sdd-agent-platform 0.4.1 → 0.4.2

package/node_modules/@sdd-agent-platform/core/src/verification/validation-cache.ts

@@ -0,0 +1,106 @@
+import { createHash } from 'node:crypto';
+import type { SddTask, SddTaskModel } from '../sdd-docs/task-parser.js';
+
+export type ValidationCacheUnsafeReason = 'env_unknown' | 'tool_version_unknown' | 'non_deterministic_command' | 'external_service_dependency' | 'source_closure_unknown';
+
+export interface ValidationCacheKeyInput {
+  branch: string;
+  model: SddTaskModel;
+  task: SddTask;
+  command: string;
+  argv: string[] | null;
+  shell: boolean;
+  validationScopeTaskIds: string[];
+  acceptanceRefs: string[];
+}
+
+export interface ValidationCachePlan {
+  cacheKey: string;
+  normalizedCommand: string;
+  cwd: string;
+  envFingerprint: string;
+  toolFingerprint: string;
+  verifyContractHash: string | null;
+  tasksContractHash: string | null;
+  sourceClosureHash: string;
+  targetClosureHash: string;
+  unsafeReasons: ValidationCacheUnsafeReason[];
+  eligible: boolean;
+}
+
+export function buildValidationCachePlan(input: ValidationCacheKeyInput): ValidationCachePlan {
+  const normalizedCommand = normalizeCommand(input.command, input.argv);
+  const envFingerprint = runtimeEnvFingerprint();
+  const toolFingerprint = runtimeToolFingerprint();
+  const sourceClosureHash = stableHash({
+    branch: input.branch,
+    sourceTaskIds: input.validationScopeTaskIds.slice().sort(),
+    spec: input.model.documents.specContractHash ?? input.model.documents.specHash ?? null,
+    plan: input.model.documents.planContractHash ?? input.model.documents.planHash ?? null,
+    tasks: input.model.documents.tasksContractHash ?? input.model.documents.tasksHash ?? null,
+    verify: input.model.documents.verifyContractHash ?? input.model.documents.verifyHash ?? null
+  });
+  const targetClosureHash = stableHash({
+    acceptanceRefs: input.acceptanceRefs.slice().sort(),
+    taskIds: input.validationScopeTaskIds.slice().sort()
+  });
+  const unsafeReasons = unsafeReasonsForCommand(input.command, input.task);
+  const cacheKey = stableHash({
+    contract: 'phase-8.26-validation-cache-key-v1',
+    command: normalizedCommand,
+    cwd: '.',
+    envFingerprint,
+    toolFingerprint,
+    verifyContractHash: input.model.documents.verifyContractHash ?? null,
+    tasksContractHash: input.model.documents.tasksContractHash ?? null,
+    sourceClosureHash,
+    targetClosureHash
+  });
+  return {
+    cacheKey,
+    normalizedCommand,
+    cwd: '.',
+    envFingerprint,
+    toolFingerprint,
+    verifyContractHash: input.model.documents.verifyContractHash ?? null,
+    tasksContractHash: input.model.documents.tasksContractHash ?? null,
+    sourceClosureHash,
+    targetClosureHash,
+    unsafeReasons,
+    eligible: unsafeReasons.length === 0
+  };
+}
+
+function unsafeReasonsForCommand(command: string, task: SddTask): ValidationCacheUnsafeReason[] {
+  const normalized = command.trim().toLowerCase();
+  const reasons: ValidationCacheUnsafeReason[] = [];
+  if (!normalized || task.affectedFiles.length === 0) {
+    reasons.push('source_closure_unknown');
+  }
+  if (/\b(date|time|random|uuid|sleep)\b/.test(normalized)) {
+    reasons.push('non_deterministic_command');
+  }
+  if (/\b(curl|wget|ssh|scp|docker\s+pull|npm\s+install|pnpm\s+install|yarn\s+install)\b|https?:\/\//.test(normalized)) {
+    reasons.push('external_service_dependency');
+  }
+  if (normalized.startsWith('manual:')) {
+    reasons.push('non_deterministic_command');
+  }
+  return [...new Set(reasons)];
+}
+
+function normalizeCommand(command: string, argv: string[] | null): string {
+  return argv ? JSON.stringify(argv) : command.trim().replace(/\s+/g, ' ');
+}
+
+function runtimeEnvFingerprint(): string {
+  return stableHash({ platform: process.platform, arch: process.arch, nodeEnv: process.env.NODE_ENV ?? null });
+}
+
+function runtimeToolFingerprint(): string {
+  return stableHash({ node: process.version });
+}
+
+function stableHash(value: unknown): string {
+  return createHash('sha256').update(JSON.stringify(value), 'utf8').digest('hex');
+}

package/node_modules/@sdd-agent-platform/core/src/verification/validation-wave.test.ts

@@ -7,11 +7,13 @@ import path from 'node:path';
 import { evaluateAndRecordWorkflowGateDecision } from '../workflow-gate/evidence-packet.js';
 import { initProject } from '../config/init-project.js';
 import { writeBranchDocs } from '../test-support/fixtures.js';
-import { listRuntimeAcceptanceEvidenceMaps, listRuntimeValidationEnvironmentSessions, listRuntimeValidationWaveRuns, listRuntimeWorkflowGateDecisions, recordRuntimeDurableGap } from '../storage/runtime-store.js';
+import { listRuntimeAcceptanceEvidenceMaps, listRuntimeTestSteps, listRuntimeValidationCacheUses, listRuntimeValidationEnvironmentSessions, listRuntimeValidationWaveRuns, listRuntimeWorkflowGateDecisions, recordRuntimeDurableGap } from '../storage/runtime-store.js';
 import { readRunState, writeRunState } from '../run-state/run-state.js';
 import { readTaskEvidenceView } from '../run-state/task-evidence.js';
 import { writeVerifyContract } from './verify-contract.js';
 import { planValidationWave, renderValidationWaveResult, runValidationWave } from './validation-wave.js';
+import { evaluateLifecycleRiskDecisionForModel, recordLifecycleRiskDecisionProjection } from '../risk.js';
+import { parseSddBranch } from '../sdd-docs/task-parser.js';
 
 function taskMarkdown(taskId: string, command: string, wave: number): string {
   return `### ${taskId}: Validation wave task
@@ -172,6 +174,7 @@ ${taskMarkdown('T1', 'node -e "process.stdout.write(\'one\')"', 1)}
 ${taskMarkdown('T2', 'node -e "process.stdout.write(\'two\')"', 1)}`);
     await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
 
+    await seedLifecycleRiskDecision(root, 'feature');
     const result = await runValidationWave(root, { branch: 'feature', wave: 1, approved: true });
     const waves = await listRuntimeValidationWaveRuns(root, { partition: 'feature', waveRunId: result.waveRunId });
     const sessions = await listRuntimeValidationEnvironmentSessions(root, { partition: 'feature', waveRunId: result.waveRunId });
@@ -191,7 +194,7 @@ ${taskMarkdown('T2', 'node -e "process.stdout.write(\'two\')"', 1)}`);
     const workflowGateScope = (result.workflowGateDecision?.payload as { workflowScope?: { waveRunId: string | null; taskIds: string[]; runIds: string[]; evidenceRefs: string[] } } | undefined)?.workflowScope;
     const wavePayloadScope = (waves[0].payload as { workflowScope?: unknown }).workflowScope as typeof workflowGateScope;
     const gateDecisions = await listRuntimeWorkflowGateDecisions(root, { partition: 'feature', decisionKind: 'validation_wave' });
-    const expectedEvidenceRefs = result.taskResults.flatMap((taskResult) => [taskResult.validationArtifact, taskResult.indexArtifact].filter((ref): ref is string => Boolean(ref))).sort();
+    const expectedEvidenceRefs = result.taskResults.flatMap((taskResult) => [taskResult.validationArtifact].filter((ref): ref is string => Boolean(ref))).sort();
 
     assert.equal(workflowGateScope?.waveRunId, result.waveRunId);
     assert.deepEqual(workflowGateScope?.taskIds, ['T1', 'T2']);
@@ -204,6 +207,39 @@ ${taskMarkdown('T2', 'node -e "process.stdout.write(\'two\')"', 1)}`);
   }
 });
 
+test('validation wave reuses identical deterministic validation command through cache', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-validation-wave-cache-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'feature', `# Tasks
+
+${taskMarkdown('T1', 'node shared-cache-command.js', 1)}
+${taskMarkdown('T2', 'node shared-cache-command.js', 1)}`);
+    await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
+    const counterPath = path.join(root, 'validation-counter.txt');
+    const commandInput = { argv: [process.execPath, '-e', "const fs=require('fs'); const file=process.argv[1]; const count=fs.existsSync(file) ? Number(fs.readFileSync(file,'utf8')) : 0; fs.writeFileSync(file, String(count + 1)); process.stdout.write('ok');", counterPath] };
+
+    await seedLifecycleRiskDecision(root, 'feature');
+    const result = await runValidationWave(root, {
+      branch: 'feature',
+      wave: 1,
+      approved: true,
+      commandInputsByTask: { T1: [commandInput], T2: [commandInput] }
+    });
+    const steps = (await Promise.all(result.taskResults.map((taskResult) => listRuntimeTestSteps(root, { runId: taskResult.runId })))).flat();
+    const cacheUses = await listRuntimeValidationCacheUses(root, { branchSlug: 'feature' });
+
+    assert.equal(result.status, 'PASS');
+    assert.equal(await readFile(counterPath, 'utf8'), '1');
+    assert.equal(steps.some((step) => (step.payload as { cacheStatus?: string }).cacheStatus === 'miss'), true);
+    assert.equal(steps.some((step) => (step.payload as { cacheStatus?: string }).cacheStatus === 'hit'), true);
+    assert.equal(cacheUses.length, 1);
+    assert.deepEqual(cacheUses[0].mappedTaskIds, ['T2']);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
 test('validation wave gate evaluates durable gaps across the whole wave', async () => {
   const root = await mkdtemp(path.join(tmpdir(), 'sdd-validation-wave-durable-gap-'));
   try {
@@ -214,6 +250,7 @@ ${taskMarkdown('T1', 'node -e "process.stdout.write(\'one\')"', 1)}
 ${taskMarkdown('T2', 'node -e "process.stdout.write(\'two\')"', 1)}`);
     await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
 
+    await seedLifecycleRiskDecision(root, 'feature');
     const result = await runValidationWave(root, { branch: 'feature', wave: 1, approved: true });
     const secondTask = result.taskResults.find((taskResult) => taskResult.taskId === 'T2');
     assert.ok(result.workflowGateDecision);
@@ -238,7 +275,7 @@ ${taskMarkdown('T2', 'node -e "process.stdout.write(\'two\')"', 1)}`);
     });
     await writeRunState(root, { ...await readRunState(root, secondTask.runId), status: 'blocked' });
 
-    const expectedEvidenceRefs = result.taskResults.flatMap((taskResult) => [taskResult.validationArtifact, taskResult.indexArtifact].filter((ref): ref is string => Boolean(ref)));
+    const expectedEvidenceRefs = result.taskResults.flatMap((taskResult) => [taskResult.validationArtifact].filter((ref): ref is string => Boolean(ref)));
     const { decision } = await evaluateAndRecordWorkflowGateDecision(root, {
       branch: 'feature',
       taskId: result.taskResults[0]?.taskId ?? null,
@@ -295,7 +332,7 @@ ${batchTaskMarkdown('T1', 'node -e "process.stdout.write(\'one\')"', 'docs-batch
     assert.equal(result.status, 'BLOCKED');
     assert.equal(result.plan.selectionBoundary, 'wave');
     assert.equal(result.plan.batchId, 'docs-batch-a');
-    assert.match(result.next, /sdd test wave --branch feature --wave 1/);
+    assert.match(result.next, /sdd test wave-1 --branch feature/);
     assert.doesNotMatch(result.next, /sdd test batch docs-batch-a/);
   } finally {
     await rm(root, { recursive: true, force: true });
@@ -311,6 +348,7 @@ test('validation wave uses verify acceptance mapping for runtime coverage', asyn
 ${batchTaskMarkdown('T1', 'node -e "process.stdout.write(\'one\')"', 'docs-batch-a').replace('  - node -e "process.stdout.write(\'one\')" => AC-T1', '  - node -e "process.stdout.write(\'one\')"')}`);
     await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
 
+    await seedLifecycleRiskDecision(root, 'feature');
     const result = await runValidationWave(root, { branch: 'feature', batchId: 'docs-batch-a', approved: true });
 
     assert.equal(result.status, 'PASS');
@@ -320,6 +358,10 @@ ${batchTaskMarkdown('T1', 'node -e "process.stdout.write(\'one\')"', 'docs-batch
   }
 });
 
+async function seedLifecycleRiskDecision(root: string, branch: string): Promise<void> {
+  const model = await parseSddBranch(root, branch);
+  await recordLifecycleRiskDecisionProjection(root, evaluateLifecycleRiskDecisionForModel(branch, model));
+}
 
 test('validation wave blocks missing verify without generating runtime evidence', async () => {
   const root = await mkdtemp(path.join(tmpdir(), 'sdd-validation-wave-blocked-'));
@@ -334,7 +376,7 @@ ${taskMarkdown('T1', 'node -e "process.stdout.write(\'one\')"', 1)}`);
     assert.equal(result.status, 'BLOCKED');
     assert.equal(result.taskResults.length, 0);
     assert.match(result.gaps.join('\n'), /verify\.md contract is BLOCKED/);
-    assert.match(result.next, /sdd test wave --branch feature --wave 1/);
+    assert.match(result.next, /sdd test wave-1 --branch feature/);
   } finally {
     await rm(root, { recursive: true, force: true });
   }

package/node_modules/@sdd-agent-platform/core/src/verification/validation-wave.ts

@@ -28,6 +28,23 @@ interface VerifyBatchPlan {
   acceptanceMapping: Map<string, string[]>;
 }
 
+export interface VerifyValidationUnit {
+  validationUnitId: string;
+  timing: string | null;
+  taskIds: string[];
+  checks: string[];
+  forbiddenValidation: string[];
+  requiredArtifacts: string[];
+  acceptanceMapping: Record<string, string[]>;
+}
+
+export interface VerifyValidationUnitList {
+  contract: 'sdd-verify-validation-units-v1';
+  branch: string;
+  verifyContract: VerifyContractInspection;
+  units: VerifyValidationUnit[];
+}
+
 export interface ValidationWavePlan {
   contract: typeof VALIDATION_WAVE_RUNTIME_CONTRACT_VERSION;
   branch: string;
@@ -66,6 +83,19 @@ export interface ValidationWaveRunResult {
   next: string;
 }
 
+export async function listVerifyValidationUnits(projectRoot: string, options: { branch?: string | null } = {}): Promise<VerifyValidationUnitList> {
+  const context = await resolveSddContext(projectRoot, { branch: options.branch ?? undefined, branchSource: options.branch ? 'cli_option' : undefined });
+  const verifyContract = await inspectVerifyContract(projectRoot, { branch: context.partition, branchSource: 'cli_option' });
+  const verifyBatches = await readVerifyBatchPlans(verifyContract);
+  return {
+    contract: 'sdd-verify-validation-units-v1',
+    branch: context.partition,
+    verifyContract,
+    units: Array.from(verifyBatches.values()).map(verifyValidationUnitFromBatch)
+  };
+}
+
+
 export async function planValidationWave(projectRoot: string, options: RunValidationWaveOptions = {}): Promise<ValidationWavePlan> {
   const context = await resolveSddContext(projectRoot, { branch: options.branch ?? undefined, branchSource: options.branch ? 'cli_option' : undefined });
   const model = await parseSddBranch(projectRoot, context.partition);
@@ -159,7 +189,7 @@ export async function runValidationWave(projectRoot: string, options: RunValidat
       waveRunId,
       taskIds: plan.taskIds,
       runIds: taskResults.map((result) => result.runId),
-      evidenceRefs: taskResults.flatMap((result) => [result.validationArtifact, result.indexArtifact].filter((ref): ref is string => Boolean(ref)))
+      evidenceRefs: taskResults.flatMap((result) => [result.validationArtifact].filter((ref): ref is string => Boolean(ref)))
     })).decision
     : null;
   const status = finalWaveStatus(validationStatus, workflowGateDecision);
@@ -449,6 +479,19 @@ function serializeVerifyBatchPlan(batch: VerifyBatchPlan): ValidationWavePlan['v
   };
 }
 
+
+function verifyValidationUnitFromBatch(batch: VerifyBatchPlan): VerifyValidationUnit {
+  return {
+    validationUnitId: batch.id,
+    timing: batch.timing,
+    taskIds: batch.tasks,
+    checks: batch.checks,
+    forbiddenValidation: batch.forbiddenValidation,
+    requiredArtifacts: batch.requiredArtifacts,
+    acceptanceMapping: Object.fromEntries(batch.acceptanceMapping)
+  };
+}
+
 function cleanYamlScalar(value: string): string {
   const trimmed = value.trim();
   if (trimmed.startsWith('"') && trimmed.endsWith('"')) {
@@ -494,7 +537,7 @@ function finalWaveStatus(validationStatus: RuntimeValidationWaveStatus, workflow
 
 function nextForValidationWave(status: RuntimeValidationWaveStatus, branch: string, selectionBoundary: ValidationWaveSelectionBoundary, batchId: string | null, wave: number | null, taskIds: string[], workflowGateDecision: WorkflowGateDecision | null): string {
   if (status === 'PASS') {
-    return `sdd ship --branch ${branch} --dry-run`;
+    return `sdd test close --branch ${branch} --target goal-verify --compact-json`;
   }
   if (workflowGateDecision && workflowGateDecision.status !== 'PASS') {
     return `Inspect validation wave gate ${workflowGateDecision.decisionId}, resolve blockers or decision-card requirements, then rerun ${rerunValidationCommand(branch, selectionBoundary, batchId, wave, taskIds)}.`;
@@ -504,10 +547,10 @@ function nextForValidationWave(status: RuntimeValidationWaveStatus, branch: stri
 
 function rerunValidationCommand(branch: string, selectionBoundary: ValidationWaveSelectionBoundary, batchId: string | null, wave: number | null, taskIds: string[]): string {
   if (selectionBoundary === 'batch' && batchId) {
-    return `sdd test batch ${batchId} --branch ${branch}`;
+    return `sdd test ${batchId} --branch ${branch}`;
   }
   if (selectionBoundary === 'tasks' && taskIds.length > 0) {
-    return `sdd test wave --branch ${branch} ${taskIds.map((taskId) => `--task ${taskId}`).join(' ')}`;
+    return `sdd test ${taskIds.length === 1 ? `task-${taskIds[0]}` : taskIds.map((taskId) => `task-${taskId}`).join(',')} --branch ${branch}`;
   }
-  return wave === null ? `sdd test wave --branch ${branch}` : `sdd test wave --branch ${branch} --wave ${wave}`;
+  return wave === null ? `sdd test wave-all --branch ${branch}` : `sdd test wave-${wave} --branch ${branch}`;
 }

package/node_modules/@sdd-agent-platform/core/src/verification/verify-contract.test.ts

@@ -31,11 +31,12 @@ test('writeVerifyContract creates task-derived verify contract', async () => {
 
     const written = await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
     const inspection = await inspectVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
-
     assert.equal(written.status, 'created');
     assert.match(written.content, /contract: sdd-verify-doc-v1/);
+    assert.doesNotMatch(written.content, /based_on_tasks_/);
+    assert.doesNotMatch(written.content, /created_at:/);
     assert.match(written.content, /verification_batches:/);
-    assert.match(written.content, /id: \"task-T1\"/);
+    assert.match(written.content, /id: "task-T1"/);
     assert.match(written.content, /failure_policy:\n      repair_flow: deferred/);
     assert.match(written.content, /\| T1 \|/);
     assert.match(written.content, /author_role: verification-designer/);
@@ -131,8 +132,8 @@ Only UI image.
   }
 });
 
-test('inspectVerifyContract warns when verify document is stale', async () => {
-  const root = await mkdtemp(path.join(tmpdir(), 'sdd-verify-contract-stale-'));
+test('inspectVerifyContract warns when verify matrix no longer mentions current tasks', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-verify-contract-task-drift-'));
   try {
     await writeBranchDocs(root, 'feature', validTaskMarkdown('T1', []));
     await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
@@ -141,55 +142,37 @@ test('inspectVerifyContract warns when verify document is stale', async () => {
     const inspection = await inspectVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
 
     assert.equal(inspection.status, 'WARN');
-    assert.equal(inspection.issues.some((issue) => issue.field === 'based_on_tasks_contract_hash'), true);
+    assert.equal(inspection.issues.some((issue) => issue.field === 'based_on_tasks_contract_hash'), false);
     assert.equal(inspection.issues.some((issue) => issue.field === 'tasks' && /T2/.test(issue.message)), true);
   } finally {
     await rm(root, { recursive: true, force: true });
   }
 });
 
-test('inspectVerifyContract blocks legacy verify documents without tasks contract hash', async () => {
-  const root = await mkdtemp(path.join(tmpdir(), 'sdd-verify-contract-legacy-'));
-  try {
-    await writeBranchDocs(root, 'feature', validTaskMarkdown('T1', []));
-    const written = await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
-    await writeFile(path.join(root, 'specs', 'feature', 'verify.md'), written.content.replace(/^based_on_tasks_contract_hash: .+\n/m, ''), 'utf8');
-
-    const inspection = await inspectVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
-
-    assert.equal(inspection.status, 'BLOCKED');
-    assert.equal(inspection.issues.some((issue) => issue.field === 'based_on_tasks_contract_hash' && issue.level === 'FAIL'), true);
-  } finally {
-    await rm(root, { recursive: true, force: true });
-  }
-});
-
-test('writeVerifyContract upgrades legacy verify documents without force', async () => {
-  const root = await mkdtemp(path.join(tmpdir(), 'sdd-verify-contract-upgrade-'));
+test('inspectVerifyContract ignores legacy based_on metadata', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-verify-contract-legacy-ignored-'));
   try {
     await writeBranchDocs(root, 'feature', validTaskMarkdown('T1', []));
     const written = await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
-    await writeFile(path.join(root, 'specs', 'feature', 'verify.md'), written.content.replace(/^based_on_tasks_contract_hash: .+\n/m, ''), 'utf8');
+    const legacy = written.content.replace('author_role: verification-designer', 'based_on_tasks_contract_hash: legacy\nbased_on_tasks_hash: legacy\nauthor_role: verification-designer');
+    await writeFile(path.join(root, 'specs', 'feature', 'verify.md'), legacy, 'utf8');
 
-    const upgraded = await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
     const inspection = await inspectVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
 
-    assert.equal(upgraded.status, 'updated');
-    assert.match(upgraded.content, /based_on_tasks_contract_hash: /);
     assert.equal(inspection.status, 'PASS');
+    assert.equal(inspection.issues.some((issue) => issue.field === 'based_on_tasks_contract_hash'), false);
   } finally {
     await rm(root, { recursive: true, force: true });
   }
 });
 
-test('writeVerifyContract preserves stale bound verify documents without force', async () => {
-  const root = await mkdtemp(path.join(tmpdir(), 'sdd-verify-contract-preserve-stale-'));
+test('writeVerifyContract preserves current verify documents without based_on metadata', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-verify-contract-preserve-current-'));
   try {
     await writeBranchDocs(root, 'feature', validTaskMarkdown('T1', []));
     const written = await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
     const verifyPath = path.join(root, 'specs', 'feature', 'verify.md');
     const initial = await readFile(verifyPath, 'utf8');
-    await writeFile(path.join(root, 'specs', 'feature', 'tasks.md'), validTaskMarkdown('T2', []), 'utf8');
 
     const preserved = await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
     const inspection = await inspectVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
@@ -197,7 +180,8 @@ test('writeVerifyContract preserves stale bound verify documents without force',
     assert.equal(written.status, 'created');
     assert.equal(preserved.status, 'unchanged');
     assert.equal(preserved.content, initial);
-    assert.equal(inspection.status, 'WARN');
+    assert.doesNotMatch(preserved.content, /based_on_tasks_/);
+    assert.equal(inspection.status, 'PASS');
   } finally {
     await rm(root, { recursive: true, force: true });
   }

package/node_modules/@sdd-agent-platform/core/src/verification/verify-contract.ts

@@ -74,32 +74,13 @@ export async function inspectVerifyContract(projectRoot: string, options: { bran
         action: 'Regenerate verify.md with sdd verifies write or update the frontmatter contract.'
       });
     }
-    if (!model.documents.verifyBasedOnTasksContractHash) {
-      issues.push({
-        level: 'FAIL',
-        field: 'based_on_tasks_contract_hash',
-        message: 'verify.md does not bind to the frozen tasks contract hash.',
-        action: `Run /sdd:tasks or sdd verifies write --branch ${context.partition} --force to regenerate verify.md from the current tasks contract.`
-      });
-    }
-
-    if (model.documents.verifyStale) {
-      issues.push({
-        level: model.documents.verifyBasedOnTasksContractHash ? 'WARN' : 'FAIL',
-        field: 'based_on_tasks_contract_hash',
-        message: model.documents.verifyBasedOnTasksContractHash
-          ? `verify.md is stale for current tasks contract hash ${model.documents.tasksContractHash}.`
-          : 'verify.md cannot be proven current because based_on_tasks_contract_hash is missing.',
-        action: `Run /sdd:tasks or sdd verifies write --branch ${context.partition} --force after reviewing task contract changes.`
-      });
-    }
     const authorRole = readDocumentScalar(raw, 'author_role');
     if (authorRole !== VERIFY_CONTRACT_AUTHOR_ROLE) {
       issues.push({
         level: 'WARN',
         field: 'author_role',
         message: `verify.md must be owned by ${VERIFY_CONTRACT_AUTHOR_ROLE}, not ${authorRole ?? 'missing'}.`,
-        action: 'Regenerate verify.md with a verification-designer role before running sdd test task.'
+        action: 'Regenerate verify.md with a verification-designer role before running sdd test <validation_unit_id-or-validation_text>.'
       });
     }
     const independentFromRoles = readDocumentList(raw, 'independent_from_roles');
@@ -153,14 +134,13 @@ export async function inspectVerifyContract(projectRoot: string, options: { bran
 export async function writeVerifyContract(projectRoot: string, options: { branch?: string | null; branchSource?: ContextBranchSource; force?: boolean } = {}): Promise<WriteVerifyContractResult> {
   const context = await resolveSddContext(projectRoot, options);
   const model = await parseSddBranch(projectRoot, context.partition);
-  const content = renderVerifyContractDocument(model, new Date().toISOString());
+  const content = renderVerifyContractDocument(model);
   const existed = await exists(model.verifyPath);
   if (existed && !options.force) {
     const current = await readFile(model.verifyPath, 'utf8');
-    const currentTasksContractHash = readDocumentScalar(current, 'based_on_tasks_contract_hash');
     const hasCurrentBatchPlan = /^verification_batches:\s*$/m.test(current);
-    const hasContractBinding = Boolean(currentTasksContractHash && currentTasksContractHash !== 'missing');
-    if (current === content || (hasContractBinding && hasCurrentBatchPlan)) {
+    const hasCurrentContract = current.includes(`contract: ${VERIFY_DOCUMENT_CONTRACT_VERSION}`);
+    if (current === content || (hasCurrentContract && hasCurrentBatchPlan)) {
       return {
         branch: context.partition,
         verifyPath: model.verifyPath,
@@ -181,18 +161,14 @@ export async function writeVerifyContract(projectRoot: string, options: { branch
   };
 }
 
-export function renderVerifyContractDocument(model: SddTaskModel, timestamp: string): string {
+export function renderVerifyContractDocument(model: SddTaskModel): string {
   return `---
 contract: ${VERIFY_DOCUMENT_CONTRACT_VERSION}
 version: 1.0.0
 branch: ${model.branch}
-based_on_tasks_contract_hash: ${model.documents.tasksContractHash ?? 'missing'}
-based_on_tasks_hash: ${model.documents.tasksHash ?? 'missing'}
 author_role: ${VERIFY_CONTRACT_AUTHOR_ROLE}
 independent_from_roles:
 ${REQUIRED_INDEPENDENT_FROM_ROLES.map((role) => `  - ${role}`).join('\n')}
-created_at: ${timestamp}
-updated_at: ${timestamp}
 ---
 
 # Verify Contract: ${model.branch}
@@ -216,16 +192,16 @@ ${model.tasks.length > 0 ? model.tasks.map(renderTaskMatrixRow).join('\n') : '|
 
 - The agent that creates tasks.md must not be the same authority that owns verify.md.
 - The implementer must not own verify.md or perform authoritative goal verification.
-- Reviewer and validator evidence must use run-relative artifacts/<file> paths.
-- Physical evidence files live under branch evidence .sdd/runs/<branchSlug>/evidence/artifacts/.
+- Reviewer and validator evidence must use .sdd/runs/<branch>/test/*.md or .sdd/runs/<branch>/do/*.md refs.
+- Physical evidence files live under branch stage evidence .sdd/runs/<branch>/<stage>/*.md.
 - Goal-level verify must resolve the latest eligible run by branch and task unless --run is explicitly supplied for replay.
 - PASS requires policy-backed acceptance evidence, not mention-only acceptance text.
 - \`/sdd:test\` consumes this contract and must not create or refresh it.
-- Low-level sync-back may inspect or replay the generated proposal for diagnostic/recovery use, but normal workflow completion proceeds through test judgment and ship readiness.
+- Goal-level verification feeds runtime truth-alignment; normal workflow completion proceeds through test judgment, goal verification, and ship readiness.
 
 ## 5. Out of Scope
 
-- This document does not replace runtime.sqlite, branch evidence artifacts, validator reports, or sync-back proposals.
+- This document does not replace runtime.sqlite, branch stage evidence artifacts, validator reports, or truth-alignment projections.
 - This document does not authorize publish, push, tag, release, or source changes outside the selected task boundary.
 `;
 }

package/node_modules/@sdd-agent-platform/core/src/work-units/contracts.ts

@@ -4,7 +4,7 @@ import { WORK_UNIT_CONTRACT_VERSION } from '../contracts.js';
 export type WorkUnitType = 'main-agent' | 'co-main-agent' | 'subagent';
 export type WorkUnitStatus = 'pending' | 'running' | 'completed' | 'blocked' | 'failed' | 'cancelled';
 export type WorkUnitAuthority = 'stage-owner' | 'stage-contributor' | 'non-authoritative';
-export type WorkUnitRequiredBefore = 'stage-output' | 'handoff' | 'sync-back' | 'ship' | 'never';
+export type WorkUnitRequiredBefore = 'stage-output' | 'handoff' | 'ship' | 'never';
 
 export interface WorkUnit {
   contract: typeof WORK_UNIT_CONTRACT_VERSION;