sdd-agent-platform 0.4.0 → 0.4.1

package/node_modules/@sdd-agent-platform/core/src/router/route-projection.ts

@@ -1,12 +1,15 @@
+import type { AgentCapabilityCatalog, AgentCapabilityCatalogEntry, AgentCapabilityDomain, AgentCapabilityMaterialPack, AgentCapabilityStage } from '../registries/agent-capability-catalog.js';
 import { TOOL_PERMISSION_SPEC_VERSION } from '../contracts.js';
 import type { LifecycleAutonomyCeiling } from '../lifecycle/decision-gate.js';
 import type { SddTask, SddTaskGap } from '../sdd-docs/task-parser.js';
 import type {
+  AgentCapabilityRouteDecision,
   AgentProfileId,
   AgentRouterCategory,
   AgentRouterRejectedProfile,
   AgentRuntimeAdapterMapping,
   AgentRuntimeRoutingRule,
+  CapabilitySourceCatalogEntry,
   ModelPolicyContract,
   RuntimeRegistryEntrySource,
   ToolPermissionSpec
@@ -79,6 +82,56 @@ export function selectRequiredSkillCapabilities(task: SddTask, profile: AgentPro
   return [...capabilities];
 }
 
+export function buildAgentCapabilityRouteDecision(task: SddTask | null, category: AgentRouterCategory, autonomyCeiling: LifecycleAutonomyCeiling, registry: AgentSkillRuntimeRegistry, catalog: AgentCapabilityCatalog): AgentCapabilityRouteDecision {
+  if (!task) {
+    return {
+      authority: 'advisory_only',
+      selectedDomains: [],
+      selectedPacks: [],
+      rejectedExternalSources: rejectedCapabilitySources(registry.capabilitySources),
+      consideredExternalSources: consideredCapabilitySources(registry.capabilitySources),
+      evidenceRequirements: ['task metadata must exist before capability routing can select evidence requirements'],
+      permissionCeiling: autonomyCeiling
+    };
+  }
+  const stage = routeCapabilityStage(task, category);
+  const text = taskSignalText(task);
+  const selectedCapabilities = catalog.capabilities.filter((capability) => capability.domainGroup === 'professional' && capabilityStageFits(capability, stage, task, text) && capabilityMatchesTask(capability, task, text));
+  const effectiveCapabilities = selectedCapabilities.length > 0 ? selectedCapabilities : fallbackCapabilitiesForTask(catalog.capabilities, task, stage);
+  const packById = new Map(catalog.materialPacks.map((pack) => [pack.id, pack]));
+  const selectedPackIds = new Set<string>();
+  for (const capability of effectiveCapabilities) {
+    for (const packId of capability.routing.materialPackIds) {
+      const pack = packById.get(packId);
+      if (pack && pack.loadPolicy !== 'never_inline' && packFitsRoute(pack, stage, text)) {
+        selectedPackIds.add(packId);
+      }
+    }
+  }
+  return {
+    authority: 'advisory_only',
+    selectedDomains: effectiveCapabilities.map((capability) => ({
+      domain: capability.domain,
+      capabilityId: capability.id,
+      authority: capability.authority,
+      reason: capabilityReason(capability, task)
+    })),
+    selectedPacks: [...selectedPackIds].map((packId) => packById.get(packId)).filter((pack): pack is AgentCapabilityMaterialPack => Boolean(pack)).map((pack) => ({
+      id: pack.id,
+      domains: [...pack.domains],
+      loadPolicy: pack.loadPolicy,
+      contextBudget: pack.contextBudget,
+      sourceKind: pack.sourceKind,
+      expectedOutputs: [...pack.expectedOutputs],
+      reason: packReason(pack, stage)
+    })),
+    rejectedExternalSources: rejectedCapabilitySources(registry.capabilitySources),
+    consideredExternalSources: consideredCapabilitySources(registry.capabilitySources),
+    evidenceRequirements: evidenceRequirementsForCapabilities(effectiveCapabilities),
+    permissionCeiling: autonomyCeiling
+  };
+}
+
 export function routeRegistrySources(registry: AgentSkillRuntimeRegistry, profile: AgentProfileId | null, capabilityIds: string[]): RuntimeRegistryEntrySource[] {
   const selected: RuntimeRegistryEntrySource[] = [];
   const seen = new Set<string>();
@@ -144,3 +197,161 @@ export function buildRejectedProfiles(allowedProfiles: AgentProfileId[], blocked
     .filter((profile) => !allowed.has(profile.id))
     .map((profile) => ({ profile: profile.id, reason: blockedReason ?? 'Profile is outside task metadata allowed_agents/agent_fit, routing rules, or router risk category.' }));
 }
+
+function routeCapabilityStage(task: SddTask, category: AgentRouterCategory): AgentCapabilityStage {
+  if (category === 'planning') {
+    return 'plan';
+  }
+  if (category === 'validation' || task.status === 'completed') {
+    return 'test';
+  }
+  return 'do';
+}
+
+function taskSignalText(task: SddTask): string {
+  return [
+    task.id,
+    task.title ?? '',
+    task.boundary ?? '',
+    task.implementationNotes ?? '',
+    ...task.risk,
+    ...task.affectedFiles,
+    ...task.validation,
+    ...task.acceptance,
+    ...task.allowedAgents,
+    ...task.agentFit
+  ].join('\n').toLowerCase();
+}
+
+function capabilityMatchesTask(capability: AgentCapabilityCatalogEntry, task: SddTask, text: string): boolean {
+  return capability.routing.riskTags.some((tag) => text.includes(tag.toLowerCase())) || capability.routing.projectStackTags.some((tag) => projectStackMatches(tag, task, text)) || capability.routing.materialPackIds.some((packId) => text.includes(packId.replace(/^baseline-/, '').replace(/-/g, ' '))) || domainFileSignal(capability.domain, task.affectedFiles);
+}
+
+function fallbackCapabilitiesForTask(capabilities: AgentCapabilityCatalogEntry[], task: SddTask, stage: AgentCapabilityStage): AgentCapabilityCatalogEntry[] {
+  const codeFile = task.affectedFiles.some((file) => /\.(ts|js|java|go|py|rs|cs|php|rb)$/i.test(file));
+  const fallbackDomain: AgentCapabilityDomain = codeFile ? 'backend-engineering' : 'solution-design';
+  const fallback = capabilities.find((capability) => capability.domain === fallbackDomain && capabilityStageFits(capability, stage, task, taskSignalText(task)));
+  return fallback ? [fallback] : [];
+}
+
+function packFitsRoute(pack: AgentCapabilityMaterialPack, stage: AgentCapabilityStage, text: string): boolean {
+  const keywordTriggered = pack.triggerKeywords.some((keyword) => text.includes(keyword.toLowerCase()));
+  if (pack.sourceKind === 'sdd_native_baseline') {
+    return pack.triggerStages.includes(stage) || keywordTriggered;
+  }
+  return pack.triggerStages.includes(stage) && keywordTriggered;
+}
+
+function domainFileSignal(domain: AgentCapabilityDomain, affectedFiles: string[]): boolean {
+  const files = affectedFiles.map((file) => file.toLowerCase());
+  if (domain === 'frontend-engineering') {
+    return files.some((file) => /\.(tsx|jsx|vue|svelte|css|scss|less)$/.test(file) || file.includes('/components/') || file.includes('/pages/'));
+  }
+  if (domain === 'db-data-engineering') {
+    return files.some((file) => /\.(sql|prisma)$/.test(file) || file.includes('migration') || file.includes('schema') || file.includes('database'));
+  }
+  if (domain === 'backend-engineering') {
+    return files.some((file) => /\.(ts|js|java|go|py|rs|cs|php|rb)$/.test(file)) && !domainFileSignal('frontend-engineering', affectedFiles);
+  }
+  return false;
+}
+
+function capabilityStageFits(capability: AgentCapabilityCatalogEntry, stage: AgentCapabilityStage, task: SddTask, text: string): boolean {
+  if (capability.stages.includes(stage)) {
+    return true;
+  }
+  if (capability.domain === 'testing-quality-engineering' && stage === 'do') {
+    return testingQualityTaskSignal(task);
+  }
+  return capability.domain === 'release-engineering' && /release|ship|deploy|rollback|ci|发布/.test(text);
+}
+
+function testingQualityTaskSignal(task: SddTask): boolean {
+  const taskText = [task.id, task.title ?? '', task.boundary ?? '', task.implementationNotes ?? '', ...task.risk, ...task.affectedFiles, ...task.acceptance].join('\n').toLowerCase();
+  return /quality|coverage|acceptance|验证|测试/.test(taskText) || task.affectedFiles.some((file) => /\.(test|spec)\.[tj]sx?$/i.test(file));
+}
+
+function capabilityReason(capability: AgentCapabilityCatalogEntry, task: SddTask): string {
+  const fileSignal = domainFileSignal(capability.domain, task.affectedFiles) ? 'affected file evidence' : 'task risk, validation, or text evidence';
+  return `${capability.domain} selected from ${fileSignal}; authority remains ${capability.authority}.`;
+}
+
+function packReason(pack: AgentCapabilityMaterialPack, stage: AgentCapabilityStage): string {
+  return `${pack.id} is route_when_triggered for ${stage} and stays ${pack.contextBudget} context.`;
+}
+
+function evidenceRequirementsForCapabilities(capabilities: AgentCapabilityCatalogEntry[]): string[] {
+  const requirements = new Set<string>();
+  for (const capability of capabilities) {
+    for (const output of capability.outputs) {
+      requirements.add(`${capability.domain}: ${output}`);
+    }
+  }
+  return [...requirements];
+}
+
+function consideredCapabilitySources(sources: CapabilitySourceCatalogEntry[]): AgentCapabilityRouteDecision['consideredExternalSources'] {
+  return sources
+    .filter((source) => source.kind !== 'native_host')
+    .map((source) => ({
+      sourceId: source.id,
+      kind: source.kind,
+      quarantineStatus: source.quarantineStatus,
+      reuseDecision: source.reuseDecision,
+      allowedEvidenceTypes: [...source.allowedEvidenceTypes],
+      consideredUse: source.allowedUse,
+      reason: rejectedSourceReason(source)
+    }));
+}
+
+
+function rejectedCapabilitySources(sources: CapabilitySourceCatalogEntry[]): AgentCapabilityRouteDecision['rejectedExternalSources'] {
+  return sources
+    .filter((source) => source.kind !== 'native_host' && (source.quarantineRequired || source.reuseDecision !== 'reuse_direct' || source.kind === 'future_adapter'))
+    .map((source) => ({
+      sourceId: source.id,
+      quarantineStatus: source.quarantineStatus,
+      reuseDecision: source.reuseDecision,
+      allowedEvidenceTypes: [...source.allowedEvidenceTypes],
+      reason: rejectedSourceReason(source)
+    }));
+}
+
+function projectStackMatches(tag: string, task: SddTask, text: string): boolean {
+  if (tag === 'generic') {
+    return false;
+  }
+  if (text.includes(tag.toLowerCase())) {
+    return true;
+  }
+  const files = task.affectedFiles.map((file) => file.toLowerCase());
+  if (tag === 'typescript') {
+    return files.some((file) => /\.(ts|tsx)$/.test(file));
+  }
+  if (tag === 'javascript') {
+    return files.some((file) => /\.(js|jsx)$/.test(file));
+  }
+  if (tag === 'java') {
+    return files.some((file) => file.endsWith('.java'));
+  }
+  if (tag === 'sql') {
+    return files.some((file) => /\.(sql|prisma)$/.test(file));
+  }
+  return files.some((file) => file.includes(tag.toLowerCase()));
+}
+
+function rejectedSourceReason(source: CapabilitySourceCatalogEntry): string {
+  if (source.quarantineStatus === 'denied') {
+    return 'Source is denied or unsupported and cannot participate in routing.';
+  }
+  if (source.kind === 'future_adapter') {
+    return 'Future adapter is recorded as metadata only until host behavior is validated.';
+  }
+  if (source.quarantineStatus === 'quarantined' || source.quarantineStatus === 'required') {
+    return 'Source requires quarantine/provenance review and is not invoked by capability routing.';
+  }
+  if (source.reuseDecision === 'avoid') {
+    return 'Reuse policy avoids this source.';
+  }
+  return 'External source is considered but not loaded during progressive disclosure.';
+}

package/node_modules/@sdd-agent-platform/core/src/router/route-sdd-task.test.ts

@@ -14,6 +14,9 @@ import {
   validTaskMarkdown,
   writeBranchDocs
 } from '../test-support/fixtures.js';
+import { writeVerifyContract } from '../verification/verify-contract.js';
+import { createRun, readRunState, writeRunState } from '../run-state/run-state.js';
+import { bindTestRunState } from '../test-support/run-state.js';
 import {
   inspectAgentSkillTeamRuntime,
   inspectCapabilitySource,
@@ -38,12 +41,18 @@ test('Phase 6 agent skill team runtime exposes reusable contracts and router dec
     const sourceCatalog = await listCapabilitySources(root);
     const agencySource = await inspectCapabilitySource(root, 'agency_agents_material');
     const agencyImport = await inspectExternalAgentPackImport(root, 'agency_agents_material');
+    const codexSource = await inspectCapabilitySource(root, 'codex_host_future');
+    const codexImport = await inspectExternalAgentPackImport(root, 'codex_host_future');
+    const figmaSource = await inspectCapabilitySource(root, 'figma_design_future');
     const teamDefault = await inspectTeamModePolicy(root);
     const teamEnabled = await inspectTeamModePolicy(root, { taskId: 'ONBOARDING-1', branch: 'master', enabled: true });
     const route = await routeSddTask(root, { taskId: 'ONBOARDING-1', branch: 'master', teamModeEnabled: true });
 
     assert.equal(runtime.version, 'phase-6.0-agent-skill-team-runtime-v1');
     assert.equal(runtime.teamMode.decision, 'disabled');
+    assert.equal(runtime.hostAdapter.workflowProjectionPolicy.includes('host-neutral canonical CLI commands'), true);
+    assert.deepEqual(runtime.hostAdapter.workflowProjections.map((projection) => `${projection.host}:${projection.support}`), ['claude_code:active', 'codex:future', 'opencode:active']);
+    assert.equal(runtime.hostAdapter.workflowProjections.find((projection) => projection.host === 'codex')?.unsupportedReason?.includes('not marked active'), true);
     assert.equal(runtime.profiles.some((profile) => profile.id === 'orchestrator'), true);
     assert.equal(runtime.profiles.some((profile) => profile.id === 'security'), true);
     assert.equal(runtime.skillCapabilities.some((capability) => capability.id === 'claude.subagent.researcher'), true);
@@ -52,8 +61,19 @@ test('Phase 6 agent skill team runtime exposes reusable contracts and router dec
     assert.ok(hashlineCapability);
     assert.equal(hashlineCapability.reuseDecision, 'reuse_direct');
     assert.equal(sourceCatalog.sources.some((source) => source.id === 'ohmy_team_mode'), true);
+    assert.ok(codexSource);
+    assert.equal(codexSource.quarantineStatus, 'denied');
+    assert.equal(codexSource.hostCompatibility.includes('codex:unsupported'), true);
+    assert.equal(codexImport.status, 'denied');
+    assert.equal(codexImport.allowedProfiles.length, 0);
+    assert.ok(figmaSource);
+    assert.equal(figmaSource.allowedEvidenceTypes.includes('design_context'), true);
+    assert.equal(figmaSource.reuseDecision, 'adapt_via_host_adapter');
     assert.ok(agencySource);
     assert.equal(agencySource.quarantineRequired, true);
+    assert.equal(agencySource.quarantineStatus, 'quarantined');
+    assert.equal(agencySource.permissionModel.length > 0, true);
+    assert.equal(agencySource.provenanceRequirements.length > 0, true);
     assert.equal(agencyImport.status, 'quarantined');
     assert.equal(agencyImport.checks.some((check) => check.check === 'dangerous_command_scan'), true);
     assert.equal(teamDefault.decision, 'disabled');
@@ -80,6 +100,7 @@ test('Phase 6 adaptive team-mode routes choose cost-bounded agent teams automati
   try {
     await initProject(root);
     await writeBranchDocs(root, 'master', `# Tasks\n\n${adaptiveTeamTaskMarkdown('LOW', { allowedAgents: ['implementer'], affectedFiles: ['docs/low.md'] })}\n${adaptiveTeamTaskMarkdown('REVIEW', { allowedAgents: ['reviewer'], requiredArtifacts: ['artifacts/review-REVIEW.md'], affectedFiles: ['docs/review.md'] })}\n${adaptiveTeamTaskMarkdown('SOURCE', { allowedAgents: ['implementer'] })}\n${adaptiveTeamTaskMarkdown('HIGH', { allowedAgents: ['implementer'], risk: ['database'] })}\n${adaptiveTeamTaskMarkdown('SECURITY', { allowedAgents: ['security'], risk: ['security'] })}`);
+    await writeVerifyContract(root, { branch: 'master', branchSource: 'cli_option', force: true });
 
     const low = await routeSddTask(root, { taskId: 'LOW', branch: 'master' });
     const review = await routeSddTask(root, { taskId: 'REVIEW', branch: 'master' });
@@ -156,6 +177,7 @@ test('routeSddTask uses derived route cache and opt-in profiling only', async ()
   try {
     await initProject(root);
     await writeBranchDocs(root, 'master', `# Tasks\n\n${adaptiveTeamTaskMarkdown('CACHE', { allowedAgents: ['reviewer'], requiredArtifacts: ['artifacts/review-CACHE.md'], affectedFiles: ['docs/cache.md'] })}`);
+    await writeVerifyContract(root, { branch: 'master', branchSource: 'cli_option', force: true });
 
     const uncached = await routeSddTask(root, { taskId: 'CACHE', branch: 'master' });
     const first = await routeSddTask(root, { taskId: 'CACHE', branch: 'master', cache: true, profile: true });
@@ -181,6 +203,7 @@ test('routeSddTask uses derived route cache and opt-in profiling only', async ()
     assert.equal(third.profile.some((span) => span.name === 'route_compute'), false);
 
     await writeBranchDocs(root, 'master', `# Tasks\n\n${adaptiveTeamTaskMarkdown('CACHE', { allowedAgents: ['reviewer'], requiredArtifacts: ['artifacts/review-CACHE.md'], affectedFiles: ['docs/cache.md'] })}\n\nCache key invalidation fixture.`);
+    await writeVerifyContract(root, { branch: 'master', branchSource: 'cli_option', force: true });
     const invalidated = await routeSddTask(root, { taskId: 'CACHE', branch: 'master', cache: true });
 
     assert.equal(invalidated.cache?.status, 'stored');
@@ -197,6 +220,7 @@ test('Phase 6.3 project agent runtime merges project config and routes by alias
     await initProject(root);
     await appendProjectRuntimeConfig(root, phase63ProjectRuntimeConfig());
     await writeBranchDocs(root, 'master', phase63FrontendTaskMarkdown('FRONTEND-1'));
+    await writeVerifyContract(root, { branch: 'master', branchSource: 'cli_option', force: true });
 
     const runtime = await inspectAgentSkillTeamRuntime(root);
     const validation = await validateAgentSkillTeamRuntime(root);
@@ -249,6 +273,12 @@ test('Phase 6.3 invalid agent runtime declarations fail closed', async () => {
     assert.match(issueText, /project\.skill\.bad\.evidenceType/);
     assert.match(issueText, /unknown source missing_source/);
     assert.match(issueText, /unsafe_source\.attribution/);
+    assert.match(issueText, /unsafe_source\.permissionModel/);
+    assert.match(issueText, /unsafe_source\.provenanceRequirements/);
+    assert.match(issueText, /unsafe_source\.hostCompatibility/);
+    assert.match(issueText, /unsafe_source\.allowedEvidenceTypes/);
+    assert.match(issueText, /unsafe_source\.forbiddenAuthority/);
+    assert.match(issueText, /Quarantined source is missing active quarantine status/);
     assert.match(issueText, /Quarantined source cannot be reused directly/);
     assert.match(issueText, /Quarantined source requests prompt import, direct execution, or lifecycle authority/);
   } finally {
@@ -256,6 +286,57 @@ test('Phase 6.3 invalid agent runtime declarations fail closed', async () => {
   }
 });
 
+test('Phase 8.6 capability routing selects narrow domains, packs, and rejected external sources', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-phase86-capability-routing-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'master', `# Tasks
+
+${capabilityRouteTaskMarkdown('SIMPLE', 'Simple backend parser fix', ['packages/core/src/parser.ts'], [], ['npm test'])}
+${capabilityRouteTaskMarkdown('UI', 'UI UX frontend interaction update', ['src/components/Button.tsx'], ['ui-ux', 'accessibility'], ['browser Playwright validation'])}
+${capabilityRouteTaskMarkdown('SECURITY', 'Security permission boundary update', ['packages/core/src/auth.ts'], ['security'], ['npm test'])}
+${capabilityRouteTaskMarkdown('DB', 'Database migration data safety update', ['db/migrations/001.sql'], ['database', 'data-loss'], ['npm test'])}
+${capabilityRouteTaskMarkdown('RELEASE', 'Release deploy rollback readiness', ['.github/workflows/release.yml'], ['release', 'ci-build'], ['npm test'])}
+${capabilityRouteTaskMarkdown('TESTING', 'Testing quality coverage update', ['packages/core/src/parser.test.ts'], ['validation'], ['coverage acceptance test'])}`);
+
+    const simple = await routeSddTask(root, { taskId: 'SIMPLE', branch: 'master' });
+    const ui = await routeSddTask(root, { taskId: 'UI', branch: 'master' });
+    const security = await routeSddTask(root, { taskId: 'SECURITY', branch: 'master', approved: true });
+    const db = await routeSddTask(root, { taskId: 'DB', branch: 'master', approved: true });
+    const release = await routeSddTask(root, { taskId: 'RELEASE', branch: 'master', approved: true });
+    const testing = await routeSddTask(root, { taskId: 'TESTING', branch: 'master' });
+    const figmaConsidered = ui.capabilityDecision.consideredExternalSources.find((source) => source.sourceId === 'figma_design_future');
+    const uiUxProMaxConsidered = ui.capabilityDecision.consideredExternalSources.find((source) => source.sourceId === 'ui_ux_pro_max_external');
+
+
+    assert.deepEqual(simple.capabilityDecision.selectedDomains.map((item) => item.domain), ['backend-engineering']);
+    assert.equal(simple.capabilityDecision.selectedPacks.length <= 2, true);
+    assert.equal(simple.capabilityDecision.authority, 'advisory_only');
+    assert.equal(simple.capabilityDecision.permissionCeiling, simple.autonomyCeiling);
+    assert.equal(ui.capabilityDecision.selectedDomains.some((item) => item.domain === 'frontend-engineering'), true);
+    assert.equal(ui.capabilityDecision.selectedDomains.some((item) => item.domain === 'ui-ux-product-design'), true);
+    assert.equal(ui.capabilityDecision.selectedPacks.some((pack) => pack.id === 'baseline-ui-ux-product-design'), true);
+    assert.equal(ui.capabilityDecision.rejectedExternalSources.some((source) => source.sourceId === 'figma_design_future' && /Future adapter|quarantine/.test(source.reason)), true);
+    assert.equal(ui.capabilityDecision.rejectedExternalSources.some((source) => source.sourceId === 'ui_ux_pro_max_external' && /quarantine/i.test(source.reason)), true);
+    assert.ok(figmaConsidered);
+    assert.equal(figmaConsidered.kind, 'future_adapter');
+    assert.equal(figmaConsidered.consideredUse.length > 0, true);
+    assert.ok(uiUxProMaxConsidered);
+    assert.equal(uiUxProMaxConsidered.kind, 'open_source_material');
+    assert.equal(uiUxProMaxConsidered.quarantineStatus, 'quarantined');
+    assert.equal(security.capabilityDecision.selectedDomains.some((item) => item.domain === 'security-engineering'), true);
+    assert.equal(db.capabilityDecision.selectedDomains.some((item) => item.domain === 'db-data-engineering'), true);
+    assert.equal(release.capabilityDecision.selectedDomains.some((item) => item.domain === 'release-engineering'), true);
+    assert.equal(release.capabilityDecision.selectedPacks.some((pack) => pack.id === 'baseline-release-engineering'), true);
+    assert.equal(testing.capabilityDecision.selectedDomains.some((item) => item.domain === 'testing-quality-engineering'), true);
+    assert.equal(testing.capabilityDecision.evidenceRequirements.some((item) => item.includes('evidence requirement')), true);
+    assert.equal(ui.requiredCapabilities.includes('figma_design_future'), false);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+
 test('routeSddTask blocks downstream tasks until dependencies are completed', async () => {
   const root = await mkdtemp(path.join(tmpdir(), 'sdd-route-dependencies-'));
   try {
@@ -266,8 +347,8 @@ test('routeSddTask blocks downstream tasks until dependencies are completed', as
 
     assert.equal(blocked.category, 'blocked');
     assert.equal(blocked.recommendedProfile, null);
-    assert.match(blocked.blockedReason ?? '', /DEP2 depends on DEP1, but DEP1 status is pending/);
-    assert.match(blocked.nextAction, /Complete and sync-back DEP1 before routing DEP2/);
+    assert.match(blocked.blockedReason ?? '', /DEP2 depends on DEP1, but DEP1 has not passed required verification/);
+    assert.match(blocked.nextAction, /sdd test task DEP1/);
 
     await writeBranchDocs(root, 'feature', `# Tasks\n\n${validTaskMarkdown('DEP1', []).replace('status: pending', 'status: completed')}\n${validTaskMarkdown('DEP2', ['DEP1']).replace('packages/core/src/index.ts', 'docs/dep2.md')}`);
     const ready = await routeSddTask(root, { taskId: 'DEP2', branch: 'feature' });
@@ -278,4 +359,71 @@ test('routeSddTask blocks downstream tasks until dependencies are completed', as
   } finally {
     await rm(root, { recursive: true, force: true });
   }
-});
+});
+
+test('routeSddTask uses latest eligible runtime dependency readiness', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-route-runtime-dependencies-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'feature', `# Tasks
+
+${validTaskMarkdown('DEP1', [])
+  .replace('packages/core/src/index.ts', 'docs/dep1.md')
+  .replace('validation:\n  - npm test', 'validation_batch: dep-batch\nvalidation_timing: batch_end\nrequires_verify_before_next: false\nvalidation:\n  - npm test')}
+${validTaskMarkdown('DEP2', ['DEP1']).replace('packages/core/src/index.ts', 'docs/dep2.md')}`);
+    const run = await createRun(root, { runId: 'run-dep1-implemented' });
+    await bindTestRunState(root, run.runId, 'feature', 'DEP1');
+    const bound = await readRunState(root, run.runId);
+    await writeRunState(root, {
+      ...bound,
+      status: 'completed',
+      tasks: {
+        ...bound.tasks,
+        DEP1: {
+          status: 'implemented_pending_validation',
+          implementationStatus: 'implemented',
+          verificationStatus: 'pending_batch',
+          validationBatch: 'dep-batch',
+          validationTiming: 'batch_end',
+          requiresVerifyBeforeNext: false,
+          gaps: [],
+          artifacts: []
+        }
+      }
+    });
+
+    const decision = await routeSddTask(root, { taskId: 'DEP2', branch: 'feature' });
+
+    assert.notEqual(decision.category, 'blocked');
+    assert.equal(decision.blockedReason, null);
+    assert.ok(decision.recommendedProfile);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+function capabilityRouteTaskMarkdown(taskId: string, title: string, affectedFiles: string[], risk: string[], validation: string[]): string {
+  const affectedFilesBlock = affectedFiles.length === 0 ? 'affected_files: []' : `affected_files:\n${affectedFiles.map((file) => `  - ${file}`).join('\n')}`;
+  const riskBlock = risk.length === 0 ? 'risk: []' : `risk:\n${risk.map((item) => `  - ${item}`).join('\n')}`;
+  const validationBlock = validation.length === 0 ? 'validation: []' : `validation:\n${validation.map((item) => `  - ${item}`).join('\n')}`;
+  return `### ${taskId}: ${title}
+
+\`\`\`sdd-task
+id: ${taskId}
+status: pending
+wave: 1
+depends_on: []
+acceptance_refs:
+  - AC-1
+${affectedFilesBlock}
+${validationBlock}
+${riskBlock}
+allowed_agents:
+  - implementer
+\`\`\`
+
+#### Acceptance
+
+- ${title}.
+`;
+}

package/node_modules/@sdd-agent-platform/core/src/router/routing.ts

@@ -11,11 +11,15 @@ import { buildAgentSkillRuntimeRegistry } from './runtime-registry.js';
 import { buildTeamModePolicy, resolveTeamModeActivation } from './team-mode.js';
 import { matchRoutingRules } from './routing-rules.js';
 import { chooseRecommendedProfile, deriveAllowedProfiles, toAgentProfileId } from './profile-resolution.js';
-import { adapterMappingForProfile, buildRejectedProfiles, buildToolPermissionSpec, modelPolicyForProfile, quarantineWarningsForSources, routeCategory, routeRegistrySources, selectRequiredSkillCapabilities } from './route-projection.js';
+import { adapterMappingForProfile, buildAgentCapabilityRouteDecision, buildRejectedProfiles, buildToolPermissionSpec, modelPolicyForProfile, quarantineWarningsForSources, routeCategory, routeRegistrySources, selectRequiredSkillCapabilities } from './route-projection.js';
 import { lifecycleAutonomyCeilingFromDecision, ensureLifecycleRiskDecision } from '../orchestration/runtime.js';
 import { taskAutonomyCeiling } from './risk-policy.js';
 import { evaluateTaskWorkflowGate } from '../risk.js';
 import { nextDependencyTaskId, resolveTaskDependencyReadiness } from '../workflow-state/dependencies.js';
+import { selectLatestEligibleRunsByTask, type LatestEligibleRunSelection } from '../workflow-state/latest-eligible-run.js';
+import { readAllRunStates } from '../run-state/run-state.js';
+import type { RunState, RunStateTaskRuntime } from '../run-state/model.js';
+import { inspectAgentCapabilityCatalog } from '../registries/agent-capability-catalog.js';
 import type {
   AgentRouterDecision,
   TeamModePolicy
@@ -46,10 +50,14 @@ export async function routeSddTask(projectRoot: string, options: { taskId: strin
   const routeStart = Date.now();
   const routeStartedAt = new Date(routeStart).toISOString();
   const registry = await buildAgentSkillRuntimeRegistry(projectRoot);
+  const capabilityCatalog = await inspectAgentCapabilityCatalog(projectRoot);
   profileSpans.push(runtimeProfileSpan('agent_runtime_registry', routeStart));
   const branchStart = Date.now();
-  const branch = options.branch ?? (await resolveSddContext(projectRoot)).branch;
+  const context = await resolveSddContext(projectRoot, { branch: options.branch, branchSource: options.branch ? 'cli_option' : undefined });
+  const branch = context.partition;
   const model = await parseSddBranch(projectRoot, branch);
+  const states = await readAllRunStates(projectRoot);
+  const runtimeByTask = latestRuntimeTaskStates(selectLatestEligibleRunsByTask({ states, model, partition: branch, currentGitBranch: context.currentGitBranch }), states);
   profileSpans.push(runtimeProfileSpan('document_parse', branchStart));
   const cacheKey = routeCacheKey({ taskId: options.taskId, branch, agent: options.agent ?? null, teamModeActivation: resolveTeamModeActivation(options, 'auto'), approved: options.approved, documents: model.documents });
   const cachedDecision = options.cache ? await readRouteCache<AgentRouterDecision>(projectRoot, cacheKey) : null;
@@ -73,9 +81,9 @@ export async function routeSddTask(projectRoot: string, options: { taskId: strin
   const lifecycleBlockedReason = workflowGate.blocksRoute
     ? workflowGate.primaryReason
     : null;
-  const dependencyReadiness = task ? resolveTaskDependencyReadiness(model, options.taskId) : null;
+  const dependencyReadiness = task ? resolveTaskDependencyReadiness(model, options.taskId, { runtimeByTask }) : null;
   const dependencyBlockedReason = dependencyReadiness?.blockingReasons[0] ?? null;
-  const dependencyTaskId = task ? nextDependencyTaskId(model, options.taskId) : null;
+  const dependencyTaskId = task ? nextDependencyTaskId(model, options.taskId, { runtimeByTask }) : null;
   const taskRecommendedProfile = task && !blockingGap && !dependencyBlockedReason && !lifecycleBlockedReason ? chooseRecommendedProfile(task, allowedProfiles, registry, matchedRules) : null;
   const recommendedProfile = dependencyBlockedReason || lifecycleBlockedReason ? null : delegatedProfile ?? taskRecommendedProfile;
   const category = task ? routeCategory(task, blockingGap, allowedProfiles, matchedRules) : 'blocked';
@@ -87,6 +95,7 @@ export async function routeSddTask(projectRoot: string, options: { taskId: strin
   const routedCategory = blockedReason ? 'blocked' : category;
   const registrySources = routeRegistrySources(registry, recommendedProfile, requiredCapabilities);
   const adapterMapping = recommendedProfile ? adapterMappingForProfile(registry, recommendedProfile) : null;
+  const capabilityDecision = buildAgentCapabilityRouteDecision(task ?? null, routedCategory, autonomyCeiling, registry, capabilityCatalog);
   const decision: AgentRouterDecision = {
     version: AGENT_ROUTER_CONTRACT_VERSION,
     taskId: options.taskId,
@@ -116,7 +125,8 @@ export async function routeSddTask(projectRoot: string, options: { taskId: strin
     primaryReason: workflowGate.primaryReason,
     requiredArtifacts: task?.requiredArtifacts ?? [],
     blockedReason,
-    nextAction: routeNextAction({ taskId: options.taskId, taskExists: Boolean(task), hasBlockingGap: Boolean(blockingGap), dependencyTaskId, workflowGateNextAction: workflowGate.nextAction, recommendedProfile, requiredCapabilities }),
+    nextAction: routeNextAction({ taskId: options.taskId, taskExists: Boolean(task), hasBlockingGap: Boolean(blockingGap), dependencyTaskId, blockedReason, workflowGateNextAction: workflowGate.nextAction, recommendedProfile, requiredCapabilities }),
+    capabilityDecision,
     registrySources,
     resolvedAliases: profileSelection.resolvedAliases,
     routingRuleHits: matchedRules.map((rule) => rule.id),
@@ -135,11 +145,28 @@ export async function routeSddTask(projectRoot: string, options: { taskId: strin
   return decision;
 }
 
+function latestRuntimeTaskStates(selections: LatestEligibleRunSelection[], states: RunState[]): Map<string, RunStateTaskRuntime> {
+  const stateByRunId = new Map(states.map((state) => [state.runId, state]));
+  const result = new Map<string, RunStateTaskRuntime>();
+  for (const selection of selections) {
+    const selected = selection.selected;
+    if (!selected) {
+      continue;
+    }
+    const taskState = stateByRunId.get(selected.runId)?.tasks[selected.taskId];
+    if (taskState) {
+      result.set(selected.taskId, taskState);
+    }
+  }
+  return result;
+}
+
 function routeNextAction(input: {
   taskId: string;
   taskExists: boolean;
   hasBlockingGap: boolean;
   dependencyTaskId: string | null;
+  blockedReason: string | null;
   workflowGateNextAction: string;
   recommendedProfile: string | null;
   requiredCapabilities: string[];
@@ -151,7 +178,9 @@ function routeNextAction(input: {
     return `Fix task gaps before routing ${input.taskId}.`;
   }
   if (input.dependencyTaskId) {
-    return `Complete and sync-back ${input.dependencyTaskId} before routing ${input.taskId}.`;
+    return input.blockedReason?.includes('has not passed required verification')
+      ? `Run sdd test task ${input.dependencyTaskId} before routing ${input.taskId}.`
+      : `Run sdd do task ${input.dependencyTaskId} before routing ${input.taskId}.`;
   }
   if (input.workflowGateNextAction) {
     return input.workflowGateNextAction;

package/node_modules/@sdd-agent-platform/core/src/router/runtime-inspection.ts

@@ -80,13 +80,17 @@ export async function inspectExternalAgentPackImport(projectRoot: string, source
       reason: 'Unknown external source cannot be routed.'
     };
   }
-  if (source.reuseDecision === 'avoid') {
+  if (source.reuseDecision === 'avoid' || source.quarantineStatus === 'denied') {
     return {
       version: EXTERNAL_AGENT_PACK_IMPORT_POLICY_VERSION,
       sourceId,
       status: 'denied',
-      checks: [{ check: 'reuse_decision', status: 'fail', evidence: `${source.id} is marked avoid for Phase 6 core runtime.` }],
-      mappingResult: 'future adapter only',
+      checks: [
+        { check: 'reuse_decision', status: source.reuseDecision === 'avoid' ? 'fail' : 'warn', evidence: `${source.id} reuse=${source.reuseDecision}.` },
+        { check: 'quarantine_status', status: source.quarantineStatus === 'denied' ? 'fail' : 'warn', evidence: `${source.id} quarantine_status=${source.quarantineStatus}.` },
+        { check: 'host_compatibility', status: source.hostCompatibility.some((item) => item.includes('unsupported')) ? 'fail' : 'warn', evidence: source.hostCompatibility.join(',') || 'not declared' }
+      ],
+      mappingResult: 'future adapter or unsupported source only',
       allowedProfiles: [],
       riskCeiling: 'research_before_implementation',
       reason: source.rationale
@@ -98,11 +102,14 @@ export async function inspectExternalAgentPackImport(projectRoot: string, source
       { check: 'hidden_unicode_scan', status: 'not_run', evidence: 'External material has not been scanned for hidden Unicode.' },
       { check: 'secret_scan', status: 'not_run', evidence: 'External material has not been scanned for secrets.' },
       { check: 'dangerous_command_scan', status: 'not_run', evidence: 'External material has not been scanned for dangerous commands.' },
+      { check: 'permission_model', status: source.permissionModel.length > 0 ? 'pass' : 'fail', evidence: source.permissionModel.join(',') || 'No permission model declared.' },
+      { check: 'provenance_requirements', status: source.provenanceRequirements.length > 0 ? 'pass' : 'fail', evidence: source.provenanceRequirements.join(',') || 'No provenance requirements declared.' },
       { check: 'sdd_frontmatter_mapping', status: 'not_run', evidence: 'External material has not been mapped to SDD capability/profile fields.' }
     ]
     : [
       { check: 'source_catalog', status: 'pass', evidence: `${source.id} is cataloged as ${source.reuseDecision}.` },
-      { check: 'quarantine_required', status: 'pass', evidence: 'This source is a native capability or mechanism reference, not an imported prompt pack.' }
+      { check: 'quarantine_required', status: 'pass', evidence: 'This source is a native capability or mechanism reference, not an imported prompt pack.' },
+      { check: 'provenance_requirements', status: source.provenanceRequirements.length > 0 ? 'pass' : 'fail', evidence: source.provenanceRequirements.join(',') || 'No provenance requirements declared.' }
     ];
   return {
     version: EXTERNAL_AGENT_PACK_IMPORT_POLICY_VERSION,