sdd-agent-platform 0.4.0 → 0.4.2

package/node_modules/@sdd-agent-platform/core/src/delegation/validation.ts

@@ -1,5 +1,5 @@
 import { DELEGATION_LIVENESS_CONTRACT, DELEGATION_LIVENESS_VERSION } from '../contracts.js';
-import { toArtifactRootRelativePath } from '../runtime-paths.js';
+import { normalizeStageEvidenceOrLegacyArtifactRef } from '../runtime-paths.js';
 import { validateSddResultArtifact } from '../artifacts/sdd-result.js';
 import type { DelegationRecord, DelegationStatus } from './model.js';
 
@@ -17,7 +17,7 @@ export interface DelegationValidationReport {
   issues: ContractValidationIssue[];
 }
 
-export function createDelegationRecord(input: { delegationId: string; task: string; agent: string; expectedArtifact: string; runMode?: DelegationRecord['runMode']; blocking?: boolean; requiredForPhaseExit?: boolean; startedAt?: string; timeoutSeconds?: number; status?: DelegationStatus }): DelegationRecord {
+export function createDelegationRecord(input: { delegationId: string; task: string; agent: string; expectedArtifact: string; runMode?: DelegationRecord['runMode']; blocking?: boolean; requiredForPhaseExit?: boolean; startedAt?: string; timeoutSeconds?: number; status?: DelegationStatus; attempt?: number; retryOf?: string | null; replayReason?: DelegationRecord['replayReason'] }): DelegationRecord {
   return {
     contract: DELEGATION_LIVENESS_CONTRACT,
     version: DELEGATION_LIVENESS_VERSION,
@@ -33,7 +33,10 @@ export function createDelegationRecord(input: { delegationId: string; task: stri
     timeoutSeconds: input.timeoutSeconds ?? 900,
     expectedArtifact: input.expectedArtifact,
     terminalEventRequired: true,
-    terminalEventAt: null
+    terminalEventAt: null,
+    attempt: input.attempt,
+    retryOf: input.retryOf ?? null,
+    replayReason: input.replayReason ?? null
   };
 }
 
@@ -105,9 +108,9 @@ function validateDelegationShape(delegation: DelegationRecord): ContractValidati
 
 function validateRunRelativeArtifactReference(value: string, issues: ContractValidationIssue[], field = 'artifacts'): void {
   try {
-    toArtifactRootRelativePath(value);
+    normalizeStageEvidenceOrLegacyArtifactRef(value);
   } catch (error) {
-    issues.push(contractIssue(field, messageFromError(error), 'Use run-relative artifacts/<file> paths that stay under the run artifact directory.'));
+    issues.push(contractIssue(field, messageFromError(error), 'Use repo-relative .sdd/runs/<branch>/<stage>/*.md stage evidence refs for new delegation evidence.'));
   }
 }
 

package/node_modules/@sdd-agent-platform/core/src/doctor/checks/document-chain.ts

@@ -57,7 +57,7 @@ export async function inspectDocumentChainEvidence(projectRoot: string, branch?:
             level: 'WARN',
             check: 'document_chain_high_risk_evidence',
             message: `High-risk task ${task.id} should require explicit reviewer and validator evidence artifacts.`,
-            action: 'Add artifacts/review-<task>.md and artifacts/validation-<task>.md or equivalent evidence paths.'
+            action: 'Add .sdd/runs/<branch>/do/code-review-vN.md and .sdd/runs/<branch>/test/validation-vN.md or equivalent accepted stage evidence paths.'
           });
         }
         if (task.verificationAvailability.length === 0) {

package/node_modules/@sdd-agent-platform/core/src/doctor/checks/project.ts

@@ -6,7 +6,7 @@ import { promisify } from 'node:util';
 import { PROJECT_CONFIG_CONTRACT } from '../../contracts.js';
 import { messageFromError } from '../../contracts/issues.js';
 import { readProjectConfig as readProjectConfigFile } from '../../config/project-config.js';
-import { getProjectConfigPath, getRunsDir } from '../../runtime-paths.js';
+import { getProjectConfigPath, getRunEvidenceRoot } from '../../runtime-paths.js';
 import type { ProjectAgentRuntimeConfig } from '../../router/agent-runtime.js';
 import { parseAgentRuntimeConfig } from '../../router/agent-runtime-config.js';
 import { exists } from '../../storage/json-io.js';
@@ -45,24 +45,24 @@ export async function inspectProjectConfig(projectRoot: string): Promise<{ exist
 }
 
 export async function inspectRunsDirectoryAccess(projectRoot: string): Promise<{ available: boolean; checks: DoctorCheck[] }> {
-  const runsDir = getRunsDir(projectRoot);
-  if (!(await exists(runsDir))) {
+  const stageEvidenceRoot = getRunEvidenceRoot(projectRoot);
+  if (!(await exists(stageEvidenceRoot))) {
     return {
-      available: false,
-      checks: [{ level: 'WARN', check: 'runs_dir', message: '.sdd/runs does not exist yet.', action: 'Run sdd init or sdd run create.' }]
+      available: true,
+      checks: [{ level: 'WARN', check: 'stage_evidence_dir', message: '.sdd/runs/<branch>/<stage> evidence root does not exist yet.', action: 'Let stage-manager or agent-team author accepted evidence under .sdd/runs/<branch>/<stage>/*.md during do/test/ship flow.' }]
     };
   }
 
   try {
-    await access(runsDir, constants.R_OK | constants.W_OK);
+    await access(stageEvidenceRoot, constants.R_OK | constants.W_OK);
     return {
       available: true,
-      checks: [{ level: 'PASS', check: 'runs_dir', message: '.sdd/runs exists and is readable/writable.' }]
+      checks: [{ level: 'PASS', check: 'stage_evidence_dir', message: '.sdd/runs/<branch>/<stage> evidence root exists and is readable/writable.' }]
     };
   } catch {
     return {
       available: false,
-      checks: [{ level: 'FAIL', check: 'runs_dir', message: '.sdd/runs is not readable/writable.', action: 'Fix filesystem permissions for .sdd/runs.' }]
+      checks: [{ level: 'FAIL', check: 'stage_evidence_dir', message: '.sdd/runs/<branch>/<stage> evidence root is not readable/writable.', action: 'Fix filesystem permissions for branch stage evidence under .sdd/runs/<branch>/<stage>/*.md.' }]
     };
   }
 }

package/node_modules/@sdd-agent-platform/core/src/doctor/checks/registries.ts

@@ -12,7 +12,6 @@ import type { DoctorCheck } from '../model.js';
 const BASELINE_GOVERNANCE_POLICY_OPERATIONS: GovernancePolicyOperation[] = [
   'background_executor',
   'wave_executor',
-  'sync_back_apply',
   'destructive_git',
   'external_interaction',
   'cleanup'

package/node_modules/@sdd-agent-platform/core/src/doctor/checks/run-evidence.ts

@@ -109,11 +109,11 @@ export async function inspectRunEvidence(projectRoot: string, options: { allRuns
       }
       if (routePreflightEvents.length > 0 && agentExecutionRecords.length === 0) {
         issueCount += 1;
-        checks.push({ level: 'FAIL', check: 'agent_execution_record', message: `${runId}: agent_router_preflight exists but no AgentExecutionRecord was persisted.`, action: 'Persist blocked/skipped/claimed/completed execution provenance under .sdd/runs/<run_id>/agent-executions/.' });
+        checks.push({ level: 'FAIL', check: 'agent_execution_record', message: `${runId}: agent_router_preflight exists but no AgentExecutionRecord was persisted.`, action: 'Persist blocked/skipped/claimed/completed execution provenance in runtime.sqlite agent_executions.' });
       }
       if (routePreflightEvents.some(routePreflightNeedsTeamSession) && teamSessionRecords.length === 0) {
         issueCount += 1;
-        checks.push({ level: 'FAIL', check: 'team_session_record', message: `${runId}: team-mode preflight exists but no TeamSessionRecord was persisted.`, action: 'Persist team-mode provenance under .sdd/runs/<run_id>/team-sessions/.' });
+        checks.push({ level: 'FAIL', check: 'team_session_record', message: `${runId}: team-mode preflight exists but no TeamSessionRecord was persisted.`, action: 'Persist team-mode provenance in runtime.sqlite team_sessions.' });
       }
       for (const delegation of Object.values(state.delegations).filter((candidate) => isDelegationTerminal(candidate.status))) {
         if (agentExecutionRecords.length > 0 && !agentExecutionRecords.some((record) => record.delegationId === delegation.delegationId)) {
@@ -167,7 +167,7 @@ export async function inspectRunEvidence(projectRoot: string, options: { allRuns
 
 
   if (states.length === 0) {
-    checks.push({ level: 'WARN', check: 'run_evidence', message: 'No runs found in runtime.sqlite.', action: 'Create a run before /sdd:do or /sdd:test.' });
+    checks.push({ level: 'WARN', check: 'run_evidence', message: 'No runs found in runtime.sqlite.', action: 'Create a run before do/test execution.' });
   } else if (inspected.length === 0 && issueCount === 0) {
     checks.push({ level: 'WARN', check: 'run_evidence', message: branchPartition ? `No non-archived runs were inspected for branch ${branchPartition}.` : 'No non-archived runs were inspected.', action: 'Use sdd doctor --all-runs to audit archived history or create a new run.' });
   } else if (issueCount === 0) {
@@ -189,7 +189,7 @@ async function inspectLatestRunEvidenceFastPath(projectRoot: string, branch: str
       message: `Workflow State Resolver inspected latest run ${latestRun.runId} for ${workflow.branch} without deep evidence scan.`
     }];
     for (const conflict of workflow.affectedFileConflicts) {
-      checks.push({ level: 'WARN', check: 'run_evidence_fast_path_conflict', message: `Affected file ${conflict.file} is active in run ${conflict.runId} for ${conflict.partition}/${conflict.taskId}.`, action: 'Use sdd sync-back inspect or sdd doctor --all-runs for deep runtime evidence diagnostics.' });
+      checks.push({ level: 'WARN', check: 'run_evidence_fast_path_conflict', message: `Affected file ${conflict.file} is active in run ${conflict.runId} for ${conflict.partition}/${conflict.taskId}.`, action: 'Use sdd status or sdd doctor --all-runs for deep runtime evidence diagnostics.' });
     }
     return checks;
   } catch (error) {
@@ -222,7 +222,7 @@ function inspectArtifactScopeConsistency(state: RunState, invocationLedger: Awai
       level: 'FAIL',
       check: 'artifact_scope',
       message: `${state.runId}: ${artifactWrites.length} artifact write(s) are attached to an unscoped run.`,
-      action: 'Create runs with sdd run create --branch <branch> --task <task_id> before writing artifacts.'
+      action: 'Create scoped runtime state with sdd run create --branch <branch> --task <task_id> before registering stage evidence.'
     });
   }
   for (const entry of artifactWrites) {
@@ -231,7 +231,7 @@ function inspectArtifactScopeConsistency(state: RunState, invocationLedger: Awai
         level: 'FAIL',
         check: 'artifact_scope',
         message: `${state.runId}: artifact ${entry.ref} is scoped to task ${entry.taskId}, but run task is ${state.taskId}.`,
-        action: 'Write artifacts only through the scoped run/task pair that owns the evidence.'
+        action: 'Register evidence only through the scoped run/task pair that owns the stage evidence ref.'
       });
     }
     if (entry.branch && state.partition && entry.branch !== state.partition && entry.branch !== state.gitBranch) {
@@ -239,7 +239,7 @@ function inspectArtifactScopeConsistency(state: RunState, invocationLedger: Awai
         level: 'FAIL',
         check: 'artifact_scope',
         message: `${state.runId}: artifact ${entry.ref} is scoped to branch ${entry.branch}, but run branch is ${state.gitBranch ?? state.partition}.`,
-        action: 'Reject branch/run mismatches before artifact writes.'
+        action: 'Reject branch/run mismatches before registering stage evidence refs.'
       });
     }
   }

package/node_modules/@sdd-agent-platform/core/src/doctor/checks/run-trust.ts

@@ -1,4 +1,3 @@
-import { createHash } from 'node:crypto';
 import { SDD_EVIDENCE_CONTRACT } from '../../contracts.js';
 import { messageFromError } from '../../contracts/issues.js';
 import { containsTemplatePlaceholder, validateArtifactTrust, type EvidenceClaim } from '../../artifacts/sdd-evidence.js';
@@ -14,23 +13,6 @@ export async function inspectRunTrustEvidence(projectRoot: string, state: RunSta
   const materials = ledgerMaterialRefs(invocationLedger);
   let inspectedTrustArtifacts = 0;
 
-  if (state.syncBack.status !== 'not_created') {
-    if (!state.syncBack.proposalPath) {
-      checks.push({ level: 'FAIL', check: 'sync_back_monotonicity', message: `${runId}: sync-back status is ${state.syncBack.status} but proposalPath is missing.`, action: 'Keep sync-back transitions monotonic and preserve the proposal path from verify/apply.' });
-    } else if (!state.syncBack.proposalDigest) {
-      checks.push({ level: 'WARN', check: 'sync_back_proposal_digest', message: `${runId}: sync-back proposal ${state.syncBack.proposalPath} has no recorded digest.`, action: 'Re-run verify with the Phase 6.9 runtime so inspect/apply can detect proposal drift.' });
-    } else {
-      try {
-        const proposal = await readArtifact(projectRoot, runId, toArtifactRootRelativePath(state.syncBack.proposalPath));
-        const digest = hashDocumentContent(proposal);
-        if (digest !== state.syncBack.proposalDigest) {
-          checks.push({ level: 'FAIL', check: 'sync_back_proposal_digest', message: `${runId}: sync-back proposal ${state.syncBack.proposalPath} digest changed from ${state.syncBack.proposalDigest} to ${digest}.`, action: 'Restore the verified proposal or re-run verify before sync-back apply.' });
-        }
-      } catch (error) {
-        checks.push({ level: 'FAIL', check: 'sync_back_proposal_digest', message: `${runId}: cannot read sync-back proposal ${state.syncBack.proposalPath}: ${messageFromError(error)}`, action: 'Restore the proposal artifact before sync-back inspect/apply.' });
-      }
-    }
-  }
 
   for (const [taskId, taskState] of Object.entries(state.tasks)) {
     for (const coverage of acceptanceCoverageEntries(taskState)) {
@@ -119,9 +101,6 @@ function claimMaterialRefs(claim: EvidenceClaim): string[] {
   return refs;
 }
 
-function hashDocumentContent(raw: string): string {
-  return createHash('sha256').update(raw.replace(/\r\n/g, '\n'), 'utf8').digest('hex');
-}
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null;

package/node_modules/@sdd-agent-platform/core/src/doctor/checks/runtime-contracts.ts

@@ -265,7 +265,7 @@ export async function inspectWaveExecutorContract(projectRoot: string): Promise<
     return [{
       level: 'PASS',
       check: 'wave_executor_contract',
-      message: `Wave executor contract ${WAVE_EXECUTOR_CONTRACT_VERSION} declares ${strategies.length} strategy option(s), planner-driven execution, and no sync-back apply side effects.`
+      message: `Wave executor contract ${WAVE_EXECUTOR_CONTRACT_VERSION} declares ${strategies.length} strategy option(s), planner-driven execution, and no truth-alignment approval side effects.`
     }];
   } catch (error) {
     return [{

package/node_modules/@sdd-agent-platform/core/src/doctor/doctor.test.ts

@@ -1,7 +1,7 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import { execFile } from 'node:child_process';
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { promisify } from 'node:util';
@@ -15,12 +15,14 @@ import { rebuildLocalRunIndex } from '../run-state/run-index.js';
 import { archiveRun, createRun, readRunState, writeRunState } from '../run-state/run-state.js';
 import { validResultArtifact, validTaskMarkdown, writeBranchDocs } from '../test-support/fixtures.js';
 import { bindTestRunState } from '../test-support/run-state.js';
-import { STAGE_RUN_CONTRACT_VERSION, SUBAGENT_DISPATCH_CONTRACT_VERSION, WORKFLOW_HANDOFF_CONTRACT_VERSION, type RuntimeScope } from '../contracts.js';
+import { EVENT_LOG_CONTRACT, STAGE_RUN_CONTRACT_VERSION, SUBAGENT_DISPATCH_CONTRACT_VERSION, WORKFLOW_HANDOFF_CONTRACT_VERSION, type RuntimeScope } from '../contracts.js';
 import { recordStageRunProjection, recordWorkflowHandoffProjection, type StageRun, type WorkflowHandoff } from '../stage-runtime.js';
 import { decideContextOffload, evaluateContextLoadSignal, recordContextLoadSignalProjection, recordContextOffloadDecisionProjection } from '../context-offload.js';
 import { recordSubagentDispatchProjection, type SubagentDispatch } from '../subagents.js';
 import { runShip } from '../lifecycle/ship.js';
-import { withRuntimeStore } from '../storage/runtime-store.js';
+import { listRuntimeRepairs, recordRuntimeCapabilityAdoption, recordRuntimeEvent, recordRuntimeTestRun, recordRuntimeTestStep, runtimeScopedId, withRuntimeStore } from '../storage/runtime-store.js';
+import { getProjectStatus } from '../status/project-status.js';
+import { writeVerifyContract } from '../verification/verify-contract.js';
 import { doctor } from './doctor.js';
 
 const execFileAsync = promisify(execFile);
@@ -225,6 +227,101 @@ test('doctor latestOnly ignores older failed run evidence', async () => {
   }
 });
 
+test('doctor reports runtime performance observability warnings', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-runtime-performance-doctor-'));
+  try {
+    await initProject(root);
+    const staleRun = await createRun(root, { runId: 'run-stale' });
+    const missingStepsRun = await createRun(root, { runId: 'run-missing-steps' });
+    const waitingRun = await createRun(root, { runId: 'run-waiting' });
+    const slowRun = await createRun(root, { runId: 'run-slow-validation' });
+
+    const staleState = { ...staleRun, status: 'running' as const, updatedAt: '2020-01-01T00:00:00.000Z' };
+    await withRuntimeStore(root, ({ db }) => {
+      db.prepare('UPDATE runs SET status = ?, updated_at = ?, state_json = ?, state_hash = ? WHERE run_id = ?')
+        .run(staleState.status, staleState.updatedAt, JSON.stringify(staleState), 'test-stale', staleState.runId);
+    });
+    await recordRuntimeTestRun(root, {
+      testRunId: 'test-run-missing-steps',
+      runId: missingStepsRun.runId,
+      partition: 'master',
+      taskId: 'T1',
+      status: 'PASS',
+      startedAt: '2026-05-01T00:00:00.000Z',
+      completedAt: '2026-05-01T00:00:02.000Z',
+      payload: {}
+    });
+    const waitingState = { ...waitingRun, createdAt: '2026-05-01T00:00:00.000Z', updatedAt: '2026-05-01T00:00:40.000Z' };
+    await withRuntimeStore(root, ({ db }) => {
+      db.prepare('DELETE FROM events WHERE run_id = ?').run(waitingRun.runId);
+      db.prepare('UPDATE runs SET updated_at = ?, state_json = ?, state_hash = ? WHERE run_id = ?')
+        .run(waitingState.updatedAt, JSON.stringify(waitingState), 'test-waiting', waitingState.runId);
+    });
+    await recordRuntimeEvent(root, { contract: EVENT_LOG_CONTRACT, runId: waitingRun.runId, time: '2026-05-01T00:00:00.000Z', event: 'agent_invocation_started' });
+    await recordRuntimeEvent(root, { contract: EVENT_LOG_CONTRACT, runId: waitingRun.runId, time: '2026-05-01T00:00:30.000Z', event: 'run_context_bound' });
+    await recordRuntimeTestRun(root, {
+      testRunId: 'test-run-slow-validation',
+      runId: slowRun.runId,
+      partition: 'master',
+      taskId: 'T1',
+      status: 'PASS',
+      startedAt: '2026-05-01T00:00:00.000Z',
+      completedAt: '2026-05-01T00:01:00.000Z',
+      payload: {}
+    });
+    await recordRuntimeTestStep(root, {
+      stepId: 'test-run-slow-validation:001',
+      testRunId: 'test-run-slow-validation',
+      runId: slowRun.runId,
+      taskId: 'T1',
+      command: 'npm test',
+      status: 'PASS',
+      exitCode: 0,
+      durationMs: 45_000,
+      outputArtifact: 'artifacts/test-T1-001.log',
+      payload: { startedAt: '2026-05-01T00:00:00.000Z', endedAt: '2026-05-01T00:00:45.000Z' }
+    });
+
+    const report = await doctor(root, { allRuns: true });
+    const check = report.checks.find((candidate) => candidate.check === 'runtime_performance_observability');
+
+    assert.equal(check?.level, 'WARN');
+    assert.match(check?.message ?? '', /stale_open=.*run-stale/);
+    assert.match(check?.message ?? '', /missing_test_steps=run-missing-steps/);
+    assert.match(check?.message ?? '', /waiting_dominated=run-waiting:30000ms/);
+    assert.match(check?.message ?? '', /host_no_output=run-waiting:30000ms/);
+    assert.match(check?.message ?? '', /slow_validation=run-slow-validation:test-run-slow-validation:001:45000ms/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('doctor reports mixed-version recovery plan without legacy based_on repair', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-mixed-version-recovery-'));
+  try {
+    await initProject(root);
+    const taskMarkdown = validTaskMarkdown('T1', [])
+      .replace('validation:\n  - npm test', 'validation:\n  - ```powershell npm test')
+      .replace('risk: []', 'required_artifacts:\n  - specs/feature/artifacts/implement-T1.md\nrisk: []');
+    await writeBranchDocs(root, 'feature', taskMarkdown);
+    await writeFile(path.join(root, 'specs', 'feature', 'verify.md'), '# Verify\n\nbased_on_tasks_hash: legacy\n', 'utf8');
+
+    const report = await doctor(root, { branch: 'feature', latestOnly: true });
+    const check = report.checks.find((candidate) => candidate.check === 'mixed_version_recovery');
+
+    assert.equal(check?.level, 'FAIL');
+    assert.match(check?.message ?? '', /issues=2/);
+    assert.match(check?.message ?? '', /safe_fixes=1/);
+    assert.match(check?.message ?? '', /behavior_changes=1/);
+    assert.match(check?.message ?? '', /legacy_artifacts=none/);
+    assert.match(check?.message ?? '', /sdd doctor --branch feature --latest-only/);
+    assert.match(check?.action ?? '', /do not promote legacy stale runs as accepted truth/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+
 test('doctor trust suite flags mention-only acceptance and weak validator PASS artifacts', async () => {
   const root = await mkdtemp(path.join(tmpdir(), 'sdd-doctor-trust-'));
   try {
@@ -399,11 +496,71 @@ test('doctor reports unavailable Phase 8 runtime checks as warnings', async () =
     });
 
     const report = await doctor(root, { latestOnly: true, branch: 'master' });
+    const warningRepairs = await listRuntimeRepairs(root, { branchSlug: 'master', status: 'open' });
 
     assert.equal(report.checks.some((check) => check.check === 'lifecycle_risk_decision' && check.level === 'WARN' && /unavailable/.test(check.message)), true);
     assert.equal(report.checks.some((check) => check.check === 'workflow_handoff_state' && check.level === 'WARN' && /unavailable/.test(check.message)), true);
     assert.equal(report.checks.some((check) => check.check === 'context_offload_state' && check.level === 'WARN' && /unavailable/.test(check.message)), true);
     assert.equal(report.checks.some((check) => check.check === 'subagent_dispatch_state' && check.level === 'WARN' && /unavailable/.test(check.message)), true);
+    assert.equal(warningRepairs.some((repair) => repair.blockers.some((blocker) => /lifecycle_risk_decision|workflow_handoff_state|context_offload_state|subagent_dispatch_state/.test(blocker))), false);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('Phase 8.28 blocks release-critical capability gaps until adoption is recorded', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-capability-health-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'master', capabilityHealthTaskMarkdown('SECURITY'));
+
+    const status = await getProjectStatus(root, { branch: 'master' });
+    const report = await doctor(root, { latestOnly: true, branch: 'master' });
+    const ship = await runShip(root, { branch: 'master', dryRun: true });
+    const doctorCheck = report.checks.find((check) => check.check === 'capability_health');
+    const shipCheck = ship.checks.find((check) => check.name === 'capability_health');
+
+    assert.equal(status.capabilityHealth.status, 'blocked');
+    assert.equal(status.capabilityHealth.missingBaselineDomains.length, 0);
+    assert.equal(status.capabilityHealth.sources.quarantined > 0, true);
+    assert.equal(status.capabilityHealth.sources.denied > 0, true);
+    assert.deepEqual(status.capabilityHealth.releaseCriticalGaps, ['security-engineering']);
+    assert.equal(status.capabilityHealth.warnings.some((warning) => /release-critical capability gap security-engineering/.test(warning)), true);
+    assert.equal(doctorCheck?.level, 'FAIL');
+    assert.match(doctorCheck?.message ?? '', /release_critical_gaps=security-engineering/);
+    assert.equal(shipCheck?.status, 'BLOCKED');
+    const capabilityRepairs = await listRuntimeRepairs(root, { branchSlug: 'master', status: 'open' });
+    assert.equal(capabilityRepairs.some((repair) => repair.blockers.some((blocker) => blocker.startsWith('capability_health:'))), false);
+
+    await recordRuntimeCapabilityAdoption(root, {
+      adoptionId: runtimeScopedId('capability-adoption', 'master', 'ship', 'security-engineering'),
+      branchSlug: 'master',
+      lifecycleStage: 'ship',
+      capabilityDomain: 'security-engineering',
+      sourceId: 'sdd_professional_baseline',
+      status: 'rejected',
+      reason: 'Security capability reviewed; no additional security evidence is required for this scoped release task.',
+      evidenceRefs: ['tasks:SECURITY'],
+      finalAuthority: 'sdd_gate',
+      createdAt: '2026-05-27T00:00:00.000Z',
+      updatedAt: '2026-05-27T00:00:00.000Z',
+      payload: { releaseCritical: true }
+    });
+
+    const adoptedStatus = await getProjectStatus(root, { branch: 'master' });
+    const adoptedReport = await doctor(root, { latestOnly: true, branch: 'master' });
+    const adoptedShip = await runShip(root, { branch: 'master', dryRun: true });
+    const adoptedDoctorCheck = adoptedReport.checks.find((check) => check.check === 'capability_health');
+    const adoptedShipCheck = adoptedShip.checks.find((check) => check.name === 'capability_health');
+
+    assert.equal(adoptedStatus.capabilityHealth.status, 'pass');
+    assert.deepEqual(adoptedStatus.capabilityHealth.releaseCriticalGaps, []);
+    assert.deepEqual(adoptedStatus.capabilityHealth.adoptions.releaseCriticalClosures, ['security-engineering']);
+    assert.equal(adoptedDoctorCheck?.level, 'PASS');
+    assert.match(adoptedDoctorCheck?.message ?? '', /adoption_closures=security-engineering/);
+    assert.equal(adoptedShipCheck?.status, 'PASS');
+    assert.match(adoptedShipCheck?.message ?? '', /adoption_closures=security-engineering/);
+    assert.equal(adoptedShipCheck?.nextAction, undefined);
   } finally {
     await rm(root, { recursive: true, force: true });
   }
@@ -432,11 +589,12 @@ test('ship reports token pressure as diagnostic pass', async () => {
   }
 });
 
-test('ship blocks validated runs until sync-back is applied', async () => {
-  const root = await mkdtemp(path.join(tmpdir(), 'sdd-ship-syncback-required-'));
+test('ship accepts validated runs without requiring a removed sync-back stage', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-ship-eight-stage-ready-'));
   try {
     await initProject(root);
     await writeBranchDocs(root, 'master', validTaskMarkdown('T1', []));
+    await writeVerifyContract(root, { branch: 'master', branchSource: 'cli_option' });
     const state = await createRun(root, { runId: 'run-1' });
     await bindTestRunState(root, state.runId, 'master', 'T1');
     const bound = await readRunState(root, state.runId);
@@ -453,8 +611,30 @@ test('ship blocks validated runs until sync-back is applied', async () => {
     const ship = await runShip(root, { branch: 'master', dryRun: true });
     const latestRunCheck = ship.checks.find((check) => check.name === 'latest_run');
 
-    assert.equal(latestRunCheck?.status, 'BLOCKED');
-    assert.match(latestRunCheck?.message ?? '', /sync_back=not_created/);
+    assert.equal(latestRunCheck?.status, 'PASS');
+    assert.match(latestRunCheck?.message ?? '', /run=run-1 status=completed validation=pass/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('doctor does not report historical legacy file diagnostics', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-phase818-doctor-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'master', validTaskMarkdown('T1', []));
+    const state = await createRun(root, { runId: 'run-1', branch: 'master', taskId: 'T1' });
+    await writeArtifact(root, state.runId, 'review-T1.md', validResultArtifact('reviewer', 'T1', 'PASS', 'artifacts/review-T1.md'));
+    const legacyRunDir = path.join(root, '.sdd', 'runs', state.runId);
+    await mkdir(path.join(legacyRunDir, 'agent-executions'), { recursive: true });
+    await writeFile(path.join(legacyRunDir, 'state.json'), '{}', 'utf8');
+    await writeFile(path.join(legacyRunDir, 'events.jsonl'), '{}\n', 'utf8');
+    await writeFile(path.join(legacyRunDir, 'invocations.jsonl'), '{}\n', 'utf8');
+    await writeFile(path.join(legacyRunDir, 'agent-executions', 'legacy.json'), '{}', 'utf8');
+    const report = await doctor(root, { allRuns: true, branch: 'master' });
+
+    assert.equal(report.checks.some((check) => check.check === 'phase8_18_legacy_run_files'), false);
+    assert.equal(report.checks.some((check) => check.check === 'phase8_18_legacy_sidecars'), false);
   } finally {
     await rm(root, { recursive: true, force: true });
   }
@@ -486,6 +666,36 @@ test('ship still blocks context offload curation', async () => {
   }
 });
 
+function capabilityHealthTaskMarkdown(taskId: string): string {
+  return `# Tasks
+
+### ${taskId}: Security readiness task
+
+\`\`\`sdd-task
+id: ${taskId}
+status: pending
+wave: 1
+depends_on: []
+acceptance_refs:
+  - AC-1
+affected_files:
+  - packages/core/src/auth.ts
+validation:
+  - npm test
+risk:
+  - security
+\`\`\`
+
+#### Boundary
+
+Stay inside security readiness fixtures.
+
+#### Acceptance
+
+- AC-1: Security readiness is covered.
+`;
+}
+
 const doctorScope: RuntimeScope = { branch: 'master', taskId: 'T1', runId: 'run-1' };
 
 function doctorStageRun(): StageRun {