBrRefs)}`,
+        "warning",
+        entry.examplesPath,
+        "layerCoverage.exBroadBrRef",
+        exWithMultipleBrRefs.map(([id]) => id),
+        "change",
+        "05_Examples.md \u306E `BR-Ref` \u306F EX \u3054\u3068\u306B1\u4EF6\u3078\u5206\u5272\u3067\u304D\u308B\u304B\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\uFF08\u8584\u3055/\u66D6\u6627\u3055\u306E\u30B7\u30B0\u30CA\u30EB\uFF09\u3002"
+      )
+    );
+  }
   if (missingAc.length > 0) {
     issues.push(
       issue(
@@ -8654,6 +8714,28 @@ function buildCoverageCounts(targets, refsBySource) {
   }
   return counts;
 }
+function findSourcesWithEmptyRefs(refsBySource) {
+  return Array.from(refsBySource.entries()).filter(([, refs]) => refs.size === 0).map(([id]) => id).sort((left, right) => left.localeCompare(right));
+}
+function findSourcesWithMultipleRefs(refsBySource) {
+  return Array.from(refsBySource.entries()).filter(([, refs]) => refs.size > 1).map(([id, refs]) => {
+    const sortedRefs = Array.from(refs.values()).sort(
+      (left, right) => left.localeCompare(right)
+    );
+    return [id, sortedRefs];
+  }).sort((left, right) => left[0].localeCompare(right[0]));
+}
+function findTcWithoutAnyRefs(tcToAcRefs, tcToExRefs) {
+  const ids = /* @__PURE__ */ new Set([...tcToAcRefs.keys(), ...tcToExRefs.keys()]);
+  return Array.from(ids).filter((id) => {
+    const acCount = tcToAcRefs.get(id)?.size ?? 0;
+    const exCount = tcToExRefs.get(id)?.size ?? 0;
+    return acCount === 0 && exCount === 0;
+  }).sort((left, right) => left.localeCompare(right));
+}
+function formatMultiRefSignals(signals) {
+  return signals.map(([id, refs]) => `${id}(${refs.join(", ")})`).join(", ");
+}
 function toCoverageRows(counts) {
   return Array.from(counts.entries()).map(([id, count]) => ({ id, count })).sort((left, right) => left.id.localeCompare(right.id));
 }
@@ -9979,7 +10061,7 @@ async function validateRequirePackReadiness(root, config) {
     issues.push(
       issue(
         "QFAI-RPACK-006",
-        `legacy require-pack \u3092\u691C\u51FA\u3057\u307E\u3057\u305F\uFF08v1.4.24 \u306F warning\uFF09: ${readiness.legacyPackNames.join(", ")}`,
+        `legacy require-pack \u3092\u691C\u51FA\u3057\u307E\u3057\u305F\uFF08v1.4.25 \u306F warning\uFF09: ${readiness.legacyPackNames.join(", ")}`,
         "warning",
         requireRoot,
         "requirePack.legacy",
@@ -10084,7 +10166,7 @@ async function validateRepositoryHygiene(root, config) {
     issues.push(
       issue(
         "QFAI-HYG-001",
-        `legacy \u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u3092\u691C\u51FA\u3057\u307E\u3057\u305F\uFF08v1.4.24 \u306F warning\uFF09: .qfai/${rule.legacy}/`,
+        `legacy \u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u3092\u691C\u51FA\u3057\u307E\u3057\u305F\uFF08v1.4.25 \u306F warning\uFF09: .qfai/${rule.legacy}/`,
         "warning",
         legacyPath,
         "hygiene.legacyDirectory",
@@ -10099,7 +10181,7 @@ async function validateRepositoryHygiene(root, config) {
     issues.push(
       issue(
         "QFAI-HYG-002",
-        `specs \u914D\u4E0B\u306B\u30C6\u30F3\u30D7\u30EC\u6DF7\u5165\u7591\u3044\u3092\u691C\u51FA\u3057\u307E\u3057\u305F\uFF08v1.4.24 \u306F warning\uFF09: ${suspiciousPaths.join(", ")}`,
+        `specs \u914D\u4E0B\u306B\u30C6\u30F3\u30D7\u30EC\u6DF7\u5165\u7591\u3044\u3092\u691C\u51FA\u3057\u307E\u3057\u305F\uFF08v1.4.25 \u306F warning\uFF09: ${suspiciousPaths.join(", ")}`,
         "warning",
         specsRoot,
         "hygiene.templateContamination",
@@ -12517,13 +12599,20 @@ var ISSUE_EXPECTED_BY_CODE = {
   "QFAI-RPACK-003": "The latest require-pack files contain minimum substantive content.",
   "QFAI-RPACK-004": "No blocking OQ remains in 08_OQ.md (Disposition=open with Gate discuss|require|sdd).",
   "QFAI-RPACK-005": "require-* naming must be timestamp format only (dangerous names are forbidden).",
-  "QFAI-RPACK-006": "Legacy require-* serial packs are migration warnings in v1.4.24.",
+  "QFAI-RPACK-006": "Legacy require-* serial packs are migration warnings in v1.4.25.",
   "QFAI-DISCUSS-023": "Discuss directory naming uses discuss-YYYYMMDDhhmmssSSS for new outputs.",
   "QFAI-DISCUSS-024": "Latest discuss pack contains required files (01_Context.md..09_delta.md).",
   "QFAI-DISCUSS-025": "No open OQ remains in latest discuss 05_OQ-Register.md.",
   "QFAI-DISCUSS-026": "Deferred rows include complete metadata in 07_Deferred.md.",
   "QFAI-DISCUSS-027": "Every deferred OQ in 05_OQ-Register.md is listed in 07_Deferred.md.",
-  "QFAI-DISCUSS-028": "Legacy discuss serial packs are migration warnings in v1.4.24.",
+  "QFAI-DISCUSS-028": "Legacy discuss serial packs are migration warnings in v1.4.25.",
+  "QFAI-COV-201": "Every AC must be referenced by at least one TC (`AC-Refs`).",
+  "QFAI-COV-202": "Every BR must be referenced by at least one EX (`BR-Ref`).",
+  "QFAI-COV-203": "Every EX must be referenced by at least one TC (`EX-Ref`).",
+  "QFAI-COV-204": "Every BR row must include at least one AC reference in `AC-Refs`.",
+  "QFAI-COV-205": "Every EX row must include at least one BR reference in `BR-Ref`.",
+  "QFAI-COV-206": "Every TC row must include at least one reference in `AC-Refs` or `EX-Ref`.",
+  "QFAI-COV-207": "EX rows that reference multiple BR IDs should be reviewed as density-smell signals.",
   "QFAI-HYG-001": "Legacy directory aliases are warned and should be migrated to canonical names.",
   "QFAI-HYG-002": "Template/sample artifacts should not remain under `.qfai/specs/**`.",
   "QFAI-REVIEW-001": "`.qfai/review/.gitignore` exists.",
@@ -12532,7 +12621,7 @@ var ISSUE_EXPECTED_BY_CODE = {
   "QFAI-REVIEW-004": "Each review pack contains `summary.json`.",
   "QFAI-REVIEW-005": "Each review pack contains one or more reviewer files (`Rxx_*.md`).",
   "QFAI-REVIEW-006": "Each review summary JSON is parseable.",
-  "QFAI-REVIEW-007": "Each review summary satisfies the v1.4.24 minimum schema.",
+  "QFAI-REVIEW-007": "Each review summary satisfies the v1.4.25 minimum schema.",
   "QFAI-CONTRACT-030": "Contract index references must match declared contract IDs in .qfai/contracts/**."
 };
 function resolveIssueTarget(issue2) {