sdd-agent-platform 0.3.0 → 0.4.1

package/node_modules/@sdd-agent-platform/core/src/work-units/runtime.test.ts

@@ -0,0 +1,88 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+
+import { WORK_UNIT_CONTRACT_VERSION, type RuntimeRef, type RuntimeScope } from '../contracts.js';
+import { initProject } from '../config/init-project.js';
+import type { WorkUnit } from './contracts.js';
+import { canTransitionWorkUnit, recordWorkUnitProjection, readWorkUnitProjection, transitionWorkUnit, validateWorkUnit, workUnitBlocksGate } from './runtime.js';
+
+const scope: RuntimeScope = { branch: 'master', taskId: 'PHASE8-8', runId: 'run-1' };
+const contextRef: RuntimeRef = { kind: 'projection', ref: 'sdd-context-package:PHASE8-8' };
+const evidenceRef: RuntimeRef = { kind: 'evidence', ref: 'artifacts/phase8-work-unit-validation.md#AC-1' };
+
+test('work unit state machine accepts legal transitions and rejects terminal mutation', () => {
+  const running = transitionWorkUnit(workUnit({ status: 'pending' }), 'running');
+  const completed = transitionWorkUnit(running.workUnit, 'completed', { completedAt: '2026-05-18T00:01:00.000Z' });
+  const reopened = transitionWorkUnit(completed.workUnit, 'running');
+
+  assert.equal(canTransitionWorkUnit('pending', 'running'), true);
+  assert.equal(running.valid, true);
+  assert.equal(completed.valid, true);
+  assert.equal(completed.workUnit.status, 'completed');
+  assert.equal(completed.workUnit.completedAt, '2026-05-18T00:01:00.000Z');
+  assert.equal(canTransitionWorkUnit('completed', 'running'), false);
+  assert.equal(reopened.valid, false);
+  assert.match(reopened.issues[0], /Illegal work unit transition/);
+});
+
+test('work unit validation enforces lifecycle authority and blocking gates', () => {
+  const subagentOwner = validateWorkUnit(workUnit({ type: 'subagent', authority: 'stage-owner', blocking: true, requiredBefore: 'handoff' }));
+  const coMainOwner = validateWorkUnit(workUnit({ type: 'co-main-agent', authority: 'stage-owner', blocking: true, requiredBefore: 'handoff' }));
+  const nonBlockingGate = validateWorkUnit(workUnit({ blocking: false, requiredBefore: 'handoff' }));
+  const blockingWithoutGate = validateWorkUnit(workUnit({ blocking: true, requiredBefore: 'never' }));
+
+  assert.equal(subagentOwner.valid, false);
+  assert.equal(subagentOwner.issues.some((issue) => /Subagent work units must be non-authoritative/.test(issue)), true);
+  assert.equal(coMainOwner.valid, false);
+  assert.equal(coMainOwner.issues.some((issue) => /Only main-agent work units/.test(issue)), true);
+  assert.equal(nonBlockingGate.valid, false);
+  assert.equal(blockingWithoutGate.valid, false);
+});
+
+test('work unit blocking gate semantics distinguish blocking and non-blocking work', () => {
+  assert.equal(workUnitBlocksGate(workUnit({ blocking: true, requiredBefore: 'handoff', status: 'running' }), 'handoff'), true);
+  assert.equal(workUnitBlocksGate(workUnit({ blocking: true, requiredBefore: 'handoff', status: 'completed' }), 'handoff'), false);
+  assert.equal(workUnitBlocksGate(workUnit({ blocking: false, requiredBefore: 'never', status: 'running' }), 'handoff'), false);
+});
+
+test('work unit projections can be written and read', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-work-unit-runtime-'));
+  try {
+    await initProject(root);
+    const unit = workUnit({ status: 'running', blocking: true, requiredBefore: 'handoff' });
+
+    const write = await recordWorkUnitProjection(root, unit);
+    const restored = await readWorkUnitProjection(root, scope, unit.id);
+
+    assert.equal(write.status, 'created');
+    assert.equal(restored?.payload.id, unit.id);
+    assert.equal(restored?.payload.status, 'running');
+    assert.equal(restored?.payload.requiredBefore, 'handoff');
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+function workUnit(overrides: Partial<WorkUnit> = {}): WorkUnit {
+  return {
+    contract: WORK_UNIT_CONTRACT_VERSION,
+    id: 'wu-phase8-8',
+    scope,
+    stageRunId: 'stage-do',
+    type: 'main-agent',
+    name: 'implement phase8 runtime',
+    purpose: 'Record bounded runtime work without transferring lifecycle ownership.',
+    status: 'pending',
+    blocking: true,
+    authority: 'stage-owner',
+    requiredBefore: 'stage-output',
+    contextRef,
+    outputRefs: [],
+    evidenceRefs: [evidenceRef],
+    createdAt: '2026-05-18T00:00:00.000Z',
+    ...overrides
+  };
+}

package/node_modules/@sdd-agent-platform/core/src/work-units/runtime.ts

@@ -0,0 +1,112 @@
+import { createHash } from 'node:crypto';
+
+import type { RuntimeProjectionEnvelope, RuntimeScope } from '../contracts.js';
+import { readRuntimeProjectionEnvelope, recordRuntimeProjectionEnvelope, type RuntimeProjectionEnvelopeWriteResult } from '../storage/runtime-store.js';
+import type { WorkUnit, WorkUnitStatus } from './contracts.js';
+
+export const WORK_UNIT_RUNTIME_PRODUCER_VERSION = 'phase8-work-unit-runtime-v1';
+export const WORK_UNIT_PROJECTION_TYPE = 'phase8_work_unit';
+
+const WORK_UNIT_TRANSITIONS: Record<WorkUnitStatus, readonly WorkUnitStatus[]> = {
+  pending: ['running', 'blocked', 'cancelled'],
+  running: ['completed', 'blocked', 'failed', 'cancelled'],
+  blocked: ['running', 'cancelled'],
+  completed: [],
+  failed: [],
+  cancelled: []
+};
+
+export interface WorkUnitValidationResult {
+  valid: boolean;
+  issues: string[];
+}
+
+export interface WorkUnitTransitionResult extends WorkUnitValidationResult {
+  workUnit: WorkUnit;
+}
+
+export function canTransitionWorkUnit(from: WorkUnitStatus, to: WorkUnitStatus): boolean {
+  return WORK_UNIT_TRANSITIONS[from].includes(to);
+}
+
+export function transitionWorkUnit(workUnit: WorkUnit, status: WorkUnitStatus, options: { completedAt?: string } = {}): WorkUnitTransitionResult {
+  if (!canTransitionWorkUnit(workUnit.status, status)) {
+    return {
+      valid: false,
+      issues: [`Illegal work unit transition ${workUnit.status} -> ${status} for ${workUnit.id}.`],
+      workUnit
+    };
+  }
+  const next: WorkUnit = {
+    ...workUnit,
+    status,
+    completedAt: status === 'completed' || status === 'failed' || status === 'cancelled' ? options.completedAt ?? new Date().toISOString() : workUnit.completedAt
+  };
+  return { valid: validateWorkUnit(next).valid, issues: validateWorkUnit(next).issues, workUnit: next };
+}
+
+export function validateWorkUnit(workUnit: WorkUnit): WorkUnitValidationResult {
+  const issues: string[] = [];
+  if (workUnit.type === 'subagent' && workUnit.authority !== 'non-authoritative') {
+    issues.push('Subagent work units must be non-authoritative.');
+  }
+  if (workUnit.authority === 'stage-owner' && workUnit.type !== 'main-agent') {
+    issues.push('Only main-agent work units can own a lifecycle stage.');
+  }
+  if (!workUnit.blocking && workUnit.requiredBefore !== 'never') {
+    issues.push('Non-blocking work units cannot declare a required-before gate.');
+  }
+  if (workUnit.blocking && workUnit.requiredBefore === 'never') {
+    issues.push('Blocking work units must declare the gate they block.');
+  }
+  return { valid: issues.length === 0, issues };
+}
+
+export function workUnitBlocksGate(workUnit: WorkUnit, gate: WorkUnit['requiredBefore']): boolean {
+  return workUnit.blocking && workUnit.requiredBefore === gate && workUnit.status !== 'completed';
+}
+
+export function workUnitScopeKey(scope: RuntimeScope, workUnitId: string): string {
+  return [scope.branch, scope.taskId ?? 'all', scope.runId ?? 'none', scope.changeRef ?? 'none', workUnitId].join(':');
+}
+
+export async function recordWorkUnitProjection(projectRoot: string, workUnit: WorkUnit): Promise<RuntimeProjectionEnvelopeWriteResult<WorkUnit>> {
+  return recordRuntimeProjectionEnvelope(projectRoot, {
+    projectionType: WORK_UNIT_PROJECTION_TYPE,
+    scopeKey: workUnitScopeKey(workUnit.scope, workUnit.id),
+    inputHash: workUnitInputHash(workUnit),
+    producer: 'phase8-work-unit-runtime',
+    producerVersion: WORK_UNIT_RUNTIME_PRODUCER_VERSION,
+    generatedAt: workUnit.completedAt ?? workUnit.createdAt,
+    payload: workUnit
+  });
+}
+
+export async function readWorkUnitProjection(projectRoot: string, scope: RuntimeScope, workUnitId: string): Promise<RuntimeProjectionEnvelope<WorkUnit> | null> {
+  return readRuntimeProjectionEnvelope(projectRoot, WORK_UNIT_PROJECTION_TYPE, workUnitScopeKey(scope, workUnitId));
+}
+
+function workUnitInputHash(workUnit: WorkUnit): string {
+  return stableHash(JSON.stringify({
+    contract: workUnit.contract,
+    id: workUnit.id,
+    scope: workUnit.scope,
+    stageRunId: workUnit.stageRunId,
+    type: workUnit.type,
+    name: workUnit.name,
+    purpose: workUnit.purpose,
+    status: workUnit.status,
+    blocking: workUnit.blocking,
+    authority: workUnit.authority,
+    requiredBefore: workUnit.requiredBefore,
+    contextRef: workUnit.contextRef,
+    outputRefs: workUnit.outputRefs,
+    evidenceRefs: workUnit.evidenceRefs,
+    createdAt: workUnit.createdAt,
+    completedAt: workUnit.completedAt ?? null
+  }));
+}
+
+function stableHash(value: string): string {
+  return createHash('sha256').update(value, 'utf8').digest('hex');
+}

package/node_modules/@sdd-agent-platform/core/src/work-units.ts

@@ -0,0 +1,2 @@
+export * from './work-units/contracts.js';
+export * from './work-units/runtime.js';

package/node_modules/@sdd-agent-platform/core/src/workflow-gate/evidence-packet.ts

@@ -0,0 +1,196 @@
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { WORKFLOW_GATE_RUNTIME_CONTRACT_VERSION } from '../contracts.js';
+import { listRuntimeArtifactPayloads, listRuntimeDurableGaps, listRuntimeFanInEvidenceSets, listRuntimeLlmAdvisorAssessments, listRuntimeSyncBackDecisions, recordRuntimeWorkflowGateDecision, runtimeScopedId, type RuntimeArtifactPayloadRecord } from '../storage/runtime-store.js';
+import { getEvidenceAttachmentPath } from '../runtime-paths.js';
+import { readAllRunStates } from '../run-state/run-state.js';
+import { affectedFileConflictsForSelectedRuns } from '../workflow-state/affected-file-conflicts.js';
+import { resolveWorkflowState } from '../workflow-state/resolve.js';
+import { evaluateWorkflowGateHardChecks } from './hard-checks.js';
+import { synthesizeWorkflowGateDecision } from './policy.js';
+import type { WorkflowGateDecision, WorkflowGateDecisionKind, WorkflowGateEvidencePacket } from './types.js';
+
+export async function buildWorkflowGateEvidencePacket(projectRoot: string, input: { branch?: string | null; taskId?: string | null; runId?: string | null; decisionKind: WorkflowGateDecisionKind; waveRunId?: string | null; taskIds?: string[]; runIds?: string[]; evidenceRefs?: string[] }): Promise<WorkflowGateEvidencePacket> {
+  const workflow = await resolveWorkflowState(projectRoot, { branch: input.branch, branchSource: input.branch ? 'cli_option' : undefined, taskId: input.taskId ?? null });
+  const taskId = input.taskId ?? workflow.latestRun?.taskId ?? workflow.model.tasks[0]?.id ?? null;
+  const selection = taskId ? workflow.latestEligibleRunsByTask.find((candidate) => candidate.taskId === taskId) ?? null : null;
+  const runId = input.runId ?? selection?.selected?.runId ?? workflow.latestRun?.runId ?? null;
+  const scopedTaskIds = sortedUnique(input.taskIds ?? (taskId ? [taskId] : []));
+  const scopedLatestEligibleSelections = scopedTaskIds.length > 0
+    ? scopedTaskIds.map((scopedTaskId) => workflow.latestEligibleRunsByTask.find((candidate) => candidate.taskId === scopedTaskId) ?? emptyLatestEligibleSelection(workflow.branch, scopedTaskId))
+    : (selection ? [selection] : []);
+  const scopedRunIds = sortedUnique(input.runIds ?? scopedLatestEligibleSelections.flatMap((candidate) => candidate.selected ? [candidate.selected.runId] : []));
+  const workflowScope = {
+    waveRunId: input.waveRunId ?? null,
+    taskIds: scopedTaskIds,
+    runIds: scopedRunIds.length > 0 ? scopedRunIds : sortedUnique(runId ? [runId] : []),
+    evidenceRefs: sortedUnique(input.evidenceRefs ?? [])
+  };
+  const scopedTasks = workflowScope.taskIds.length > 0
+    ? workflow.model.tasks.filter((candidate) => workflowScope.taskIds.includes(candidate.id))
+    : workflow.model.tasks.filter((candidate) => candidate.id === taskId);
+  const runtimeInputs = await loadRuntimeGateInputs(projectRoot, workflow.branch, workflowScope.taskIds, workflowScope.runIds);
+  const scopedAffectedFileConflicts = await loadScopedAffectedFileConflicts(projectRoot, workflow.affectedFileConflicts, workflowScope.runIds);
+  const packetBase = {
+    packetId: runtimeScopedId(WORKFLOW_GATE_RUNTIME_CONTRACT_VERSION, workflow.branch, taskId ?? 'none', runId ?? 'none', input.decisionKind),
+    generatedAt: new Date().toISOString(),
+    decisionKind: input.decisionKind,
+    partition: workflow.branch,
+    taskId,
+    runId,
+    documents: workflow.documents,
+    latestEligibleSelection: selection,
+    latestEligibleSelections: scopedLatestEligibleSelections,
+    workflowScope,
+    runtimeHealth: runtimeInputs.runtimeHealth,
+    durableGaps: runtimeInputs.durableGaps,
+    dependencyBlockers: workflow.dependencyBlockers,
+    affectedFileConflicts: scopedAffectedFileConflicts,
+    syncBackDecision: runtimeInputs.syncBackDecisions[0] ?? null,
+    syncBackDecisions: runtimeInputs.syncBackDecisions,
+    fanInEvidenceSets: runtimeInputs.fanInEvidenceSets,
+    advisorAssessments: runtimeInputs.advisorAssessments,
+    canonicalEvidenceRefs: sortedUnique([...workflowScope.evidenceRefs, ...runtimeInputs.payloads.filter((payload) => payload.status === 'active').map((payload) => payload.logicalRef)]),
+    requiredArtifactRefs: sortedUnique(scopedTasks.flatMap((task) => task.requiredArtifacts)),
+    artifactPayloadHealth: await inspectArtifactPayloadHealth(projectRoot, runtimeInputs.payloads.filter((payload) => payload.status === 'active'))
+  };
+  return {
+    ...packetBase,
+    hardChecks: evaluateWorkflowGateHardChecks(packetBase)
+  };
+}
+
+function emptyLatestEligibleSelection(partition: string, taskId: string): WorkflowGateEvidencePacket['latestEligibleSelections'][number] {
+  return {
+    partition,
+    taskId,
+    selected: null,
+    candidates: [],
+    rejected: []
+  };
+}
+
+async function loadScopedAffectedFileConflicts(projectRoot: string, fallback: WorkflowGateEvidencePacket['affectedFileConflicts'], runIds: string[]): Promise<WorkflowGateEvidencePacket['affectedFileConflicts']> {
+  if (runIds.length === 0) {
+    return fallback;
+  }
+  const states = await readAllRunStates(projectRoot);
+  const selectedRuns = states.filter((state) => runIds.includes(state.runId));
+  return affectedFileConflictsForSelectedRuns(states, selectedRuns);
+}
+
+async function loadRuntimeGateInputs(projectRoot: string, partition: string, taskIds: string[], runIds: string[]): Promise<{
+  runtimeHealth: WorkflowGateEvidencePacket['runtimeHealth'];
+  durableGaps: WorkflowGateEvidencePacket['durableGaps'];
+  syncBackDecisions: NonNullable<WorkflowGateEvidencePacket['syncBackDecision']>[];
+  fanInEvidenceSets: WorkflowGateEvidencePacket['fanInEvidenceSets'];
+  advisorAssessments: WorkflowGateEvidencePacket['advisorAssessments'];
+  payloads: RuntimeArtifactPayloadRecord[];
+}> {
+  try {
+    const runtimeScopes = scopedRuntimeQueries(taskIds, runIds);
+    const [durableGapResults, syncBackDecisionResults, fanInEvidenceSetResults, advisorAssessmentResults, payloadResults] = await Promise.all([
+      Promise.all(runtimeScopes.map((scope) => listRuntimeDurableGaps(projectRoot, { partition, taskId: scope.taskId, runId: scope.runId, status: 'open_terminal' }))),
+      Promise.all(runIds.map((scopedRunId) => listRuntimeSyncBackDecisions(projectRoot, scopedRunId))),
+      Promise.all(runtimeScopes.map((scope) => listRuntimeFanInEvidenceSets(projectRoot, { partition, taskId: scope.taskId, runId: scope.runId }))),
+      Promise.all(runtimeScopes.map((scope) => listRuntimeLlmAdvisorAssessments(projectRoot, { partition, taskId: scope.taskId, runId: scope.runId }))),
+      Promise.all(runIds.map((scopedRunId) => listRuntimeArtifactPayloads(projectRoot, { runId: scopedRunId })))
+    ]);
+    return {
+      runtimeHealth: { status: 'ok', issues: [] },
+      durableGaps: uniqueBy(durableGapResults.flat(), (gap) => gap.gapId),
+      syncBackDecisions: uniqueBy(syncBackDecisionResults.flat(), (decision) => decision.decisionId),
+      fanInEvidenceSets: uniqueBy(fanInEvidenceSetResults.flat(), (evidenceSet) => evidenceSet.fanInId),
+      advisorAssessments: uniqueBy(advisorAssessmentResults.flat(), (assessment) => assessment.assessmentId),
+      payloads: uniqueBy(payloadResults.flat(), (payload) => payload.payloadId)
+    };
+  } catch (error) {
+    return {
+      runtimeHealth: { status: 'unavailable', issues: [messageFromError(error)] },
+      durableGaps: [],
+      syncBackDecisions: [],
+      fanInEvidenceSets: [],
+      advisorAssessments: [],
+      payloads: []
+    };
+  }
+}
+
+function scopedRuntimeQueries(taskIds: string[], runIds: string[]): Array<{ taskId: string | null; runId: string | null }> {
+  if (taskIds.length === 0 && runIds.length === 0) {
+    return [{ taskId: null, runId: null }];
+  }
+  if (taskIds.length === 0) {
+    return runIds.map((scopedRunId) => ({ taskId: null, runId: scopedRunId }));
+  }
+  if (runIds.length === 0) {
+    return taskIds.map((scopedTaskId) => ({ taskId: scopedTaskId, runId: null }));
+  }
+  return uniqueBy([
+    ...taskIds.flatMap((scopedTaskId) => runIds.map((scopedRunId) => ({ taskId: scopedTaskId, runId: scopedRunId }))),
+    ...taskIds.map((scopedTaskId) => ({ taskId: scopedTaskId, runId: null })),
+    ...runIds.map((scopedRunId) => ({ taskId: null, runId: scopedRunId }))
+  ], (scope) => `${scope.taskId ?? 'none'}:${scope.runId ?? 'none'}`);
+}
+
+function uniqueBy<T>(items: T[], keyOf: (item: T) => string): T[] {
+  const seen = new Set<string>();
+  return items.filter((item) => {
+    const key = keyOf(item);
+    if (seen.has(key)) {
+      return false;
+    }
+    seen.add(key);
+    return true;
+  });
+}
+
+async function inspectArtifactPayloadHealth(projectRoot: string, payloads: RuntimeArtifactPayloadRecord[]): Promise<WorkflowGateEvidencePacket['artifactPayloadHealth']> {
+  return Promise.all(payloads.map(async (payload) => {
+    try {
+      const raw = await readFile(getEvidenceAttachmentPath(projectRoot, payload.branchSlug, payload.physicalPayloadPath), 'utf8');
+      const actualDigest = hashDocumentContent(raw);
+      return {
+        payloadId: payload.payloadId,
+        logicalRef: payload.logicalRef,
+        physicalPayloadPath: payload.physicalPayloadPath,
+        expectedDigest: payload.digest,
+        actualDigest,
+        status: actualDigest === payload.digest ? 'ok' as const : 'digest_drift' as const
+      };
+    } catch {
+      return {
+        payloadId: payload.payloadId,
+        logicalRef: payload.logicalRef,
+        physicalPayloadPath: payload.physicalPayloadPath,
+        expectedDigest: payload.digest,
+        actualDigest: null,
+        status: 'missing' as const
+      };
+    }
+  }));
+}
+
+function hashDocumentContent(raw: string): string {
+  return createHash('sha256').update(raw.replace(/\r\n/g, '\n'), 'utf8').digest('hex');
+}
+
+export async function evaluateAndRecordWorkflowGateDecision(projectRoot: string, input: { branch?: string | null; taskId?: string | null; runId?: string | null; decisionKind: WorkflowGateDecisionKind; waveRunId?: string | null; taskIds?: string[]; runIds?: string[]; evidenceRefs?: string[] }): Promise<{ packet: WorkflowGateEvidencePacket; decision: WorkflowGateDecision }> {
+  const packet = await buildWorkflowGateEvidencePacket(projectRoot, input);
+  const decision = synthesizeWorkflowGateDecision(packet);
+  try {
+    await recordRuntimeWorkflowGateDecision(projectRoot, decision);
+  } catch (error) {
+    if (packet.runtimeHealth.status === 'ok') {
+      throw error;
+    }
+  }
+  return { packet, decision };
+}
+function sortedUnique(values: string[]): string[] {
+  return [...new Set(values.filter(Boolean))].sort();
+}
+
+function messageFromError(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}

package/node_modules/@sdd-agent-platform/core/src/workflow-gate/hard-checks.test.ts

@@ -0,0 +1,171 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { STAGE_TEAM_RUNTIME_CONTRACT_VERSION } from '../contracts.js';
+import { evaluateWorkflowGateHardChecks } from './hard-checks.js';
+import type { WorkflowGateEvidencePacket } from './types.js';
+
+const generatedAt = '2026-01-01T00:00:00.000Z';
+
+test('workflow gate hard checks block deterministic workflow violations', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({
+    durableGaps: [{
+      gapId: 'gap-001',
+      partition: 'feature',
+      taskId: 'T1',
+      runId: 'run-001',
+      stage: 'test',
+      gate: 'ship',
+      source: 'runtime',
+      category: 'validation',
+      severity: 'blocking',
+      status: 'open',
+      message: 'Validation evidence is missing.',
+      recommendation: null,
+      evidenceRefs: ['artifacts/validation-T1.md'],
+      proposalRefs: [],
+      sourceRefs: [],
+      createdAt: generatedAt,
+      updatedAt: generatedAt,
+      closedAt: null,
+      payload: {}
+    }],
+    fanInEvidenceSets: [{
+      contract: STAGE_TEAM_RUNTIME_CONTRACT_VERSION,
+      fanInId: 'fanin-001',
+      partition: 'feature',
+      runId: 'run-001',
+      taskId: 'T1',
+      stage: 'test',
+      roleResultIds: [],
+      durableGapIds: [],
+      proposalRefs: [],
+      advisorAssessmentIds: [],
+      evidenceRefs: ['artifacts/validation-T1.md'],
+      canonicalEvidenceRefs: [],
+      gateInputOnly: false,
+      createdAt: generatedAt,
+      payload: {}
+    } as unknown as WorkflowGateEvidencePacket['fanInEvidenceSets'][number]],
+    requiredArtifactRefs: ['artifacts/required-T1.md']
+  }));
+
+  assert.deepEqual(checks.filter((check) => check.severity === 'blocked').map((check) => check.code).sort(), [
+    'authority_violation',
+    'durable_gap_blocking',
+    'missing_required_artifact'
+  ]);
+});
+
+test('workflow gate hard checks warn when no latest eligible run exists', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({ latestEligibleSelection: null }));
+
+  assert.equal(checks.some((check) => check.code === 'latest_eligible_missing' && check.severity === 'warning'), true);
+});
+
+test('workflow gate hard checks block missing and drifted artifact payloads', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({
+    artifactPayloadHealth: [
+      {
+        payloadId: 'payload-missing',
+        logicalRef: 'artifacts/validation-T1.md',
+        physicalPayloadPath: 'artifacts/validation-T1-run-old.md',
+        expectedDigest: 'expected',
+        actualDigest: null,
+        status: 'missing'
+      },
+      {
+        payloadId: 'payload-drift',
+        logicalRef: 'artifacts/review-T1.md',
+        physicalPayloadPath: 'artifacts/review-T1-run-old.md',
+        expectedDigest: 'expected',
+        actualDigest: 'actual',
+        status: 'digest_drift'
+      }
+    ]
+  }));
+
+  assert.deepEqual(checks.filter((check) => check.severity === 'blocked').map((check) => check.code).sort(), ['digest_drift', 'missing_payload']);
+});
+
+test('workflow gate hard checks block missing verify contract and runtime health failures', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({
+    runtimeHealth: { status: 'unavailable', issues: ['schema mismatch'] },
+    documents: {
+      ...packetInput().documents,
+      verifyExists: false,
+      verifyBasedOnTasksContractHash: null
+    } as WorkflowGateEvidencePacket['documents']
+  }));
+
+  assert.equal(checks.some((check) => check.code === 'schema_health_unavailable' && check.severity === 'blocked'), true);
+  assert.equal(checks.some((check) => check.code === 'missing_documents' && check.refs.includes('verify.md')), true);
+});
+
+function packetInput(overrides: Partial<Omit<WorkflowGateEvidencePacket, 'hardChecks'>> = {}): Omit<WorkflowGateEvidencePacket, 'hardChecks'> {
+  return {
+    packetId: 'packet-001',
+    generatedAt,
+    decisionKind: 'ship',
+    partition: 'feature',
+    taskId: 'T1',
+    runId: 'run-001',
+    documents: {
+      specExists: true,
+      planExists: true,
+      tasksExists: true,
+      verifyExists: true,
+      planStale: false,
+      tasksStale: false,
+      verifyStale: false,
+      specHash: 'spec-doc',
+      planHash: 'plan-doc',
+      tasksHash: 'tasks-doc',
+      verifyHash: 'verify-doc',
+      specContractHash: 'spec-contract',
+      planContractHash: 'plan-contract',
+      tasksContractHash: 'tasks-contract',
+      verifyContractHash: 'verify-contract',
+      planBasedOnSpecHash: 'spec-doc',
+      tasksBasedOnPlanHash: 'plan-doc',
+      verifyBasedOnTasksHash: 'tasks-doc',
+      planBasedOnSpecContractHash: 'spec-contract',
+      tasksBasedOnPlanContractHash: 'plan-contract',
+      verifyBasedOnTasksContractHash: 'tasks-contract'
+    } as WorkflowGateEvidencePacket['documents'],
+    latestEligibleSelection: {
+      partition: 'feature',
+      taskId: 'T1',
+      selected: {
+        partition: 'feature',
+        gitBranch: 'feature',
+        taskId: 'T1',
+        runId: 'run-001',
+        runStatus: 'completed',
+        validationStatus: 'pass',
+        syncBackStatus: 'not_created',
+        affectedFiles: [],
+        updatedAt: generatedAt,
+        compatibility: 'compatible',
+        eligibleForDefaultApply: true,
+        reasons: []
+      },
+      candidates: [],
+      rejected: []
+    },
+    latestEligibleSelections: [],
+    workflowScope: { waveRunId: null, taskIds: ['T1'], runIds: ['run-001'], evidenceRefs: [] },
+    runtimeHealth: { status: 'ok', issues: [] },
+    durableGaps: [],
+    dependencyBlockers: [],
+    affectedFileConflicts: [],
+    syncBackDecision: null,
+    syncBackDecisions: [],
+    fanInEvidenceSets: [],
+    advisorAssessments: [],
+    canonicalEvidenceRefs: [],
+    requiredArtifactRefs: [],
+    artifactPayloadHealth: [],
+    ...overrides
+  };
+}