qfai 1.7.0 → 1.7.2

package/dist/index.mjs

@@ -2,6 +2,22 @@
 import { access, readFile } from "fs/promises";
 import path from "path";
 import { parse as parseYaml } from "yaml";
+
+// src/core/uiux/renderEvidenceTypes.ts
+var DEFAULT_RENDER_VIEWPORTS = ["desktop", "mobile"];
+function normalizeRenderViewports(viewports) {
+  const normalized = Array.isArray(viewports) ? viewports.map((item) => item.trim()).filter((item) => item.length > 0) : [];
+  if (normalized.length > 0) {
+    return Array.from(new Set(normalized));
+  }
+  return [...DEFAULT_RENDER_VIEWPORTS];
+}
+function looksLikeInlineRenderPayload(value) {
+  const trimmed = value.trim().toLowerCase();
+  return trimmed.startsWith("data:image") || trimmed.includes("<html");
+}
+
+// src/core/config.ts
 var defaultConfig = {
   paths: {
     contractsDir: ".qfai/contracts",
@@ -451,6 +467,133 @@ function normalizeUiux(raw, configPath, issues) {
       );
     }
   }
+  if (raw.renderEvidence !== void 0) {
+    const renderEvidence = normalizeRenderEvidence(raw.renderEvidence, configPath, issues);
+    if (renderEvidence) {
+      result.renderEvidence = renderEvidence;
+    }
+  }
+  if (raw.audit !== void 0) {
+    const audit = normalizeUiuxAudit(raw.audit, configPath, issues);
+    if (audit) {
+      result.audit = audit;
+    }
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
+}
+function normalizeUiuxAudit(raw, configPath, issues) {
+  if (!isRecord(raw)) {
+    issues.push(configIssue(configPath, "uiux.audit \u306F\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002"));
+    return void 0;
+  }
+  const result = {};
+  if (raw.enabled !== void 0) {
+    if (typeof raw.enabled === "boolean") {
+      result.enabled = raw.enabled;
+    } else {
+      issues.push(configIssue(configPath, "uiux.audit.enabled \u306F\u30D6\u30FC\u30EB\u5024\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002"));
+    }
+  }
+  if (raw.slopDetection !== void 0) {
+    if (typeof raw.slopDetection === "boolean") {
+      result.slopDetection = raw.slopDetection;
+    } else {
+      issues.push(
+        configIssue(configPath, "uiux.audit.slopDetection \u306F\u30D6\u30FC\u30EB\u5024\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002")
+      );
+    }
+  }
+  if (raw.maxPrimaryCtas !== void 0) {
+    if (typeof raw.maxPrimaryCtas === "number" && Number.isFinite(raw.maxPrimaryCtas) && raw.maxPrimaryCtas >= 0) {
+      result.maxPrimaryCtas = raw.maxPrimaryCtas;
+    } else {
+      issues.push(
+        configIssue(configPath, "uiux.audit.maxPrimaryCtas \u306F0\u4EE5\u4E0A\u306E\u6570\u5024\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002")
+      );
+    }
+  }
+  if (raw.maxRawTokenLiteralWarnings !== void 0) {
+    if (typeof raw.maxRawTokenLiteralWarnings === "number" && Number.isFinite(raw.maxRawTokenLiteralWarnings) && raw.maxRawTokenLiteralWarnings >= 0) {
+      result.maxRawTokenLiteralWarnings = raw.maxRawTokenLiteralWarnings;
+    } else {
+      issues.push(
+        configIssue(
+          configPath,
+          "uiux.audit.maxRawTokenLiteralWarnings \u306F0\u4EE5\u4E0A\u306E\u6570\u5024\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002"
+        )
+      );
+    }
+  }
+  if (raw.maxDuplicateFindingsPerRule !== void 0) {
+    if (typeof raw.maxDuplicateFindingsPerRule === "number" && Number.isFinite(raw.maxDuplicateFindingsPerRule) && raw.maxDuplicateFindingsPerRule >= 0) {
+      result.maxDuplicateFindingsPerRule = raw.maxDuplicateFindingsPerRule;
+    } else {
+      issues.push(
+        configIssue(
+          configPath,
+          "uiux.audit.maxDuplicateFindingsPerRule \u306F0\u4EE5\u4E0A\u306E\u6570\u5024\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002"
+        )
+      );
+    }
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
+}
+function normalizeRenderEvidence(raw, configPath, issues) {
+  if (!isRecord(raw)) {
+    issues.push(
+      configIssue(configPath, "uiux.renderEvidence \u306F\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002")
+    );
+    return void 0;
+  }
+  const result = {};
+  if (raw.enabled !== void 0) {
+    if (typeof raw.enabled === "boolean") {
+      result.enabled = raw.enabled;
+    } else {
+      issues.push(
+        configIssue(configPath, "uiux.renderEvidence.enabled \u306F\u30D6\u30FC\u30EB\u5024\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002")
+      );
+    }
+  }
+  if (raw.viewports !== void 0) {
+    if (Array.isArray(raw.viewports) && raw.viewports.every((item) => typeof item === "string")) {
+      result.viewports = normalizeRenderViewports(raw.viewports);
+    } else {
+      issues.push(
+        configIssue(configPath, "uiux.renderEvidence.viewports \u306F\u6587\u5B57\u5217\u914D\u5217\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002")
+      );
+    }
+  }
+  if (raw.out !== void 0) {
+    if (typeof raw.out === "string" && raw.out.trim().length > 0) {
+      result.out = raw.out.trim();
+    } else {
+      issues.push(
+        configIssue(configPath, "uiux.renderEvidence.out \u306F\u7A7A\u3067\u306A\u3044\u6587\u5B57\u5217\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002")
+      );
+    }
+  }
+  if (raw.baseUrl !== void 0) {
+    if (typeof raw.baseUrl === "string" && raw.baseUrl.trim().length > 0) {
+      result.baseUrl = raw.baseUrl.trim();
+    } else {
+      issues.push(
+        configIssue(
+          configPath,
+          "uiux.renderEvidence.baseUrl \u306F\u7A7A\u3067\u306A\u3044\u6587\u5B57\u5217\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002"
+        )
+      );
+    }
+  }
+  if (raw.failOpen !== void 0) {
+    if (typeof raw.failOpen === "boolean") {
+      result.failOpen = raw.failOpen;
+    } else {
+      issues.push(
+        configIssue(configPath, "uiux.renderEvidence.failOpen \u306F\u30D6\u30FC\u30EB\u5024\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002")
+      );
+    }
+  }
   return Object.keys(result).length > 0 ? result : void 0;
 }
 function configIssue(file, message) {
@@ -1514,11 +1657,11 @@ function cloneGlobal(pattern) {
 }
 
 // src/core/atddTraceability.ts
-var US_TEST_ANNOTATION_RE = /\bQFAI:SPEC-(\d{4}):US-(\d{4})\b/g;
-var TC_TEST_ANNOTATION_RE = /\bQFAI:SPEC-(\d{4}):TC-(\d{4})\b/g;
+var US_TEST_ANNOTATION_RE = /\bQFAI:SPEC-(\d{4}):US-(\d{4}(?:-\d{4})?)\b/g;
+var TC_TEST_ANNOTATION_RE = /\bQFAI:SPEC-(\d{4}):TC-(\d{4}(?:-\d{4})?)\b/g;
 var API_TEST_ANNOTATION_RE = /\bQFAI:CON-API-(\d+)\b/g;
-var SHORT_US_ID_RE = /^US-\d{4}$/;
-var SHORT_TC_ID_RE = /^TC-\d{4}$/;
+var US_ID_RE = /^US-\d{4}(?:-\d{4})?$/;
+var TC_ID_RE = /^TC-\d{4}(?:-\d{4})?$/;
 var API_CONTRACT_ID_RE = /^CON-API-\d+$/;
 var TEST_FILE_GLOB = "**/*.{ts,tsx,js,jsx,mjs,cjs,mts,cts,feature,md,markdown}";
 async function evaluateAtddCodeTraceability(root, config) {
@@ -1666,11 +1809,11 @@ async function collectApiContractIds(apiRoot) {
 function collectShortIds(text, prefix) {
   const ids = /* @__PURE__ */ new Set();
   const headingIds = collectMarkdownItems(text, prefix).map((item) => item.id);
-  const pattern = prefix === "US" ? /\bUS-\d{4}\b/g : /\bTC-\d{4}\b/g;
+  const pattern = prefix === "US" ? /\bUS-\d{4}(?:-\d{4})?\b/g : /\bTC-\d{4}(?:-\d{4})?\b/g;
   const looseIds = uniqueMatches(text, pattern);
   for (const id of [...headingIds, ...looseIds]) {
     const normalized = id.toUpperCase();
-    if (prefix === "US" && SHORT_US_ID_RE.test(normalized) || prefix === "TC" && SHORT_TC_ID_RE.test(normalized)) {
+    if (prefix === "US" && US_ID_RE.test(normalized) || prefix === "TC" && TC_ID_RE.test(normalized)) {
       ids.add(normalized);
     }
   }
@@ -2355,6 +2498,7 @@ var ID_PREFIXES = [
   "DB",
   "THEMA"
 ];
+var DIGIT_AHEAD = "(?=[A-Za-z0-9_-]*\\d)";
 var STRICT_ID_PATTERNS = {
   CAP: /\bCAP-\d{4}\b/g,
   SPEC: /\bSPEC-\d{4}\b/g,
@@ -2370,18 +2514,18 @@ var STRICT_ID_PATTERNS = {
   ADR: /\bADR-\d{4}\b/g
 };
 var LOOSE_ID_PATTERNS = {
-  CAP: /\bCAP-[A-Za-z0-9_-]+\b/gi,
-  SPEC: /\bSPEC-[A-Za-z0-9_-]+\b/gi,
-  US: /\bUS-[A-Za-z0-9_-]+\b/gi,
-  BR: /\bBR-[A-Za-z0-9_-]+\b/gi,
-  SC: /\bSC-[A-Za-z0-9_-]+\b/gi,
-  AC: /\bAC-[A-Za-z0-9_-]+\b/gi,
-  CASE: /\bCASE-[A-Za-z0-9_-]+\b/gi,
-  UI: /\bUI-[A-Za-z0-9_-]+\b/gi,
-  API: /\bAPI-[A-Za-z0-9_-]+\b/gi,
-  DB: /\bDB-[A-Za-z0-9_-]+\b/gi,
-  THEMA: /\bTHEMA-[A-Za-z0-9_-]+\b/gi,
-  ADR: /\bADR-[A-Za-z0-9_-]+\b/gi
+  CAP: new RegExp(`\\bCAP-${DIGIT_AHEAD}[A-Za-z0-9_-]+\\b`, "gi"),
+  SPEC: new RegExp(`\\bSPEC-${DIGIT_AHEAD}[A-Za-z0-9_-]+\\b`, "gi"),
+  US: new RegExp(`\\bUS-${DIGIT_AHEAD}[A-Za-z0-9_-]+\\b`, "gi"),
+  BR: new RegExp(`\\bBR-${DIGIT_AHEAD}[A-Za-z0-9_-]+\\b`, "gi"),
+  SC: new RegExp(`\\bSC-${DIGIT_AHEAD}[A-Za-z0-9_-]+\\b`, "gi"),
+  AC: new RegExp(`\\bAC-${DIGIT_AHEAD}[A-Za-z0-9_-]+\\b`, "gi"),
+  CASE: new RegExp(`\\bCASE-${DIGIT_AHEAD}[A-Za-z0-9_-]+\\b`, "gi"),
+  UI: new RegExp(`\\bUI-${DIGIT_AHEAD}[A-Za-z0-9_-]+\\b`, "gi"),
+  API: new RegExp(`\\bAPI-${DIGIT_AHEAD}[A-Za-z0-9_-]+\\b`, "gi"),
+  DB: new RegExp(`\\bDB-${DIGIT_AHEAD}[A-Za-z0-9_-]+\\b`, "gi"),
+  THEMA: new RegExp(`\\bTHEMA-${DIGIT_AHEAD}[A-Za-z0-9_-]+\\b`, "gi"),
+  ADR: new RegExp(`\\bADR-${DIGIT_AHEAD}[A-Za-z0-9_-]+\\b`, "gi")
 };
 function extractIds(text, prefix) {
   const pattern = STRICT_ID_PATTERNS[prefix];
@@ -3423,8 +3567,8 @@ function formatError4(error) {
 }
 
 // src/core/report.ts
-import { readFile as readFile40 } from "fs/promises";
-import path52 from "path";
+import { readFile as readFile42 } from "fs/promises";
+import path54 from "path";
 
 // src/core/contractIndex.ts
 import { readFile as readFile10 } from "fs/promises";
@@ -4182,8 +4326,8 @@ import { readFile as readFile11 } from "fs/promises";
 import path14 from "path";
 import { fileURLToPath } from "url";
 async function resolveToolVersion() {
-  if ("1.7.0".length > 0) {
-    return "1.7.0";
+  if ("1.7.2".length > 0) {
+    return "1.7.2";
   }
   try {
     const packagePath = resolvePackageJsonPath();
@@ -7026,7 +7170,7 @@ import path24 from "path";
 var SC_TAG_RE3 = /^SC-\d{4}-\d{4}$/;
 var SC_TAG_RE_GLOBAL = /\bSC-\d{4}-\d{4}\b/g;
 var SPEC_TAG_RE = /^SPEC-\d{4}$/;
-var US_ID_RE = /\bUS-\d{4}-\d{4}\b/g;
+var US_ID_RE2 = /\bUS-\d{4}-\d{4}\b/g;
 var AC_ID_RE3 = /\bAC-\d{4}-\d{4}\b/g;
 var DOWNSTREAM_ID_RE = /\b(?:US|AC|BR|SC|CASE)-\d{4}-\d{4}\b/g;
 async function validateTraceability(root, config, phase) {
@@ -7153,7 +7297,7 @@ async function collectLayeredEdgeData(entry, issues) {
   const { definitions: acIds, refsByDefinition: acToUs } = extractTableDefinitionRefs(
     acceptanceCriteriaText,
     /^AC-\d{4}-\d{4}$/,
-    US_ID_RE
+    US_ID_RE2
   );
   const { definitions: brIds, refsByDefinition: brToAc } = extractTableDefinitionRefs(
     businessRulesText,
@@ -8209,15 +8353,15 @@ import path28 from "path";
 import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
 import path29 from "path";
 var ID_PATTERNS = {
-  us: /^US-\d{4}$/,
-  ac: /^AC-\d{4}$/,
-  br: /^BR-\d{4}$/,
-  ex: /^EX-\d{4}$/
+  us: /^US-\d{4}(?:-\d{4})?$/,
+  ac: /^AC-\d{4}(?:-\d{4})?$/,
+  br: /^BR-\d{4}(?:-\d{4})?$/,
+  ex: /^EX-\d{4}(?:-\d{4})?$/
 };
 var V1421_REFS = {
-  ac: /\bAC-\d{4}\b/gi,
-  br: /\bBR-\d{4}\b/gi,
-  ex: /\bEX-\d{4}\b/gi
+  ac: /\bAC-\d{4}(?:-\d{4})?\b/gi,
+  br: /\bBR-\d{4}(?:-\d{4})?\b/gi,
+  ex: /\bEX-\d{4}(?:-\d{4})?\b/gi
 };
 async function validateLayerCoverage(root, config) {
   const specsRoot = resolvePath(root, config, "specsDir");
@@ -8490,11 +8634,11 @@ function parseAcceptanceCriteriaIds2(text) {
   const ids = /* @__PURE__ */ new Set();
   const lines = text.replace(/\r\n/g, "\n").split("\n");
   for (const line of lines) {
-    const headingMatch = /^##\s*(AC-\d{4})\b/i.exec(line.trim());
+    const headingMatch = /^##\s*(AC-\d{4}(?:-\d{4})?)\b/i.exec(line.trim());
     if (headingMatch?.[1]) {
       ids.add(headingMatch[1].toUpperCase());
     }
-    const commentMatch = /^\s*#\s*(AC-\d{4})\b/i.exec(line);
+    const commentMatch = /^\s*#\s*(AC-\d{4}(?:-\d{4})?)\b/i.exec(line);
     if (commentMatch?.[1]) {
       ids.add(commentMatch[1].toUpperCase());
     }
@@ -8514,8 +8658,8 @@ function parseAcceptanceCriteriaIds2(text) {
 function parseDefinitionRefs(text, prefix, refPattern, options = {}) {
   const lines = text.replace(/\r\n/g, "\n").split("\n");
   const refsById = /* @__PURE__ */ new Map();
-  const idPattern = new RegExp(`^${prefix}-\\d{4}$`);
-  const headingPattern = new RegExp(`^##\\s*(${prefix}-\\d{4})\\b`, "i");
+  const idPattern = new RegExp(`^${prefix}-\\d{4}(?:-\\d{4})?$`);
+  const headingPattern = new RegExp(`^##\\s*(${prefix}-\\d{4}(?:-\\d{4})?)\\b`, "i");
   const referenceColumns = new Set(
     (options.referenceColumns ?? []).map((column) => normalizeColumnName(column))
   );
@@ -8916,7 +9060,7 @@ var US_DOWNSTREAM_RE = /\b(?:AC|BR|EX|TC)-\d{4}\b/g;
 var AC_DOWNSTREAM_RE = /\b(?:BR|EX|TC)-\d{4}\b/g;
 var BR_DOWNSTREAM_RE = /\b(?:EX|TC)-\d{4}\b/g;
 var CAP_ID_RE = /^CAP-\d{4}$/;
-var US_ID_RE2 = /^US-\d{4}$/;
+var US_ID_RE3 = /^US-\d{4}$/;
 var AC_ID_RE4 = /^AC-\d{4}$/;
 var BR_OR_AC_ID_RE = /^(?:BR|AC)-\d{4}$/;
 var EX_ID_RE2 = /^EX-\d{4}$/;
@@ -8955,7 +9099,7 @@ async function validateLayeredTraceability(root, config) {
         ...await validateMarkdownParentFormat(entry.userStoriesPath, "US", CAP_ID_RE, "CAP")
       );
       issues.push(
-        ...await validateMarkdownParentFormat(entry.acceptanceCriteriaPath, "AC", US_ID_RE2, "US")
+        ...await validateMarkdownParentFormat(entry.acceptanceCriteriaPath, "AC", US_ID_RE3, "US")
       );
       issues.push(
         ...await validateMarkdownParentFormat(entry.businessRulesPath, "BR", AC_ID_RE4, "AC")
@@ -9761,7 +9905,7 @@ function validateExParentExists(filePath, exItems, acIds, brIds) {
 }
 
 // src/core/validators/prototypingEvidence.ts
-import { readFile as readFile25 } from "fs/promises";
+import { access as access9, readFile as readFile25 } from "fs/promises";
 import path34 from "path";
 var EVIDENCE_MARKDOWN_FILE = "prototyping.md";
 var EVIDENCE_JSON_FILE = "prototyping.json";
@@ -10267,6 +10411,100 @@ async function validateUiFidelity(root, config, evidenceJsonPath, evidence) {
       )
     );
   }
+  const renderIssues = await validateRenderEvidenceScreens(
+    root,
+    config,
+    evidenceJsonPath,
+    uiFidelity.screens
+  );
+  issues.push(...renderIssues);
+  return issues;
+}
+async function validateRenderEvidenceScreens(root, config, evidenceJsonPath, screens) {
+  const issues = [];
+  const hasAnyRenderEvidence = screens.some((screen) => screen.renders.length > 0);
+  if (!hasAnyRenderEvidence) {
+    return issues;
+  }
+  const qualityProfile = config.uiux?.qualityProfile ?? "default";
+  for (const screen of screens) {
+    if (screen.renders.length === 0) {
+      continue;
+    }
+    const viewports = new Set(screen.renders.map((render) => render.viewport));
+    const missingDefaultViewports = DEFAULT_RENDER_VIEWPORTS.filter(
+      (viewport) => !viewports.has(viewport)
+    );
+    const allSkipped = screen.renders.every((render) => render.status === "skipped");
+    for (const render of screen.renders) {
+      if (render.status !== "captured") {
+        continue;
+      }
+      const invalidPaths = [
+        { label: "imagePath", value: render.imagePath },
+        { label: "htmlPath", value: render.htmlPath }
+      ].filter((entry) => looksLikeInlineRenderPayload(entry.value));
+      if (invalidPaths.length > 0) {
+        issues.push(
+          issue(
+            "QFAI-PROT-244",
+            `QFAI-PROT-244: render evidence must be path-only. route=${screen.route}, viewport=${render.viewport}, invalid=${invalidPaths.map((entry) => entry.label).join("|")}`,
+            "error",
+            evidenceJsonPath,
+            "prototypingEvidence.renderArtifactPresence",
+            [
+              `route=${screen.route}`,
+              `viewport=${render.viewport}`,
+              ...invalidPaths.map((entry) => `artifact=${entry.label}`)
+            ],
+            "change",
+            "imagePath/htmlPath \u306B\u306F\u30D5\u30A1\u30A4\u30EB\u30D1\u30B9\u306E\u307F\u3092\u4FDD\u5B58\u3057\u3001data URI \u3084 HTML \u672C\u6587\u3092 JSON \u306B\u57CB\u3081\u8FBC\u307E\u306A\u3044\u3067\u304F\u3060\u3055\u3044\u3002"
+          )
+        );
+        continue;
+      }
+      const missingArtifacts = await collectMissingRenderArtifacts(root, render);
+      if (missingArtifacts.length > 0) {
+        issues.push(
+          issue(
+            "QFAI-PROT-244",
+            `QFAI-PROT-244: captured render artifact is missing. route=${screen.route}, viewport=${render.viewport}, missing=${missingArtifacts.join("|")}`,
+            "error",
+            evidenceJsonPath,
+            "prototypingEvidence.renderArtifactPresence",
+            [
+              `route=${screen.route}`,
+              `viewport=${render.viewport}`,
+              ...missingArtifacts.map((artifact) => `artifact=${artifact}`)
+            ],
+            "change",
+            "render capture \u3092\u518D\u5B9F\u884C\u3057\u3001screenshot \u3068 HTML snapshot \u306E\u4E21\u65B9\u304C\u4FDD\u5B58\u3055\u308C\u308B\u3053\u3068\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
+          )
+        );
+      }
+    }
+    if (missingDefaultViewports.length === 0 && !allSkipped) {
+      continue;
+    }
+    const severity = qualityProfile === "default" ? "warning" : "error";
+    const reason = allSkipped ? "all renders are skipped" : `missing default viewports=${missingDefaultViewports.join("|")}`;
+    issues.push(
+      issue(
+        "QFAI-PROT-245",
+        `QFAI-PROT-245: render coverage is incomplete for ${screen.route}. ${reason}. qualityProfile=${qualityProfile}`,
+        severity,
+        evidenceJsonPath,
+        "prototypingEvidence.renderCoverage",
+        [
+          `route=${screen.route}`,
+          ...missingDefaultViewports.map((viewport) => `viewport=${viewport}`),
+          `qualityProfile=${qualityProfile}`
+        ],
+        "change",
+        allSkipped ? "\u5C11\u306A\u304F\u3068\u3082 desktop/mobile \u306E\u3044\u305A\u308C\u304B\u3067 captured \u307E\u305F\u306F failed \u306E\u660E\u793A\u7684\u306A render outcome \u3092\u6B8B\u3057\u3066\u304F\u3060\u3055\u3044\u3002" : "desktop/mobile \u306E default viewport \u3092\u63C3\u3048\u308B\u304B\u3001profile \u8A2D\u5B9A\u3068 scope \u3092\u898B\u76F4\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
+      )
+    );
+  }
   return issues;
 }
 function formatUiFidelityMismatch(mismatch) {
@@ -10479,6 +10717,10 @@ function normalizeUiFidelityScreen(value) {
   if (!mockPaths.ok) {
     return mockPaths;
   }
+  const renders = normalizeRenderEntries(value.renders);
+  if (!renders.ok) {
+    return renders;
+  }
   return {
     ok: true,
     value: {
@@ -10489,10 +10731,105 @@ function normalizeUiFidelityScreen(value) {
       ...normalizeOptionalMissingBlock(value.missing),
       ...typeof value.coverage === "number" ? { coverage: value.coverage } : {},
       observed: observed.value,
-      mockPaths: mockPaths.value
+      mockPaths: mockPaths.value,
+      renders: renders.value
     }
   };
 }
+function normalizeRenderEntries(value) {
+  if (value === void 0) {
+    return { ok: true, value: [] };
+  }
+  if (!Array.isArray(value)) {
+    return { ok: false, reason: "`uiFidelity.screens[].renders` must be an array" };
+  }
+  const renders = [];
+  for (const entry of value) {
+    const normalized = normalizeRenderEntry(entry);
+    if (!normalized.ok) {
+      return normalized;
+    }
+    renders.push(normalized.value);
+  }
+  return { ok: true, value: renders };
+}
+function normalizeRenderEntry(value) {
+  if (!isRecord5(value)) {
+    return { ok: false, reason: "`uiFidelity.screens[].renders[]` must be objects" };
+  }
+  if (typeof value.viewport !== "string" || value.viewport.trim().length === 0) {
+    return { ok: false, reason: "`uiFidelity.screens[].renders[].viewport` is required" };
+  }
+  if (!isNonNegativeInteger(value.width) || !isNonNegativeInteger(value.height) || value.width === 0 || value.height === 0) {
+    return {
+      ok: false,
+      reason: "`uiFidelity.screens[].renders[]` requires positive integers for width/height"
+    };
+  }
+  const viewport = value.viewport.trim();
+  const width = value.width;
+  const height = value.height;
+  const status = typeof value.status === "string" ? value.status.trim().toLowerCase() : "";
+  if (status === "captured") {
+    if (typeof value.imagePath !== "string" || value.imagePath.trim().length === 0 || typeof value.htmlPath !== "string" || value.htmlPath.trim().length === 0) {
+      return {
+        ok: false,
+        reason: "`captured` render entries require imagePath and htmlPath"
+      };
+    }
+    return {
+      ok: true,
+      value: {
+        viewport,
+        status: "captured",
+        width,
+        height,
+        imagePath: value.imagePath.trim(),
+        htmlPath: value.htmlPath.trim()
+      }
+    };
+  }
+  if (status === "skipped") {
+    if (typeof value.skippedReason !== "string" || value.skippedReason.trim().length === 0) {
+      return {
+        ok: false,
+        reason: "`skipped` render entries require skippedReason"
+      };
+    }
+    return {
+      ok: true,
+      value: {
+        viewport,
+        status: "skipped",
+        width,
+        height,
+        skippedReason: value.skippedReason.trim()
+      }
+    };
+  }
+  if (status === "failed") {
+    if (typeof value.error !== "string" || value.error.trim().length === 0) {
+      return {
+        ok: false,
+        reason: "`failed` render entries require error"
+      };
+    }
+    return {
+      ok: true,
+      value: {
+        viewport,
+        status: "failed",
+        width,
+        height,
+        error: value.error.trim()
+      }
+    };
+  }
+  return {
+    ok: false,
+    reason: "`uiFidelity.screens[].renders[].status` must be captured|skipped|failed"
+  };
+}
 function normalizeUiFidelityExpected(value) {
   if (!isRecord5(value)) {
     return {
@@ -10716,6 +11053,22 @@ function normalizeOptionalMissingBlock(value) {
 function isRecord5(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
+async function collectMissingRenderArtifacts(root, render) {
+  const missing = [];
+  const candidates = [
+    { label: "imagePath", target: render.imagePath },
+    { label: "htmlPath", target: render.htmlPath }
+  ];
+  for (const candidate of candidates) {
+    const resolved = path34.isAbsolute(candidate.target) ? candidate.target : path34.resolve(root, candidate.target);
+    try {
+      await access9(resolved);
+    } catch {
+      missing.push(candidate.label);
+    }
+  }
+  return missing;
+}
 function isInteger(value) {
   return typeof value === "number" && Number.isFinite(value) && Number.isInteger(value);
 }
@@ -11064,7 +11417,7 @@ function collectLayer(layer, layerName, target, errors) {
 }
 function flattenTokens(obj, prefix, target, errors) {
   for (const [key, value] of Object.entries(obj)) {
-    const path53 = `${prefix}.${key}`;
+    const path55 = `${prefix}.${key}`;
     if (value && typeof value === "object" && !Array.isArray(value)) {
       const record2 = value;
       if ("$value" in record2) {
@@ -11080,9 +11433,9 @@ function flattenTokens(obj, prefix, target, errors) {
         if (typeof record2.platform === "string") {
           token.platform = record2.platform;
         }
-        target.set(path53, token);
+        target.set(path55, token);
       } else {
-        flattenTokens(record2, path53, target, errors);
+        flattenTokens(record2, path55, target, errors);
       }
     }
   }
@@ -11092,44 +11445,44 @@ function resolveAllReferences(result) {
   for (const [key, val] of result.primitives) allTokens.set(key, val);
   for (const [key, val] of result.semantics) allTokens.set(key, val);
   for (const [key, val] of result.components) allTokens.set(key, val);
-  for (const [path53] of allTokens) {
-    resolveTokenRef(path53, allTokens, /* @__PURE__ */ new Set(), 0, result);
+  for (const [path55] of allTokens) {
+    resolveTokenRef(path55, allTokens, /* @__PURE__ */ new Set(), 0, result);
   }
 }
-function resolveTokenRef(path53, allTokens, visited, depth, result) {
-  if (result.resolved.has(path53)) {
-    return result.resolved.get(path53);
+function resolveTokenRef(path55, allTokens, visited, depth, result) {
+  if (result.resolved.has(path55)) {
+    return result.resolved.get(path55);
   }
   if (depth > MAX_RESOLVE_DEPTH) {
     result.errors.push({
-      message: `Max reference depth exceeded at: ${path53}`,
-      path: path53
+      message: `Max reference depth exceeded at: ${path55}`,
+      path: path55
     });
     return void 0;
   }
-  if (visited.has(path53)) {
+  if (visited.has(path55)) {
     result.errors.push({
-      message: `Circular reference detected: ${path53}`,
-      path: path53
+      message: `Circular reference detected: ${path55}`,
+      path: path55
     });
     return void 0;
   }
-  const token = allTokens.get(path53);
+  const token = allTokens.get(path55);
   if (!token) {
     return void 0;
   }
   if (typeof token.$value !== "string") {
     const rawValue2 = stringifyTokenValue(token.$value);
-    result.resolved.set(path53, rawValue2);
+    result.resolved.set(path55, rawValue2);
     return rawValue2;
   }
   const rawValue = stringifyTokenValue(token.$value);
   const refs = [...rawValue.matchAll(REF_PATTERN)];
   if (refs.length === 0) {
-    result.resolved.set(path53, rawValue);
+    result.resolved.set(path55, rawValue);
     return rawValue;
   }
-  visited.add(path53);
+  visited.add(path55);
   let resolved = rawValue;
   for (const ref of refs) {
     const refPath = ref[1];
@@ -11137,8 +11490,8 @@ function resolveTokenRef(path53, allTokens, visited, depth, result) {
     const refToken = allTokens.get(refPath);
     if (!refToken) {
       result.errors.push({
-        message: `Unresolved token reference: {${refPath}} at ${path53}`,
-        path: path53
+        message: `Unresolved token reference: {${refPath}} at ${path55}`,
+        path: path55
       });
       continue;
     }
@@ -11147,7 +11500,7 @@ function resolveTokenRef(path53, allTokens, visited, depth, result) {
       resolved = resolved.split(`{${refPath}}`).join(refValue);
     }
   }
-  result.resolved.set(path53, resolved);
+  result.resolved.set(path55, resolved);
   return resolved;
 }
 function stringifyTokenValue(value) {
@@ -14259,6 +14612,7 @@ async function validateNavigationFlow(root, config) {
 
 // src/core/validators/renderCritique.ts
 import path49 from "path";
+import { readFile as readFile39 } from "fs/promises";
 import fg9 from "fast-glob";
 var RENDERED_KEYWORDS_RE = /\b(rendered|screenshot|html\b|preview|visual\s*review)/i;
 var DDP_REFERENCE_RE = /\b(ddp|design\s*direction\s*pack)\b/i;
@@ -14290,6 +14644,7 @@ async function validateRenderCritique(root, config) {
   if (!hasDdp) return issues;
   const skillsDir = path49.join(root, config.paths.skillsDir).replace(/\\/g, "/");
   const evidenceDir = path49.join(root, ".qfai", "evidence").replace(/\\/g, "/");
+  const renderEvidenceViewports = await collectRenderEvidenceViewports(root);
   const skillPromptPattern = path49.posix.join(skillsDir, "qfai-{prototyping,implement}*/SKILL.md");
   const skillFiles = await fg9(skillPromptPattern, { dot: true });
   const evidencePattern = path49.posix.join(evidenceDir, "{prototyping*,critique-*}.md");
@@ -14329,7 +14684,7 @@ async function validateRenderCritique(root, config) {
     }
   }
   const allEvidenceContent = await collectContent(evidenceFiles);
-  if (evidenceFiles.length > 0 && !DESKTOP_RE.test(allEvidenceContent)) {
+  if (evidenceFiles.length > 0 && !DESKTOP_RE.test(allEvidenceContent) && !renderEvidenceViewports.has("desktop")) {
     issues.push(
       issue(
         "QFAI-CRIT-003",
@@ -14343,7 +14698,7 @@ async function validateRenderCritique(root, config) {
       )
     );
   }
-  if (evidenceFiles.length > 0 && !MOBILE_RE.test(allEvidenceContent)) {
+  if (evidenceFiles.length > 0 && !MOBILE_RE.test(allEvidenceContent) && !renderEvidenceViewports.has("mobile")) {
     issues.push(
       issue(
         "QFAI-CRIT-004",
@@ -14504,9 +14859,49 @@ async function collectContent(files) {
   }
   return contents.join("\n---\n");
 }
+async function collectRenderEvidenceViewports(root) {
+  const prototypingJsonPath = path49.join(root, ".qfai", "evidence", "prototyping.json");
+  try {
+    const raw = await readFile39(prototypingJsonPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return /* @__PURE__ */ new Set();
+    }
+    const uiFidelity = parsed.uiFidelity;
+    if (!uiFidelity || typeof uiFidelity !== "object" || Array.isArray(uiFidelity)) {
+      return /* @__PURE__ */ new Set();
+    }
+    const screens = uiFidelity.screens;
+    if (!Array.isArray(screens)) {
+      return /* @__PURE__ */ new Set();
+    }
+    const viewports = /* @__PURE__ */ new Set();
+    for (const screen of screens) {
+      if (!screen || typeof screen !== "object" || Array.isArray(screen)) {
+        continue;
+      }
+      const renders = screen.renders;
+      if (!Array.isArray(renders)) {
+        continue;
+      }
+      for (const render of renders) {
+        if (!render || typeof render !== "object" || Array.isArray(render)) {
+          continue;
+        }
+        const viewport = render.viewport;
+        if (typeof viewport === "string" && viewport.trim().length > 0) {
+          viewports.add(viewport.trim().toLowerCase());
+        }
+      }
+    }
+    return viewports;
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
 
 // src/core/validators/designFidelity.ts
-import { readFile as readFile39 } from "fs/promises";
+import { readFile as readFile40 } from "fs/promises";
 import path50 from "path";
 import fg10 from "fast-glob";
 var SCORECARD_HEADING_RE = /^#{1,3}\s+Fidelity\s+Scorecard/im;
@@ -14539,7 +14934,7 @@ async function validateDesignFidelity(root, config) {
   for (const filePath of allFiles) {
     let content;
     try {
-      content = await readFile39(filePath, "utf-8");
+      content = await readFile40(filePath, "utf-8");
     } catch {
       continue;
     }
@@ -15162,6 +15557,252 @@ async function validateDiscussionDesignHardening(root, config) {
   return issues;
 }
 
+// src/core/validators/designAudit.ts
+import { readdir as readdir9 } from "fs/promises";
+import path52 from "path";
+var COSMETIC_CATEGORIES = ["generic-shell", "stock-imagery", "placeholder-copy"];
+function resolveAuditConfig(config) {
+  const audit = config.uiux?.audit;
+  const profile = config.uiux?.qualityProfile ?? "default";
+  return {
+    enabled: audit?.enabled ?? true,
+    slopDetection: audit?.slopDetection ?? true,
+    qualityProfile: profile,
+    maxPrimaryCtas: audit?.maxPrimaryCtas ?? 1,
+    maxRawTokenLiteralWarnings: audit?.maxRawTokenLiteralWarnings ?? 5,
+    maxDuplicateFindingsPerRule: audit?.maxDuplicateFindingsPerRule ?? 5
+  };
+}
+function mapSeverity(tier, profile, category) {
+  if (tier === 1) return "error";
+  if (tier === 2) return profile === "strict" ? "error" : "warning";
+  if (profile === "default") {
+    return category && COSMETIC_CATEGORIES.includes(category) ? "info" : "warning";
+  }
+  return "warning";
+}
+function findingToIssue(finding, profile, rulePrefix = "audit") {
+  const severity = mapSeverity(finding.severityTier, profile, finding.dimension);
+  return issue(
+    finding.ruleId,
+    finding.message,
+    severity,
+    finding.file,
+    `${rulePrefix}.${finding.dimension}`,
+    finding.evidence.length > 0 ? finding.evidence : void 0,
+    "compatibility",
+    finding.guidance
+  );
+}
+function extractSection2(content, heading) {
+  const idx = content.indexOf(heading);
+  if (idx === -1) return null;
+  const start = idx + heading.length;
+  const headingLevel = heading.match(/^#+/)?.[0]?.length ?? 3;
+  const rest = content.slice(start);
+  const headingPattern = new RegExp(`^#{1,${headingLevel}} `, "m");
+  const nextHeadingMatch = headingPattern.exec(rest);
+  const sectionContent = nextHeadingMatch ? rest.slice(0, nextHeadingMatch.index) : rest;
+  return sectionContent.trim() || null;
+}
+function checkCtaHierarchy(content, auditConfig, file) {
+  const findings = [];
+  const ctaSection = extractSection2(content, "### CTA Hierarchy");
+  if (!ctaSection) return findings;
+  const primaryLines = ctaSection.match(/^-\s*Primary:/gm) || [];
+  const primaryCount = primaryLines.length;
+  if (primaryCount === 0) {
+    findings.push({
+      ruleId: "QFAI-AUD-001",
+      dimension: "visualHierarchy",
+      severityTier: 1,
+      message: "No primary CTA defined in CTA Hierarchy",
+      why: "Every UI screen needs a clear primary action to guide users",
+      evidence: [],
+      guidance: "Define at least one primary CTA in the CTA Hierarchy section",
+      file
+    });
+  }
+  if (primaryCount > auditConfig.maxPrimaryCtas) {
+    findings.push({
+      ruleId: "QFAI-AUD-020",
+      dimension: "visualHierarchy",
+      severityTier: 2,
+      message: `Multiple primary CTAs detected (${primaryCount} > ${auditConfig.maxPrimaryCtas})`,
+      why: "Multiple primary CTAs create decision paralysis and weaken visual hierarchy",
+      evidence: primaryLines.map((l) => l.trim()),
+      guidance: "Reduce to a single primary CTA per screen; demote others to secondary",
+      file
+    });
+  }
+  return findings;
+}
+var RAW_COLOR_RE = /#[0-9a-fA-F]{3,8}\b|rgb\([^)]+\)|rgba\([^)]+\)|hsl\([^)]+\)|hsla\([^)]+\)/g;
+async function checkTokenDrift(root, auditConfig, cfg) {
+  const findings = [];
+  const configuredDir = cfg.uiux?.designTokensDir;
+  const tokensDir = configuredDir ? path52.resolve(root, configuredDir) : path52.join(root, cfg.paths.contractsDir, "design");
+  let hasTokenFiles = false;
+  try {
+    const entries = await readdir9(tokensDir);
+    hasTokenFiles = entries.some((e) => /\.ya?ml$/i.test(e));
+  } catch {
+    return findings;
+  }
+  if (!hasTokenFiles) return findings;
+  const contractsUiDir = path52.join(root, cfg.paths.contractsDir, "ui");
+  let htmlFiles = [];
+  try {
+    const entries = await readdir9(contractsUiDir);
+    htmlFiles = entries.filter((e) => /\.html?$/i.test(e));
+  } catch {
+    return findings;
+  }
+  let rawCount = 0;
+  const sampleLiterals = [];
+  for (const htmlFile of htmlFiles) {
+    const content = await readSafe(path52.join(contractsUiDir, htmlFile));
+    if (!content) continue;
+    const matches = content.match(RAW_COLOR_RE);
+    if (matches) {
+      rawCount += matches.length;
+      for (const m of matches) {
+        if (sampleLiterals.length < 10) {
+          sampleLiterals.push(m.toLowerCase());
+        }
+      }
+    }
+  }
+  if (rawCount > auditConfig.maxRawTokenLiteralWarnings) {
+    findings.push({
+      ruleId: "QFAI-AUD-004",
+      dimension: "tokenDiscipline",
+      severityTier: 1,
+      message: `Token drift: ${rawCount} raw color literal occurrences found (threshold: ${auditConfig.maxRawTokenLiteralWarnings})`,
+      why: "Raw color values bypass design tokens, causing visual inconsistency",
+      evidence: sampleLiterals,
+      guidance: "Replace raw color literals with design token references"
+    });
+  }
+  return findings;
+}
+function deduplicateFindings(issues, maxPerRule) {
+  const counts = /* @__PURE__ */ new Map();
+  const result = [];
+  for (const iss of issues) {
+    const count = counts.get(iss.code) ?? 0;
+    if (count < maxPerRule) {
+      result.push(iss);
+    }
+    counts.set(iss.code, count + 1);
+  }
+  for (const [code, count] of counts) {
+    if (count > maxPerRule) {
+      result.push({
+        code,
+        severity: "info",
+        category: "compatibility",
+        message: `${count - maxPerRule} additional "${code}" finding(s) suppressed (max ${maxPerRule} per rule)`,
+        rule: `audit.dedup.${code}`
+      });
+    }
+  }
+  return result;
+}
+async function validateDesignAudit(root, config) {
+  const auditConfig = resolveAuditConfig(config);
+  if (!auditConfig.enabled) return [];
+  const discussionDir = path52.join(root, config.paths.discussionDir);
+  const packRoot = await findLatestDiscussionPackDir(discussionDir);
+  if (!packRoot) return [];
+  const uiBearing = await isUiBearing(packRoot);
+  if (!uiBearing) return [];
+  const storyPath = path52.join(packRoot, "03_Story-Workshop.md");
+  const content = await readSafe(storyPath);
+  if (!content) return [];
+  const findings = [];
+  findings.push(...checkCtaHierarchy(content, auditConfig, "03_Story-Workshop.md"));
+  findings.push(...await checkTokenDrift(root, auditConfig, config));
+  const issues = findings.map((f) => findingToIssue(f, auditConfig.qualityProfile));
+  return deduplicateFindings(issues, auditConfig.maxDuplicateFindingsPerRule);
+}
+
+// src/core/validators/designSlop.ts
+import { existsSync as existsSync2 } from "fs";
+import { readFile as readFile41 } from "fs/promises";
+import path53 from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
+function isValidSlopPattern(rule) {
+  if (typeof rule !== "object" || rule === null) return false;
+  const r = rule;
+  return typeof r.id === "string" && typeof r.category === "string" && typeof r.tier === "number" && Array.isArray(r.scopes) && typeof r.match === "string" && typeof r.message === "string" && typeof r.guidance === "string";
+}
+async function loadSlopPatterns(jsonPath) {
+  const raw = await readFile41(jsonPath, "utf-8");
+  const parsed = JSON.parse(raw);
+  if (!Array.isArray(parsed)) return [];
+  return parsed.filter((r) => isValidSlopPattern(r));
+}
+function defaultPatternsPath() {
+  const base = import.meta.url;
+  const basePath = base.startsWith("file:") ? fileURLToPath4(base) : base;
+  const baseDir = path53.dirname(basePath);
+  const candidates = [
+    path53.join(baseDir, "designSlopPatterns.json"),
+    path53.resolve(baseDir, "../../../assets/validators/designSlopPatterns.json"),
+    path53.resolve(baseDir, "../../assets/validators/designSlopPatterns.json")
+  ];
+  for (const c of candidates) {
+    if (existsSync2(c)) return c;
+  }
+  return candidates[0];
+}
+async function validateDesignSlop(root, config) {
+  const auditConfig = resolveAuditConfig(config);
+  if (!auditConfig.enabled) return [];
+  if (!auditConfig.slopDetection) return [];
+  const discussionDir = path53.join(root, config.paths.discussionDir);
+  const packRoot = await findLatestDiscussionPackDir(discussionDir);
+  if (!packRoot) return [];
+  const uiBearing = await isUiBearing(packRoot);
+  if (!uiBearing) return [];
+  let patterns;
+  try {
+    patterns = await loadSlopPatterns(defaultPatternsPath());
+  } catch {
+    return [];
+  }
+  const findings = [];
+  const seenRules = /* @__PURE__ */ new Set();
+  for (const pattern of patterns) {
+    let regex;
+    try {
+      regex = new RegExp(pattern.match, "gi");
+    } catch {
+      continue;
+    }
+    for (const scope of pattern.scopes) {
+      const filePath = path53.join(packRoot, scope);
+      const content = await readSafe(filePath);
+      if (!content) continue;
+      if (regex.test(content) && !seenRules.has(pattern.id)) {
+        seenRules.add(pattern.id);
+        findings.push({
+          ruleId: pattern.id,
+          dimension: pattern.category,
+          severityTier: pattern.tier,
+          message: pattern.message,
+          why: `Slop pattern "${pattern.id}" matched in ${scope}`,
+          evidence: [],
+          guidance: pattern.guidance,
+          file: scope
+        });
+      }
+    }
+  }
+  return findings.map((f) => findingToIssue(f, auditConfig.qualityProfile, "slop"));
+}
+
 // src/core/validate.ts
 var UIUX_VALIDATION_BUDGET_MS = 2e3;
 async function validateProject(root, configResult, options = {}) {
@@ -15179,7 +15820,9 @@ async function validateProject(root, configResult, options = {}) {
     () => validateBpApDb(root, config),
     () => validateUiDefinitionConsistency(root, config),
     () => validateResearchSummary(root, config),
-    () => validateAgentDefinition(root, config)
+    () => validateAgentDefinition(root, config),
+    () => validateDesignAudit(root, config),
+    () => validateDesignSlop(root, config)
   ];
   const uiuxIssueGroups = await Promise.all(uiuxValidators.map((validator) => validator()));
   const uiuxIssues = [...platformResult.issues, ...uiuxIssueGroups.flat()];
@@ -15266,15 +15909,15 @@ var REPORT_GUARDRAILS_MAX = 20;
 var REPORT_TEST_STRATEGY_SAMPLE_LIMIT = 20;
 var SC_TAG_RE4 = /^SC-\d{4}-\d{4}$/;
 async function createReportData(root, validation, configResult) {
-  const resolvedRoot = path52.resolve(root);
+  const resolvedRoot = path54.resolve(root);
   const resolved = configResult ?? await loadConfig(resolvedRoot);
   const config = resolved.config;
   const configPath = resolved.configPath;
   const specsRoot = resolvePath(resolvedRoot, config, "specsDir");
   const contractsRoot = resolvePath(resolvedRoot, config, "contractsDir");
-  const apiRoot = path52.join(contractsRoot, "api");
-  const uiRoot = path52.join(contractsRoot, "ui");
-  const dbRoot = path52.join(contractsRoot, "db");
+  const apiRoot = path54.join(contractsRoot, "api");
+  const uiRoot = path54.join(contractsRoot, "ui");
+  const dbRoot = path54.join(contractsRoot, "db");
   const srcRoot = resolvePath(resolvedRoot, config, "srcDir");
   const testsRoot = resolvePath(resolvedRoot, config, "testsDir");
   const specEntries = await collectSpecEntries(specsRoot);
@@ -15602,6 +16245,8 @@ function formatReportMarkdown(data, options = {}) {
   lines.push("");
   lines.push("- [Compatibility Issues](#compatibility-issues)");
   lines.push("- [Change Issues](#change-issues)");
+  lines.push("- [Design Audit Findings](#design-audit-findings)");
+  lines.push("- [Slop Guardrails Findings](#slop-guardrails-findings)");
   lines.push("- [Change Type](#change-type)");
   lines.push("- [Waivers](#waivers)");
   lines.push("- [Decision Guardrails](#decision-guardrails)");
@@ -15750,6 +16395,46 @@ function formatReportMarkdown(data, options = {}) {
   lines.push("### Issues");
   lines.push("");
   lines.push(...formatIssueCards(issuesByCategory.change));
+  const auditIssues = data.issues.filter((i) => /^QFAI-AUD-/.test(i.code));
+  if (auditIssues.length > 0) {
+    lines.push("## Design Audit Findings");
+    lines.push("");
+    const byDimension = /* @__PURE__ */ new Map();
+    for (const iss of auditIssues) {
+      const dim = iss.rule?.replace(/^audit\./, "").split(".")[0] ?? "unknown";
+      const group = byDimension.get(dim) ?? [];
+      group.push(iss);
+      byDimension.set(dim, group);
+    }
+    for (const [dim, dimIssues] of byDimension) {
+      lines.push(`### ${dim}`);
+      lines.push("");
+      for (const iss of dimIssues) {
+        lines.push(`- **${iss.severity.toUpperCase()}** [${iss.code}] ${iss.message}`);
+      }
+      lines.push("");
+    }
+  }
+  const slopIssues = data.issues.filter((i) => /^SLP-/.test(i.code));
+  if (slopIssues.length > 0) {
+    lines.push("## Slop Guardrails Findings");
+    lines.push("");
+    const byCategory = /* @__PURE__ */ new Map();
+    for (const iss of slopIssues) {
+      const cat = iss.rule?.replace(/^slop\./, "").split(".")[0] ?? "unknown";
+      const group = byCategory.get(cat) ?? [];
+      group.push(iss);
+      byCategory.set(cat, group);
+    }
+    for (const [cat, catIssues] of byCategory) {
+      lines.push(`### ${cat}`);
+      lines.push("");
+      for (const iss of catIssues) {
+        lines.push(`- **${iss.severity.toUpperCase()}** [${iss.code}] ${iss.message}`);
+      }
+      lines.push("");
+    }
+  }
   lines.push("## Change Type");
   lines.push("");
   lines.push("### Summary");
@@ -16121,6 +16806,20 @@ function formatReportMarkdown(data, options = {}) {
   } else {
     lines.push("- issue \u306F\u691C\u51FA\u3055\u308C\u307E\u305B\u3093\u3067\u3057\u305F\u3002\u904B\u7528\u30C6\u30F3\u30D7\u30EC\u306B\u6CBF\u3063\u3066\u7D99\u7D9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002");
   }
+  const renderEvidenceIssues = data.issues.filter(
+    (item) => ["QFAI-PROT-101", "QFAI-PROT-244", "QFAI-PROT-245"].includes(item.code)
+  );
+  if (renderEvidenceIssues.length > 0) {
+    lines.push(
+      "- render evidence \u304C\u4E0D\u8DB3\u307E\u305F\u306F\u4E0D\u5B8C\u5168\u3067\u3059\u3002viewport coverage \u3068 artifact path \u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
+    );
+    lines.push(
+      "- recover: `qfai prototyping --autogen-ui-fidelity --render-evidence --viewports desktop,mobile` \u3092\u5B9F\u884C\u3057\u3001`.qfai/evidence/prototyping.json` \u3068 render bundle \u3092\u66F4\u65B0\u3057\u307E\u3059\u3002"
+    );
+    lines.push(
+      "- why it matters: render evidence \u306F viewport coverage \u3068 missing artifact \u306E\u5207\u308A\u5206\u3051\u306B\u4F7F\u308F\u308C\u3001strict/high profile \u3067\u306F gate \u306B\u5F71\u97FF\u3057\u307E\u3059\u3002"
+    );
+  }
   lines.push("- \u5909\u66F4\u5185\u5BB9\u30FB\u53D7\u5165\u89B3\u70B9\u306F `.qfai/specs/*/18_delta.md` \u306B\u8A18\u9332\u3057\u307E\u3059\u3002");
   lines.push("- \u53C2\u7167\u30EB\u30FC\u30EB\u306E\u6B63\u672C: `.qfai/assistant/instructions/constitution.md`");
   return lines.join("\n");
@@ -16155,7 +16854,7 @@ async function collectChangeTypeSummary(specsRoot) {
   };
   const deltaFiles = await collectDeltaFiles(specsRoot);
   for (const deltaFile of deltaFiles) {
-    const text = await readFile40(deltaFile, "utf-8");
+    const text = await readFile42(deltaFile, "utf-8");
     const parsed = parseDeltaV1(text);
     for (const entry of parsed.entries) {
       if (!entry.meta) {
@@ -16192,7 +16891,7 @@ async function collectSpecContractRefs(specFiles, contractIdList) {
     idToSpecs.set(contractId, /* @__PURE__ */ new Set());
   }
   for (const file of specFiles) {
-    const text = await readFile40(file, "utf-8");
+    const text = await readFile42(file, "utf-8");
     const parsed = parseSpec(text, file);
     const specKey = parsed.specId;
     if (!specKey) {
@@ -16229,7 +16928,7 @@ async function collectIds(files) {
     result[prefix] = /* @__PURE__ */ new Set();
   }
   for (const file of files) {
-    const text = await readFile40(file, "utf-8");
+    const text = await readFile42(file, "utf-8");
     for (const prefix of ID_PREFIXES) {
       const ids = extractIds(text, prefix);
       ids.forEach((id) => result[prefix].add(id));
@@ -16244,7 +16943,7 @@ async function collectIds(files) {
 async function collectUpstreamIds(files) {
   const ids = /* @__PURE__ */ new Set();
   for (const file of files) {
-    const text = await readFile40(file, "utf-8");
+    const text = await readFile42(file, "utf-8");
     extractAllIds(text).forEach((id) => ids.add(id));
   }
   return ids;
@@ -16265,7 +16964,7 @@ async function evaluateTraceability(upstreamIds, srcRoot, testsRoot) {
   }
   const pattern = buildIdPattern(Array.from(upstreamIds));
   for (const file of targetFiles) {
-    const text = await readFile40(file, "utf-8");
+    const text = await readFile42(file, "utf-8");
     if (pattern.test(text)) {
       return true;
     }
@@ -16384,7 +17083,7 @@ function normalizeScSources(root, sources) {
 async function countScenarios(scenarioFiles) {
   let total = 0;
   for (const file of scenarioFiles) {
-    const text = await readFile40(file, "utf-8");
+    const text = await readFile42(file, "utf-8");
     const { document, errors } = parseScenarioDocument(text, file);
     if (!document || errors.length > 0) {
       continue;
@@ -16415,7 +17114,7 @@ async function collectTestStrategy(scenarioFiles, root, config, limit) {
   let totalScenarios = 0;
   let e2eCount = 0;
   for (const file of scenarioFiles) {
-    const text = await readFile40(file, "utf-8");
+    const text = await readFile42(file, "utf-8");
     const { document, errors } = parseScenarioDocument(text, file);
     if (!document || errors.length > 0) {
       continue;
@@ -16503,10 +17202,10 @@ function buildHotspots(issues) {
 async function collectTddCoverage(entries) {
   const specs = [];
   for (const entry of entries) {
-    const testCasesPath = path52.join(entry.dir, "06_Test-Cases.md");
+    const testCasesPath = path54.join(entry.dir, "06_Test-Cases.md");
     let tcContent;
     try {
-      tcContent = await readFile40(testCasesPath, "utf-8");
+      tcContent = await readFile42(testCasesPath, "utf-8");
     } catch {
       continue;
     }
@@ -16538,10 +17237,10 @@ async function collectTddCoverage(entries) {
       });
       continue;
     }
-    const tddListPath = path52.join(entry.dir, "tdd", "test-list.md");
+    const tddListPath = path54.join(entry.dir, "tdd", "test-list.md");
     let tddContent;
     try {
-      tddContent = await readFile40(tddListPath, "utf-8");
+      tddContent = await readFile42(tddListPath, "utf-8");
     } catch {
       specs.push({
         specNumber: entry.specNumber,