sdd-agent-platform 0.4.1 → 0.4.2

package/node_modules/@sdd-agent-platform/core/src/workflow-gate/hard-checks.test.ts

@@ -1,8 +1,21 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
 
 import { STAGE_TEAM_RUNTIME_CONTRACT_VERSION } from '../contracts.js';
+import { initProject } from '../config/init-project.js';
+import { getEvidenceAttachmentPath } from '../runtime-paths.js';
+import { createRun } from '../run-state/run-state.js';
+import { createRuntimeEvidenceSet, listRuntimeRepairs, recordRuntimeArtifactPayload, recordRuntimeRepair, runtimeScopedId, updateRuntimeSelectionPointer } from '../storage/runtime-store.js';
+import { validTaskMarkdown, writeBranchDocs } from '../test-support/fixtures.js';
+import { bindTestRunState, markTestRunReadyForShip } from '../test-support/run-state.js';
+import { writeVerifyContract } from '../verification/verify-contract.js';
+import { buildOpenRepairRecord } from '../workflow-state/repair-contract.js';
 import { evaluateWorkflowGateHardChecks } from './hard-checks.js';
+import { buildWorkflowGateEvidencePacket, evaluateAndRecordWorkflowGateDecision } from './evidence-packet.js';
 import type { WorkflowGateEvidencePacket } from './types.js';
 
 const generatedAt = '2026-01-01T00:00:00.000Z';
@@ -63,6 +76,46 @@ test('workflow gate hard checks warn when no latest eligible run exists', () =>
   assert.equal(checks.some((check) => check.code === 'latest_eligible_missing' && check.severity === 'warning'), true);
 });
 
+test('workflow gate hard checks do not require latest do run for scoped test run', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({
+    decisionKind: 'test',
+    workflowScope: { waveRunId: null, taskIds: ['T6'], runIds: ['test-run-001'], evidenceRefs: [] },
+    latestEligibleSelection: {
+      partition: 'feature',
+      taskId: 'T6',
+      selected: null,
+      candidates: [{
+        partition: 'feature',
+        gitBranch: 'feature',
+        taskId: 'T6',
+        runId: 'blocked-do-run',
+        runStatus: 'blocked',
+        validationStatus: 'blocked',
+        affectedFiles: [],
+        updatedAt: generatedAt,
+        compatibility: 'compatible',
+        eligibleForDefaultApply: false,
+        reasons: ['Run is blocked.']
+      }],
+      rejected: [{
+        partition: 'feature',
+        gitBranch: 'feature',
+        taskId: 'T6',
+        runId: 'blocked-do-run',
+        runStatus: 'blocked',
+        validationStatus: 'blocked',
+        affectedFiles: [],
+        updatedAt: generatedAt,
+        compatibility: 'compatible',
+        eligibleForDefaultApply: false,
+        reasons: ['Run is blocked.']
+      }]
+    }
+  }));
+
+  assert.equal(checks.some((check) => check.code === 'run_rejected'), false);
+});
+
 test('workflow gate hard checks block missing and drifted artifact payloads', () => {
   const checks = evaluateWorkflowGateHardChecks(packetInput({
     artifactPayloadHealth: [
@@ -88,6 +141,58 @@ test('workflow gate hard checks block missing and drifted artifact payloads', ()
   assert.deepEqual(checks.filter((check) => check.severity === 'blocked').map((check) => check.code).sort(), ['digest_drift', 'missing_payload']);
 });
 
+test('workflow gate hard checks require accepted selection pointer evidence authority', () => {
+  const noneChecks = evaluateWorkflowGateHardChecks(packetInput({
+    selectedEvidence: { source: 'none', evidenceSet: null, pointer: null, payloads: [] }
+  }));
+  const legacyChecks = evaluateWorkflowGateHardChecks(packetInput({
+    selectedEvidence: { source: 'legacy_active_payloads', evidenceSet: null, pointer: null, payloads: [selectedEvidencePayload('artifacts/validation-T1.md', 'active')] }
+  }));
+  const candidateChecks = evaluateWorkflowGateHardChecks(packetInput({
+    selectedEvidence: { source: 'candidate_payloads', evidenceSet: null, pointer: null, payloads: [selectedEvidencePayload('artifacts/validation-T1.md', 'active')] }
+  }));
+
+  assert.equal(noneChecks.some((check) => check.code === 'missing_evidence_selection' && check.severity === 'blocked'), true);
+  assert.equal(legacyChecks.some((check) => check.code === 'missing_evidence_selection' && check.refs.includes('payload-active')), true);
+  assert.equal(candidateChecks.some((check) => check.code === 'missing_evidence_selection' && check.refs.includes('payload-active')), true);
+});
+
+test('workflow gate hard checks reject non-consumable evidence statuses', () => {
+  const statuses: Array<WorkflowGateEvidencePacket['selectedEvidence']['payloads'][number]['status']> = ['partial', 'active_attempt', 'rejected', 'superseded', 'quarantined', 'stale'];
+  const checks = evaluateWorkflowGateHardChecks(packetInput({
+    selectedEvidence: selectedEvidenceSelection(statuses.map((status) => selectedEvidencePayload('artifacts/validation-T1.md', status))),
+    requiredArtifactRefs: ['artifacts/validation-T1.md']
+  }));
+
+  assert.equal(checks.filter((check) => check.code === 'non_consumable_evidence').length, statuses.length);
+  assert.equal(checks.some((check) => check.code === 'missing_required_artifact' && check.refs.includes('artifacts/validation-T1.md')), true);
+});
+
+test('workflow gate hard checks do not let fan-in refs satisfy selected evidence requirements', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({
+    fanInEvidenceSets: [{
+      contract: STAGE_TEAM_RUNTIME_CONTRACT_VERSION,
+      fanInId: 'fanin-selected-authority',
+      partition: 'feature',
+      runId: 'run-001',
+      taskId: 'T1',
+      stage: 'test',
+      roleResultIds: [],
+      durableGapIds: [],
+      proposalRefs: [],
+      advisorAssessmentIds: [],
+      evidenceRefs: ['artifacts/required-T1.md'],
+      canonicalEvidenceRefs: ['artifacts/required-T1.md'],
+      gateInputOnly: true,
+      createdAt: generatedAt,
+      payload: {}
+    }],
+    requiredArtifactRefs: ['artifacts/required-T1.md']
+  }));
+
+  assert.equal(checks.some((check) => check.code === 'missing_required_artifact' && check.refs.includes('artifacts/required-T1.md')), true);
+});
+
 test('workflow gate hard checks block missing verify contract and runtime health failures', () => {
   const checks = evaluateWorkflowGateHardChecks(packetInput({
     runtimeHealth: { status: 'unavailable', issues: ['schema mismatch'] },
@@ -102,6 +207,239 @@ test('workflow gate hard checks block missing verify contract and runtime health
   assert.equal(checks.some((check) => check.code === 'missing_documents' && check.refs.includes('verify.md')), true);
 });
 
+test('workflow gate evidence scopes dependency blockers by decision kind', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-workflow-gate-scope-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'feature', `# Tasks\n\n${validTaskMarkdown('DEP1', []).replace('packages/core/src/index.ts', 'docs/dep1.md')}\n${validTaskMarkdown('DEP2', ['DEP1']).replaceAll('T1', 'DEP2').replace('packages/core/src/index.ts', 'docs/dep2.md')}`);
+
+    const taskPacket = await buildWorkflowGateEvidencePacket(root, {
+      branch: 'feature',
+      taskId: 'DEP1',
+      decisionKind: 'test'
+    });
+    const shipPacket = await buildWorkflowGateEvidencePacket(root, {
+      branch: 'feature',
+      decisionKind: 'ship'
+    });
+
+    assert.deepEqual(taskPacket.workflowScope.taskIds, ['DEP1']);
+    assert.deepEqual(taskPacket.dependencyBlockers, []);
+    assert.deepEqual(shipPacket.workflowScope.taskIds, ['DEP1', 'DEP2']);
+    assert.deepEqual(shipPacket.dependencyBlockers.map((blocker) => `${blocker.taskId}->${blocker.dependencyId}`), ['DEP2->DEP1']);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('workflow gate uses selected accepted evidence instead of latest active payload drift', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-workflow-gate-selected-evidence-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'feature', validTaskMarkdown('T1', []));
+    const run = await createRun(root, { runId: 'selected-evidence-run-001' });
+    const logicalRef = 'artifacts/validation-T1.md';
+    const acceptedPath = 'artifacts/validation-T1-accepted.md';
+    const latestPath = 'artifacts/validation-T1-latest.md';
+    const acceptedContent = 'accepted evidence\n';
+    const latestContent = 'latest evidence\n';
+    await mkdir(path.dirname(getEvidenceAttachmentPath(root, 'feature', acceptedPath)), { recursive: true });
+    await mkdir(path.dirname(getEvidenceAttachmentPath(root, 'feature', latestPath)), { recursive: true });
+    await writeFile(getEvidenceAttachmentPath(root, 'feature', acceptedPath), acceptedContent, 'utf8');
+    await writeFile(getEvidenceAttachmentPath(root, 'feature', latestPath), latestContent, 'utf8');
+    const acceptedPayload = await recordRuntimeArtifactPayload(root, {
+      payloadId: runtimeScopedId(run.runId, logicalRef, 'accepted'),
+      runId: run.runId,
+      sourceRunId: run.runId,
+      branchSlug: 'feature',
+      taskId: 'T1',
+      logicalRef,
+      physicalPayloadPath: acceptedPath,
+      artifactRole: 'validation',
+      digest: hashContent(acceptedContent),
+      status: 'active',
+      payload: { title: 'accepted' }
+    });
+    const latestPayload = await recordRuntimeArtifactPayload(root, {
+      payloadId: runtimeScopedId(run.runId, logicalRef, 'latest'),
+      runId: run.runId,
+      sourceRunId: run.runId,
+      branchSlug: 'feature',
+      taskId: 'T1',
+      logicalRef,
+      physicalPayloadPath: latestPath,
+      artifactRole: 'validation',
+      digest: hashContent(latestContent),
+      status: 'active',
+      payload: { title: 'latest' }
+    });
+    const evidenceSetId = runtimeScopedId(run.runId, 'T1', 'accepted-set');
+    await createRuntimeEvidenceSet(root, {
+      evidenceSetId,
+      branchSlug: 'feature',
+      scopeKind: 'task',
+      scopeId: 'T1',
+      sourceRunId: run.runId,
+      documentContractHashes: { spec: null, plan: null, tasks: null, verify: null },
+      gateDecisionId: 'gate-pass-001',
+      status: 'accepted',
+      items: [{ evidenceSetId, payloadId: acceptedPayload.payloadId, logicalRef, role: 'validation', required: false, digestAtSelection: acceptedPayload.digest }],
+      payload: { source: 'test' }
+    });
+    await updateRuntimeSelectionPointer(root, {
+      branchSlug: 'feature',
+      scopeKind: 'task',
+      scopeId: 'T1',
+      selectedEvidenceSetId: evidenceSetId,
+      selectedAt: generatedAt,
+      selectedByGateDecisionId: 'gate-pass-001',
+      reason: 'accepted test evidence'
+    });
+
+    await writeFile(getEvidenceAttachmentPath(root, 'feature', latestPath), 'latest drift\n', 'utf8');
+    const latestDriftPacket = await buildWorkflowGateEvidencePacket(root, { branch: 'feature', taskId: 'T1', decisionKind: 'test' });
+    await writeFile(getEvidenceAttachmentPath(root, 'feature', acceptedPath), 'accepted drift\n', 'utf8');
+    const selectedDriftPacket = await buildWorkflowGateEvidencePacket(root, { branch: 'feature', taskId: 'T1', decisionKind: 'test' });
+
+    assert.deepEqual(latestDriftPacket.selectedEvidence.payloads.map((payload) => payload.payloadId), [acceptedPayload.payloadId]);
+    assert.equal(latestDriftPacket.selectedEvidence.payloads.some((payload) => payload.payloadId === latestPayload.payloadId), false);
+    assert.equal(latestDriftPacket.hardChecks.some((check) => check.code === 'digest_drift'), false);
+    assert.equal(selectedDriftPacket.hardChecks.some((check) => check.code === 'digest_drift' && check.refs.includes(acceptedPayload.payloadId)), true);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('workflow gate PASS resolves scoped open repair records', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-workflow-gate-repair-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'feature', validTaskMarkdown('T1', []));
+    await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
+    const run = await createRun(root, { runId: 'repair-gate-run-001' });
+    await bindTestRunState(root, run.runId, 'feature', 'T1');
+    await markTestRunReadyForShip(root, run.runId, 'T1');
+    const validationRef = 'artifacts/validation-T1.md';
+    const validationPath = 'artifacts/validation-T1-repair.md';
+    const validationContent = 'repair gate validation evidence\n';
+    await mkdir(path.dirname(getEvidenceAttachmentPath(root, 'feature', validationPath)), { recursive: true });
+    await writeFile(getEvidenceAttachmentPath(root, 'feature', validationPath), validationContent, 'utf8');
+    const validationPayloadId = runtimeScopedId(run.runId, validationRef, 'repair-validation');
+    await recordRuntimeArtifactPayload(root, {
+      payloadId: validationPayloadId,
+      runId: run.runId,
+      sourceRunId: run.runId,
+      branchSlug: 'feature',
+      taskId: 'T1',
+      logicalRef: validationRef,
+      physicalPayloadPath: validationPath,
+      artifactRole: 'validation',
+      digest: hashContent(validationContent),
+      status: 'active',
+      payload: { source: 'repair-test' }
+    });
+    const evidenceSetId = runtimeScopedId(run.runId, 'T1', 'repair-accepted-set');
+    await createRuntimeEvidenceSet(root, {
+      evidenceSetId,
+      branchSlug: 'feature',
+      scopeKind: 'task',
+      scopeId: 'T1',
+      sourceRunId: run.runId,
+      documentContractHashes: { spec: null, plan: null, tasks: null, verify: null },
+      gateDecisionId: 'gate-pass-repair-input',
+      status: 'accepted',
+      items: [{ evidenceSetId, payloadId: validationPayloadId, logicalRef: validationRef, role: 'validation', required: false, digestAtSelection: hashContent(validationContent) }],
+      payload: { source: 'repair-test' }
+    });
+    await updateRuntimeSelectionPointer(root, {
+      branchSlug: 'feature',
+      scopeKind: 'task',
+      scopeId: 'T1',
+      selectedEvidenceSetId: evidenceSetId,
+      selectedAt: generatedAt,
+      selectedByGateDecisionId: 'gate-pass-repair-input',
+      reason: 'accepted repair validation evidence'
+    });
+    await recordRuntimeRepair(root, buildOpenRepairRecord({
+      branchSlug: 'feature',
+      taskId: 'T1',
+      runId: run.runId,
+      message: 'artifact digest evidence drift requires replay',
+      recommendedCommands: ['sdd test task-T1 --branch feature']
+    }));
+
+    const result = await evaluateAndRecordWorkflowGateDecision(root, { branch: 'feature', taskId: 'T1', runId: run.runId, decisionKind: 'test' });
+    const openRepairs = await listRuntimeRepairs(root, { branchSlug: 'feature', status: 'open' });
+    const resolvedRepairs = await listRuntimeRepairs(root, { branchSlug: 'feature', status: 'resolved' });
+
+    assert.equal(result.decision.status, 'PASS');
+    assert.equal(openRepairs.length, 0);
+    assert.equal(resolvedRepairs.length, 1);
+    assert.equal((resolvedRepairs[0].payload as { resolvedByGateDecisionId?: string }).resolvedByGateDecisionId, result.decision.decisionId);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+function selectedEvidencePayload(logicalRef = 'artifacts/validation-T1.md', status: WorkflowGateEvidencePacket['selectedEvidence']['payloads'][number]['status'] = 'active'): WorkflowGateEvidencePacket['selectedEvidence']['payloads'][number] {
+  return {
+    payloadId: `payload-${status}`,
+    runId: 'run-001',
+    sourceRunId: 'run-001',
+    branchSlug: 'feature',
+    taskId: 'T1',
+    logicalRef,
+    physicalPayloadPath: logicalRef,
+    artifactRole: 'validation',
+    digest: `digest-${status}`,
+    sequence: 1,
+    status,
+    supersedes: null,
+    createdAt: generatedAt,
+    payload: {}
+  };
+}
+
+function selectedEvidenceSelection(payloads = [selectedEvidencePayload()]): WorkflowGateEvidencePacket['selectedEvidence'] {
+  return {
+    source: 'selection_pointer',
+    evidenceSet: {
+      evidenceSetId: 'evidence-set-001',
+      branchSlug: 'feature',
+      scopeKind: 'task',
+      scopeId: 'T1',
+      sourceRunId: 'run-001',
+      documentContractHashes: {},
+      gateDecisionId: 'gate-001',
+      status: 'accepted',
+      createdAt: generatedAt,
+      items: payloads.map((payload) => ({
+        evidenceSetId: 'evidence-set-001',
+        payloadId: payload.payloadId,
+        logicalRef: payload.logicalRef,
+        role: payload.artifactRole,
+        required: true,
+        digestAtSelection: payload.digest
+      })),
+      payload: {}
+    },
+    pointer: {
+      branchSlug: 'feature',
+      scopeKind: 'task',
+      scopeId: 'T1',
+      selectedEvidenceSetId: 'evidence-set-001',
+      selectedAt: generatedAt,
+      selectedByGateDecisionId: 'gate-001',
+      reason: 'accepted evidence selection'
+    },
+    payloads
+  };
+}
+
+function hashContent(content: string): string {
+  return createHash('sha256').update(content.replace(/\r\n/g, '\n'), 'utf8').digest('hex');
+}
+
 function packetInput(overrides: Partial<Omit<WorkflowGateEvidencePacket, 'hardChecks'>> = {}): Omit<WorkflowGateEvidencePacket, 'hardChecks'> {
   return {
     packetId: 'packet-001',
@@ -143,7 +481,6 @@ function packetInput(overrides: Partial<Omit<WorkflowGateEvidencePacket, 'hardCh
         runId: 'run-001',
         runStatus: 'completed',
         validationStatus: 'pass',
-        syncBackStatus: 'not_created',
         affectedFiles: [],
         updatedAt: generatedAt,
         compatibility: 'compatible',
@@ -159,10 +496,9 @@ function packetInput(overrides: Partial<Omit<WorkflowGateEvidencePacket, 'hardCh
     durableGaps: [],
     dependencyBlockers: [],
     affectedFileConflicts: [],
-    syncBackDecision: null,
-    syncBackDecisions: [],
     fanInEvidenceSets: [],
     advisorAssessments: [],
+    selectedEvidence: selectedEvidenceSelection(),
     canonicalEvidenceRefs: [],
     requiredArtifactRefs: [],
     artifactPayloadHealth: [],

package/node_modules/@sdd-agent-platform/core/src/workflow-gate/hard-checks.ts

@@ -11,7 +11,6 @@ export function evaluateWorkflowGateHardChecks(packet: WorkflowGateHardCheckInpu
     ...affectedFileChecks(packet),
     ...durableGapChecks(packet),
     ...artifactChecks(packet),
-    ...syncBackChecks(packet),
     ...authorityChecks(packet)
   ];
 }
@@ -43,15 +42,13 @@ function documentChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardChe
   if (stale.length > 0) {
     checks.push(blocked('stale_documents', packet.partition, `Stale workflow documents: ${stale.join(', ')}.`, 'Refresh the stale stage contract before continuing.', stale));
   }
-  if (docs.verifyExists && !docs.verifyBasedOnTasksContractHash) {
-    checks.push(blocked('contract_hash_mismatch', packet.partition, 'verify.md is missing based_on_tasks_contract_hash.', 'Regenerate verify.md from the frozen current tasks contract.', ['verify.md', 'tasks.md']));
-  } else if (docs.verifyBasedOnTasksContractHash && docs.tasksContractHash && docs.verifyBasedOnTasksContractHash !== docs.tasksContractHash) {
-    checks.push(blocked('contract_hash_mismatch', packet.partition, 'verify.md is bound to an older tasks contract hash.', 'Regenerate verify.md from the frozen current tasks contract.', ['verify.md', 'tasks.md']));
-  }
   return checks;
 }
 
 function latestEligibleChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
+  if (packet.decisionKind === 'test' && packet.workflowScope.runIds.length > 0) {
+    return [];
+  }
   const scopedSelections = packet.latestEligibleSelections ?? [];
   const selections = scopedSelections.length > 0 ? scopedSelections : (packet.latestEligibleSelection ? [packet.latestEligibleSelection] : []);
   if (selections.length === 0) {
@@ -94,10 +91,25 @@ function durableGapChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardC
 }
 
 function artifactChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  const available = new Set([...packet.canonicalEvidenceRefs, ...packet.fanInEvidenceSets.flatMap((set) => [...set.canonicalEvidenceRefs, ...set.evidenceRefs])]);
-  const checks = packet.requiredArtifactRefs
+  const checks: WorkflowGateHardCheck[] = [];
+  if (packet.selectedEvidence.source === 'legacy_active_payloads' || packet.selectedEvidence.source === 'candidate_payloads') {
+    checks.push(blocked('missing_evidence_selection', packet.partition, `Gate evidence resolved from ${packet.selectedEvidence.source} instead of an accepted selection pointer.`, 'Create or refresh the runtime accepted evidence set before gate PASS.', packet.selectedEvidence.payloads.map((payload) => payload.payloadId)));
+  }
+  if (packet.selectedEvidence.source === 'none' || packet.selectedEvidence.payloads.length === 0) {
+    checks.push(blocked('missing_evidence_selection', packet.partition, 'No runtime-selected evidence payloads are available for this gate.', 'Collect evidence and create a runtime accepted evidence selection before gate PASS.', packet.requiredArtifactRefs));
+  }
+  const nonConsumable = packet.selectedEvidence.payloads.filter((payload) => !isConsumablePayloadStatus(payload.status));
+  for (const payload of nonConsumable) {
+    checks.push(blocked('non_consumable_evidence', packet.partition, `Evidence ${payload.logicalRef} is ${payload.status} and cannot satisfy gate authority.`, 'Select accepted or current candidate evidence; keep rejected, superseded, quarantined, stale, partial, and active-attempt refs for audit only.', [payload.payloadId, payload.logicalRef, payload.status]));
+  }
+  const nonPrimary = packet.selectedEvidence.payloads.filter((payload) => isConsumablePayloadStatus(payload.status) && !isPrimaryGateEvidencePayload(payload));
+  for (const payload of nonPrimary) {
+    checks.push(warning('non_primary_evidence', packet.partition, `Evidence ${payload.logicalRef} has role ${payload.artifactRole} and cannot satisfy primary gate authority.`, 'Use selected primary stage evidence for gate obligations; keep diagnostic, derived, legacy, and reasoning refs outside primary evidence.', [payload.payloadId, payload.logicalRef, payload.artifactRole]));
+  }
+  const available = new Set(consumableEvidenceRefs(packet));
+  checks.push(...packet.requiredArtifactRefs
     .filter((ref) => !available.has(ref))
-    .map((ref) => blocked('missing_required_artifact', packet.partition, `Required artifact ${ref} is missing from gate evidence.`, 'Collect required artifacts before gate PASS.', [ref]));
+    .map((ref) => blocked('missing_required_artifact', packet.partition, `Required artifact ${ref} is missing from selected gate evidence.`, 'Collect required artifacts and include them in the accepted evidence selection before gate PASS.', [ref])));
   for (const payload of packet.artifactPayloadHealth) {
     if (payload.status === 'missing') {
       checks.push(blocked('missing_payload', packet.partition, `Artifact payload ${payload.logicalRef} is missing at ${payload.physicalPayloadPath}.`, 'Restore the immutable payload or regenerate current evidence before gate PASS.', [payload.payloadId, payload.logicalRef, payload.physicalPayloadPath]));
@@ -108,13 +120,40 @@ function artifactChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardChe
   return checks;
 }
 
-function syncBackChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  const decisions = packet.syncBackDecisions.length > 0 ? packet.syncBackDecisions : (packet.syncBackDecision ? [packet.syncBackDecision] : []);
-  return decisions
-    .filter((decision) => decision.status === 'blocked' || decision.status === 'divergent')
-    .map((decision) => blocked('sync_back_divergence', packet.partition, `Sync-back decision ${decision.decisionId} is ${decision.status}.`, 'Inspect sync-back decision divergence before continuing.', [decision.decisionId]));
+function consumableEvidenceRefs(packet: WorkflowGateHardCheckInput): string[] {
+  if (packet.selectedEvidence.source === 'selection_pointer') {
+    if (packet.selectedEvidence.evidenceSet?.status !== 'accepted') {
+      return [];
+    }
+    return activePayloadRefs(packet);
+  }
+  if (packet.selectedEvidence.source === 'candidate_payloads') {
+    return activePayloadRefs(packet);
+  }
+  return [];
+}
+
+function activePayloadRefs(packet: WorkflowGateHardCheckInput): string[] {
+  return packet.selectedEvidence.payloads.filter((payload) => isConsumablePayloadStatus(payload.status) && isPrimaryGateEvidencePayload(payload)).map((payload) => payload.logicalRef);
+}
+
+function isConsumablePayloadStatus(status: string): boolean {
+  return status === 'active';
 }
 
+function isPrimaryGateEvidencePayload(payload: WorkflowGateHardCheckInput['selectedEvidence']['payloads'][number]): boolean {
+  const ref = payload.logicalRef.replace(/\\/g, '/').toLowerCase();
+  const role = payload.artifactRole.toLowerCase();
+  if (ref.startsWith('runs/') || ref.startsWith('artifacts/') || ref.includes('/evidence/artifacts/')) {
+    return false;
+  }
+  if (ref.includes('/test-index-') || ref.endsWith('.log')) {
+    return false;
+  }
+  return !/(command-output|test-index|diagnostic|derived|cache|profile|summary|context-package|acceptance-coverage|review|manager|handoff|collaboration)/.test(role);
+}
+
+
 function authorityChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
   const checks: WorkflowGateHardCheck[] = [];
   for (const fanIn of packet.fanInEvidenceSets) {

package/node_modules/@sdd-agent-platform/core/src/workflow-gate/policy.test.ts

@@ -22,7 +22,7 @@ test('workflow gate policy keeps hard blocks monotonic over advisor concerns', (
 
   assert.equal(decision.status, 'BLOCKED');
   assert.equal(decision.decidedBy, 'runtime_policy');
-  assert.deepEqual(decision.forbiddenNextActions, ['ship', 'sync-back-apply', 'mark-task-complete', 'stage-pass']);
+  assert.deepEqual(decision.forbiddenNextActions, ['ship', 'truth-alignment-approval', 'mark-task-complete', 'stage-pass']);
 });
 
 test('workflow gate policy requires a human for high-concern ship advisors', () => {
@@ -54,12 +54,14 @@ test('workflow gate policy escalates invalid advisors and warns on low confidenc
   assert.equal(lowConfidence.status, 'WARN');
   assert.equal(lowConfidence.advisorSummary.lowConfidenceCount, 1);
   assert.deepEqual(lowConfidence.allowedNextActions, ['inspect-evidence']);
-  assert.deepEqual(lowConfidence.forbiddenNextActions, ['ship', 'sync-back-apply', 'mark-task-complete', 'stage-pass']);
+  assert.deepEqual(lowConfidence.forbiddenNextActions, ['ship', 'truth-alignment-approval', 'mark-task-complete', 'stage-pass']);
 });
 
-test('workflow gate policy hashes stable gate inputs and carries evidence refs', () => {
+test('workflow gate policy hashes selected evidence and carries gate binding', () => {
+  const selectedPayload = selectedEvidencePayload('artifacts/validation-T1.md', 'digest-validation');
   const decision = synthesizeWorkflowGateDecision(packet({
     canonicalEvidenceRefs: ['artifacts/validation-T1.md'],
+    selectedEvidence: { source: 'candidate_payloads', evidenceSet: null, pointer: null, payloads: [selectedPayload] },
     fanInEvidenceSets: [{
       contract: STAGE_TEAM_RUNTIME_CONTRACT_VERSION,
       fanInId: 'fanin-001',
@@ -72,7 +74,7 @@ test('workflow gate policy hashes stable gate inputs and carries evidence refs',
       proposalRefs: [],
       advisorAssessmentIds: [],
       evidenceRefs: ['artifacts/review-T1.md'],
-      canonicalEvidenceRefs: ['artifacts/validation-T1.md'],
+      canonicalEvidenceRefs: ['artifacts/review-T1.md'],
       gateInputOnly: true,
       createdAt: generatedAt,
       payload: {}
@@ -81,8 +83,25 @@ test('workflow gate policy hashes stable gate inputs and carries evidence refs',
 
   assert.match(decision.decisionId, /^gate-[a-f0-9]{16}$/);
   assert.equal(decision.status, 'PASS');
-  assert.deepEqual(decision.evidenceRefs, ['artifacts/review-T1.md', 'artifacts/validation-T1.md']);
-  assert.deepEqual(decision.payload, { contract: WORKFLOW_GATE_RUNTIME_CONTRACT_VERSION, packetId: 'packet-001', workflowScope: { waveRunId: null, taskIds: ['T1'], runIds: ['run-001'], evidenceRefs: [] } });
+  assert.deepEqual(decision.evidenceRefs, ['artifacts/validation-T1.md']);
+  assert.deepEqual(decision.payload, {
+    contract: WORKFLOW_GATE_RUNTIME_CONTRACT_VERSION,
+    packetId: 'packet-001',
+    workflowScope: { waveRunId: null, taskIds: ['T1'], runIds: ['run-001'], evidenceRefs: [] },
+    evidenceBinding: {
+      contract: 'sdd-gate-evidence-binding-v1',
+      branch: 'feature',
+      gate: 'ship',
+      selectionPointerRef: null,
+      acceptedEvidenceSetRef: null,
+      source: 'candidate_payloads',
+      selectedRefs: [{ payloadId: selectedPayload.payloadId, logicalRef: selectedPayload.logicalRef, digest: selectedPayload.digest, status: selectedPayload.status }],
+      blockedRefs: [],
+      selectionReasons: [],
+      decision: 'pass',
+      reasons: []
+    }
+  });
 });
 
 function packet(overrides: Partial<WorkflowGateEvidencePacket> = {}): WorkflowGateEvidencePacket {
@@ -101,10 +120,9 @@ function packet(overrides: Partial<WorkflowGateEvidencePacket> = {}): WorkflowGa
     durableGaps: [],
     dependencyBlockers: [],
     affectedFileConflicts: [],
-    syncBackDecision: null,
-    syncBackDecisions: [],
     fanInEvidenceSets: [],
     advisorAssessments: [],
+    selectedEvidence: { source: 'none', evidenceSet: null, pointer: null, payloads: [] },
     canonicalEvidenceRefs: [],
     requiredArtifactRefs: [],
     artifactPayloadHealth: [],
@@ -113,6 +131,25 @@ function packet(overrides: Partial<WorkflowGateEvidencePacket> = {}): WorkflowGa
   };
 }
 
+function selectedEvidencePayload(logicalRef: string, digest: string): WorkflowGateEvidencePacket['selectedEvidence']['payloads'][number] {
+  return {
+    payloadId: `payload-${digest}`,
+    runId: 'run-001',
+    sourceRunId: 'run-001',
+    branchSlug: 'feature',
+    taskId: 'T1',
+    logicalRef,
+    physicalPayloadPath: logicalRef,
+    artifactRole: 'validation',
+    digest,
+    sequence: 1,
+    status: 'active',
+    supersedes: null,
+    createdAt: generatedAt,
+    payload: {}
+  };
+}
+
 function advisor(concern: WorkflowGateEvidencePacket['advisorAssessments'][number]['concern'], overrides: Partial<WorkflowGateEvidencePacket['advisorAssessments'][number]> = {}): WorkflowGateEvidencePacket['advisorAssessments'][number] {
   return {
     contract: STAGE_TEAM_RUNTIME_CONTRACT_VERSION,