sdd-agent-platform 0.4.0 → 0.4.1

package/node_modules/@sdd-agent-platform/core/src/sync-back/apply.ts

@@ -9,6 +9,7 @@ import type { SddTask, SddTaskModel, SddTaskStatus } from '../sdd-docs/task-pars
 import { inspectSyncBack } from './inspect.js';
 import type { SyncBackInspection } from './inspect.js';
 import { writeVerifyContract } from '../verification/verify-contract.js';
+import { readRuntimeSyncBackDecision, recordRuntimeSyncBackDecision, runtimeScopedId } from '../storage/runtime-store.js';
 
 export interface SyncBackApplyResult {
   runId: string;
@@ -74,6 +75,22 @@ export async function applySyncBack(projectRoot: string, options: { runId?: stri
       status: 'applied'
     }
   });
+  const existingDecision = await readRuntimeSyncBackDecision(projectRoot, state.runId, inspection.taskId);
+  const decisionTime = new Date().toISOString();
+  await recordRuntimeSyncBackDecision(projectRoot, {
+    decisionId: existingDecision?.decisionId ?? runtimeScopedId(state.runId, inspection.taskId, 'sync-back'),
+    runId: state.runId,
+    branch: inspection.branch,
+    taskId: inspection.taskId,
+    status: 'applied',
+    proposalPath: inspection.proposalPath,
+    proposalDigest: inspection.proposalDigest,
+    proposalPayloadId: existingDecision?.proposalPayloadId ?? null,
+    reasons: [],
+    createdAt: existingDecision?.createdAt ?? decisionTime,
+    updatedAt: decisionTime,
+    payload: { previousStatus: existingDecision?.status ?? state.syncBack.status, tasksPath: path.relative(projectRoot, tasksPath) }
+  });
   await appendEvent(projectRoot, state.runId, {
     event: 'sync_back_applied',
     runId: state.runId,
@@ -109,8 +126,13 @@ function documentSnapshotFromModel(model: SddTaskModel): RunDocumentSnapshot {
     specHash: model.documents.specHash ?? null,
     planHash: model.documents.planHash ?? null,
     tasksHash: model.documents.tasksHash ?? null,
+    specContractHash: model.documents.specContractHash ?? null,
+    planContractHash: model.documents.planContractHash ?? null,
+    tasksContractHash: model.documents.tasksContractHash ?? null,
     planBasedOnSpecHash: model.documents.planBasedOnSpecHash ?? null,
-    tasksBasedOnPlanHash: model.documents.tasksBasedOnPlanHash ?? null
+    tasksBasedOnPlanHash: model.documents.tasksBasedOnPlanHash ?? null,
+    planBasedOnSpecContractHash: model.documents.planBasedOnSpecContractHash ?? null,
+    tasksBasedOnPlanContractHash: model.documents.tasksBasedOnPlanContractHash ?? null
   };
 }
 

package/node_modules/@sdd-agent-platform/core/src/sync-back/inspect.ts

@@ -18,6 +18,10 @@ import { buildTaskRiskProfile } from '../task-risk-profile.js';
 import { inspectVerifyContract, type VerifyContractIssue, type VerifyContractStatus } from '../verification/verify-contract.js';
 import { evaluateLifecycleRiskDecisionForModel, inspectLifecycleRiskDecisionForModel, type LifecycleRiskConsumerDiagnostic } from '../risk.js';
 import { dependencyBlockingReasonsForTask } from '../workflow-state/dependencies.js';
+import { listRuntimeTestRuns, readRuntimeSyncBackDecision } from '../storage/runtime-store.js';
+import { readTaskEvidenceView, type TaskEvidenceView } from '../run-state/task-evidence.js';
+import type { CapabilityEvidenceClassification } from '../evidence-runtime.js';
+import { evaluateAndRecordWorkflowGateDecision } from '../workflow-gate/evidence-packet.js';
 
 export interface ResolvedTaskRun {
   runId: string;
@@ -28,6 +32,7 @@ export interface ResolvedTaskRun {
   explicitRunId: boolean;
   staleReasons: string[];
   affectedFileConflicts: WorkflowAffectedFileConflict[];
+  selectorRejectionReasons: string[];
 }
 
 export type SyncBackInspectionStatus = 'ready' | 'blocked' | 'applied';
@@ -38,6 +43,20 @@ export interface SyncBackApplyPolicy {
   reasons: string[];
 }
 
+export type SyncBackCapabilityReadinessStatus = 'not_recorded' | 'runtime_evidence_ready' | 'candidate_only' | 'blocked';
+
+export interface SyncBackCapabilityReadiness {
+  status: SyncBackCapabilityReadinessStatus;
+  authoritativeForApply: false;
+  requiredDomains: string[];
+  accepted: string[];
+  candidate: string[];
+  quarantined: string[];
+  diagnostic: string[];
+  blocked: string[];
+  reason: string;
+}
+
 export interface SyncBackApprovalCard {
   contract: 'sdd-sync-back-approval-card-v1';
   scope: {
@@ -54,6 +73,7 @@ export interface SyncBackApprovalCard {
     digestValid: boolean | null;
   };
   approval: SyncBackApplyPolicy;
+  capabilityReadiness: SyncBackCapabilityReadiness;
   blockers: string[];
   staleReasons: string[];
   affectedFileConflicts: Array<{
@@ -69,6 +89,7 @@ export interface SyncBackApprovalCard {
   verifyContractIssues: VerifyContractIssue[];
   staleVerifyRecoveryCommand: string | null;
   lifecycleRisk: LifecycleRiskConsumerDiagnostic;
+  workflowGateDecision: TaskEvidenceView['workflowGate']['latestDecision'];
 }
 
 export interface SyncBackInspection {
@@ -89,12 +110,15 @@ export interface SyncBackInspection {
   gaps: SddTaskGap[];
   applyPolicy: SyncBackApplyPolicy;
   approvalCard: SyncBackApprovalCard;
+  capabilityReadiness: SyncBackCapabilityReadiness;
   staleReasons: string[];
   affectedFileConflicts: WorkflowAffectedFileConflict[];
   verifyContractStatus: VerifyContractStatus;
   verifyContractIssues: VerifyContractIssue[];
   staleVerifyRecoveryCommand: string | null;
   lifecycleRisk: LifecycleRiskConsumerDiagnostic;
+  workflowGateDecision: TaskEvidenceView['workflowGate']['latestDecision'];
+  taskEvidenceView: TaskEvidenceView;
 }
 
 export async function resolveTaskRun(projectRoot: string, options: { runId?: string; branch?: string; taskId: string }): Promise<ResolvedTaskRun> {
@@ -119,7 +143,8 @@ export async function resolveTaskRun(projectRoot: string, options: { runId?: str
       task: inspected.task,
       explicitRunId: true,
       staleReasons: await runDocumentStaleReasons(projectRoot, state, model),
-      affectedFileConflicts: await affectedFileConflictsForRun(projectRoot, state)
+      affectedFileConflicts: await affectedFileConflictsForRun(projectRoot, state),
+      selectorRejectionReasons: []
     };
   }
 
@@ -129,19 +154,27 @@ export async function resolveTaskRun(projectRoot: string, options: { runId?: str
     taskId: options.taskId
   });
   const inspected = inspectSddTask(workflow.model, options.taskId);
-  const candidate = workflow.latestRunsByTask.find((entry) => entry.taskId === options.taskId);
-  if (!candidate || !workflow.latestRunState) {
+  const selection = workflow.latestEligibleRunsByTask.find((entry) => entry.taskId === options.taskId);
+  const candidate = selection?.selected ?? selection?.rejected[0] ?? null;
+  if (!candidate) {
     throw new Error(`No eligible run found for ${workflow.context.partition}/${options.taskId}. Run sdd do task ${options.taskId} first, or pass --run <run_id>.`);
   }
+  const state = selection?.selected && workflow.latestRunState && selection.selected.runId === workflow.latestRunState.runId
+    ? workflow.latestRunState
+    : await readRunState(projectRoot, candidate.runId);
+  if (!state) {
+    throw new Error(`Run state ${candidate.runId} is unavailable for ${workflow.context.partition}/${options.taskId}. Pass --run <run_id> or rerun the task.`);
+  }
   return {
-    runId: workflow.latestRunState.runId,
-    state: workflow.latestRunState,
+    runId: state.runId,
+    state,
     context: workflow.context,
     model: workflow.model,
     task: inspected.task,
     explicitRunId: false,
-    staleReasons: await runDocumentStaleReasons(projectRoot, workflow.latestRunState, workflow.model),
-    affectedFileConflicts: workflow.affectedFileConflicts
+    staleReasons: await runDocumentStaleReasons(projectRoot, state, workflow.model),
+    affectedFileConflicts: workflow.affectedFileConflicts,
+    selectorRejectionReasons: selection?.selected ? [] : candidate.reasons
   };
 }
 
@@ -155,8 +188,17 @@ export async function inspectSyncBack(projectRoot: string, options: { runId?: st
   const branch = resolved.context.partition;
   const state = resolved.state;
   const model = resolved.model;
+  const syncBackDecision = await readRuntimeSyncBackDecision(projectRoot, state.runId, taskId);
+  const taskEvidenceView = await readTaskEvidenceView(projectRoot, { branch, taskId });
+  const workflowGateDecision = (await evaluateAndRecordWorkflowGateDecision(projectRoot, { branch, taskId, runId: state.runId, decisionKind: 'sync_back' })).decision;
   const inspected = inspectSddTask(model, taskId);
   const reasons: string[] = [];
+  if (workflowGateDecision.status === 'BLOCKED') {
+    reasons.push(...syncBackWorkflowGateReasons(workflowGateDecision, resolved.explicitRunId));
+  }
+  if (workflowGateDecision.status === 'HUMAN_REQUIRED') {
+    reasons.push(...workflowGateDecision.reasons.map((reason) => `Workflow gate requires human decision before sync-back: ${reason}`));
+  }
   const markdownTask = inspected.task;
   const taskGaps = inspected.gaps;
   if (!inspected.task) {
@@ -168,6 +210,9 @@ export async function inspectSyncBack(projectRoot: string, options: { runId?: st
   for (const reason of resolved.staleReasons) {
     reasons.push(reason);
   }
+  for (const reason of resolved.selectorRejectionReasons) {
+    reasons.push(reason);
+  }
   for (const conflict of resolved.affectedFileConflicts) {
     reasons.push(`Affected file ${conflict.file} is active in run ${conflict.runId} for ${conflict.partition}/${conflict.taskId}.`);
   }
@@ -175,8 +220,8 @@ export async function inspectSyncBack(projectRoot: string, options: { runId?: st
   const verifyContract = await inspectVerifyContract(projectRoot, { branch, branchSource: 'cli_option' });
   const blockingVerifyIssues = verifyContract.status === 'PASS' ? [] : verifyContract.issues;
   const staleVerifyRecoveryCommand = verifyContract.status === 'PASS' ? null : `sdd verifies write --branch ${branch} --force && sdd sync-back inspect ${state.runId} --branch ${branch} --task ${taskId}`;
-  const proposalPath = state.syncBack.proposalPath;
-  const expectedProposalDigest = state.syncBack.proposalDigest ?? null;
+  const proposalPath = syncBackDecision?.proposalPath ?? state.syncBack.proposalPath;
+  const expectedProposalDigest = syncBackDecision?.proposalDigest ?? state.syncBack.proposalDigest ?? null;
   let proposal: string | null = null;
   let proposalDigestValid: boolean | null = null;
   if (!proposalPath) {
@@ -215,7 +260,10 @@ export async function inspectSyncBack(projectRoot: string, options: { runId?: st
     applyPolicy = requireSyncBackApproval(applyPolicy, `Current Git branch is ${resolved.context.currentGitBranch}, but run ${state.runId} belongs to ${state.gitBranch}.`);
   }
 
-  const status: SyncBackInspectionStatus = state.syncBack.status === 'applied' ? 'applied' : reasons.length === 0 ? 'ready' : 'blocked';
+  const capabilityReadiness = await inspectSyncBackCapabilityReadiness(projectRoot, state.runId, taskId, state.validation.status);
+  const capabilityReadinessReasons = syncBackCapabilityReadinessReasons(capabilityReadiness);
+  reasons.push(...capabilityReadinessReasons);
+  const status: SyncBackInspectionStatus = (syncBackDecision?.status ?? state.syncBack.status) === 'applied' ? 'applied' : reasons.length === 0 ? 'ready' : 'blocked';
   const artifacts = state.validation.evidence.length > 0 ? state.validation.evidence : state.artifacts.map((artifact) => artifact.path);
   const gaps = [...taskGaps, ...runtimeGaps];
 
@@ -236,6 +284,7 @@ export async function inspectSyncBack(projectRoot: string, options: { runId?: st
     artifacts,
     gaps,
     applyPolicy,
+    capabilityReadiness,
     approvalCard: buildSyncBackApprovalCard({
       runId: state.runId,
       branch,
@@ -252,14 +301,18 @@ export async function inspectSyncBack(projectRoot: string, options: { runId?: st
       verifyContractStatus: verifyContract.status,
       verifyContractIssues: blockingVerifyIssues,
       staleVerifyRecoveryCommand,
-      lifecycleRisk
+      lifecycleRisk,
+      capabilityReadiness,
+      workflowGateDecision
     }),
     staleReasons: resolved.staleReasons,
     affectedFileConflicts: resolved.affectedFileConflicts,
     verifyContractStatus: verifyContract.status,
     verifyContractIssues: blockingVerifyIssues,
     staleVerifyRecoveryCommand,
-    lifecycleRisk
+    lifecycleRisk,
+    workflowGateDecision,
+    taskEvidenceView
   };
 }
 
@@ -280,6 +333,8 @@ function buildSyncBackApprovalCard(input: {
   verifyContractIssues: VerifyContractIssue[];
   staleVerifyRecoveryCommand: string | null;
   lifecycleRisk: LifecycleRiskConsumerDiagnostic;
+  capabilityReadiness: SyncBackCapabilityReadiness;
+  workflowGateDecision: TaskEvidenceView['workflowGate']['latestDecision'];
 }): SyncBackApprovalCard {
   return {
     contract: 'sdd-sync-back-approval-card-v1',
@@ -297,6 +352,7 @@ function buildSyncBackApprovalCard(input: {
       digestValid: input.proposalDigestValid
     },
     approval: input.applyPolicy,
+    capabilityReadiness: input.capabilityReadiness,
     blockers: input.reasons,
     staleReasons: input.staleReasons,
     affectedFileConflicts: input.affectedFileConflicts.map((conflict) => ({
@@ -311,10 +367,18 @@ function buildSyncBackApprovalCard(input: {
     verifyContractIssues: input.verifyContractIssues,
     staleVerifyRecoveryCommand: input.staleVerifyRecoveryCommand,
     lifecycleRisk: input.lifecycleRisk,
+    workflowGateDecision: input.workflowGateDecision,
     nextAction: syncBackApprovalNextAction(input.status, input.applyPolicy, input.runId, input.branch, input.taskId, input.staleVerifyRecoveryCommand, input.proposalPath)
   };
 }
 
+function syncBackWorkflowGateReasons(decision: NonNullable<TaskEvidenceView['workflowGate']['latestDecision']>, explicitRunId: boolean): string[] {
+  return decision.hardBlocks
+    .filter((check) => check.code !== 'stale_documents' && check.code !== 'contract_hash_mismatch')
+    .filter((check) => !(explicitRunId && check.code === 'run_rejected'))
+    .map((check) => `Workflow gate blocked sync-back: ${check.code}: ${check.message}`);
+}
+
 function syncBackApprovalRisk(status: SyncBackInspectionStatus, applyPolicy: SyncBackApplyPolicy): SyncBackApprovalCard['risk'] {
   if (status === 'blocked') {
     return 'blocked';
@@ -424,6 +488,75 @@ function syncBackTaskLifecycleRiskReasons(branch: string, model: SddTaskModel, t
   return [];
 }
 
+async function inspectSyncBackCapabilityReadiness(projectRoot: string, runId: string, taskId: string, validationStatus: string): Promise<SyncBackCapabilityReadiness> {
+  const testRuns = await listRuntimeTestRuns(projectRoot, runId);
+  const latest = testRuns.find((run) => run.taskId === taskId);
+  const evidence = capabilityEvidenceFromPayload(latest?.payload);
+  if (evidence.length === 0) {
+    return {
+      status: 'not_recorded',
+      authoritativeForApply: false,
+      requiredDomains: [],
+      accepted: [],
+      candidate: [],
+      quarantined: [],
+      diagnostic: [],
+      blocked: [],
+      reason: 'No capability evidence classification was recorded for this sync-back candidate; apply readiness still depends on accepted runtime validation evidence.'
+    };
+  }
+  const professional = evidence.filter((item) => item.source === 'professional_capability');
+  const blockingEvidence = evidence.filter(isSyncBackBlockingCapabilityEvidence);
+  const readiness: SyncBackCapabilityReadiness = {
+    status: 'candidate_only',
+    authoritativeForApply: false,
+    requiredDomains: uniqueStrings(professional.map((item) => item.domainOrSourceId)),
+    accepted: evidenceNames(evidence, 'accepted'),
+    candidate: evidenceNames(evidence, 'candidate'),
+    quarantined: evidenceNames(evidence, 'quarantined'),
+    diagnostic: evidenceNames(evidence, 'diagnostic'),
+    blocked: evidenceNames(blockingEvidence, 'blocked'),
+    reason: 'Capability evidence is advisory for sync-back; task completion writeback is governed by accepted runtime validation evidence and apply policy.'
+  };
+  if (readiness.blocked.length > 0) {
+    return { ...readiness, status: 'blocked', reason: 'Blocked capability sources cannot authorize sync-back apply.' };
+  }
+  if (validationStatus === 'pass') {
+    return { ...readiness, status: 'runtime_evidence_ready', reason: 'Runtime validation evidence is accepted; capability evidence remains advisory and cannot mark completion by itself.' };
+  }
+  return readiness;
+}
+
+function syncBackCapabilityReadinessReasons(readiness: SyncBackCapabilityReadiness): string[] {
+  return readiness.status === 'blocked' ? [readiness.reason] : [];
+}
+
+function isSyncBackBlockingCapabilityEvidence(item: CapabilityEvidenceClassification): boolean {
+  return item.class === 'blocked' && (item.source === 'professional_capability' || item.acceptanceRefs.length > 0);
+}
+
+function capabilityEvidenceFromPayload(payload: unknown): CapabilityEvidenceClassification[] {
+  if (!isRecord(payload) || !Array.isArray(payload.capabilityEvidence)) {
+    return [];
+  }
+  return payload.capabilityEvidence.filter(isCapabilityEvidenceClassification);
+}
+
+function isCapabilityEvidenceClassification(value: unknown): value is CapabilityEvidenceClassification {
+  return isRecord(value)
+    && (value.class === 'accepted' || value.class === 'candidate' || value.class === 'quarantined' || value.class === 'diagnostic' || value.class === 'blocked')
+    && (value.source === 'professional_capability' || value.source === 'external_source' || value.source === 'runtime_diagnostic')
+    && typeof value.domainOrSourceId === 'string';
+}
+
+function evidenceNames(evidence: CapabilityEvidenceClassification[], evidenceClass: CapabilityEvidenceClassification['class']): string[] {
+  return uniqueStrings(evidence.filter((item) => item.class === evidenceClass).map((item) => `${item.source}:${item.domainOrSourceId}`));
+}
+
+function uniqueStrings(values: string[]): string[] {
+  return [...new Set(values)].sort((left, right) => left.localeCompare(right));
+}
+
 function deriveSyncBackApplyPolicy(state: RunState, task: SddTask | null): SyncBackApplyPolicy {
   const reasons: string[] = [];
   const decision = state.lifecycleDecision?.decision;

package/node_modules/@sdd-agent-platform/core/src/sync-back/sync-back.test.ts

@@ -18,12 +18,46 @@ import { bindTestRunState, markTestRunReadyForSyncBack } from '../test-support/r
 import { runGoalVerify } from '../verification/goal-verify.js';
 import { inspectVerifyContract, writeVerifyContract } from '../verification/verify-contract.js';
 import { runSingleTaskLoop } from '../verification/single-task-loop.js';
+import { runSddTest } from '../verification/test-runtime.js';
 import { createDelegationRecord } from '../delegation/validation.js';
+import { recordRuntimeTestRun } from '../storage/runtime-store.js';
 import { applySyncBack } from './apply.js';
 import { inspectSyncBack } from './inspect.js';
 
 const execFileAsync = promisify(execFile);
 
+function capabilitySyncBackTaskMarkdown(taskId: string, command: string): string {
+  return `# Tasks
+
+### ${taskId}: Mapped validation task
+
+\`\`\`sdd-task
+id: ${taskId}
+status: pending
+wave: 1
+depends_on: []
+acceptance_refs:
+  - AC-1
+plan_refs:
+  - "§4 Target Design Overview"
+affected_files:
+  - docs/${taskId.toLowerCase()}.md
+validation:
+  - ${command} => AC-1
+risk:
+  - security
+\`\`\`
+
+#### Boundary
+
+Stay in validation runtime fixtures only.
+
+#### Acceptance
+
+- AC-1: Parser behavior is covered.
+`;
+}
+
 test('sync-back inspect blocks modified proposal digest', async () => {
   const root = await mkdtemp(path.join(tmpdir(), 'sdd-syncback-digest-'));
   try {
@@ -96,6 +130,89 @@ test('sync-back apply requires approval for risky complex tasks', async () => {
   }
 });
 
+test('sync-back inspect surfaces capability readiness without making capability evidence authoritative', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-syncback-capability-readiness-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'feature', capabilitySyncBackTaskMarkdown('CAPABILITY', 'node -e "process.stdout.write(\'ok\')"'));
+    await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
+
+    const tested = await runSddTest(root, {
+      branch: 'feature',
+      taskId: 'CAPABILITY',
+      approved: true,
+      commands: ['node -e "process.stdout.write(\'ok\')"']
+    });
+    const testState = await readRunState(root, tested.runId);
+    assert.equal(tested.status, 'PASS');
+    assert.equal(tested.syncBackReady, false);
+    assert.equal(testState.syncBack.status, 'not_created');
+    await markTestRunReadyForSyncBack(root, tested.runId, 'CAPABILITY');
+    const syncBack = await inspectSyncBack(root, { runId: tested.runId, branch: 'feature', taskId: 'CAPABILITY' });
+
+    assert.equal(syncBack.status, 'ready');
+    assert.equal(syncBack.capabilityReadiness.status, 'runtime_evidence_ready');
+    assert.equal(syncBack.capabilityReadiness.authoritativeForApply, false);
+    assert.deepEqual(syncBack.capabilityReadiness.requiredDomains, ['security-engineering']);
+    assert.equal(syncBack.capabilityReadiness.candidate.some((item) => item.includes('security-engineering')), true);
+    assert.equal(syncBack.capabilityReadiness.quarantined.length > 0, true);
+    assert.deepEqual(syncBack.capabilityReadiness.accepted, []);
+    assert.deepEqual(syncBack.approvalCard.capabilityReadiness, syncBack.capabilityReadiness);
+    await assert.rejects(
+      () => applySyncBack(root, { runId: tested.runId, branch: 'feature', taskId: 'CAPABILITY' }),
+      /--approved/
+    );
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('sync-back inspect blocks explicitly blocked capability readiness', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-syncback-blocked-capability-readiness-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'feature', capabilitySyncBackTaskMarkdown('CAPABILITY', 'node -e "process.stdout.write(\'ok\')"'));
+    await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
+    const state = await createRun(root, { runId: 'run-1' });
+    await bindTestRunState(root, state.runId, 'feature', 'CAPABILITY');
+    await markTestRunReadyForSyncBack(root, state.runId, 'CAPABILITY');
+    const now = new Date().toISOString();
+    await recordRuntimeTestRun(root, {
+      testRunId: 'blocked-capability-test',
+      runId: state.runId,
+      partition: 'feature',
+      taskId: 'CAPABILITY',
+      status: 'PASS',
+      startedAt: now,
+      completedAt: now,
+      payload: {
+        capabilityEvidence: [{
+          class: 'blocked',
+          source: 'external_source',
+          domainOrSourceId: 'denied-source',
+          evidenceRefs: [],
+          acceptanceRefs: ['AC-1'],
+          provenanceRefs: [],
+          reason: 'Denied external capability source must not be used for sync-back.'
+        }]
+      }
+    });
+
+    const syncBack = await inspectSyncBack(root, { runId: state.runId, branch: 'feature', taskId: 'CAPABILITY' });
+
+    assert.equal(syncBack.status, 'blocked');
+    assert.equal(syncBack.capabilityReadiness.status, 'blocked');
+    assert.equal(syncBack.capabilityReadiness.blocked.includes('external_source:denied-source'), true);
+    assert.equal(syncBack.reasons.some((reason) => reason.includes('Blocked capability sources')), true);
+    await assert.rejects(
+      () => applySyncBack(root, { runId: state.runId, branch: 'feature', taskId: 'CAPABILITY' }),
+      /Blocked capability sources/
+    );
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
 test('sync-back gates direct-safe task by task scope instead of branch lifecycle risk', async () => {
   const root = await mkdtemp(path.join(tmpdir(), 'sdd-syncback-task-scope-'));
   try {
@@ -234,7 +351,7 @@ test('sync-back inspect reports stale verify contract as diagnostic without bloc
   }
 });
 
-test('sync-back inspect reports missing verify contract as diagnostic without blocking ready task', async () => {
+test('sync-back inspect blocks missing verify contract instead of treating it as ready', async () => {
   const root = await mkdtemp(path.join(tmpdir(), 'sdd-syncback-missing-verify-'));
   try {
     await initProject(root);
@@ -245,11 +362,11 @@ test('sync-back inspect reports missing verify contract as diagnostic without bl
 
     const syncBack = await inspectSyncBack(root, { runId: state.runId, branch: 'feature', taskId: 'T1' });
 
-    assert.equal(syncBack.status, 'ready');
-    assert.equal(syncBack.verifyContractStatus, 'WARN');
+    assert.equal(syncBack.status, 'blocked');
+    assert.equal(syncBack.verifyContractStatus, 'BLOCKED');
     assert.equal(syncBack.verifyContractIssues.some((issue) => issue.field === 'verify.md'), true);
     assert.match(syncBack.staleVerifyRecoveryCommand ?? '', /sdd verifies write --branch feature --force/);
-    assert.equal(syncBack.reasons.some((reason) => reason.includes('Verification contract document is missing.')), false);
+    assert.equal(syncBack.reasons.some((reason) => reason.includes('Workflow gate blocked sync-back: missing_documents')), true);
   } finally {
     await rm(root, { recursive: true, force: true });
   }
@@ -302,7 +419,7 @@ test('sync-back apply refreshes verify contract after tasks writeback', async ()
   }
 });
 
-test('Phase 6.5 requires approval before sync-back apply on the wrong Git branch', async () => {
+test('Phase 8.12 requires approval for sync-back on the wrong Git branch and allows explicit approved run', async () => {
   const root = await mkdtemp(path.join(tmpdir(), 'sdd-phase65-wrong-branch-'));
   try {
     await initProject(root);
@@ -315,15 +432,19 @@ test('Phase 6.5 requires approval before sync-back apply on the wrong Git branch
     await markTestRunReadyForSyncBack(root, state.runId, 'T1');
 
     const syncBack = await inspectSyncBack(root, { branch: 'feature', taskId: 'T1' });
+    const explicitSyncBack = await inspectSyncBack(root, { runId: state.runId, branch: 'feature', taskId: 'T1' });
 
     assert.equal(syncBack.status, 'ready');
     assert.equal(syncBack.applyPolicy.requiresApproval, true);
     assert.equal(syncBack.applyPolicy.reasons.some((reason) => reason.includes('Current Git branch is other')), true);
+    assert.equal(explicitSyncBack.status, 'ready');
+    assert.equal(explicitSyncBack.applyPolicy.requiresApproval, true);
+    assert.equal(explicitSyncBack.applyPolicy.reasons.some((reason) => reason.includes('Current Git branch is other')), true);
     await assert.rejects(
       () => applySyncBack(root, { branch: 'feature', taskId: 'T1' }),
-      /--approved/
+      /Current Git branch is other/
     );
-    const applied = await applySyncBack(root, { branch: 'feature', taskId: 'T1', approved: true });
+    const applied = await applySyncBack(root, { runId: state.runId, branch: 'feature', taskId: 'T1', approved: true });
     assert.equal(applied.applied, true);
   } finally {
     await rm(root, { recursive: true, force: true });
@@ -340,7 +461,9 @@ test('Phase 6.5 reports active affected file conflicts', async () => {
     await markTestRunReadyForSyncBack(root, runA.runId, 'T1');
     const runB = await createRun(root, { runId: 'run-b' });
     await bindTestRunState(root, runB.runId, 'feature', 'T2');
-    await markTestRunReadyForSyncBack(root, runB.runId, 'T2');
+    const runC = await createRun(root, { runId: 'run-c' });
+    await bindTestRunState(root, runC.runId, 'feature', 'T2');
+    await markTestRunReadyForSyncBack(root, runC.runId, 'T2');
 
     const syncBack = await inspectSyncBack(root, { runId: runA.runId, branch: 'feature', taskId: 'T1' });
     const status = await getProjectStatus(root, { branch: 'feature' });
@@ -435,7 +558,7 @@ test('sync-back blocks downstream apply until dependencies are completed', async
     const syncBack = await inspectSyncBack(root, { runId: state.runId, branch: 'feature', taskId: 'DEP2' });
 
     assert.equal(syncBack.status, 'blocked');
-    assert.equal(syncBack.reasons.some((reason) => reason.includes('DEP2 depends on DEP1, but DEP1 status is pending')), true);
+    assert.equal(syncBack.reasons.some((reason) => reason.includes('DEP2 depends on DEP1, but DEP1 has not passed required verification')), true);
     await assert.rejects(
       () => applySyncBack(root, { runId: state.runId, branch: 'feature', taskId: 'DEP2', approved: true }),
       /DEP2 depends on DEP1/

package/node_modules/@sdd-agent-platform/core/src/test-support/fixtures.ts

@@ -17,6 +17,26 @@ export function phase63ProjectRuntimeConfig(): string {
       source_ref: docs/external/frontend-agent-manifest.yml
       reuse_decision: adapt_via_host_adapter
       quarantine_required: true
+      quarantine_status: quarantined
+      permission_model:
+        - project-scoped read/search only before quarantine pass
+        - no direct prompt import
+      provenance_requirements:
+        - project manifest path
+        - source attribution
+        - quarantine scan result
+      host_compatibility:
+        - claude-code:future_adapter
+        - host-neutral:future_adapter
+      allowed_evidence_types:
+        - candidate_evidence
+        - external_reference
+      forbidden_authority:
+        - lifecycle gate authority
+        - stage completion decision
+        - sync-back apply decision
+        - ship readiness pass
+        - permission escalation
       allowed_use: declarative taxonomy and capability mapping only
       attribution: project frontend manifest
       rationale: project-provided agent metadata for validated contracts only
@@ -94,6 +114,7 @@ export function phase63InvalidProjectRuntimeConfig(): string {
       source_ref: docs/external/unsafe-agent-pack.yml
       reuse_decision: reuse_direct
       quarantine_required: true
+      quarantine_status: not_required
       allowed_use: direct execution and prompt import
       attribution: ""
       rationale: lifecycle authority request

package/node_modules/@sdd-agent-platform/core/src/test-support/run-state.ts

@@ -19,8 +19,13 @@ export async function bindTestRunState(root: string, runId: string, branch: stri
       specHash: model.documents.specHash ?? null,
       planHash: model.documents.planHash ?? null,
       tasksHash: model.documents.tasksHash ?? null,
+      specContractHash: model.documents.specContractHash ?? null,
+      planContractHash: model.documents.planContractHash ?? null,
+      tasksContractHash: model.documents.tasksContractHash ?? null,
       planBasedOnSpecHash: model.documents.planBasedOnSpecHash ?? null,
-      tasksBasedOnPlanHash: model.documents.tasksBasedOnPlanHash ?? null
+      tasksBasedOnPlanHash: model.documents.tasksBasedOnPlanHash ?? null,
+      planBasedOnSpecContractHash: model.documents.planBasedOnSpecContractHash ?? null,
+      tasksBasedOnPlanContractHash: model.documents.tasksBasedOnPlanContractHash ?? null
     }
   });
 }
@@ -34,7 +39,16 @@ export async function markTestRunReadyForSyncBack(root: string, runId: string, t
     status: 'completed',
     tasks: {
       ...state.tasks,
-      [taskId]: { status: 'verified', gaps: [], artifacts: ['artifacts/sync-back-proposal.md'] }
+      [taskId]: {
+        status: 'implemented_verified',
+        implementationStatus: 'implemented',
+        verificationStatus: 'pass',
+        validationBatch: null,
+        validationTiming: 'task_end',
+        requiresVerifyBeforeNext: true,
+        gaps: [],
+        artifacts: ['artifacts/sync-back-proposal.md']
+      }
     },
     validation: {
       status: 'pass',

package/node_modules/@sdd-agent-platform/core/src/verification/goal-verify.test.ts

@@ -255,7 +255,7 @@ test('runGoalVerify maps validation evidence to acceptance and writes sync-back
     assert.equal(inspection.taskRunEvidence.invocationLedger.some((entry) => entry.kind === 'artifact_hash' && entry.ref === 'artifacts/sync-back-proposal.md'), true);
     assert.equal(status.latestRun?.runId, state.runId);
     assert.equal(status.tasks.pending, 1);
-    assert.equal(status.recommendedNextCommand, 'sdd sync-back inspect --branch feature --task T1');
+    assert.equal(status.recommendedNextCommand, 'sdd ship --branch feature --dry-run');
     assert.equal(syncBack.status, 'ready');
     assert.equal(syncBack.markdownStatus, 'pending');
     assert.match(syncBack.proposal ?? '', /status: verified/);