seal-gate 0.3.0

package/src/detectors/evidence-gap-detector.ts

@@ -0,0 +1,90 @@
+import { Claim, SealEvidence, SealIssue, EvidenceEnvelope } from '../types.js'
+import { makeIssue } from '../types.js'
+
+function hasMemoryEnvelope(references: EvidenceEnvelope[]): boolean {
+  return references.some(r => r.type === 'memory' || (r.type === 'text' && ('label' in r) && /alaya|retrieved/i.test(r.label)))
+}
+
+export interface EvidenceGapResult {
+  issues: SealIssue[]
+  missing_evidence: string[]
+  trust_deductions: number
+}
+
+const RISK_ORDER = ['LOW', 'MEDIUM', 'HIGH', 'CRITICAL']
+
+export class EvidenceGapDetector {
+  static detect(claims: Claim[], evidence: SealEvidence, risk_level = 'MEDIUM'): EvidenceGapResult {
+    const issues: SealIssue[] = []
+    const missing_evidence: string[] = []
+    let trust_deductions = 0
+
+    for (const claim of claims) {
+      if (claim.type === 'test_result_claim') {
+        const hasLog = evidence.test_log.trim().length > 0
+        const hasCommandEvidence = evidence.references.some(r =>
+          r.type === 'command' && /test|spec|jest|vitest|pytest/i.test(r.command)
+        )
+        if (!hasLog && !hasCommandEvidence) {
+          issues.push(makeIssue({
+            type: 'MISSING_EVIDENCE', severity: 'HIGH', layer: 'L3', source: 'core',
+            rule_id: 'E001', trust_deduction: 20,
+            evidence: `No test log for claim: "${claim.text}"`,
+            required_fix: 'Provide test_log or command evidence envelope with test output',
+          }))
+          missing_evidence.push(`test_log required for: ${claim.text}`)
+          trust_deductions += 20
+        }
+      }
+
+      if (claim.type === 'build_claim') {
+        const hasLog = evidence.build_log.trim().length > 0
+        const hasCommandEvidence = evidence.references.some(r =>
+          r.type === 'command' && /build|compile|make|gradle|maven|tsc/i.test(r.command)
+        )
+        if (!hasLog && !hasCommandEvidence) {
+          issues.push(makeIssue({
+            type: 'MISSING_EVIDENCE', severity: 'MEDIUM', layer: 'L3', source: 'core',
+            rule_id: 'E002', trust_deduction: 15,
+            evidence: `No build log for claim: "${claim.text}"`,
+            suggested_fix: 'Provide build_log or command evidence envelope with build output',
+          }))
+          trust_deductions += 15
+        }
+      }
+
+      if (claim.type === 'risk_claim') {
+        const hasSecurityEvidence = evidence.test_log.trim().length > 0 &&
+          /security|auth|unauthorized|pentest|vuln/i.test(evidence.test_log)
+        const hasRefEvidence = evidence.references.some(r =>
+          r.type === 'text' && /security/i.test('label' in r ? r.label : '')
+        )
+        if (!hasSecurityEvidence && !hasRefEvidence) {
+          issues.push(makeIssue({
+            type: 'MISSING_EVIDENCE', severity: 'HIGH', layer: 'L3', source: 'core',
+            rule_id: 'E003', trust_deduction: 20,
+            evidence: `No security reasoning for claim: "${claim.text}"`,
+            required_fix: 'Provide security test log or security-reasoning text envelope',
+          }))
+          trust_deductions += 20
+        }
+      }
+
+      if (claim.type === 'production_claim' && RISK_ORDER.indexOf(risk_level) >= RISK_ORDER.indexOf('MEDIUM')) {
+        const hasAnyEvidence = evidence.references.length > 0 || evidence.test_log.trim().length > 0
+        if (!hasAnyEvidence) {
+          issues.push(makeIssue({
+            type: 'MISSING_EVIDENCE', severity: 'CRITICAL', layer: 'L3', source: 'core',
+            rule_id: 'E004', trust_deduction: 20,
+            evidence: `No evidence for production-readiness claim: "${claim.text}"`,
+            required_fix: 'Provide evidence envelopes demonstrating production readiness',
+          }))
+          missing_evidence.push(`production evidence required for: ${claim.text}`)
+          trust_deductions += 20
+        }
+      }
+    }
+
+    return { issues, missing_evidence, trust_deductions }
+  }
+}

package/src/detectors/falsification-detector.ts

@@ -0,0 +1,82 @@
+import { SealIssue, SealInput } from '../types.js'
+
+export const FALSIFICATION_PROBES = [
+  {
+    id: 'failure_mode',
+    question: 'What is the worst input, unhandled state, or concurrent case this plan does not address?',
+  },
+  {
+    id: 'assumption_collapse',
+    question: 'Which stated assumption, if false, breaks the plan entirely?',
+  },
+  {
+    id: 'missing_step',
+    question: 'What must hold between step K and K+1 that is never established by the plan?',
+  },
+  {
+    id: 'reversibility',
+    question: 'Which actions are irreversible and ungated by a human sign-off or rollback procedure?',
+  },
+] as const
+
+export type ProbeId = typeof FALSIFICATION_PROBES[number]['id']
+
+export interface FalsificationProbeResult {
+  probe: ProbeId
+  finding: string
+  evidence_file?: string
+  evidence_lines?: number[]
+  confidence: number
+}
+
+export interface FalsificationAdapter {
+  runProbes(
+    input: SealInput,
+    probes: typeof FALSIFICATION_PROBES,
+  ): Promise<FalsificationProbeResult[]>
+}
+
+let adapter: FalsificationAdapter | null = null
+
+export const FalsificationDetector = {
+  withAdapter(a: FalsificationAdapter): void {
+    adapter = a
+  },
+
+  async detect(input: SealInput): Promise<SealIssue[]> {
+    if (!adapter) {
+      // No LLM adapter registered — Stage 4 skipped (by design, not an error)
+      return []
+    }
+
+    const results = await adapter.runProbes(input, FALSIFICATION_PROBES)
+    const issues: SealIssue[] = []
+
+    for (const result of results) {
+      if (!result.finding || result.finding.trim().length < 10) continue
+
+      const hasLocation = !!(result.evidence_file && result.evidence_lines && result.evidence_lines.length > 0)
+      // Cap rule: no file+line citation → stays weak (REVISE max), cannot block
+      const severity = hasLocation && result.confidence >= 0.8 ? 'HIGH' : 'MEDIUM'
+      const required_verdict = hasLocation ? 'REVISE' : undefined
+
+      issues.push({
+        type: 'LOGIC_BUG',
+        severity,
+        is_blocking: false, // falsification findings are never auto-blocking (cap rule)
+        layer: 'LLM_OVERLAY',
+        source: 'llm-overlay',
+        rule_id: `PR004:${result.probe}`,
+        required_verdict,
+        evidence: `[${result.probe}] ${result.finding}`,
+        evidence_file: result.evidence_file,
+        evidence_lines: result.evidence_lines,
+        confidence: result.confidence,
+        policy_tags: ['falsification', result.probe],
+        trust_deduction: hasLocation ? 8 : 3,
+      })
+    }
+
+    return issues
+  },
+}

package/src/detectors/orphan-claim-detector.ts

@@ -0,0 +1,62 @@
+import { Claim, SealIssue, makeIssue } from '../types.js'
+
+// Anchor patterns: what counts as a traceable upstream reference
+const ANCHOR_PATTERNS: RegExp[] = [
+  /\bREQ-\d+\b/,
+  /\bAC-\d+\b/,
+  /\bphase\.json\b/,
+  /\bintent\.md\b/,
+  /\bself-check\.md\b/,
+  /\bper\s+(spec|intent|design|plan|requirement)/i,
+  /\bper\s+§/i,
+  /§\w/,                       // section reference
+  /\[verified\]/i,
+  /\[inferred\]/i,
+  /\bassumes?\b.*\bknown\b/i,
+]
+
+function hasAnchor(claimText: string, surroundingContext: string): boolean {
+  const combined = claimText + ' ' + surroundingContext
+  return ANCHOR_PATTERNS.some(p => p.test(combined))
+}
+
+function extractContext(artifact: string, pos: number, radius = 200): string {
+  const start = Math.max(0, pos - radius)
+  const end = Math.min(artifact.length, pos + radius)
+  return artifact.slice(start, end)
+}
+
+export interface OrphanClaimResult {
+  issues: SealIssue[]
+}
+
+export class OrphanClaimDetector {
+  static detect(claims: Claim[], artifact: string): OrphanClaimResult {
+    const issues: SealIssue[] = []
+
+    for (const claim of claims) {
+      if (!claim.requires_evidence) continue
+
+      const context = extractContext(artifact, claim.start_pos)
+      if (hasAnchor(claim.text, context)) continue
+
+      // Untraceable — MISSING_EVIDENCE (weak/non-blocking per spec)
+      issues.push({
+        ...makeIssue({
+          type: 'MISSING_EVIDENCE',
+          severity: 'LOW',       // stays non-blocking per spec design
+          layer: 'L3',
+          source: 'core',
+          rule_id: 'PR003',
+          trust_deduction: 5,    // partial -20 from spec applied across multiple orphans
+          evidence: `Orphan claim — no traceable anchor (REQ/AC/intent/phase.json): "${claim.text.slice(0, 80)}"`,
+          suggested_fix: 'Add a REQ-N, AC-N, or §-reference anchoring this claim to an upstream artifact',
+        }),
+        confidence: 0.7,
+        policy_tags: ['traceability'],
+      })
+    }
+
+    return { issues }
+  }
+}

package/src/detectors/risk-classifier.ts

@@ -0,0 +1,50 @@
+import { RiskLevel } from '../types.js'
+
+const RISK_ORDER: RiskLevel[] = ['LOW', 'MEDIUM', 'HIGH', 'CRITICAL']
+
+function maxRisk(a: RiskLevel, b: RiskLevel): RiskLevel {
+  return RISK_ORDER.indexOf(a) >= RISK_ORDER.indexOf(b) ? a : b
+}
+
+const CRITICAL_PATTERN = /\b(DROP\s+TABLE|delete.{0,20}production|rm\s+-rf|irreversible|PII|personal\s+data|health\s+data|financial\s+record|legal\s+(?:liability|compliance)|payment|billing)\b/i
+const HIGH_PATTERN = /\b(auth(?:entication|orization)?|token|session|JWT|OAuth|password|migration|rollback|schema\s+change|chmod|sudo|admin|privilege)\b/i
+
+export interface RiskResult {
+  risk_level: RiskLevel
+  trust_deduction: number
+  matched_rules: string[]
+}
+
+export class RiskClassifier {
+  static classify(params: { output: string; diff: string; risk_hint: RiskLevel | null }): RiskResult {
+    const { output, diff, risk_hint } = params
+    const text = output + '\n' + diff
+    let risk_level: RiskLevel = 'MEDIUM'
+    let trust_deduction = 0
+    const matched_rules: string[] = []
+
+    if (CRITICAL_PATTERN.test(text)) {
+      risk_level = maxRisk(risk_level, 'CRITICAL')
+      trust_deduction += 20
+      matched_rules.push('RK-CRITICAL')
+    }
+    if (HIGH_PATTERN.test(text)) {
+      risk_level = maxRisk(risk_level, 'HIGH')
+      if (!matched_rules.includes('RK-HIGH')) {
+        trust_deduction += 10
+        matched_rules.push('RK-HIGH')
+      }
+    }
+
+    if (risk_hint) {
+      const prevLevel = risk_level
+      risk_level = maxRisk(risk_level, risk_hint)
+      if (risk_level !== prevLevel) {
+        if (risk_level === 'CRITICAL') trust_deduction += 10
+        else if (risk_level === 'HIGH') trust_deduction += 5
+      }
+    }
+
+    return { risk_level, trust_deduction, matched_rules }
+  }
+}

package/src/detectors/spec-coverage-detector.ts

@@ -0,0 +1,66 @@
+import { SealIssue } from '../types.js'
+import { makeIssue } from '../types.js'
+
+export interface SpecCoverageResult {
+  issues: SealIssue[]
+  assumptions: string[]
+  trust_deductions: number
+}
+
+export class SpecCoverageDetector {
+  static detect(spec: string | null, output: string): SpecCoverageResult {
+    if (!spec || spec.trim() === '') {
+      return {
+        issues: [],
+        assumptions: ['No spec provided — L1 (spec compliance) skipped'],
+        trust_deductions: 0,
+      }
+    }
+
+    const issues: SealIssue[] = []
+    const assumptions: string[] = []
+    let trust_deductions = 0
+
+    // Extract acceptance criteria (bullet points)
+    const criteriaLines = spec.split('\n').filter(l => /^[-*]\s+.+/.test(l.trim()))
+    const missingCriteria: string[] = []
+
+    for (const line of criteriaLines) {
+      const criterion = line.replace(/^[-*]\s+/, '').trim()
+      const keywords = criterion.split(/\s+/).filter(w => w.length >= 4)
+      const mentioned = keywords.some(kw => output.toLowerCase().includes(kw.toLowerCase()))
+      if (!mentioned) missingCriteria.push(criterion)
+    }
+
+    const maxDeduction = 20
+    for (const criterion of missingCriteria) {
+      if (trust_deductions >= maxDeduction) break
+      issues.push(makeIssue({
+        type: 'SPEC_MISMATCH', severity: 'MEDIUM', layer: 'L1', source: 'core',
+        rule_id: 'SC301', trust_deduction: 10,
+        evidence: `Acceptance criterion not referenced in output: "${criterion}"`,
+        suggested_fix: `Address criterion: ${criterion}`,
+      }))
+      trust_deductions = Math.min(trust_deductions + 10, maxDeduction)
+    }
+
+    // Check structural section headers
+    const specHeaders = new Set(
+      (spec.match(/^#{1,3}\s+(.+)/gm) ?? []).map(h => h.replace(/^#+\s+/, '').toLowerCase())
+    )
+    const outputHeaders = (output.match(/^#{1,3}\s+(.+)/gm) ?? []).map(h => h.replace(/^#+\s+/, '').toLowerCase())
+
+    for (const header of outputHeaders) {
+      if (specHeaders.size > 0 && !specHeaders.has(header)) {
+        issues.push(makeIssue({
+          type: 'SPEC_MISMATCH', severity: 'LOW', layer: 'L1', source: 'core',
+          rule_id: 'SC302',
+          evidence: `Output section "${header}" not present in spec (structural check only)`,
+          suggested_fix: 'Verify this section is within spec scope',
+        }))
+      }
+    }
+
+    return { issues, assumptions, trust_deductions }
+  }
+}

package/src/detectors/spec-coverage-validator.ts

@@ -0,0 +1,174 @@
+import { SealIssue, makeIssue } from '../types.js'
+
+export interface SpecCoverageResult {
+  issues: SealIssue[]
+  assumptions: string[]
+  trust_deductions: number
+  coverage: SpecCriterionResult[]
+}
+
+export interface SpecCriterionResult {
+  criterion: string
+  level: 0 | 1           // 0 = not covered, 1 = covered at assertion/execution level
+  match_type: 'none' | 'assertion' | 'test_name' | 'keyword'
+  evidence?: string       // which test/assertion covered it
+}
+
+/** Default stop words for keyword extraction */
+const STOP_WORDS = new Set([
+  'shall', 'must', 'should', 'when', 'then', 'given', 'that', 'this', 'with',
+  'the', 'and', 'for', 'are', 'but', 'not', 'have', 'has', 'been', 'was',
+  'were', 'will', 'can', 'all', 'each', 'every', 'some', 'any', 'its', 'their',
+])
+
+const MAX_LEVEL1_DEDUCTION = 20
+
+/**
+ * Parse acceptance criteria from spec markdown.
+ * Supports:
+ * - Bullet items under `#### Scenario:` headers
+ * - Bullet items under requirement sections
+ * - Lines starting with - [ ] / - [x] / - * 
+ */
+function parseCriteria(spec: string): string[] {
+  const criteria: string[] = []
+  const lines = spec.split('\n')
+
+  for (const line of lines) {
+    const trimmed = line.trim()
+    // Match bullet points that look like criteria (non-empty, not just checkboxes)
+    const bulletMatch = trimmed.match(/^[-*]\s+(?:\[[ x]\])?\s*(.+)$/)
+    if (bulletMatch) {
+      const text = bulletMatch[1].trim()
+      if (text.length > 10 && !text.startsWith('#')) {
+        criteria.push(text)
+      }
+    }
+  }
+
+  return criteria
+}
+
+/**
+ * Check if criterion is covered at Level 1 (assertion/execution match).
+ * Strategy: search test_log for:
+ * 1. Test names containing criterion keywords or AC- IDs
+ * 2. Assertion messages containing criterion keywords
+ * 3. Explicit mapping comments like "// covers: criterion"
+ */
+function isCoveredAtLevel1(criterion: string, testLog: string, diff: string): { covered: boolean; matchType: 'assertion' | 'test_name' | 'keyword' | 'none'; evidence?: string } {
+  const lowerCriterion = criterion.toLowerCase()
+  const lowerTestLog = testLog.toLowerCase()
+  const lowerDiff = diff.toLowerCase()
+
+  // Extract significant words from criterion (≥4 chars, not stop words)
+  const words = lowerCriterion
+    .replace(/[^\w\s]/g, ' ')
+    .split(/\s+/)
+    .filter(w => w.length >= 4 && !STOP_WORDS.has(w))
+
+  if (words.length === 0) return { covered: false, matchType: 'keyword' }
+
+  // Check for AC-N or REQ-N identifiers
+  const idMatch = criterion.match(/\b(AC|REQ|CRITERION)[-_](\d+)\b/i)
+  if (idMatch) {
+    const id = idMatch[0].toLowerCase()
+    if (lowerTestLog.includes(id) || lowerDiff.includes(id)) {
+      return { covered: true, matchType: 'test_name', evidence: `ID reference: ${idMatch[0]}` }
+    }
+  }
+
+  // Check test_log for assertion patterns with criterion words
+  const assertionPatterns = [
+    new RegExp(`assert(?:ion)?\\s*\\(?[^)]*${words[0]}[^)]*\\)`, 'i'),
+    new RegExp(`expect\\([^)]*\\)\\.to(?:Be|Equal|Match|Contain)\\([^)]*${words[0]}[^)]*\\)`, 'i'),
+    new RegExp(`test\\(['"\`][^'"\`]*${words[0]}[^'"\`]*['"\`]`, 'i'),
+    new RegExp(`it\\(['"\`][^'"\`]*${words[0]}[^'"\`]*['"\`]`, 'i'),
+    new RegExp(`describe\\(['"\`][^'"\`]*${words[0]}[^'"\`]*['"\`]`, 'i'),
+    new RegExp(`//\\s*covers:?\\s*.*${words[0]}`, 'i'),
+  ]
+
+  for (const pattern of assertionPatterns) {
+    const match = pattern.exec(testLog)
+    if (match) {
+      const snippet = match[0].slice(0, 80)
+      return { covered: true, matchType: 'assertion', evidence: snippet }
+    }
+  }
+
+  // Check test_log for test names containing significant words (at least 50% match)
+  const wordMatchCount = words.filter(w => lowerTestLog.includes(w)).length
+  if (words.length > 0 && wordMatchCount / words.length >= 0.5) {
+    return { covered: true, matchType: 'test_name', evidence: `${wordMatchCount}/${words.length} keywords matched` }
+  }
+
+  // Fall back to keyword presence in test_log (Level 0 detection as diagnostic)
+  const anyWordMatch = words.some(w => lowerTestLog.includes(w))
+  if (anyWordMatch) {
+    return { covered: false, matchType: 'keyword' }
+  }
+
+  return { covered: false, matchType: 'none' }
+}
+
+export class SpecCoverageValidator {
+  /**
+   * Validate spec coverage at Level 1 (execution/assertion match).
+   * Unlike SpecCoverageDetector (keyword heuristic), this validator
+   * checks actual assertion and test name patterns in the test log.
+   */
+  static validate(spec: string | null, testLog: string, diff: string): SpecCoverageResult {
+    if (!spec || spec.trim() === '') {
+      return {
+        issues: [],
+        assumptions: ['No spec provided — L1 (spec compliance) skipped'],
+        trust_deductions: 0,
+        coverage: [],
+      }
+    }
+
+    const criteria = parseCriteria(spec)
+    if (criteria.length === 0) {
+      return {
+        issues: [],
+        assumptions: ['Spec has no parseable acceptance criteria'],
+        trust_deductions: 0,
+        coverage: [],
+      }
+    }
+
+    const coverage: SpecCriterionResult[] = []
+    const issues: SealIssue[] = []
+    let trust_deductions = 0
+
+    for (const criterion of criteria) {
+      const result = isCoveredAtLevel1(criterion, testLog, diff)
+
+      coverage.push({
+        criterion: criterion.slice(0, 120) + (criterion.length > 120 ? '…' : ''),
+        level: result.covered ? 1 : 0,
+        match_type: result.matchType,
+        evidence: result.evidence,
+      })
+
+      if (!result.covered) {
+        const deduction = Math.min(10, MAX_LEVEL1_DEDUCTION - trust_deductions)
+        if (deduction > 0) {
+          issues.push(makeIssue({
+            type: 'SPEC_MISMATCH',
+            severity: 'MEDIUM',
+            layer: 'L1',
+            source: 'core',
+            rule_id: 'SV101',
+            trust_deduction: deduction,
+            evidence: `Acceptance criterion not covered at execution level: "${criterion.slice(0, 80)}"`,
+            suggested_fix: `Add a test or assertion covering: ${criterion.slice(0, 80)}`,
+          }))
+          trust_deductions += deduction
+        }
+      }
+    }
+
+    return { issues, assumptions: [], trust_deductions, coverage }
+  }
+}

package/src/detectors/test-weakness-detector.ts

@@ -0,0 +1,84 @@
+import { SealIssue, ArtifactType, RiskLevel, SealEvidence } from '../types.js'
+import { makeIssue } from '../types.js'
+
+const NEGATIVE_TEST_PATTERN = /\b(fail|error|exception|invalid|unauthorized|forbidden|edge|negative|reject|timeout|backoff)\b/i
+const RETRY_PATTERN = /\b(retry|retries|exponential.?backoff|timeout|circuit.?breaker)\b/i
+const BUG_FIX_PATTERN = /\b(fix(?:ed)?|bug|defect|regression)\b/i
+const REGRESSION_TEST_PATTERN = /\b(regression|repro|original.?bug|fixed.?case)\b/i
+const AUTH_UNAUTH_PATTERN = /\b(unauthorized|forbidden|403|401|permission.?denied|access.?denied)\b/i
+
+export interface TestWeaknessResult {
+  issues: SealIssue[]
+  trust_deductions: number
+}
+
+export class TestWeaknessDetector {
+  static detect(params: {
+    artifact_type: ArtifactType
+    output: string
+    risk_level: RiskLevel
+    auth_flagged: boolean
+  }, evidence: SealEvidence): TestWeaknessResult {
+    const { artifact_type, output, risk_level, auth_flagged } = params
+    const { test_log } = evidence
+    const issues: SealIssue[] = []
+    let trust_deductions = 0
+
+    // TW201: implementation without tests
+    const isImpl = artifact_type === 'code_diff' || artifact_type === 'llm_response'
+    if (isImpl && test_log.trim() === '') {
+      issues.push(makeIssue({
+        type: 'TEST_GAP', severity: 'HIGH', layer: 'L4', source: 'core',
+        rule_id: 'TW201', trust_deduction: 15,
+        evidence: 'Implementation artifact has no test evidence',
+        required_fix: 'Provide test_log demonstrating test coverage',
+      }))
+      trust_deductions += 15
+    }
+
+    // TW202: happy path only for MEDIUM+ risk
+    const riskOrder = ['LOW', 'MEDIUM', 'HIGH', 'CRITICAL']
+    const isMediumPlus = riskOrder.indexOf(risk_level) >= riskOrder.indexOf('MEDIUM')
+    if (isMediumPlus && test_log.trim().length > 0 && !NEGATIVE_TEST_PATTERN.test(test_log)) {
+      issues.push(makeIssue({
+        type: 'TEST_GAP', severity: 'MEDIUM', layer: 'L4', source: 'core',
+        rule_id: 'TW202', trust_deduction: 10,
+        evidence: `Tests appear to cover happy path only for ${risk_level} risk artifact`,
+        suggested_fix: 'Add negative cases, error scenarios, or edge cases',
+      }))
+      trust_deductions += 10
+    }
+
+    // TW203: bug fix without regression test
+    if (BUG_FIX_PATTERN.test(output) && test_log.trim().length > 0 && !REGRESSION_TEST_PATTERN.test(test_log)) {
+      issues.push(makeIssue({
+        type: 'TEST_GAP', severity: 'HIGH', layer: 'L4', source: 'core',
+        rule_id: 'TW203',
+        evidence: 'Bug fix detected but no regression test evidence found',
+        required_fix: 'Add regression test that reproduces the original bug',
+      }))
+    }
+
+    // TW204: retry logic without failure/timeout test
+    if (RETRY_PATTERN.test(output) && test_log.trim().length > 0 && !NEGATIVE_TEST_PATTERN.test(test_log)) {
+      issues.push(makeIssue({
+        type: 'TEST_GAP', severity: 'MEDIUM', layer: 'L4', source: 'core',
+        rule_id: 'TW204',
+        evidence: 'Retry/timeout logic detected but no failure/timeout test evidence',
+        suggested_fix: 'Add tests for timeout and failure scenarios',
+      }))
+    }
+
+    // TW205: auth change without unauthorized test
+    if (auth_flagged && test_log.trim().length > 0 && !AUTH_UNAUTH_PATTERN.test(test_log)) {
+      issues.push(makeIssue({
+        type: 'TEST_GAP', severity: 'CRITICAL', layer: 'L4', source: 'core',
+        rule_id: 'TW205', required_verdict: 'ESCALATE_TO_HUMAN',
+        evidence: 'Auth-related change detected but no unauthorized/forbidden test evidence',
+        required_fix: 'Add tests for unauthorized and forbidden access scenarios',
+      }))
+    }
+
+    return { issues, trust_deductions }
+  }
+}