sdd-agent-platform 0.4.1 → 0.5.0

package/node_modules/@sdd-agent-platform/core/src/workflow-gate/hard-checks.test.ts

@@ -1,171 +1,169 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-
-import { STAGE_TEAM_RUNTIME_CONTRACT_VERSION } from '../contracts.js';
-import { evaluateWorkflowGateHardChecks } from './hard-checks.js';
-import type { WorkflowGateEvidencePacket } from './types.js';
-
-const generatedAt = '2026-01-01T00:00:00.000Z';
-
-test('workflow gate hard checks block deterministic workflow violations', () => {
-  const checks = evaluateWorkflowGateHardChecks(packetInput({
-    durableGaps: [{
-      gapId: 'gap-001',
-      partition: 'feature',
-      taskId: 'T1',
-      runId: 'run-001',
-      stage: 'test',
-      gate: 'ship',
-      source: 'runtime',
-      category: 'validation',
-      severity: 'blocking',
-      status: 'open',
-      message: 'Validation evidence is missing.',
-      recommendation: null,
-      evidenceRefs: ['artifacts/validation-T1.md'],
-      proposalRefs: [],
-      sourceRefs: [],
-      createdAt: generatedAt,
-      updatedAt: generatedAt,
-      closedAt: null,
-      payload: {}
-    }],
-    fanInEvidenceSets: [{
-      contract: STAGE_TEAM_RUNTIME_CONTRACT_VERSION,
-      fanInId: 'fanin-001',
-      partition: 'feature',
-      runId: 'run-001',
-      taskId: 'T1',
-      stage: 'test',
-      roleResultIds: [],
-      durableGapIds: [],
-      proposalRefs: [],
-      advisorAssessmentIds: [],
-      evidenceRefs: ['artifacts/validation-T1.md'],
-      canonicalEvidenceRefs: [],
-      gateInputOnly: false,
-      createdAt: generatedAt,
-      payload: {}
-    } as unknown as WorkflowGateEvidencePacket['fanInEvidenceSets'][number]],
-    requiredArtifactRefs: ['artifacts/required-T1.md']
-  }));
-
-  assert.deepEqual(checks.filter((check) => check.severity === 'blocked').map((check) => check.code).sort(), [
-    'authority_violation',
-    'durable_gap_blocking',
-    'missing_required_artifact'
-  ]);
-});
-
-test('workflow gate hard checks warn when no latest eligible run exists', () => {
-  const checks = evaluateWorkflowGateHardChecks(packetInput({ latestEligibleSelection: null }));
-
-  assert.equal(checks.some((check) => check.code === 'latest_eligible_missing' && check.severity === 'warning'), true);
-});
-
-test('workflow gate hard checks block missing and drifted artifact payloads', () => {
-  const checks = evaluateWorkflowGateHardChecks(packetInput({
-    artifactPayloadHealth: [
-      {
-        payloadId: 'payload-missing',
-        logicalRef: 'artifacts/validation-T1.md',
-        physicalPayloadPath: 'artifacts/validation-T1-run-old.md',
-        expectedDigest: 'expected',
-        actualDigest: null,
-        status: 'missing'
-      },
-      {
-        payloadId: 'payload-drift',
-        logicalRef: 'artifacts/review-T1.md',
-        physicalPayloadPath: 'artifacts/review-T1-run-old.md',
-        expectedDigest: 'expected',
-        actualDigest: 'actual',
-        status: 'digest_drift'
-      }
-    ]
-  }));
-
-  assert.deepEqual(checks.filter((check) => check.severity === 'blocked').map((check) => check.code).sort(), ['digest_drift', 'missing_payload']);
-});
-
-test('workflow gate hard checks block missing verify contract and runtime health failures', () => {
-  const checks = evaluateWorkflowGateHardChecks(packetInput({
-    runtimeHealth: { status: 'unavailable', issues: ['schema mismatch'] },
-    documents: {
-      ...packetInput().documents,
-      verifyExists: false,
-      verifyBasedOnTasksContractHash: null
-    } as WorkflowGateEvidencePacket['documents']
-  }));
-
-  assert.equal(checks.some((check) => check.code === 'schema_health_unavailable' && check.severity === 'blocked'), true);
-  assert.equal(checks.some((check) => check.code === 'missing_documents' && check.refs.includes('verify.md')), true);
-});
-
-function packetInput(overrides: Partial<Omit<WorkflowGateEvidencePacket, 'hardChecks'>> = {}): Omit<WorkflowGateEvidencePacket, 'hardChecks'> {
-  return {
-    packetId: 'packet-001',
-    generatedAt,
-    decisionKind: 'ship',
-    partition: 'feature',
-    taskId: 'T1',
-    runId: 'run-001',
-    documents: {
-      specExists: true,
-      planExists: true,
-      tasksExists: true,
-      verifyExists: true,
-      planStale: false,
-      tasksStale: false,
-      verifyStale: false,
-      specHash: 'spec-doc',
-      planHash: 'plan-doc',
-      tasksHash: 'tasks-doc',
-      verifyHash: 'verify-doc',
-      specContractHash: 'spec-contract',
-      planContractHash: 'plan-contract',
-      tasksContractHash: 'tasks-contract',
-      verifyContractHash: 'verify-contract',
-      planBasedOnSpecHash: 'spec-doc',
-      tasksBasedOnPlanHash: 'plan-doc',
-      verifyBasedOnTasksHash: 'tasks-doc',
-      planBasedOnSpecContractHash: 'spec-contract',
-      tasksBasedOnPlanContractHash: 'plan-contract',
-      verifyBasedOnTasksContractHash: 'tasks-contract'
-    } as WorkflowGateEvidencePacket['documents'],
-    latestEligibleSelection: {
-      partition: 'feature',
-      taskId: 'T1',
-      selected: {
-        partition: 'feature',
-        gitBranch: 'feature',
-        taskId: 'T1',
-        runId: 'run-001',
-        runStatus: 'completed',
-        validationStatus: 'pass',
-        syncBackStatus: 'not_created',
-        affectedFiles: [],
-        updatedAt: generatedAt,
-        compatibility: 'compatible',
-        eligibleForDefaultApply: true,
-        reasons: []
-      },
-      candidates: [],
-      rejected: []
-    },
-    latestEligibleSelections: [],
-    workflowScope: { waveRunId: null, taskIds: ['T1'], runIds: ['run-001'], evidenceRefs: [] },
-    runtimeHealth: { status: 'ok', issues: [] },
-    durableGaps: [],
-    dependencyBlockers: [],
-    affectedFileConflicts: [],
-    syncBackDecision: null,
-    syncBackDecisions: [],
-    fanInEvidenceSets: [],
-    advisorAssessments: [],
-    canonicalEvidenceRefs: [],
-    requiredArtifactRefs: [],
-    artifactPayloadHealth: [],
-    ...overrides
-  };
-}
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { STAGE_TEAM_RUNTIME_CONTRACT_VERSION } from '../contracts.js';
+import { evaluateWorkflowGateHardChecks } from './hard-checks.js';
+import type { WorkflowGateEvidencePacket } from './types.js';
+
+const generatedAt = '2026-01-01T00:00:00.000Z';
+
+test('workflow gate hard checks block deterministic workflow violations', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({
+    durableGaps: [{
+      gapId: 'gap-001',
+      partition: 'feature',
+      taskId: 'T1',
+      runId: 'run-001',
+      stage: 'test',
+      gate: 'ship',
+      source: 'runtime',
+      category: 'validation',
+      severity: 'blocking',
+      status: 'open',
+      message: 'Validation evidence is missing.',
+      recommendation: null,
+      evidenceRefs: ['artifacts/validation-T1.md'],
+      proposalRefs: [],
+      sourceRefs: [],
+      createdAt: generatedAt,
+      updatedAt: generatedAt,
+      closedAt: null,
+      payload: {}
+    }],
+    fanInEvidenceSets: [{
+      contract: STAGE_TEAM_RUNTIME_CONTRACT_VERSION,
+      fanInId: 'fanin-001',
+      partition: 'feature',
+      runId: 'run-001',
+      taskId: 'T1',
+      stage: 'test',
+      roleResultIds: [],
+      durableGapIds: [],
+      proposalRefs: [],
+      advisorAssessmentIds: [],
+      evidenceRefs: ['artifacts/validation-T1.md'],
+      canonicalEvidenceRefs: [],
+      gateInputOnly: false,
+      createdAt: generatedAt,
+      payload: {}
+    } as unknown as WorkflowGateEvidencePacket['fanInEvidenceSets'][number]],
+    requiredArtifactRefs: ['artifacts/required-T1.md']
+  }));
+
+  assert.deepEqual(checks.filter((check) => check.severity === 'blocked').map((check) => check.code).sort(), [
+    'authority_violation',
+    'durable_gap_blocking',
+    'missing_required_artifact'
+  ]);
+});
+
+test('workflow gate hard checks warn when no latest eligible run exists', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({ latestEligibleSelection: null }));
+
+  assert.equal(checks.some((check) => check.code === 'latest_eligible_missing' && check.severity === 'warning'), true);
+});
+
+test('workflow gate hard checks block missing and drifted artifact payloads', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({
+    artifactPayloadHealth: [
+      {
+        payloadId: 'payload-missing',
+        logicalRef: 'artifacts/validation-T1.md',
+        physicalPayloadPath: 'artifacts/validation-T1-run-old.md',
+        expectedDigest: 'expected',
+        actualDigest: null,
+        status: 'missing'
+      },
+      {
+        payloadId: 'payload-drift',
+        logicalRef: 'artifacts/review-T1.md',
+        physicalPayloadPath: 'artifacts/review-T1-run-old.md',
+        expectedDigest: 'expected',
+        actualDigest: 'actual',
+        status: 'digest_drift'
+      }
+    ]
+  }));
+
+  assert.deepEqual(checks.filter((check) => check.severity === 'blocked').map((check) => check.code).sort(), ['digest_drift', 'missing_payload']);
+});
+
+test('workflow gate hard checks block missing verify contract and runtime health failures', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({
+    runtimeHealth: { status: 'unavailable', issues: ['schema mismatch'] },
+    documents: {
+      ...packetInput().documents,
+      verifyExists: false,
+      verifyBasedOnTasksContractHash: null
+    } as WorkflowGateEvidencePacket['documents']
+  }));
+
+  assert.equal(checks.some((check) => check.code === 'schema_health_unavailable' && check.severity === 'blocked'), true);
+  assert.equal(checks.some((check) => check.code === 'missing_documents' && check.refs.includes('verify.md')), true);
+});
+
+function packetInput(overrides: Partial<Omit<WorkflowGateEvidencePacket, 'hardChecks'>> = {}): Omit<WorkflowGateEvidencePacket, 'hardChecks'> {
+  return {
+    packetId: 'packet-001',
+    generatedAt,
+    decisionKind: 'ship',
+    partition: 'feature',
+    taskId: 'T1',
+    runId: 'run-001',
+    documents: {
+      specExists: true,
+      planExists: true,
+      tasksExists: true,
+      verifyExists: true,
+      planStale: false,
+      tasksStale: false,
+      verifyStale: false,
+      specHash: 'spec-doc',
+      planHash: 'plan-doc',
+      tasksHash: 'tasks-doc',
+      verifyHash: 'verify-doc',
+      specContractHash: 'spec-contract',
+      planContractHash: 'plan-contract',
+      tasksContractHash: 'tasks-contract',
+      verifyContractHash: 'verify-contract',
+      planBasedOnSpecHash: 'spec-doc',
+      tasksBasedOnPlanHash: 'plan-doc',
+      verifyBasedOnTasksHash: 'tasks-doc',
+      planBasedOnSpecContractHash: 'spec-contract',
+      tasksBasedOnPlanContractHash: 'plan-contract',
+      verifyBasedOnTasksContractHash: 'tasks-contract'
+    } as WorkflowGateEvidencePacket['documents'],
+    latestEligibleSelection: {
+      partition: 'feature',
+      taskId: 'T1',
+      selected: {
+        partition: 'feature',
+        gitBranch: 'feature',
+        taskId: 'T1',
+        runId: 'run-001',
+        runStatus: 'completed',
+        validationStatus: 'pass',
+        syncBackStatus: 'not_created',
+        affectedFiles: [],
+        updatedAt: generatedAt,
+        compatibility: 'compatible',
+        eligibleForDefaultApply: true,
+        reasons: []
+      },
+      candidates: [],
+      rejected: []
+    },
+    latestEligibleSelections: [],
+    workflowScope: { waveRunId: null, taskIds: ['T1'], runIds: ['run-001'], evidenceRefs: [] },
+    runtimeHealth: { status: 'ok', issues: [] },
+    durableGaps: [],
+    dependencyBlockers: [],
+    affectedFileConflicts: [],
+    fanInEvidenceSets: [],
+    advisorAssessments: [],
+    canonicalEvidenceRefs: [],
+    requiredArtifactRefs: [],
+    artifactPayloadHealth: [],
+    ...overrides
+  };
+}

package/node_modules/@sdd-agent-platform/core/src/workflow-gate/hard-checks.ts

@@ -1,143 +1,136 @@
-import type { WorkflowGateEvidencePacket, WorkflowGateHardCheck } from './types.js';
-
-type WorkflowGateHardCheckInput = Omit<WorkflowGateEvidencePacket, 'hardChecks'>;
-
-export function evaluateWorkflowGateHardChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  return [
-    ...runtimeHealthChecks(packet),
-    ...documentChecks(packet),
-    ...latestEligibleChecks(packet),
-    ...dependencyChecks(packet),
-    ...affectedFileChecks(packet),
-    ...durableGapChecks(packet),
-    ...artifactChecks(packet),
-    ...syncBackChecks(packet),
-    ...authorityChecks(packet)
-  ];
-}
-
-function runtimeHealthChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  if (packet.runtimeHealth.status === 'ok') {
-    return [];
-  }
-  return [blocked('schema_health_unavailable', packet.partition, `Runtime store health is unavailable: ${packet.runtimeHealth.issues.join('; ') || 'unknown issue'}.`, 'Repair runtime.sqlite schema or rerun after runtime storage is available.', packet.runtimeHealth.issues)];
-}
-
-function documentChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  const checks: WorkflowGateHardCheck[] = [];
-  const docs = packet.documents;
-  const missing = [
-    ['spec.md', docs.specExists],
-    ['plan.md', docs.planExists],
-    ['tasks.md', docs.tasksExists],
-    ['verify.md', docs.verifyExists]
-  ].filter(([, exists]) => !exists).map(([name]) => String(name));
-  if (missing.length > 0) {
-    checks.push(blocked('missing_documents', packet.partition, `Missing workflow documents: ${missing.join(', ')}.`, 'Run the missing SDD document stages before gate evaluation.', missing));
-  }
-  const stale = [
-    ['plan.md', docs.planStale],
-    ['tasks.md', docs.tasksStale],
-    ['verify.md', docs.verifyStale]
-  ].filter(([, value]) => value === true).map(([name]) => String(name));
-  if (stale.length > 0) {
-    checks.push(blocked('stale_documents', packet.partition, `Stale workflow documents: ${stale.join(', ')}.`, 'Refresh the stale stage contract before continuing.', stale));
-  }
-  if (docs.verifyExists && !docs.verifyBasedOnTasksContractHash) {
-    checks.push(blocked('contract_hash_mismatch', packet.partition, 'verify.md is missing based_on_tasks_contract_hash.', 'Regenerate verify.md from the frozen current tasks contract.', ['verify.md', 'tasks.md']));
-  } else if (docs.verifyBasedOnTasksContractHash && docs.tasksContractHash && docs.verifyBasedOnTasksContractHash !== docs.tasksContractHash) {
-    checks.push(blocked('contract_hash_mismatch', packet.partition, 'verify.md is bound to an older tasks contract hash.', 'Regenerate verify.md from the frozen current tasks contract.', ['verify.md', 'tasks.md']));
-  }
-  return checks;
-}
-
-function latestEligibleChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  const scopedSelections = packet.latestEligibleSelections ?? [];
-  const selections = scopedSelections.length > 0 ? scopedSelections : (packet.latestEligibleSelection ? [packet.latestEligibleSelection] : []);
-  if (selections.length === 0) {
-    return [warning('latest_eligible_missing', packet.partition, 'No latest eligible selection is available.', 'Create a run or inspect task evidence before applying gate decisions.', [])];
-  }
-  return selections.flatMap((selection) => {
-    if (!selection.selected && selection.candidates.length > 0) {
-      return [blocked('run_rejected', packet.partition, `No default-eligible run for ${selection.taskId}; rejected candidates=${selection.rejected.length}.`, 'Inspect rejected latest-eligible candidates and resolve their reasons.', selection.rejected.map((candidate) => candidate.runId))];
-    }
-    if (!selection.selected) {
-      return [warning('latest_eligible_missing', packet.partition, `No run candidates found for ${selection.taskId}.`, 'Run implementation or validation before expecting gate PASS.', [])];
-    }
-    const selected = selection.selected;
-    if (selected.runStatus === 'blocked' || selected.runStatus === 'failed' || selected.runStatus === 'archived') {
-      return [blocked('blocked_failed_or_archived_run', packet.partition, `Selected run ${selected.runId} is ${selected.runStatus}.`, 'Use a non-blocked completed run before continuing.', [selected.runId])];
-    }
-    if (!selected.eligibleForDefaultApply || selected.compatibility === 'strict_stale' || selected.compatibility === 'incompatible') {
-      return [blocked('run_rejected', packet.partition, `Selected run ${selected.runId} is not eligible: ${selected.reasons.join('; ') || selected.compatibility}.`, 'Resolve run eligibility before continuing.', [selected.runId])];
-    }
-    if (selected.validationStatus === 'fail' || selected.validationStatus === 'blocked') {
-      return [blocked('validation_failure', packet.partition, `Selected run validation is ${selected.validationStatus}.`, 'Rerun validation and collect passing evidence.', [selected.runId])];
-    }
-    return [];
-  });
-}
-
-function dependencyChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  return packet.dependencyBlockers.map((blocker) => blocked('dependency_blocker', packet.partition, blocker.reason, `Inspect dependency ${blocker.dependencyId} before continuing.`, [blocker.taskId, blocker.dependencyId]));
-}
-
-function affectedFileChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  return packet.affectedFileConflicts.map((conflict) => blocked('affected_file_conflict', packet.partition, `Affected file ${conflict.file} is active in run ${conflict.runId}.`, 'Resolve active run conflict before applying changes.', [conflict.file, conflict.runId]));
-}
-
-function durableGapChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  return packet.durableGaps
-    .filter((gap) => gap.status === 'open' || gap.status === 'acknowledged')
-    .filter((gap) => gap.severity === 'blocking')
-    .map((gap) => blocked('durable_gap_blocking', packet.partition, gap.message, gap.recommendation ?? 'Resolve the blocking durable gap before continuing.', [gap.gapId, ...gap.evidenceRefs]));
-}
-
-function artifactChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  const available = new Set([...packet.canonicalEvidenceRefs, ...packet.fanInEvidenceSets.flatMap((set) => [...set.canonicalEvidenceRefs, ...set.evidenceRefs])]);
-  const checks = packet.requiredArtifactRefs
-    .filter((ref) => !available.has(ref))
-    .map((ref) => blocked('missing_required_artifact', packet.partition, `Required artifact ${ref} is missing from gate evidence.`, 'Collect required artifacts before gate PASS.', [ref]));
-  for (const payload of packet.artifactPayloadHealth) {
-    if (payload.status === 'missing') {
-      checks.push(blocked('missing_payload', packet.partition, `Artifact payload ${payload.logicalRef} is missing at ${payload.physicalPayloadPath}.`, 'Restore the immutable payload or regenerate current evidence before gate PASS.', [payload.payloadId, payload.logicalRef, payload.physicalPayloadPath]));
-    } else if (payload.status === 'digest_drift') {
-      checks.push(blocked('digest_drift', packet.partition, `Artifact payload ${payload.logicalRef} digest drifted: expected ${payload.expectedDigest} actual ${payload.actualDigest}.`, 'Treat the payload as tampered or stale; regenerate accepted evidence before gate PASS.', [payload.payloadId, payload.logicalRef, payload.physicalPayloadPath]));
-    }
-  }
-  return checks;
-}
-
-function syncBackChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  const decisions = packet.syncBackDecisions.length > 0 ? packet.syncBackDecisions : (packet.syncBackDecision ? [packet.syncBackDecision] : []);
-  return decisions
-    .filter((decision) => decision.status === 'blocked' || decision.status === 'divergent')
-    .map((decision) => blocked('sync_back_divergence', packet.partition, `Sync-back decision ${decision.decisionId} is ${decision.status}.`, 'Inspect sync-back decision divergence before continuing.', [decision.decisionId]));
-}
-
-function authorityChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  const checks: WorkflowGateHardCheck[] = [];
-  for (const fanIn of packet.fanInEvidenceSets) {
-    if (fanIn.gateInputOnly !== true) {
-      checks.push(blocked('authority_violation', packet.partition, `Fan-in evidence set ${fanIn.fanInId} is not gate-input-only.`, 'Regenerate fan-in evidence as non-final gate input.', [fanIn.fanInId]));
-    }
-  }
-  for (const advisor of packet.advisorAssessments) {
-    if (advisor.advisoryOnly !== true) {
-      checks.push(blocked('authority_violation', packet.partition, `Advisor assessment ${advisor.assessmentId} is not advisory-only.`, 'Discard or regenerate advisor assessment as advisory-only.', [advisor.assessmentId]));
-    }
-  }
-  return checks;
-}
-
-function blocked(code: WorkflowGateHardCheck['code'], scope: string, message: string, recovery: string, refs: string[]): WorkflowGateHardCheck {
-  return { code, severity: 'blocked', scope, message, recovery, refs: sortedUnique(refs) };
-}
-
-function warning(code: WorkflowGateHardCheck['code'], scope: string, message: string, recovery: string, refs: string[]): WorkflowGateHardCheck {
-  return { code, severity: 'warning', scope, message, recovery, refs: sortedUnique(refs) };
-}
-
-function sortedUnique(values: string[]): string[] {
-  return [...new Set(values.filter(Boolean))].sort();
-}
+import type { WorkflowGateEvidencePacket, WorkflowGateHardCheck } from './types.js';
+
+type WorkflowGateHardCheckInput = Omit<WorkflowGateEvidencePacket, 'hardChecks'>;
+
+export function evaluateWorkflowGateHardChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
+  return [
+    ...runtimeHealthChecks(packet),
+    ...documentChecks(packet),
+    ...latestEligibleChecks(packet),
+    ...dependencyChecks(packet),
+    ...affectedFileChecks(packet),
+    ...durableGapChecks(packet),
+    ...artifactChecks(packet),
+    ...authorityChecks(packet)
+  ];
+}
+
+function runtimeHealthChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
+  if (packet.runtimeHealth.status === 'ok') {
+    return [];
+  }
+  return [blocked('schema_health_unavailable', packet.partition, `Runtime store health is unavailable: ${packet.runtimeHealth.issues.join('; ') || 'unknown issue'}.`, 'Repair runtime.sqlite schema or rerun after runtime storage is available.', packet.runtimeHealth.issues)];
+}
+
+function documentChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
+  const checks: WorkflowGateHardCheck[] = [];
+  const docs = packet.documents;
+  const missing = [
+    ['spec.md', docs.specExists],
+    ['plan.md', docs.planExists],
+    ['tasks.md', docs.tasksExists],
+    ['verify.md', docs.verifyExists]
+  ].filter(([, exists]) => !exists).map(([name]) => String(name));
+  if (missing.length > 0) {
+    checks.push(blocked('missing_documents', packet.partition, `Missing workflow documents: ${missing.join(', ')}.`, 'Run the missing SDD document stages before gate evaluation.', missing));
+  }
+  const stale = [
+    ['plan.md', docs.planStale],
+    ['tasks.md', docs.tasksStale],
+    ['verify.md', docs.verifyStale]
+  ].filter(([, value]) => value === true).map(([name]) => String(name));
+  if (stale.length > 0) {
+    checks.push(blocked('stale_documents', packet.partition, `Stale workflow documents: ${stale.join(', ')}.`, 'Refresh the stale stage contract before continuing.', stale));
+  }
+  if (docs.verifyExists && !docs.verifyBasedOnTasksContractHash) {
+    checks.push(blocked('contract_hash_mismatch', packet.partition, 'verify.md is missing based_on_tasks_contract_hash.', 'Regenerate verify.md from the frozen current tasks contract.', ['verify.md', 'tasks.md']));
+  } else if (docs.verifyBasedOnTasksContractHash && docs.tasksContractHash && docs.verifyBasedOnTasksContractHash !== docs.tasksContractHash) {
+    checks.push(blocked('contract_hash_mismatch', packet.partition, 'verify.md is bound to an older tasks contract hash.', 'Regenerate verify.md from the frozen current tasks contract.', ['verify.md', 'tasks.md']));
+  }
+  return checks;
+}
+
+function latestEligibleChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
+  const scopedSelections = packet.latestEligibleSelections ?? [];
+  const selections = scopedSelections.length > 0 ? scopedSelections : (packet.latestEligibleSelection ? [packet.latestEligibleSelection] : []);
+  if (selections.length === 0) {
+    return [warning('latest_eligible_missing', packet.partition, 'No latest eligible selection is available.', 'Create a run or inspect task evidence before applying gate decisions.', [])];
+  }
+  return selections.flatMap((selection) => {
+    if (!selection.selected && selection.candidates.length > 0) {
+      return [blocked('run_rejected', packet.partition, `No default-eligible run for ${selection.taskId}; rejected candidates=${selection.rejected.length}.`, 'Inspect rejected latest-eligible candidates and resolve their reasons.', selection.rejected.map((candidate) => candidate.runId))];
+    }
+    if (!selection.selected) {
+      return [warning('latest_eligible_missing', packet.partition, `No run candidates found for ${selection.taskId}.`, 'Run implementation or validation before expecting gate PASS.', [])];
+    }
+    const selected = selection.selected;
+    if (selected.runStatus === 'blocked' || selected.runStatus === 'failed' || selected.runStatus === 'archived') {
+      return [blocked('blocked_failed_or_archived_run', packet.partition, `Selected run ${selected.runId} is ${selected.runStatus}.`, 'Use a non-blocked completed run before continuing.', [selected.runId])];
+    }
+    if (!selected.eligibleForDefaultApply || selected.compatibility === 'strict_stale' || selected.compatibility === 'incompatible') {
+      return [blocked('run_rejected', packet.partition, `Selected run ${selected.runId} is not eligible: ${selected.reasons.join('; ') || selected.compatibility}.`, 'Resolve run eligibility before continuing.', [selected.runId])];
+    }
+    if (selected.validationStatus === 'fail' || selected.validationStatus === 'blocked') {
+      return [blocked('validation_failure', packet.partition, `Selected run validation is ${selected.validationStatus}.`, 'Rerun validation and collect passing evidence.', [selected.runId])];
+    }
+    return [];
+  });
+}
+
+function dependencyChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
+  return packet.dependencyBlockers.map((blocker) => blocked('dependency_blocker', packet.partition, blocker.reason, `Inspect dependency ${blocker.dependencyId} before continuing.`, [blocker.taskId, blocker.dependencyId]));
+}
+
+function affectedFileChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
+  return packet.affectedFileConflicts.map((conflict) => blocked('affected_file_conflict', packet.partition, `Affected file ${conflict.file} is active in run ${conflict.runId}.`, 'Resolve active run conflict before applying changes.', [conflict.file, conflict.runId]));
+}
+
+function durableGapChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
+  return packet.durableGaps
+    .filter((gap) => gap.status === 'open' || gap.status === 'acknowledged')
+    .filter((gap) => gap.severity === 'blocking')
+    .map((gap) => blocked('durable_gap_blocking', packet.partition, gap.message, gap.recommendation ?? 'Resolve the blocking durable gap before continuing.', [gap.gapId, ...gap.evidenceRefs]));
+}
+
+function artifactChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
+  const available = new Set([...packet.canonicalEvidenceRefs, ...packet.fanInEvidenceSets.flatMap((set) => [...set.canonicalEvidenceRefs, ...set.evidenceRefs])]);
+  const checks = packet.requiredArtifactRefs
+    .filter((ref) => !available.has(ref))
+    .map((ref) => blocked('missing_required_artifact', packet.partition, `Required artifact ${ref} is missing from gate evidence.`, 'Collect required artifacts before gate PASS.', [ref]));
+  for (const payload of packet.artifactPayloadHealth) {
+    if (payload.status === 'missing') {
+      checks.push(blocked('missing_payload', packet.partition, `Artifact payload ${payload.logicalRef} is missing at ${payload.physicalPayloadPath}.`, 'Restore the immutable payload or regenerate current evidence before gate PASS.', [payload.payloadId, payload.logicalRef, payload.physicalPayloadPath]));
+    } else if (payload.status === 'digest_drift') {
+      checks.push(blocked('digest_drift', packet.partition, `Artifact payload ${payload.logicalRef} digest drifted: expected ${payload.expectedDigest} actual ${payload.actualDigest}.`, 'Treat the payload as tampered or stale; regenerate accepted evidence before gate PASS.', [payload.payloadId, payload.logicalRef, payload.physicalPayloadPath]));
+    }
+  }
+  return checks;
+}
+
+
+function authorityChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
+  const checks: WorkflowGateHardCheck[] = [];
+  for (const fanIn of packet.fanInEvidenceSets) {
+    if (fanIn.gateInputOnly !== true) {
+      checks.push(blocked('authority_violation', packet.partition, `Fan-in evidence set ${fanIn.fanInId} is not gate-input-only.`, 'Regenerate fan-in evidence as non-final gate input.', [fanIn.fanInId]));
+    }
+  }
+  for (const advisor of packet.advisorAssessments) {
+    if (advisor.advisoryOnly !== true) {
+      checks.push(blocked('authority_violation', packet.partition, `Advisor assessment ${advisor.assessmentId} is not advisory-only.`, 'Discard or regenerate advisor assessment as advisory-only.', [advisor.assessmentId]));
+    }
+  }
+  return checks;
+}
+
+function blocked(code: WorkflowGateHardCheck['code'], scope: string, message: string, recovery: string, refs: string[]): WorkflowGateHardCheck {
+  return { code, severity: 'blocked', scope, message, recovery, refs: sortedUnique(refs) };
+}
+
+function warning(code: WorkflowGateHardCheck['code'], scope: string, message: string, recovery: string, refs: string[]): WorkflowGateHardCheck {
+  return { code, severity: 'warning', scope, message, recovery, refs: sortedUnique(refs) };
+}
+
+function sortedUnique(values: string[]): string[] {
+  return [...new Set(values.filter(Boolean))].sort();
+}