sdd-agent-platform 0.4.2 → 0.5.1

package/node_modules/@sdd-agent-platform/core/src/workflow-gate/hard-checks.test.ts

@@ -1,507 +1,169 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { createHash } from 'node:crypto';
-import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-
-import { STAGE_TEAM_RUNTIME_CONTRACT_VERSION } from '../contracts.js';
-import { initProject } from '../config/init-project.js';
-import { getEvidenceAttachmentPath } from '../runtime-paths.js';
-import { createRun } from '../run-state/run-state.js';
-import { createRuntimeEvidenceSet, listRuntimeRepairs, recordRuntimeArtifactPayload, recordRuntimeRepair, runtimeScopedId, updateRuntimeSelectionPointer } from '../storage/runtime-store.js';
-import { validTaskMarkdown, writeBranchDocs } from '../test-support/fixtures.js';
-import { bindTestRunState, markTestRunReadyForShip } from '../test-support/run-state.js';
-import { writeVerifyContract } from '../verification/verify-contract.js';
-import { buildOpenRepairRecord } from '../workflow-state/repair-contract.js';
-import { evaluateWorkflowGateHardChecks } from './hard-checks.js';
-import { buildWorkflowGateEvidencePacket, evaluateAndRecordWorkflowGateDecision } from './evidence-packet.js';
-import type { WorkflowGateEvidencePacket } from './types.js';
-
-const generatedAt = '2026-01-01T00:00:00.000Z';
-
-test('workflow gate hard checks block deterministic workflow violations', () => {
-  const checks = evaluateWorkflowGateHardChecks(packetInput({
-    durableGaps: [{
-      gapId: 'gap-001',
-      partition: 'feature',
-      taskId: 'T1',
-      runId: 'run-001',
-      stage: 'test',
-      gate: 'ship',
-      source: 'runtime',
-      category: 'validation',
-      severity: 'blocking',
-      status: 'open',
-      message: 'Validation evidence is missing.',
-      recommendation: null,
-      evidenceRefs: ['artifacts/validation-T1.md'],
-      proposalRefs: [],
-      sourceRefs: [],
-      createdAt: generatedAt,
-      updatedAt: generatedAt,
-      closedAt: null,
-      payload: {}
-    }],
-    fanInEvidenceSets: [{
-      contract: STAGE_TEAM_RUNTIME_CONTRACT_VERSION,
-      fanInId: 'fanin-001',
-      partition: 'feature',
-      runId: 'run-001',
-      taskId: 'T1',
-      stage: 'test',
-      roleResultIds: [],
-      durableGapIds: [],
-      proposalRefs: [],
-      advisorAssessmentIds: [],
-      evidenceRefs: ['artifacts/validation-T1.md'],
-      canonicalEvidenceRefs: [],
-      gateInputOnly: false,
-      createdAt: generatedAt,
-      payload: {}
-    } as unknown as WorkflowGateEvidencePacket['fanInEvidenceSets'][number]],
-    requiredArtifactRefs: ['artifacts/required-T1.md']
-  }));
-
-  assert.deepEqual(checks.filter((check) => check.severity === 'blocked').map((check) => check.code).sort(), [
-    'authority_violation',
-    'durable_gap_blocking',
-    'missing_required_artifact'
-  ]);
-});
-
-test('workflow gate hard checks warn when no latest eligible run exists', () => {
-  const checks = evaluateWorkflowGateHardChecks(packetInput({ latestEligibleSelection: null }));
-
-  assert.equal(checks.some((check) => check.code === 'latest_eligible_missing' && check.severity === 'warning'), true);
-});
-
-test('workflow gate hard checks do not require latest do run for scoped test run', () => {
-  const checks = evaluateWorkflowGateHardChecks(packetInput({
-    decisionKind: 'test',
-    workflowScope: { waveRunId: null, taskIds: ['T6'], runIds: ['test-run-001'], evidenceRefs: [] },
-    latestEligibleSelection: {
-      partition: 'feature',
-      taskId: 'T6',
-      selected: null,
-      candidates: [{
-        partition: 'feature',
-        gitBranch: 'feature',
-        taskId: 'T6',
-        runId: 'blocked-do-run',
-        runStatus: 'blocked',
-        validationStatus: 'blocked',
-        affectedFiles: [],
-        updatedAt: generatedAt,
-        compatibility: 'compatible',
-        eligibleForDefaultApply: false,
-        reasons: ['Run is blocked.']
-      }],
-      rejected: [{
-        partition: 'feature',
-        gitBranch: 'feature',
-        taskId: 'T6',
-        runId: 'blocked-do-run',
-        runStatus: 'blocked',
-        validationStatus: 'blocked',
-        affectedFiles: [],
-        updatedAt: generatedAt,
-        compatibility: 'compatible',
-        eligibleForDefaultApply: false,
-        reasons: ['Run is blocked.']
-      }]
-    }
-  }));
-
-  assert.equal(checks.some((check) => check.code === 'run_rejected'), false);
-});
-
-test('workflow gate hard checks block missing and drifted artifact payloads', () => {
-  const checks = evaluateWorkflowGateHardChecks(packetInput({
-    artifactPayloadHealth: [
-      {
-        payloadId: 'payload-missing',
-        logicalRef: 'artifacts/validation-T1.md',
-        physicalPayloadPath: 'artifacts/validation-T1-run-old.md',
-        expectedDigest: 'expected',
-        actualDigest: null,
-        status: 'missing'
-      },
-      {
-        payloadId: 'payload-drift',
-        logicalRef: 'artifacts/review-T1.md',
-        physicalPayloadPath: 'artifacts/review-T1-run-old.md',
-        expectedDigest: 'expected',
-        actualDigest: 'actual',
-        status: 'digest_drift'
-      }
-    ]
-  }));
-
-  assert.deepEqual(checks.filter((check) => check.severity === 'blocked').map((check) => check.code).sort(), ['digest_drift', 'missing_payload']);
-});
-
-test('workflow gate hard checks require accepted selection pointer evidence authority', () => {
-  const noneChecks = evaluateWorkflowGateHardChecks(packetInput({
-    selectedEvidence: { source: 'none', evidenceSet: null, pointer: null, payloads: [] }
-  }));
-  const legacyChecks = evaluateWorkflowGateHardChecks(packetInput({
-    selectedEvidence: { source: 'legacy_active_payloads', evidenceSet: null, pointer: null, payloads: [selectedEvidencePayload('artifacts/validation-T1.md', 'active')] }
-  }));
-  const candidateChecks = evaluateWorkflowGateHardChecks(packetInput({
-    selectedEvidence: { source: 'candidate_payloads', evidenceSet: null, pointer: null, payloads: [selectedEvidencePayload('artifacts/validation-T1.md', 'active')] }
-  }));
-
-  assert.equal(noneChecks.some((check) => check.code === 'missing_evidence_selection' && check.severity === 'blocked'), true);
-  assert.equal(legacyChecks.some((check) => check.code === 'missing_evidence_selection' && check.refs.includes('payload-active')), true);
-  assert.equal(candidateChecks.some((check) => check.code === 'missing_evidence_selection' && check.refs.includes('payload-active')), true);
-});
-
-test('workflow gate hard checks reject non-consumable evidence statuses', () => {
-  const statuses: Array<WorkflowGateEvidencePacket['selectedEvidence']['payloads'][number]['status']> = ['partial', 'active_attempt', 'rejected', 'superseded', 'quarantined', 'stale'];
-  const checks = evaluateWorkflowGateHardChecks(packetInput({
-    selectedEvidence: selectedEvidenceSelection(statuses.map((status) => selectedEvidencePayload('artifacts/validation-T1.md', status))),
-    requiredArtifactRefs: ['artifacts/validation-T1.md']
-  }));
-
-  assert.equal(checks.filter((check) => check.code === 'non_consumable_evidence').length, statuses.length);
-  assert.equal(checks.some((check) => check.code === 'missing_required_artifact' && check.refs.includes('artifacts/validation-T1.md')), true);
-});
-
-test('workflow gate hard checks do not let fan-in refs satisfy selected evidence requirements', () => {
-  const checks = evaluateWorkflowGateHardChecks(packetInput({
-    fanInEvidenceSets: [{
-      contract: STAGE_TEAM_RUNTIME_CONTRACT_VERSION,
-      fanInId: 'fanin-selected-authority',
-      partition: 'feature',
-      runId: 'run-001',
-      taskId: 'T1',
-      stage: 'test',
-      roleResultIds: [],
-      durableGapIds: [],
-      proposalRefs: [],
-      advisorAssessmentIds: [],
-      evidenceRefs: ['artifacts/required-T1.md'],
-      canonicalEvidenceRefs: ['artifacts/required-T1.md'],
-      gateInputOnly: true,
-      createdAt: generatedAt,
-      payload: {}
-    }],
-    requiredArtifactRefs: ['artifacts/required-T1.md']
-  }));
-
-  assert.equal(checks.some((check) => check.code === 'missing_required_artifact' && check.refs.includes('artifacts/required-T1.md')), true);
-});
-
-test('workflow gate hard checks block missing verify contract and runtime health failures', () => {
-  const checks = evaluateWorkflowGateHardChecks(packetInput({
-    runtimeHealth: { status: 'unavailable', issues: ['schema mismatch'] },
-    documents: {
-      ...packetInput().documents,
-      verifyExists: false,
-      verifyBasedOnTasksContractHash: null
-    } as WorkflowGateEvidencePacket['documents']
-  }));
-
-  assert.equal(checks.some((check) => check.code === 'schema_health_unavailable' && check.severity === 'blocked'), true);
-  assert.equal(checks.some((check) => check.code === 'missing_documents' && check.refs.includes('verify.md')), true);
-});
-
-test('workflow gate evidence scopes dependency blockers by decision kind', async () => {
-  const root = await mkdtemp(path.join(tmpdir(), 'sdd-workflow-gate-scope-'));
-  try {
-    await initProject(root);
-    await writeBranchDocs(root, 'feature', `# Tasks\n\n${validTaskMarkdown('DEP1', []).replace('packages/core/src/index.ts', 'docs/dep1.md')}\n${validTaskMarkdown('DEP2', ['DEP1']).replaceAll('T1', 'DEP2').replace('packages/core/src/index.ts', 'docs/dep2.md')}`);
-
-    const taskPacket = await buildWorkflowGateEvidencePacket(root, {
-      branch: 'feature',
-      taskId: 'DEP1',
-      decisionKind: 'test'
-    });
-    const shipPacket = await buildWorkflowGateEvidencePacket(root, {
-      branch: 'feature',
-      decisionKind: 'ship'
-    });
-
-    assert.deepEqual(taskPacket.workflowScope.taskIds, ['DEP1']);
-    assert.deepEqual(taskPacket.dependencyBlockers, []);
-    assert.deepEqual(shipPacket.workflowScope.taskIds, ['DEP1', 'DEP2']);
-    assert.deepEqual(shipPacket.dependencyBlockers.map((blocker) => `${blocker.taskId}->${blocker.dependencyId}`), ['DEP2->DEP1']);
-  } finally {
-    await rm(root, { recursive: true, force: true });
-  }
-});
-
-test('workflow gate uses selected accepted evidence instead of latest active payload drift', async () => {
-  const root = await mkdtemp(path.join(tmpdir(), 'sdd-workflow-gate-selected-evidence-'));
-  try {
-    await initProject(root);
-    await writeBranchDocs(root, 'feature', validTaskMarkdown('T1', []));
-    const run = await createRun(root, { runId: 'selected-evidence-run-001' });
-    const logicalRef = 'artifacts/validation-T1.md';
-    const acceptedPath = 'artifacts/validation-T1-accepted.md';
-    const latestPath = 'artifacts/validation-T1-latest.md';
-    const acceptedContent = 'accepted evidence\n';
-    const latestContent = 'latest evidence\n';
-    await mkdir(path.dirname(getEvidenceAttachmentPath(root, 'feature', acceptedPath)), { recursive: true });
-    await mkdir(path.dirname(getEvidenceAttachmentPath(root, 'feature', latestPath)), { recursive: true });
-    await writeFile(getEvidenceAttachmentPath(root, 'feature', acceptedPath), acceptedContent, 'utf8');
-    await writeFile(getEvidenceAttachmentPath(root, 'feature', latestPath), latestContent, 'utf8');
-    const acceptedPayload = await recordRuntimeArtifactPayload(root, {
-      payloadId: runtimeScopedId(run.runId, logicalRef, 'accepted'),
-      runId: run.runId,
-      sourceRunId: run.runId,
-      branchSlug: 'feature',
-      taskId: 'T1',
-      logicalRef,
-      physicalPayloadPath: acceptedPath,
-      artifactRole: 'validation',
-      digest: hashContent(acceptedContent),
-      status: 'active',
-      payload: { title: 'accepted' }
-    });
-    const latestPayload = await recordRuntimeArtifactPayload(root, {
-      payloadId: runtimeScopedId(run.runId, logicalRef, 'latest'),
-      runId: run.runId,
-      sourceRunId: run.runId,
-      branchSlug: 'feature',
-      taskId: 'T1',
-      logicalRef,
-      physicalPayloadPath: latestPath,
-      artifactRole: 'validation',
-      digest: hashContent(latestContent),
-      status: 'active',
-      payload: { title: 'latest' }
-    });
-    const evidenceSetId = runtimeScopedId(run.runId, 'T1', 'accepted-set');
-    await createRuntimeEvidenceSet(root, {
-      evidenceSetId,
-      branchSlug: 'feature',
-      scopeKind: 'task',
-      scopeId: 'T1',
-      sourceRunId: run.runId,
-      documentContractHashes: { spec: null, plan: null, tasks: null, verify: null },
-      gateDecisionId: 'gate-pass-001',
-      status: 'accepted',
-      items: [{ evidenceSetId, payloadId: acceptedPayload.payloadId, logicalRef, role: 'validation', required: false, digestAtSelection: acceptedPayload.digest }],
-      payload: { source: 'test' }
-    });
-    await updateRuntimeSelectionPointer(root, {
-      branchSlug: 'feature',
-      scopeKind: 'task',
-      scopeId: 'T1',
-      selectedEvidenceSetId: evidenceSetId,
-      selectedAt: generatedAt,
-      selectedByGateDecisionId: 'gate-pass-001',
-      reason: 'accepted test evidence'
-    });
-
-    await writeFile(getEvidenceAttachmentPath(root, 'feature', latestPath), 'latest drift\n', 'utf8');
-    const latestDriftPacket = await buildWorkflowGateEvidencePacket(root, { branch: 'feature', taskId: 'T1', decisionKind: 'test' });
-    await writeFile(getEvidenceAttachmentPath(root, 'feature', acceptedPath), 'accepted drift\n', 'utf8');
-    const selectedDriftPacket = await buildWorkflowGateEvidencePacket(root, { branch: 'feature', taskId: 'T1', decisionKind: 'test' });
-
-    assert.deepEqual(latestDriftPacket.selectedEvidence.payloads.map((payload) => payload.payloadId), [acceptedPayload.payloadId]);
-    assert.equal(latestDriftPacket.selectedEvidence.payloads.some((payload) => payload.payloadId === latestPayload.payloadId), false);
-    assert.equal(latestDriftPacket.hardChecks.some((check) => check.code === 'digest_drift'), false);
-    assert.equal(selectedDriftPacket.hardChecks.some((check) => check.code === 'digest_drift' && check.refs.includes(acceptedPayload.payloadId)), true);
-  } finally {
-    await rm(root, { recursive: true, force: true });
-  }
-});
-
-test('workflow gate PASS resolves scoped open repair records', async () => {
-  const root = await mkdtemp(path.join(tmpdir(), 'sdd-workflow-gate-repair-'));
-  try {
-    await initProject(root);
-    await writeBranchDocs(root, 'feature', validTaskMarkdown('T1', []));
-    await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
-    const run = await createRun(root, { runId: 'repair-gate-run-001' });
-    await bindTestRunState(root, run.runId, 'feature', 'T1');
-    await markTestRunReadyForShip(root, run.runId, 'T1');
-    const validationRef = 'artifacts/validation-T1.md';
-    const validationPath = 'artifacts/validation-T1-repair.md';
-    const validationContent = 'repair gate validation evidence\n';
-    await mkdir(path.dirname(getEvidenceAttachmentPath(root, 'feature', validationPath)), { recursive: true });
-    await writeFile(getEvidenceAttachmentPath(root, 'feature', validationPath), validationContent, 'utf8');
-    const validationPayloadId = runtimeScopedId(run.runId, validationRef, 'repair-validation');
-    await recordRuntimeArtifactPayload(root, {
-      payloadId: validationPayloadId,
-      runId: run.runId,
-      sourceRunId: run.runId,
-      branchSlug: 'feature',
-      taskId: 'T1',
-      logicalRef: validationRef,
-      physicalPayloadPath: validationPath,
-      artifactRole: 'validation',
-      digest: hashContent(validationContent),
-      status: 'active',
-      payload: { source: 'repair-test' }
-    });
-    const evidenceSetId = runtimeScopedId(run.runId, 'T1', 'repair-accepted-set');
-    await createRuntimeEvidenceSet(root, {
-      evidenceSetId,
-      branchSlug: 'feature',
-      scopeKind: 'task',
-      scopeId: 'T1',
-      sourceRunId: run.runId,
-      documentContractHashes: { spec: null, plan: null, tasks: null, verify: null },
-      gateDecisionId: 'gate-pass-repair-input',
-      status: 'accepted',
-      items: [{ evidenceSetId, payloadId: validationPayloadId, logicalRef: validationRef, role: 'validation', required: false, digestAtSelection: hashContent(validationContent) }],
-      payload: { source: 'repair-test' }
-    });
-    await updateRuntimeSelectionPointer(root, {
-      branchSlug: 'feature',
-      scopeKind: 'task',
-      scopeId: 'T1',
-      selectedEvidenceSetId: evidenceSetId,
-      selectedAt: generatedAt,
-      selectedByGateDecisionId: 'gate-pass-repair-input',
-      reason: 'accepted repair validation evidence'
-    });
-    await recordRuntimeRepair(root, buildOpenRepairRecord({
-      branchSlug: 'feature',
-      taskId: 'T1',
-      runId: run.runId,
-      message: 'artifact digest evidence drift requires replay',
-      recommendedCommands: ['sdd test task-T1 --branch feature']
-    }));
-
-    const result = await evaluateAndRecordWorkflowGateDecision(root, { branch: 'feature', taskId: 'T1', runId: run.runId, decisionKind: 'test' });
-    const openRepairs = await listRuntimeRepairs(root, { branchSlug: 'feature', status: 'open' });
-    const resolvedRepairs = await listRuntimeRepairs(root, { branchSlug: 'feature', status: 'resolved' });
-
-    assert.equal(result.decision.status, 'PASS');
-    assert.equal(openRepairs.length, 0);
-    assert.equal(resolvedRepairs.length, 1);
-    assert.equal((resolvedRepairs[0].payload as { resolvedByGateDecisionId?: string }).resolvedByGateDecisionId, result.decision.decisionId);
-  } finally {
-    await rm(root, { recursive: true, force: true });
-  }
-});
-
-function selectedEvidencePayload(logicalRef = 'artifacts/validation-T1.md', status: WorkflowGateEvidencePacket['selectedEvidence']['payloads'][number]['status'] = 'active'): WorkflowGateEvidencePacket['selectedEvidence']['payloads'][number] {
-  return {
-    payloadId: `payload-${status}`,
-    runId: 'run-001',
-    sourceRunId: 'run-001',
-    branchSlug: 'feature',
-    taskId: 'T1',
-    logicalRef,
-    physicalPayloadPath: logicalRef,
-    artifactRole: 'validation',
-    digest: `digest-${status}`,
-    sequence: 1,
-    status,
-    supersedes: null,
-    createdAt: generatedAt,
-    payload: {}
-  };
-}
-
-function selectedEvidenceSelection(payloads = [selectedEvidencePayload()]): WorkflowGateEvidencePacket['selectedEvidence'] {
-  return {
-    source: 'selection_pointer',
-    evidenceSet: {
-      evidenceSetId: 'evidence-set-001',
-      branchSlug: 'feature',
-      scopeKind: 'task',
-      scopeId: 'T1',
-      sourceRunId: 'run-001',
-      documentContractHashes: {},
-      gateDecisionId: 'gate-001',
-      status: 'accepted',
-      createdAt: generatedAt,
-      items: payloads.map((payload) => ({
-        evidenceSetId: 'evidence-set-001',
-        payloadId: payload.payloadId,
-        logicalRef: payload.logicalRef,
-        role: payload.artifactRole,
-        required: true,
-        digestAtSelection: payload.digest
-      })),
-      payload: {}
-    },
-    pointer: {
-      branchSlug: 'feature',
-      scopeKind: 'task',
-      scopeId: 'T1',
-      selectedEvidenceSetId: 'evidence-set-001',
-      selectedAt: generatedAt,
-      selectedByGateDecisionId: 'gate-001',
-      reason: 'accepted evidence selection'
-    },
-    payloads
-  };
-}
-
-function hashContent(content: string): string {
-  return createHash('sha256').update(content.replace(/\r\n/g, '\n'), 'utf8').digest('hex');
-}
-
-function packetInput(overrides: Partial<Omit<WorkflowGateEvidencePacket, 'hardChecks'>> = {}): Omit<WorkflowGateEvidencePacket, 'hardChecks'> {
-  return {
-    packetId: 'packet-001',
-    generatedAt,
-    decisionKind: 'ship',
-    partition: 'feature',
-    taskId: 'T1',
-    runId: 'run-001',
-    documents: {
-      specExists: true,
-      planExists: true,
-      tasksExists: true,
-      verifyExists: true,
-      planStale: false,
-      tasksStale: false,
-      verifyStale: false,
-      specHash: 'spec-doc',
-      planHash: 'plan-doc',
-      tasksHash: 'tasks-doc',
-      verifyHash: 'verify-doc',
-      specContractHash: 'spec-contract',
-      planContractHash: 'plan-contract',
-      tasksContractHash: 'tasks-contract',
-      verifyContractHash: 'verify-contract',
-      planBasedOnSpecHash: 'spec-doc',
-      tasksBasedOnPlanHash: 'plan-doc',
-      verifyBasedOnTasksHash: 'tasks-doc',
-      planBasedOnSpecContractHash: 'spec-contract',
-      tasksBasedOnPlanContractHash: 'plan-contract',
-      verifyBasedOnTasksContractHash: 'tasks-contract'
-    } as WorkflowGateEvidencePacket['documents'],
-    latestEligibleSelection: {
-      partition: 'feature',
-      taskId: 'T1',
-      selected: {
-        partition: 'feature',
-        gitBranch: 'feature',
-        taskId: 'T1',
-        runId: 'run-001',
-        runStatus: 'completed',
-        validationStatus: 'pass',
-        affectedFiles: [],
-        updatedAt: generatedAt,
-        compatibility: 'compatible',
-        eligibleForDefaultApply: true,
-        reasons: []
-      },
-      candidates: [],
-      rejected: []
-    },
-    latestEligibleSelections: [],
-    workflowScope: { waveRunId: null, taskIds: ['T1'], runIds: ['run-001'], evidenceRefs: [] },
-    runtimeHealth: { status: 'ok', issues: [] },
-    durableGaps: [],
-    dependencyBlockers: [],
-    affectedFileConflicts: [],
-    fanInEvidenceSets: [],
-    advisorAssessments: [],
-    selectedEvidence: selectedEvidenceSelection(),
-    canonicalEvidenceRefs: [],
-    requiredArtifactRefs: [],
-    artifactPayloadHealth: [],
-    ...overrides
-  };
-}
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { STAGE_TEAM_RUNTIME_CONTRACT_VERSION } from '../contracts.js';
+import { evaluateWorkflowGateHardChecks } from './hard-checks.js';
+import type { WorkflowGateEvidencePacket } from './types.js';
+
+const generatedAt = '2026-01-01T00:00:00.000Z';
+
+test('workflow gate hard checks block deterministic workflow violations', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({
+    durableGaps: [{
+      gapId: 'gap-001',
+      partition: 'feature',
+      taskId: 'T1',
+      runId: 'run-001',
+      stage: 'test',
+      gate: 'ship',
+      source: 'runtime',
+      category: 'validation',
+      severity: 'blocking',
+      status: 'open',
+      message: 'Validation evidence is missing.',
+      recommendation: null,
+      evidenceRefs: ['artifacts/validation-T1.md'],
+      proposalRefs: [],
+      sourceRefs: [],
+      createdAt: generatedAt,
+      updatedAt: generatedAt,
+      closedAt: null,
+      payload: {}
+    }],
+    fanInEvidenceSets: [{
+      contract: STAGE_TEAM_RUNTIME_CONTRACT_VERSION,
+      fanInId: 'fanin-001',
+      partition: 'feature',
+      runId: 'run-001',
+      taskId: 'T1',
+      stage: 'test',
+      roleResultIds: [],
+      durableGapIds: [],
+      proposalRefs: [],
+      advisorAssessmentIds: [],
+      evidenceRefs: ['artifacts/validation-T1.md'],
+      canonicalEvidenceRefs: [],
+      gateInputOnly: false,
+      createdAt: generatedAt,
+      payload: {}
+    } as unknown as WorkflowGateEvidencePacket['fanInEvidenceSets'][number]],
+    requiredArtifactRefs: ['artifacts/required-T1.md']
+  }));
+
+  assert.deepEqual(checks.filter((check) => check.severity === 'blocked').map((check) => check.code).sort(), [
+    'authority_violation',
+    'durable_gap_blocking',
+    'missing_required_artifact'
+  ]);
+});
+
+test('workflow gate hard checks warn when no latest eligible run exists', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({ latestEligibleSelection: null }));
+
+  assert.equal(checks.some((check) => check.code === 'latest_eligible_missing' && check.severity === 'warning'), true);
+});
+
+test('workflow gate hard checks block missing and drifted artifact payloads', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({
+    artifactPayloadHealth: [
+      {
+        payloadId: 'payload-missing',
+        logicalRef: 'artifacts/validation-T1.md',
+        physicalPayloadPath: 'artifacts/validation-T1-run-old.md',
+        expectedDigest: 'expected',
+        actualDigest: null,
+        status: 'missing'
+      },
+      {
+        payloadId: 'payload-drift',
+        logicalRef: 'artifacts/review-T1.md',
+        physicalPayloadPath: 'artifacts/review-T1-run-old.md',
+        expectedDigest: 'expected',
+        actualDigest: 'actual',
+        status: 'digest_drift'
+      }
+    ]
+  }));
+
+  assert.deepEqual(checks.filter((check) => check.severity === 'blocked').map((check) => check.code).sort(), ['digest_drift', 'missing_payload']);
+});
+
+test('workflow gate hard checks block missing verify contract and runtime health failures', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({
+    runtimeHealth: { status: 'unavailable', issues: ['schema mismatch'] },
+    documents: {
+      ...packetInput().documents,
+      verifyExists: false,
+      verifyBasedOnTasksContractHash: null
+    } as WorkflowGateEvidencePacket['documents']
+  }));
+
+  assert.equal(checks.some((check) => check.code === 'schema_health_unavailable' && check.severity === 'blocked'), true);
+  assert.equal(checks.some((check) => check.code === 'missing_documents' && check.refs.includes('verify.md')), true);
+});
+
+function packetInput(overrides: Partial<Omit<WorkflowGateEvidencePacket, 'hardChecks'>> = {}): Omit<WorkflowGateEvidencePacket, 'hardChecks'> {
+  return {
+    packetId: 'packet-001',
+    generatedAt,
+    decisionKind: 'ship',
+    partition: 'feature',
+    taskId: 'T1',
+    runId: 'run-001',
+    documents: {
+      specExists: true,
+      planExists: true,
+      tasksExists: true,
+      verifyExists: true,
+      planStale: false,
+      tasksStale: false,
+      verifyStale: false,
+      specHash: 'spec-doc',
+      planHash: 'plan-doc',
+      tasksHash: 'tasks-doc',
+      verifyHash: 'verify-doc',
+      specContractHash: 'spec-contract',
+      planContractHash: 'plan-contract',
+      tasksContractHash: 'tasks-contract',
+      verifyContractHash: 'verify-contract',
+      planBasedOnSpecHash: 'spec-doc',
+      tasksBasedOnPlanHash: 'plan-doc',
+      verifyBasedOnTasksHash: 'tasks-doc',
+      planBasedOnSpecContractHash: 'spec-contract',
+      tasksBasedOnPlanContractHash: 'plan-contract',
+      verifyBasedOnTasksContractHash: 'tasks-contract'
+    } as WorkflowGateEvidencePacket['documents'],
+    latestEligibleSelection: {
+      partition: 'feature',
+      taskId: 'T1',
+      selected: {
+        partition: 'feature',
+        gitBranch: 'feature',
+        taskId: 'T1',
+        runId: 'run-001',
+        runStatus: 'completed',
+        validationStatus: 'pass',
+        syncBackStatus: 'not_created',
+        affectedFiles: [],
+        updatedAt: generatedAt,
+        compatibility: 'compatible',
+        eligibleForDefaultApply: true,
+        reasons: []
+      },
+      candidates: [],
+      rejected: []
+    },
+    latestEligibleSelections: [],
+    workflowScope: { waveRunId: null, taskIds: ['T1'], runIds: ['run-001'], evidenceRefs: [] },
+    runtimeHealth: { status: 'ok', issues: [] },
+    durableGaps: [],
+    dependencyBlockers: [],
+    affectedFileConflicts: [],
+    fanInEvidenceSets: [],
+    advisorAssessments: [],
+    canonicalEvidenceRefs: [],
+    requiredArtifactRefs: [],
+    artifactPayloadHealth: [],
+    ...overrides
+  };
+}