sdd-agent-platform 0.4.0 → 0.4.2

package/node_modules/@sdd-agent-platform/core/src/router/route-sdd-task.test.ts

@@ -1,6 +1,6 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtemp, rm } from 'node:fs/promises';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 
@@ -14,6 +14,11 @@ import {
   validTaskMarkdown,
   writeBranchDocs
 } from '../test-support/fixtures.js';
+import { writeVerifyContract } from '../verification/verify-contract.js';
+import { createRun, readRunState, writeRunState } from '../run-state/run-state.js';
+import { bindTestRunState } from '../test-support/run-state.js';
+import { evaluateLifecycleRiskDecisionForModel, recordLifecycleRiskDecisionProjection, readLifecycleRiskDecisionProjection } from '../risk.js';
+import { parseSddBranch } from '../sdd-docs/task-parser.js';
 import {
   inspectAgentSkillTeamRuntime,
   inspectCapabilitySource,
@@ -25,11 +30,13 @@ import {
   routeSddTask,
   validateAgentSkillTeamRuntime
 } from './route-sdd-task.js';
+import { importRuntimeSkillCapability } from './runtime-import.js';
 
 test('Phase 6 agent skill team runtime exposes reusable contracts and router decisions', async () => {
   const root = await mkdtemp(path.join(tmpdir(), 'sdd-phase60-runtime-'));
   try {
     await initProject(root);
+    await seedLifecycleRiskDecision(root, 'master');
 
     const runtime = await inspectAgentSkillTeamRuntime(root);
     const validation = await validateAgentSkillTeamRuntime(root);
@@ -38,12 +45,18 @@ test('Phase 6 agent skill team runtime exposes reusable contracts and router dec
     const sourceCatalog = await listCapabilitySources(root);
     const agencySource = await inspectCapabilitySource(root, 'agency_agents_material');
     const agencyImport = await inspectExternalAgentPackImport(root, 'agency_agents_material');
+    const codexSource = await inspectCapabilitySource(root, 'codex_host_future');
+    const codexImport = await inspectExternalAgentPackImport(root, 'codex_host_future');
+    const figmaSource = await inspectCapabilitySource(root, 'figma_design_future');
     const teamDefault = await inspectTeamModePolicy(root);
     const teamEnabled = await inspectTeamModePolicy(root, { taskId: 'ONBOARDING-1', branch: 'master', enabled: true });
     const route = await routeSddTask(root, { taskId: 'ONBOARDING-1', branch: 'master', teamModeEnabled: true });
 
     assert.equal(runtime.version, 'phase-6.0-agent-skill-team-runtime-v1');
     assert.equal(runtime.teamMode.decision, 'disabled');
+    assert.equal(runtime.hostAdapter.workflowProjectionPolicy.includes('host-neutral canonical CLI commands'), true);
+    assert.deepEqual(runtime.hostAdapter.workflowProjections.map((projection) => `${projection.host}:${projection.support}`), ['claude_code:active', 'codex:future', 'opencode:active']);
+    assert.equal(runtime.hostAdapter.workflowProjections.find((projection) => projection.host === 'codex')?.unsupportedReason?.includes('not marked active'), true);
     assert.equal(runtime.profiles.some((profile) => profile.id === 'orchestrator'), true);
     assert.equal(runtime.profiles.some((profile) => profile.id === 'security'), true);
     assert.equal(runtime.skillCapabilities.some((capability) => capability.id === 'claude.subagent.researcher'), true);
@@ -52,8 +65,19 @@ test('Phase 6 agent skill team runtime exposes reusable contracts and router dec
     assert.ok(hashlineCapability);
     assert.equal(hashlineCapability.reuseDecision, 'reuse_direct');
     assert.equal(sourceCatalog.sources.some((source) => source.id === 'ohmy_team_mode'), true);
+    assert.ok(codexSource);
+    assert.equal(codexSource.quarantineStatus, 'denied');
+    assert.equal(codexSource.hostCompatibility.includes('codex:unsupported'), true);
+    assert.equal(codexImport.status, 'denied');
+    assert.equal(codexImport.allowedProfiles.length, 0);
+    assert.ok(figmaSource);
+    assert.equal(figmaSource.allowedEvidenceTypes.includes('design_context'), true);
+    assert.equal(figmaSource.reuseDecision, 'adapt_via_host_adapter');
     assert.ok(agencySource);
     assert.equal(agencySource.quarantineRequired, true);
+    assert.equal(agencySource.quarantineStatus, 'quarantined');
+    assert.equal(agencySource.permissionModel.length > 0, true);
+    assert.equal(agencySource.provenanceRequirements.length > 0, true);
     assert.equal(agencyImport.status, 'quarantined');
     assert.equal(agencyImport.checks.some((check) => check.check === 'dangerous_command_scan'), true);
     assert.equal(teamDefault.decision, 'disabled');
@@ -80,6 +104,8 @@ test('Phase 6 adaptive team-mode routes choose cost-bounded agent teams automati
   try {
     await initProject(root);
     await writeBranchDocs(root, 'master', `# Tasks\n\n${adaptiveTeamTaskMarkdown('LOW', { allowedAgents: ['implementer'], affectedFiles: ['docs/low.md'] })}\n${adaptiveTeamTaskMarkdown('REVIEW', { allowedAgents: ['reviewer'], requiredArtifacts: ['artifacts/review-REVIEW.md'], affectedFiles: ['docs/review.md'] })}\n${adaptiveTeamTaskMarkdown('SOURCE', { allowedAgents: ['implementer'] })}\n${adaptiveTeamTaskMarkdown('HIGH', { allowedAgents: ['implementer'], risk: ['database'] })}\n${adaptiveTeamTaskMarkdown('SECURITY', { allowedAgents: ['security'], risk: ['security'] })}`);
+    await writeVerifyContract(root, { branch: 'master', branchSource: 'cli_option', force: true });
+    await seedLifecycleRiskDecision(root, 'master');
 
     const low = await routeSddTask(root, { taskId: 'LOW', branch: 'master' });
     const review = await routeSddTask(root, { taskId: 'REVIEW', branch: 'master' });
@@ -109,7 +135,7 @@ test('Phase 6 adaptive team-mode routes choose cost-bounded agent teams automati
     assert.equal(review.teamMode.waveRecommendation.includes('implementation_review'), true);
     assert.equal(unapprovedHigh.category, 'blocked');
     assert.equal(unapprovedHigh.lifecycleGate, 'approval-before-test');
-    assert.match(unapprovedHigh.nextAction, /rerun sdd test task HIGH --approved/);
+    assert.match(unapprovedHigh.nextAction, /rerun sdd test task-HIGH --approved/);
     assert.equal(high.teamMode.mode, 'hyperplan');
     assert.equal(high.teamMode.enabled, true);
     assert.equal(high.teamMode.costClass, 'high');
@@ -133,7 +159,7 @@ test('Phase 6 adaptive team-mode routes choose cost-bounded agent teams automati
     assert.equal(unapprovedSecurity.category, 'blocked');
     assert.match(unapprovedSecurity.blockedReason ?? '', /human approval before validation/);
     assert.equal(unapprovedSecurity.lifecycleGate, 'approval-before-test');
-    assert.match(unapprovedSecurity.nextAction, /rerun sdd test task SECURITY --approved/);
+    assert.match(unapprovedSecurity.nextAction, /rerun sdd test task-SECURITY --approved/);
     assert.doesNotMatch(unapprovedSecurity.nextAction, /Fix task gaps/);
     assert.equal(forced.teamMode.activation, 'force');
     assert.equal(forced.teamMode.mode, 'review-lite');
@@ -156,6 +182,8 @@ test('routeSddTask uses derived route cache and opt-in profiling only', async ()
   try {
     await initProject(root);
     await writeBranchDocs(root, 'master', `# Tasks\n\n${adaptiveTeamTaskMarkdown('CACHE', { allowedAgents: ['reviewer'], requiredArtifacts: ['artifacts/review-CACHE.md'], affectedFiles: ['docs/cache.md'] })}`);
+    await writeVerifyContract(root, { branch: 'master', branchSource: 'cli_option', force: true });
+    await seedLifecycleRiskDecision(root, 'master');
 
     const uncached = await routeSddTask(root, { taskId: 'CACHE', branch: 'master' });
     const first = await routeSddTask(root, { taskId: 'CACHE', branch: 'master', cache: true, profile: true });
@@ -181,6 +209,8 @@ test('routeSddTask uses derived route cache and opt-in profiling only', async ()
     assert.equal(third.profile.some((span) => span.name === 'route_compute'), false);
 
     await writeBranchDocs(root, 'master', `# Tasks\n\n${adaptiveTeamTaskMarkdown('CACHE', { allowedAgents: ['reviewer'], requiredArtifacts: ['artifacts/review-CACHE.md'], affectedFiles: ['docs/cache.md'] })}\n\nCache key invalidation fixture.`);
+    await writeVerifyContract(root, { branch: 'master', branchSource: 'cli_option', force: true });
+    await seedLifecycleRiskDecision(root, 'master');
     const invalidated = await routeSddTask(root, { taskId: 'CACHE', branch: 'master', cache: true });
 
     assert.equal(invalidated.cache?.status, 'stored');
@@ -197,6 +227,8 @@ test('Phase 6.3 project agent runtime merges project config and routes by alias
     await initProject(root);
     await appendProjectRuntimeConfig(root, phase63ProjectRuntimeConfig());
     await writeBranchDocs(root, 'master', phase63FrontendTaskMarkdown('FRONTEND-1'));
+    await writeVerifyContract(root, { branch: 'master', branchSource: 'cli_option', force: true });
+    await seedLifecycleRiskDecision(root, 'master');
 
     const runtime = await inspectAgentSkillTeamRuntime(root);
     const validation = await validateAgentSkillTeamRuntime(root);
@@ -232,6 +264,126 @@ test('Phase 6.3 project agent runtime merges project config and routes by alias
   }
 });
 
+test('Phase 6.3 skill capability import writes project and user-global runtime declarations', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-phase63-import-runtime-'));
+  try {
+    await initProject(root);
+    const configPath = path.join(root, '.sdd', 'project.yml');
+    const before = await readFile(configPath, 'utf8');
+
+    const dryRun = await importRuntimeSkillCapability(root, {
+      capabilityId: 'project.skill.frontend_review_imported',
+      source: 'project',
+      sourceRef: '.claude/skills/frontend-review/SKILL.md',
+      name: 'Frontend review imported',
+      domains: ['frontend', 'review'],
+      stages: ['plan', 'do', 'test'],
+      dryRun: true
+    });
+    assert.equal(dryRun.status, 'dry_run');
+    assert.equal(dryRun.written, false);
+    assert.equal(await inspectSkillCapability(root, 'project.skill.frontend_review_imported'), null);
+    assert.equal(await readFile(configPath, 'utf8'), before);
+
+    const created = await importRuntimeSkillCapability(root, {
+      capabilityId: 'project.skill.frontend_review_imported',
+      source: 'project',
+      sourceRef: '.claude/skills/frontend-review/SKILL.md',
+      name: 'Frontend review imported',
+      domains: ['frontend', 'review'],
+      stages: ['plan', 'do', 'test']
+    });
+    const projectCapability = await inspectSkillCapability(root, 'project.skill.frontend_review_imported');
+    const projectSource = await inspectCapabilitySource(root, 'project_skill_frontend_review_imported_source');
+    const validation = await validateAgentSkillTeamRuntime(root);
+
+    assert.equal(created.status, 'created');
+    assert.equal(created.written, true);
+    assert.ok(projectCapability);
+    assert.equal(projectCapability.source, 'project');
+    assert.equal(projectCapability.sourceRef, 'project_skill_frontend_review_imported_source');
+    assert.ok(projectSource);
+    assert.equal(projectSource.kind, 'project_material');
+    assert.equal(projectSource.quarantineRequired, false);
+    assert.equal(validation.valid, true);
+
+    const afterCreate = await readFile(configPath, 'utf8');
+    const unchanged = await importRuntimeSkillCapability(root, {
+      capabilityId: 'project.skill.frontend_review_imported',
+      source: 'project',
+      sourceRef: '.claude/skills/frontend-review/SKILL.md',
+      name: 'Frontend review imported',
+      domains: ['frontend', 'review'],
+      stages: ['plan', 'do', 'test']
+    });
+    assert.equal(unchanged.status, 'unchanged');
+    assert.equal(unchanged.written, false);
+    assert.equal(await readFile(configPath, 'utf8'), afterCreate);
+
+    const blockedUpdate = await importRuntimeSkillCapability(root, {
+      capabilityId: 'project.skill.frontend_review_imported',
+      source: 'project',
+      sourceRef: '.claude/skills/frontend-review/SKILL.md',
+      name: 'Frontend review changed',
+      domains: ['frontend', 'review'],
+      stages: ['plan', 'do', 'test']
+    });
+    assert.equal(blockedUpdate.status, 'blocked');
+    assert.equal(blockedUpdate.written, false);
+
+    const forcedUpdate = await importRuntimeSkillCapability(root, {
+      capabilityId: 'project.skill.frontend_review_imported',
+      source: 'project',
+      sourceRef: '.claude/skills/frontend-review/SKILL.md',
+      name: 'Frontend review changed',
+      domains: ['frontend', 'review'],
+      stages: ['plan', 'do', 'test'],
+      force: true
+    });
+    assert.equal(forcedUpdate.status, 'updated');
+    assert.equal(forcedUpdate.written, true);
+    assert.equal((await inspectSkillCapability(root, 'project.skill.frontend_review_imported'))?.name, 'Frontend review changed');
+
+    const userGlobal = await importRuntimeSkillCapability(root, {
+      capabilityId: 'user.skill.ui_ux_pro_max',
+      source: 'user_global',
+      sourceRef: 'C:\\Users\\inshn\\.claude\\skills\\ui-ux-pro-max\\SKILL.md',
+      name: 'UI UX Pro Max',
+      domains: ['ui_ux', 'frontend'],
+      stages: ['spec', 'plan', 'test'],
+      allowedEvidenceTypes: ['candidate_evidence', 'design_context'],
+      attribution: 'user-global Claude Code skill'
+    });
+    const userCapability = await inspectSkillCapability(root, 'user.skill.ui_ux_pro_max');
+    const userSource = await inspectCapabilitySource(root, 'user_skill_ui_ux_pro_max_source');
+    const userPack = await inspectExternalAgentPackImport(root, 'user_skill_ui_ux_pro_max_source');
+
+    assert.equal(userGlobal.status, 'created');
+    assert.ok(userCapability);
+    assert.equal(userCapability.source, 'user_global');
+    assert.ok(userSource);
+    assert.equal(userSource.kind, 'user_global_material');
+    assert.equal(userSource.quarantineRequired, true);
+    assert.equal(userSource.quarantineStatus, 'required');
+    assert.equal(userSource.allowedEvidenceTypes.includes('design_context'), true);
+    assert.equal(userPack.status, 'quarantined');
+    assert.equal((await validateAgentSkillTeamRuntime(root)).valid, true);
+
+    const builtInBlocked = await importRuntimeSkillCapability(root, {
+      capabilityId: 'host.edit.hashline',
+      source: 'project',
+      sourceRef: '.claude/skills/hashline/SKILL.md',
+      domains: ['editing'],
+      stages: ['do'],
+      force: true
+    });
+    assert.equal(builtInBlocked.status, 'blocked');
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+
 test('Phase 6.3 invalid agent runtime declarations fail closed', async () => {
   const root = await mkdtemp(path.join(tmpdir(), 'sdd-phase63-invalid-runtime-'));
   try {
@@ -249,6 +401,12 @@ test('Phase 6.3 invalid agent runtime declarations fail closed', async () => {
     assert.match(issueText, /project\.skill\.bad\.evidenceType/);
     assert.match(issueText, /unknown source missing_source/);
     assert.match(issueText, /unsafe_source\.attribution/);
+    assert.match(issueText, /unsafe_source\.permissionModel/);
+    assert.match(issueText, /unsafe_source\.provenanceRequirements/);
+    assert.match(issueText, /unsafe_source\.hostCompatibility/);
+    assert.match(issueText, /unsafe_source\.allowedEvidenceTypes/);
+    assert.match(issueText, /unsafe_source\.forbiddenAuthority/);
+    assert.match(issueText, /Quarantined source is missing active quarantine status/);
     assert.match(issueText, /Quarantined source cannot be reused directly/);
     assert.match(issueText, /Quarantined source requests prompt import, direct execution, or lifecycle authority/);
   } finally {
@@ -256,20 +414,74 @@ test('Phase 6.3 invalid agent runtime declarations fail closed', async () => {
   }
 });
 
+test('Phase 8.6 capability routing selects narrow domains, packs, and rejected external sources', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-phase86-capability-routing-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'master', `# Tasks
+
+${capabilityRouteTaskMarkdown('SIMPLE', 'Simple backend parser fix', ['packages/core/src/parser.ts'], [], ['npm test'])}
+${capabilityRouteTaskMarkdown('UI', 'UI UX frontend interaction update', ['src/components/Button.tsx'], ['ui-ux', 'accessibility'], ['browser Playwright validation'])}
+${capabilityRouteTaskMarkdown('SECURITY', 'Security permission boundary update', ['packages/core/src/auth.ts'], ['security'], ['npm test'])}
+${capabilityRouteTaskMarkdown('DB', 'Database migration data safety update', ['db/migrations/001.sql'], ['database', 'data-loss'], ['npm test'])}
+${capabilityRouteTaskMarkdown('RELEASE', 'Release deploy rollback readiness', ['.github/workflows/release.yml'], ['release', 'ci-build'], ['npm test'])}
+${capabilityRouteTaskMarkdown('TESTING', 'Testing quality coverage update', ['packages/core/src/parser.test.ts'], ['validation'], ['coverage acceptance test'])}`);
+    await seedLifecycleRiskDecision(root, 'master');
+
+    const simple = await routeSddTask(root, { taskId: 'SIMPLE', branch: 'master' });
+    const ui = await routeSddTask(root, { taskId: 'UI', branch: 'master' });
+    const security = await routeSddTask(root, { taskId: 'SECURITY', branch: 'master', approved: true });
+    const db = await routeSddTask(root, { taskId: 'DB', branch: 'master', approved: true });
+    const release = await routeSddTask(root, { taskId: 'RELEASE', branch: 'master', approved: true });
+    const testing = await routeSddTask(root, { taskId: 'TESTING', branch: 'master' });
+    const figmaConsidered = ui.capabilityDecision.consideredExternalSources.find((source) => source.sourceId === 'figma_design_future');
+    const uiUxProMaxConsidered = ui.capabilityDecision.consideredExternalSources.find((source) => source.sourceId === 'ui_ux_pro_max_external');
+
+
+    assert.deepEqual(simple.capabilityDecision.selectedDomains.map((item) => item.domain), ['backend-engineering']);
+    assert.equal(simple.capabilityDecision.selectedPacks.length <= 2, true);
+    assert.equal(simple.capabilityDecision.authority, 'advisory_only');
+    assert.equal(simple.capabilityDecision.permissionCeiling, simple.autonomyCeiling);
+    assert.equal(ui.capabilityDecision.selectedDomains.some((item) => item.domain === 'frontend-engineering'), true);
+    assert.equal(ui.capabilityDecision.selectedDomains.some((item) => item.domain === 'ui-ux-product-design'), true);
+    assert.equal(ui.capabilityDecision.selectedPacks.some((pack) => pack.id === 'baseline-ui-ux-product-design'), true);
+    assert.equal(ui.capabilityDecision.rejectedExternalSources.some((source) => source.sourceId === 'figma_design_future' && /Future adapter|quarantine/.test(source.reason)), true);
+    assert.equal(ui.capabilityDecision.rejectedExternalSources.some((source) => source.sourceId === 'ui_ux_pro_max_external' && /quarantine/i.test(source.reason)), true);
+    assert.ok(figmaConsidered);
+    assert.equal(figmaConsidered.kind, 'future_adapter');
+    assert.equal(figmaConsidered.consideredUse.length > 0, true);
+    assert.ok(uiUxProMaxConsidered);
+    assert.equal(uiUxProMaxConsidered.kind, 'open_source_material');
+    assert.equal(uiUxProMaxConsidered.quarantineStatus, 'quarantined');
+    assert.equal(security.capabilityDecision.selectedDomains.some((item) => item.domain === 'security-engineering'), true);
+    assert.equal(db.capabilityDecision.selectedDomains.some((item) => item.domain === 'db-data-engineering'), true);
+    assert.equal(release.capabilityDecision.selectedDomains.some((item) => item.domain === 'release-engineering'), true);
+    assert.equal(release.capabilityDecision.selectedPacks.some((pack) => pack.id === 'baseline-release-engineering'), true);
+    assert.equal(testing.capabilityDecision.selectedDomains.some((item) => item.domain === 'testing-quality-engineering'), true);
+    assert.equal(testing.capabilityDecision.evidenceRequirements.some((item) => item.includes('evidence requirement')), true);
+    assert.equal(ui.requiredCapabilities.includes('figma_design_future'), false);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+
 test('routeSddTask blocks downstream tasks until dependencies are completed', async () => {
   const root = await mkdtemp(path.join(tmpdir(), 'sdd-route-dependencies-'));
   try {
     await initProject(root);
     await writeBranchDocs(root, 'feature', `# Tasks\n\n${validTaskMarkdown('DEP1', [])}\n${validTaskMarkdown('DEP2', ['DEP1']).replace('packages/core/src/index.ts', 'docs/dep2.md')}`);
+    await seedLifecycleRiskDecision(root, 'feature');
 
     const blocked = await routeSddTask(root, { taskId: 'DEP2', branch: 'feature', approved: true });
 
     assert.equal(blocked.category, 'blocked');
     assert.equal(blocked.recommendedProfile, null);
-    assert.match(blocked.blockedReason ?? '', /DEP2 depends on DEP1, but DEP1 status is pending/);
-    assert.match(blocked.nextAction, /Complete and sync-back DEP1 before routing DEP2/);
+    assert.match(blocked.blockedReason ?? '', /DEP2 depends on DEP1, but DEP1 has not passed required verification/);
+    assert.match(blocked.nextAction, /sdd test task-DEP1/);
 
     await writeBranchDocs(root, 'feature', `# Tasks\n\n${validTaskMarkdown('DEP1', []).replace('status: pending', 'status: completed')}\n${validTaskMarkdown('DEP2', ['DEP1']).replace('packages/core/src/index.ts', 'docs/dep2.md')}`);
+    await seedLifecycleRiskDecision(root, 'feature');
     const ready = await routeSddTask(root, { taskId: 'DEP2', branch: 'feature' });
 
     assert.notEqual(ready.category, 'blocked');
@@ -278,4 +490,177 @@ test('routeSddTask blocks downstream tasks until dependencies are completed', as
   } finally {
     await rm(root, { recursive: true, force: true });
   }
-});
+});
+
+test('routeSddTask uses latest eligible runtime dependency readiness', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-route-runtime-dependencies-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'feature', `# Tasks
+
+${validTaskMarkdown('DEP1', [])
+  .replace('packages/core/src/index.ts', 'docs/dep1.md')
+  .replace('validation:\n  - npm test', 'validation_batch: dep-batch\nvalidation_timing: batch_end\nrequires_verify_before_next: false\nvalidation:\n  - npm test')}
+${validTaskMarkdown('DEP2', ['DEP1']).replace('packages/core/src/index.ts', 'docs/dep2.md')}`);
+    await seedLifecycleRiskDecision(root, 'feature');
+    const run = await createRun(root, { runId: 'run-dep1-implemented' });
+    await bindTestRunState(root, run.runId, 'feature', 'DEP1');
+    const bound = await readRunState(root, run.runId);
+    await writeRunState(root, {
+      ...bound,
+      status: 'completed',
+      tasks: {
+        ...bound.tasks,
+        DEP1: {
+          status: 'implemented_pending_validation',
+          implementationStatus: 'implemented',
+          verificationStatus: 'pending_batch',
+          validationBatch: 'dep-batch',
+          validationTiming: 'batch_end',
+          requiresVerifyBeforeNext: false,
+          gaps: [],
+          artifacts: []
+        }
+      }
+    });
+
+    const decision = await routeSddTask(root, { taskId: 'DEP2', branch: 'feature' });
+
+    assert.notEqual(decision.category, 'blocked');
+    assert.equal(decision.blockedReason, null);
+    assert.ok(decision.recommendedProfile);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('routeSddTask blocks stage-local routing when lifecycle projection is missing', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-route-lifecycle-authority-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'master', `# Tasks\n\n${validTaskMarkdown('LOCAL', [])}`);
+    await writeVerifyContract(root, { branch: 'master', branchSource: 'cli_option', force: true });
+
+    const decision = await routeSddTask(root, { taskId: 'LOCAL', branch: 'master' });
+
+    assert.equal(decision.category, 'blocked');
+    assert.match(decision.blockedReason ?? '', /Stage-local entry requires an active lifecycle decision/);
+    assert.match(decision.nextAction, /Run \/sdd or \/sdd:spec/);
+    assert.equal(decision.recommendedProfile, null);
+
+    const projection = await readLifecycleRiskDecisionProjection(root, { branch: 'master' });
+    assert.equal(projection, null);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('routeSddTask semantically binds natural do text to the accepted task boundary', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-route-semantic-binding-'));
+  try {
+    await initProject(root);
+    const loginTask = validTaskMarkdown('LOGIN-1', [])
+      .replace('Valid task', '登录系统')
+      .replace('Stay in parser files only.', '只实现登录系统边界。')
+      .replace('Parser behavior is covered.', '登录系统任务完成。');
+    await writeBranchDocs(root, 'master', `# Tasks\n\n${loginTask}`);
+    await writeVerifyContract(root, { branch: 'master', branchSource: 'cli_option', force: true });
+    await seedLifecycleRiskDecision(root, 'master');
+
+    const byId = await routeSddTask(root, { taskId: 'LOGIN-1', branch: 'master' });
+    const byText = await routeSddTask(root, { taskId: '做登录系统', branch: 'master' });
+
+    assert.equal(byId.taskId, 'LOGIN-1');
+    assert.equal(byText.taskId, 'LOGIN-1');
+    assert.equal(byText.stageRouteBinding?.status, 'bound');
+    assert.equal(byText.stageRouteBinding?.targetId, 'LOGIN-1');
+    assert.equal(byText.blockedReason, null);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('routeSddTask blocks ambiguous natural do text before implementation routing', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-route-ambiguous-binding-'));
+  try {
+    await initProject(root);
+    const apiTask = validTaskMarkdown('LOGIN-API', [])
+      .replace('Valid task', '登录系统接口')
+      .replace('Stay in parser files only.', '只实现登录系统接口。')
+      .replace('Parser behavior is covered.', '登录系统接口完成。')
+      .replace('packages/core/src/index.ts', 'packages/core/src/login-api.ts');
+    const pageTask = validTaskMarkdown('LOGIN-UI', [])
+      .replace('Valid task', '登录系统页面')
+      .replace('Stay in parser files only.', '只实现登录系统页面。')
+      .replace('Parser behavior is covered.', '登录系统页面完成。')
+      .replace('packages/core/src/index.ts', 'packages/core/src/login-ui.ts');
+    await writeBranchDocs(root, 'master', `# Tasks\n\n${apiTask}\n${pageTask}`);
+    await writeVerifyContract(root, { branch: 'master', branchSource: 'cli_option', force: true });
+    await seedLifecycleRiskDecision(root, 'master');
+
+    const decision = await routeSddTask(root, { taskId: '登录系统', branch: 'master' });
+
+    assert.equal(decision.category, 'blocked');
+    assert.equal(decision.recommendedProfile, null);
+    assert.equal(decision.stageRouteBinding?.status, 'ambiguous');
+    assert.deepEqual(decision.stageRouteBinding?.matchedRefs.map((ref) => ref.ref).sort(), ['task:LOGIN-API', 'task:LOGIN-UI']);
+    assert.match(decision.nextAction, /Ambiguous task text/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('routeSddTask routes boundary-expanding natural do text back to lifecycle authority', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-route-boundary-expanding-'));
+  try {
+    await initProject(root);
+    const paymentTask = validTaskMarkdown('PAY-1', [])
+      .replace('Valid task', '支付系统')
+      .replace('Stay in parser files only.', '只实现支付系统边界。')
+      .replace('Parser behavior is covered.', '支付系统任务完成。');
+    await writeBranchDocs(root, 'master', `# Tasks\n\n${paymentTask}`);
+    await writeVerifyContract(root, { branch: 'master', branchSource: 'cli_option', force: true });
+    await seedLifecycleRiskDecision(root, 'master');
+
+    const decision = await routeSddTask(root, { taskId: '做登录系统', branch: 'master' });
+
+    assert.equal(decision.category, 'blocked');
+    assert.equal(decision.recommendedProfile, null);
+    assert.equal(decision.stageRouteBinding?.status, 'boundary_expanding');
+    assert.equal(decision.stageRouteBinding?.targetId, null);
+    assert.match(decision.nextAction, /Run \/sdd or \/sdd:spec/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+function capabilityRouteTaskMarkdown(taskId: string, title: string, affectedFiles: string[], risk: string[], validation: string[]): string {
+  const affectedFilesBlock = affectedFiles.length === 0 ? 'affected_files: []' : `affected_files:\n${affectedFiles.map((file) => `  - ${file}`).join('\n')}`;
+  const riskBlock = risk.length === 0 ? 'risk: []' : `risk:\n${risk.map((item) => `  - ${item}`).join('\n')}`;
+  const validationBlock = validation.length === 0 ? 'validation: []' : `validation:\n${validation.map((item) => `  - ${item}`).join('\n')}`;
+  return `### ${taskId}: ${title}
+
+\`\`\`sdd-task
+id: ${taskId}
+status: pending
+wave: 1
+depends_on: []
+acceptance_refs:
+  - AC-1
+${affectedFilesBlock}
+${validationBlock}
+${riskBlock}
+allowed_agents:
+  - implementer
+\`\`\`
+
+#### Acceptance
+
+- ${title}.
+`;
+}
+
+async function seedLifecycleRiskDecision(root: string, branch: string): Promise<void> {
+  const model = await parseSddBranch(root, branch);
+  await recordLifecycleRiskDecisionProjection(root, evaluateLifecycleRiskDecisionForModel(branch, model));
+}