sdd-agent-platform 0.4.1 → 0.5.0

package/node_modules/@sdd-agent-platform/core/src/workflow-gate/policy.test.ts

@@ -1,137 +1,135 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-
-import { WORKFLOW_GATE_RUNTIME_CONTRACT_VERSION, STAGE_TEAM_RUNTIME_CONTRACT_VERSION } from '../contracts.js';
-import { synthesizeWorkflowGateDecision } from './policy.js';
-import type { WorkflowGateEvidencePacket } from './types.js';
-
-const generatedAt = '2026-01-01T00:00:00.000Z';
-
-test('workflow gate policy keeps hard blocks monotonic over advisor concerns', () => {
-  const decision = synthesizeWorkflowGateDecision(packet({
-    hardChecks: [{
-      code: 'validation_failure',
-      severity: 'blocked',
-      scope: 'feature',
-      message: 'Selected run validation failed.',
-      recovery: 'Rerun validation.',
-      refs: ['run-001']
-    }],
-    advisorAssessments: [advisor('none')]
-  }));
-
-  assert.equal(decision.status, 'BLOCKED');
-  assert.equal(decision.decidedBy, 'runtime_policy');
-  assert.deepEqual(decision.forbiddenNextActions, ['ship', 'sync-back-apply', 'mark-task-complete', 'stage-pass']);
-});
-
-test('workflow gate policy requires a human for high-concern ship advisors', () => {
-  const decision = synthesizeWorkflowGateDecision(packet({ advisorAssessments: [advisor('high')] }));
-
-  assert.equal(decision.status, 'HUMAN_REQUIRED');
-  assert.equal(decision.humanRequired, true);
-  assert.deepEqual(decision.allowedNextActions, ['create-decision-card', 'inspect-evidence']);
-  assert.equal(decision.forbiddenNextActions.includes('satisfy-with-subagent-output'), true);
-});
-
-test('workflow gate policy treats advisor-only stage transitions without canonical evidence as advisory only', () => {
-  const decision = synthesizeWorkflowGateDecision(packet({
-    decisionKind: 'stage_transition',
-    advisorAssessments: [advisor('low')],
-    canonicalEvidenceRefs: []
-  }));
-
-  assert.equal(decision.status, 'ADVISORY_ONLY');
-  assert.deepEqual(decision.allowedNextActions, ['inspect-advisor-assessments']);
-});
-
-test('workflow gate policy escalates invalid advisors and warns on low confidence', () => {
-  const invalid = synthesizeWorkflowGateDecision(packet({ advisorAssessments: [advisor('low', { validity: 'invalid' })] }));
-  const lowConfidence = synthesizeWorkflowGateDecision(packet({ advisorAssessments: [advisor('low', { confidence: 'low' })] }));
-
-  assert.equal(invalid.status, 'HUMAN_REQUIRED');
-  assert.equal(invalid.advisorSummary.invalidCount, 1);
-  assert.equal(lowConfidence.status, 'WARN');
-  assert.equal(lowConfidence.advisorSummary.lowConfidenceCount, 1);
-  assert.deepEqual(lowConfidence.allowedNextActions, ['inspect-evidence']);
-  assert.deepEqual(lowConfidence.forbiddenNextActions, ['ship', 'sync-back-apply', 'mark-task-complete', 'stage-pass']);
-});
-
-test('workflow gate policy hashes stable gate inputs and carries evidence refs', () => {
-  const decision = synthesizeWorkflowGateDecision(packet({
-    canonicalEvidenceRefs: ['artifacts/validation-T1.md'],
-    fanInEvidenceSets: [{
-      contract: STAGE_TEAM_RUNTIME_CONTRACT_VERSION,
-      fanInId: 'fanin-001',
-      partition: 'feature',
-      runId: 'run-001',
-      taskId: 'T1',
-      stage: 'test',
-      roleResultIds: [],
-      durableGapIds: [],
-      proposalRefs: [],
-      advisorAssessmentIds: [],
-      evidenceRefs: ['artifacts/review-T1.md'],
-      canonicalEvidenceRefs: ['artifacts/validation-T1.md'],
-      gateInputOnly: true,
-      createdAt: generatedAt,
-      payload: {}
-    }]
-  }));
-
-  assert.match(decision.decisionId, /^gate-[a-f0-9]{16}$/);
-  assert.equal(decision.status, 'PASS');
-  assert.deepEqual(decision.evidenceRefs, ['artifacts/review-T1.md', 'artifacts/validation-T1.md']);
-  assert.deepEqual(decision.payload, { contract: WORKFLOW_GATE_RUNTIME_CONTRACT_VERSION, packetId: 'packet-001', workflowScope: { waveRunId: null, taskIds: ['T1'], runIds: ['run-001'], evidenceRefs: [] } });
-});
-
-function packet(overrides: Partial<WorkflowGateEvidencePacket> = {}): WorkflowGateEvidencePacket {
-  return {
-    packetId: 'packet-001',
-    generatedAt,
-    decisionKind: 'ship',
-    partition: 'feature',
-    taskId: 'T1',
-    runId: 'run-001',
-    documents: {} as WorkflowGateEvidencePacket['documents'],
-    latestEligibleSelection: null,
-    latestEligibleSelections: [],
-    workflowScope: { waveRunId: null, taskIds: ['T1'], runIds: ['run-001'], evidenceRefs: [] },
-    runtimeHealth: { status: 'ok', issues: [] },
-    durableGaps: [],
-    dependencyBlockers: [],
-    affectedFileConflicts: [],
-    syncBackDecision: null,
-    syncBackDecisions: [],
-    fanInEvidenceSets: [],
-    advisorAssessments: [],
-    canonicalEvidenceRefs: [],
-    requiredArtifactRefs: [],
-    artifactPayloadHealth: [],
-    hardChecks: [],
-    ...overrides
-  };
-}
-
-function advisor(concern: WorkflowGateEvidencePacket['advisorAssessments'][number]['concern'], overrides: Partial<WorkflowGateEvidencePacket['advisorAssessments'][number]> = {}): WorkflowGateEvidencePacket['advisorAssessments'][number] {
-  return {
-    contract: STAGE_TEAM_RUNTIME_CONTRACT_VERSION,
-    assessmentId: `advisor-${concern}`,
-    sessionId: null,
-    partition: 'feature',
-    runId: 'run-001',
-    taskId: 'T1',
-    kind: 'evidence_sufficiency',
-    concern,
-    validity: 'valid',
-    confidence: 'high',
-    advisoryOnly: true,
-    summary: `${concern} concern`,
-    evidenceRefs: [],
-    durableGapIds: [],
-    proposalRefs: [],
-    createdAt: generatedAt,
-    ...overrides,
-    payload: {}
-  };
-}
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { WORKFLOW_GATE_RUNTIME_CONTRACT_VERSION, STAGE_TEAM_RUNTIME_CONTRACT_VERSION } from '../contracts.js';
+import { synthesizeWorkflowGateDecision } from './policy.js';
+import type { WorkflowGateEvidencePacket } from './types.js';
+
+const generatedAt = '2026-01-01T00:00:00.000Z';
+
+test('workflow gate policy keeps hard blocks monotonic over advisor concerns', () => {
+  const decision = synthesizeWorkflowGateDecision(packet({
+    hardChecks: [{
+      code: 'validation_failure',
+      severity: 'blocked',
+      scope: 'feature',
+      message: 'Selected run validation failed.',
+      recovery: 'Rerun validation.',
+      refs: ['run-001']
+    }],
+    advisorAssessments: [advisor('none')]
+  }));
+
+  assert.equal(decision.status, 'BLOCKED');
+  assert.equal(decision.decidedBy, 'runtime_policy');
+  assert.deepEqual(decision.forbiddenNextActions, ['ship', 'mark-task-complete', 'stage-pass']);
+});
+
+test('workflow gate policy requires a human for high-concern ship advisors', () => {
+  const decision = synthesizeWorkflowGateDecision(packet({ advisorAssessments: [advisor('high')] }));
+
+  assert.equal(decision.status, 'HUMAN_REQUIRED');
+  assert.equal(decision.humanRequired, true);
+  assert.deepEqual(decision.allowedNextActions, ['create-decision-card', 'inspect-evidence']);
+  assert.equal(decision.forbiddenNextActions.includes('satisfy-with-subagent-output'), true);
+});
+
+test('workflow gate policy treats advisor-only stage transitions without canonical evidence as advisory only', () => {
+  const decision = synthesizeWorkflowGateDecision(packet({
+    decisionKind: 'stage_transition',
+    advisorAssessments: [advisor('low')],
+    canonicalEvidenceRefs: []
+  }));
+
+  assert.equal(decision.status, 'ADVISORY_ONLY');
+  assert.deepEqual(decision.allowedNextActions, ['inspect-advisor-assessments']);
+});
+
+test('workflow gate policy escalates invalid advisors and warns on low confidence', () => {
+  const invalid = synthesizeWorkflowGateDecision(packet({ advisorAssessments: [advisor('low', { validity: 'invalid' })] }));
+  const lowConfidence = synthesizeWorkflowGateDecision(packet({ advisorAssessments: [advisor('low', { confidence: 'low' })] }));
+
+  assert.equal(invalid.status, 'HUMAN_REQUIRED');
+  assert.equal(invalid.advisorSummary.invalidCount, 1);
+  assert.equal(lowConfidence.status, 'WARN');
+  assert.equal(lowConfidence.advisorSummary.lowConfidenceCount, 1);
+  assert.deepEqual(lowConfidence.allowedNextActions, ['inspect-evidence']);
+  assert.deepEqual(lowConfidence.forbiddenNextActions, ['ship', 'mark-task-complete', 'stage-pass']);
+});
+
+test('workflow gate policy hashes stable gate inputs and carries evidence refs', () => {
+  const decision = synthesizeWorkflowGateDecision(packet({
+    canonicalEvidenceRefs: ['artifacts/validation-T1.md'],
+    fanInEvidenceSets: [{
+      contract: STAGE_TEAM_RUNTIME_CONTRACT_VERSION,
+      fanInId: 'fanin-001',
+      partition: 'feature',
+      runId: 'run-001',
+      taskId: 'T1',
+      stage: 'test',
+      roleResultIds: [],
+      durableGapIds: [],
+      proposalRefs: [],
+      advisorAssessmentIds: [],
+      evidenceRefs: ['artifacts/review-T1.md'],
+      canonicalEvidenceRefs: ['artifacts/validation-T1.md'],
+      gateInputOnly: true,
+      createdAt: generatedAt,
+      payload: {}
+    }]
+  }));
+
+  assert.match(decision.decisionId, /^gate-[a-f0-9]{16}$/);
+  assert.equal(decision.status, 'PASS');
+  assert.deepEqual(decision.evidenceRefs, ['artifacts/review-T1.md', 'artifacts/validation-T1.md']);
+  assert.deepEqual(decision.payload, { contract: WORKFLOW_GATE_RUNTIME_CONTRACT_VERSION, packetId: 'packet-001', workflowScope: { waveRunId: null, taskIds: ['T1'], runIds: ['run-001'], evidenceRefs: [] } });
+});
+
+function packet(overrides: Partial<WorkflowGateEvidencePacket> = {}): WorkflowGateEvidencePacket {
+  return {
+    packetId: 'packet-001',
+    generatedAt,
+    decisionKind: 'ship',
+    partition: 'feature',
+    taskId: 'T1',
+    runId: 'run-001',
+    documents: {} as WorkflowGateEvidencePacket['documents'],
+    latestEligibleSelection: null,
+    latestEligibleSelections: [],
+    workflowScope: { waveRunId: null, taskIds: ['T1'], runIds: ['run-001'], evidenceRefs: [] },
+    runtimeHealth: { status: 'ok', issues: [] },
+    durableGaps: [],
+    dependencyBlockers: [],
+    affectedFileConflicts: [],
+    fanInEvidenceSets: [],
+    advisorAssessments: [],
+    canonicalEvidenceRefs: [],
+    requiredArtifactRefs: [],
+    artifactPayloadHealth: [],
+    hardChecks: [],
+    ...overrides
+  };
+}
+
+function advisor(concern: WorkflowGateEvidencePacket['advisorAssessments'][number]['concern'], overrides: Partial<WorkflowGateEvidencePacket['advisorAssessments'][number]> = {}): WorkflowGateEvidencePacket['advisorAssessments'][number] {
+  return {
+    contract: STAGE_TEAM_RUNTIME_CONTRACT_VERSION,
+    assessmentId: `advisor-${concern}`,
+    sessionId: null,
+    partition: 'feature',
+    runId: 'run-001',
+    taskId: 'T1',
+    kind: 'evidence_sufficiency',
+    concern,
+    validity: 'valid',
+    confidence: 'high',
+    advisoryOnly: true,
+    summary: `${concern} concern`,
+    evidenceRefs: [],
+    durableGapIds: [],
+    proposalRefs: [],
+    createdAt: generatedAt,
+    ...overrides,
+    payload: {}
+  };
+}

package/node_modules/@sdd-agent-platform/core/src/workflow-gate/policy.ts

@@ -1,155 +1,153 @@
-import { createHash } from 'node:crypto';
-import { WORKFLOW_GATE_RUNTIME_CONTRACT_VERSION } from '../contracts.js';
-import type { WorkflowGateAdvisorSummary, WorkflowGateDecision, WorkflowGateEvidencePacket, WorkflowGateHardCheck, WorkflowGateStatus } from './types.js';
-
-export function synthesizeWorkflowGateDecision(packet: WorkflowGateEvidencePacket): WorkflowGateDecision {
-  const hardBlocks = packet.hardChecks.filter((check) => check.severity === 'blocked');
-  const warnings = packet.hardChecks.filter((check) => check.severity === 'warning');
-  const advisorSummary = summarizeAdvisors(packet);
-  const status = decideStatus(hardBlocks, warnings, advisorSummary, packet);
-  const humanRequired = status === 'HUMAN_REQUIRED';
-  const allowedNextActions = allowedActions(status, packet);
-  const forbiddenNextActions = forbiddenActions(status, packet);
-  return {
-    decisionId: `gate-${inputHash(packet).slice(0, 16)}`,
-    inputHash: inputHash(packet),
-    generatedAt: new Date().toISOString(),
-    partition: packet.partition,
-    taskId: packet.taskId,
-    runId: packet.runId,
-    decisionKind: packet.decisionKind,
-    status,
-    decidedBy: 'runtime_policy',
-    hardBlocks,
-    warnings,
-    advisorSummary,
-    allowedNextActions,
-    forbiddenNextActions,
-    humanRequired,
-    reasons: decisionReasons(status, hardBlocks, warnings, advisorSummary),
-    evidenceRefs: sortedUnique([...packet.canonicalEvidenceRefs, ...packet.fanInEvidenceSets.flatMap((set) => [...set.evidenceRefs, ...set.canonicalEvidenceRefs])]),
-    payload: {
-      contract: WORKFLOW_GATE_RUNTIME_CONTRACT_VERSION,
-      packetId: packet.packetId,
-      workflowScope: packet.workflowScope
-    }
-  };
-}
-
-export function summarizeAdvisors(packet: WorkflowGateEvidencePacket): WorkflowGateAdvisorSummary {
-  const highConcernCount = packet.advisorAssessments.filter((assessment) => assessment.concern === 'high').length;
-  const mediumConcernCount = packet.advisorAssessments.filter((assessment) => assessment.concern === 'medium').length;
-  const invalidCount = packet.advisorAssessments.filter((assessment) => assessment.advisoryOnly !== true || assessment.validity === 'invalid').length;
-  const lowConfidenceCount = packet.advisorAssessments.filter((assessment) => assessment.confidence === 'low').length;
-  return {
-    status: invalidCount > 0 ? 'invalid' : highConcernCount > 0 ? 'high_concern' : mediumConcernCount > 0 || lowConfidenceCount > 0 ? 'medium_concern' : packet.advisorAssessments.length > 0 ? 'low_concern' : 'none',
-    highConcernCount,
-    mediumConcernCount,
-    invalidCount,
-    lowConfidenceCount,
-    summaries: packet.advisorAssessments.map((assessment) => assessment.summary).filter(Boolean).sort()
-  };
-}
-
-export function inputHash(packet: WorkflowGateEvidencePacket): string {
-  return createHash('sha256').update(stableJson({
-    decisionKind: packet.decisionKind,
-    partition: packet.partition,
-    taskId: packet.taskId,
-    runId: packet.runId,
-    documents: packet.documents,
-    selection: packet.latestEligibleSelection,
-    selections: packet.latestEligibleSelections,
-    workflowScope: packet.workflowScope,
-    runtimeHealth: packet.runtimeHealth,
-    durableGaps: packet.durableGaps,
-    dependencyBlockers: packet.dependencyBlockers,
-    affectedFileConflicts: packet.affectedFileConflicts,
-    syncBackDecision: packet.syncBackDecision,
-    syncBackDecisions: packet.syncBackDecisions,
-    fanInEvidenceSets: packet.fanInEvidenceSets,
-    advisorAssessments: packet.advisorAssessments,
-    canonicalEvidenceRefs: packet.canonicalEvidenceRefs,
-    requiredArtifactRefs: packet.requiredArtifactRefs,
-    artifactPayloadHealth: packet.artifactPayloadHealth,
-    hardChecks: packet.hardChecks
-  }), 'utf8').digest('hex');
-}
-
-function decideStatus(hardBlocks: WorkflowGateHardCheck[], warnings: WorkflowGateHardCheck[], advisorSummary: WorkflowGateAdvisorSummary, packet: WorkflowGateEvidencePacket): WorkflowGateStatus {
-  if (hardBlocks.length > 0) {
-    return 'BLOCKED';
-  }
-  if (advisorSummary.status === 'invalid') {
-    return 'HUMAN_REQUIRED';
-  }
-  if (advisorSummary.status === 'high_concern') {
-    return 'HUMAN_REQUIRED';
-  }
-  if (warnings.length > 0 || advisorSummary.status === 'medium_concern') {
-    return 'WARN';
-  }
-  if (packet.decisionKind === 'stage_transition' && packet.advisorAssessments.length > 0 && packet.canonicalEvidenceRefs.length === 0) {
-    return 'ADVISORY_ONLY';
-  }
-  return 'PASS';
-}
-
-function allowedActions(status: WorkflowGateStatus, packet: WorkflowGateEvidencePacket): string[] {
-  if (status === 'PASS') {
-    return packet.decisionKind === 'ship' ? ['ship'] : ['continue'];
-  }
-  if (status === 'WARN') {
-    return ['inspect-evidence'];
-  }
-  if (status === 'HUMAN_REQUIRED') {
-    return ['create-decision-card', 'inspect-evidence'];
-  }
-  if (status === 'ADVISORY_ONLY') {
-    return ['inspect-advisor-assessments'];
-  }
-  return ['inspect-blockers', 'recover'];
-}
-
-function forbiddenActions(status: WorkflowGateStatus, packet: WorkflowGateEvidencePacket): string[] {
-  if (status === 'BLOCKED') {
-    return ['ship', 'sync-back-apply', 'mark-task-complete', 'stage-pass'];
-  }
-  if (status === 'HUMAN_REQUIRED') {
-    return ['satisfy-with-role-result', 'satisfy-with-subagent-output'];
-  }
-  if (status === 'ADVISORY_ONLY') {
-    return ['treat-advisor-as-pass'];
-  }
-  return status === 'WARN' ? ['ship', 'sync-back-apply', 'mark-task-complete', 'stage-pass'] : packet.decisionKind === 'ship' ? [] : ['skip-evidence-recording'];
-}
-
-function decisionReasons(status: WorkflowGateStatus, hardBlocks: WorkflowGateHardCheck[], warnings: WorkflowGateHardCheck[], advisorSummary: WorkflowGateAdvisorSummary): string[] {
-  if (hardBlocks.length > 0) {
-    return hardBlocks.map((check) => `${check.code}: ${check.message}`);
-  }
-  if (status === 'HUMAN_REQUIRED') {
-    return [`advisor=${advisorSummary.status}; human decision required because role/subagent outputs cannot satisfy this gate.`];
-  }
-  if (warnings.length > 0) {
-    return warnings.map((check) => `${check.code}: ${check.message}`);
-  }
-  if (advisorSummary.status === 'medium_concern' || advisorSummary.status === 'high_concern') {
-    return [`advisor=${advisorSummary.status}`];
-  }
-  return [`runtime_policy produced ${status}`];
-}
-
-function sortedUnique(values: string[]): string[] {
-  return [...new Set(values.filter(Boolean))].sort();
-}
-
-function stableJson(value: unknown): string {
-  if (Array.isArray(value)) {
-    return `[${value.map(stableJson).join(',')}]`;
-  }
-  if (value && typeof value === 'object') {
-    return `{${Object.entries(value as Record<string, unknown>).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`).join(',')}}`;
-  }
-  return JSON.stringify(value);
-}
+import { createHash } from 'node:crypto';
+import { WORKFLOW_GATE_RUNTIME_CONTRACT_VERSION } from '../contracts.js';
+import type { WorkflowGateAdvisorSummary, WorkflowGateDecision, WorkflowGateEvidencePacket, WorkflowGateHardCheck, WorkflowGateStatus } from './types.js';
+
+export function synthesizeWorkflowGateDecision(packet: WorkflowGateEvidencePacket): WorkflowGateDecision {
+  const hardBlocks = packet.hardChecks.filter((check) => check.severity === 'blocked');
+  const warnings = packet.hardChecks.filter((check) => check.severity === 'warning');
+  const advisorSummary = summarizeAdvisors(packet);
+  const status = decideStatus(hardBlocks, warnings, advisorSummary, packet);
+  const humanRequired = status === 'HUMAN_REQUIRED';
+  const allowedNextActions = allowedActions(status, packet);
+  const forbiddenNextActions = forbiddenActions(status, packet);
+  return {
+    decisionId: `gate-${inputHash(packet).slice(0, 16)}`,
+    inputHash: inputHash(packet),
+    generatedAt: new Date().toISOString(),
+    partition: packet.partition,
+    taskId: packet.taskId,
+    runId: packet.runId,
+    decisionKind: packet.decisionKind,
+    status,
+    decidedBy: 'runtime_policy',
+    hardBlocks,
+    warnings,
+    advisorSummary,
+    allowedNextActions,
+    forbiddenNextActions,
+    humanRequired,
+    reasons: decisionReasons(status, hardBlocks, warnings, advisorSummary),
+    evidenceRefs: sortedUnique([...packet.canonicalEvidenceRefs, ...packet.fanInEvidenceSets.flatMap((set) => [...set.evidenceRefs, ...set.canonicalEvidenceRefs])]),
+    payload: {
+      contract: WORKFLOW_GATE_RUNTIME_CONTRACT_VERSION,
+      packetId: packet.packetId,
+      workflowScope: packet.workflowScope
+    }
+  };
+}
+
+export function summarizeAdvisors(packet: WorkflowGateEvidencePacket): WorkflowGateAdvisorSummary {
+  const highConcernCount = packet.advisorAssessments.filter((assessment) => assessment.concern === 'high').length;
+  const mediumConcernCount = packet.advisorAssessments.filter((assessment) => assessment.concern === 'medium').length;
+  const invalidCount = packet.advisorAssessments.filter((assessment) => assessment.advisoryOnly !== true || assessment.validity === 'invalid').length;
+  const lowConfidenceCount = packet.advisorAssessments.filter((assessment) => assessment.confidence === 'low').length;
+  return {
+    status: invalidCount > 0 ? 'invalid' : highConcernCount > 0 ? 'high_concern' : mediumConcernCount > 0 || lowConfidenceCount > 0 ? 'medium_concern' : packet.advisorAssessments.length > 0 ? 'low_concern' : 'none',
+    highConcernCount,
+    mediumConcernCount,
+    invalidCount,
+    lowConfidenceCount,
+    summaries: packet.advisorAssessments.map((assessment) => assessment.summary).filter(Boolean).sort()
+  };
+}
+
+export function inputHash(packet: WorkflowGateEvidencePacket): string {
+  return createHash('sha256').update(stableJson({
+    decisionKind: packet.decisionKind,
+    partition: packet.partition,
+    taskId: packet.taskId,
+    runId: packet.runId,
+    documents: packet.documents,
+    selection: packet.latestEligibleSelection,
+    selections: packet.latestEligibleSelections,
+    workflowScope: packet.workflowScope,
+    runtimeHealth: packet.runtimeHealth,
+    durableGaps: packet.durableGaps,
+    dependencyBlockers: packet.dependencyBlockers,
+    affectedFileConflicts: packet.affectedFileConflicts,
+    fanInEvidenceSets: packet.fanInEvidenceSets,
+    advisorAssessments: packet.advisorAssessments,
+    canonicalEvidenceRefs: packet.canonicalEvidenceRefs,
+    requiredArtifactRefs: packet.requiredArtifactRefs,
+    artifactPayloadHealth: packet.artifactPayloadHealth,
+    hardChecks: packet.hardChecks
+  }), 'utf8').digest('hex');
+}
+
+function decideStatus(hardBlocks: WorkflowGateHardCheck[], warnings: WorkflowGateHardCheck[], advisorSummary: WorkflowGateAdvisorSummary, packet: WorkflowGateEvidencePacket): WorkflowGateStatus {
+  if (hardBlocks.length > 0) {
+    return 'BLOCKED';
+  }
+  if (advisorSummary.status === 'invalid') {
+    return 'HUMAN_REQUIRED';
+  }
+  if (advisorSummary.status === 'high_concern') {
+    return 'HUMAN_REQUIRED';
+  }
+  if (warnings.length > 0 || advisorSummary.status === 'medium_concern') {
+    return 'WARN';
+  }
+  if (packet.decisionKind === 'stage_transition' && packet.advisorAssessments.length > 0 && packet.canonicalEvidenceRefs.length === 0) {
+    return 'ADVISORY_ONLY';
+  }
+  return 'PASS';
+}
+
+function allowedActions(status: WorkflowGateStatus, packet: WorkflowGateEvidencePacket): string[] {
+  if (status === 'PASS') {
+    return packet.decisionKind === 'ship' ? ['ship'] : ['continue'];
+  }
+  if (status === 'WARN') {
+    return ['inspect-evidence'];
+  }
+  if (status === 'HUMAN_REQUIRED') {
+    return ['create-decision-card', 'inspect-evidence'];
+  }
+  if (status === 'ADVISORY_ONLY') {
+    return ['inspect-advisor-assessments'];
+  }
+  return ['inspect-blockers', 'recover'];
+}
+
+function forbiddenActions(status: WorkflowGateStatus, packet: WorkflowGateEvidencePacket): string[] {
+  if (status === 'BLOCKED') {
+    return ['ship', 'mark-task-complete', 'stage-pass'];
+  }
+  if (status === 'HUMAN_REQUIRED') {
+    return ['satisfy-with-role-result', 'satisfy-with-subagent-output'];
+  }
+  if (status === 'ADVISORY_ONLY') {
+    return ['treat-advisor-as-pass'];
+  }
+  return status === 'WARN' ? ['ship', 'mark-task-complete', 'stage-pass'] : packet.decisionKind === 'ship' ? [] : ['skip-evidence-recording'];
+}
+
+function decisionReasons(status: WorkflowGateStatus, hardBlocks: WorkflowGateHardCheck[], warnings: WorkflowGateHardCheck[], advisorSummary: WorkflowGateAdvisorSummary): string[] {
+  if (hardBlocks.length > 0) {
+    return hardBlocks.map((check) => `${check.code}: ${check.message}`);
+  }
+  if (status === 'HUMAN_REQUIRED') {
+    return [`advisor=${advisorSummary.status}; human decision required because role/subagent outputs cannot satisfy this gate.`];
+  }
+  if (warnings.length > 0) {
+    return warnings.map((check) => `${check.code}: ${check.message}`);
+  }
+  if (advisorSummary.status === 'medium_concern' || advisorSummary.status === 'high_concern') {
+    return [`advisor=${advisorSummary.status}`];
+  }
+  return [`runtime_policy produced ${status}`];
+}
+
+function sortedUnique(values: string[]): string[] {
+  return [...new Set(values.filter(Boolean))].sort();
+}
+
+function stableJson(value: unknown): string {
+  if (Array.isArray(value)) {
+    return `[${value.map(stableJson).join(',')}]`;
+  }
+  if (value && typeof value === 'object') {
+    return `{${Object.entries(value as Record<string, unknown>).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`).join(',')}}`;
+  }
+  return JSON.stringify(value);
+}