triad-plus 1.7.0 → 1.8.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 1.8.0 — 2026-09-12
+
+- Add an optional Immutable Quality Contract with a deterministic Quality
+  Baseline fingerprint and fail-closed source-drift detection.
+- Add phase-scoped `product_quality` and `delivery_closure` criteria,
+  criterion-level Evaluator+ validation, and a deterministic aggregate
+  verdict.
+- Add deterministic Evaluator+/Delivery control-plane validation while
+  preserving legacy Triad+ 1.7 compatibility.
+
 ## 1.7.0 — 2026-09-10
 
 - Add an optional deterministic importer for one BMAD `ready-for-dev` Story at

package/README.md

@@ -107,6 +107,15 @@ The Orchestrator first shows the feature cards, then delegates the bounded work.
 If a tutorial step is unclear, see the [OpenCode guide](docs/runtimes.md#opencode)
 and [troubleshooting](docs/troubleshooting.md).
 
+## Optional immutable quality target
+
+An initialized project may bind an immutable JSON Quality Baseline through
+`project.quality_contract`. Triad fingerprints the canonical manifest, verifies
+all declared sources before running costly gates, and fails closed on malformed
+contracts or source drift. `product_quality` criteria are evaluated one by one
+by a fresh Evaluator+; `delivery_closure` criteria remain in the delivery gate.
+Projects without this opt-in continue to use the legacy PRD baseline path.
+
 ## Optional BMAD Story import
 
 When BMAD planning has already produced a Story with `status: ready-for-dev`,

package/adapters/antigravity/.agents/agents/triad-evaluator/agent.md

@@ -16,3 +16,8 @@ Return `candidate_wins`, `bar_wins`, or `indeterminate`; a `bar_wins` decision
 has exactly one evidence-based largest gap. Do not edit source, change loop
 state, commit, push, or review delivery, request repair, or reopen the Triad
 run.
+
+For an immutable Quality Contract, use the supplied baseline fingerprint and
+evaluate each `product_quality` criterion exactly once. `delivery_closure`
+criteria are excluded from this fresh packet and belong to delivery closure;
+the control plane validates the final aggregate.

package/adapters/claude-code/.claude/agents/triad-evaluator.md

@@ -23,3 +23,8 @@ Return `candidate_wins`, `bar_wins`, or `indeterminate`. A `bar_wins` result has
 exactly one evidence-based largest gap with one bounded repair scope. Do not edit
 product source, change state, commit, push, or approve delivery; do not request
 repair or reopen the Triad run.
+
+For an immutable Quality Contract, report the supplied baseline fingerprint and
+evaluate every supplied `product_quality` criterion once. `delivery_closure`
+criteria are not part of this packet and are checked by delivery closure. The
+control plane, not the model, determines the deterministic aggregate verdict.

package/adapters/copilot/.github/agents/triad-evaluator.agent.md

@@ -24,3 +24,8 @@ out-of-packet control record to justify a verdict. Return `PASS`, `FAIL`, or
 Do not edit source, change Triad queue/state, assign work, commit, push, publish,
 or start repair. Your verdict is post-run information. It never reopens Triad,
 requests repair, or changes an already closed result.
+
+When an immutable Quality Contract is present, report its fingerprint and one
+result for every supplied `product_quality` criterion. Do not receive or judge
+`delivery_closure` criteria; the control plane validates the deterministic
+aggregate rather than trusting a model-selected overall verdict.

package/adapters/hermes/skills/triad/SKILL.md

@@ -51,3 +51,8 @@ post-run report at the absolute `<control-workspace>/artifacts/evaluator-plus/`
 path supplied by the Orchestrator; never infer it relative to a product worktree.
 `FAIL` or `INDETERMINATE` is information for a new
 owner-requested run, never an automatic repair and never reopens Triad.
+
+If an immutable Quality Contract is configured, pass only its fingerprint and
+`product_quality` criteria to the fresh Evaluator+. Exclude `delivery_closure`
+criteria, which are recorded by delivery closure. Return one result per product
+criterion; the shared control plane validates coverage and aggregate verdict.

package/adapters/opencode/.opencode/agents/triad-evaluator.md

@@ -36,3 +36,9 @@ result being assessed.
 Return `PASS`, `FAIL`, or `INDETERMINATE` with concise evidence. Do not edit
 source, make delivery decisions, commit, push, or change workflow state; do not
 request repair. A verdict never reopens Triad or starts repair.
+
+If the packet includes an immutable Quality Contract, use its fingerprint and
+evaluate exactly the supplied `product_quality` criteria once each. Never
+evaluate `delivery_closure` criteria; delivery closure records those separately.
+The control plane validates the deterministic aggregate, so do not invent a
+different overall verdict.

package/docs/architecture.md

@@ -22,3 +22,10 @@ runtime-specific branches to Core installer or verification logic.
 
 Evaluator+ is outside the Core: it runs after a Reviewer-approved result, receives
 a deliberately limited fresh packet, and cannot reopen the completed run.
+
+An optional immutable Quality Contract extends this existing control-plane
+baseline without creating a second control plane. Its JSON manifest binds
+approved intent sources and phase-scoped criteria to one canonical fingerprint.
+`product_quality` criteria travel in the fresh Evaluator+ packet;
+`delivery_closure` criteria are checked only during delivery closure. Projects
+without the contract keep the legacy PRD baseline behavior.

package/docs/configuration.md

@@ -47,3 +47,22 @@ optional gate becomes required for that card, and an absent or empty list keeps
 the legacy gate behavior. Selected IDs are validated before Developer dispatch
 and are bound to the assignment; Triad does not attach visual or other
 domain-specific meaning to a gate ID.
+
+## Optional immutable Quality Contract
+
+New or upgraded control workspaces may set:
+
+```yaml
+project:
+  quality_contract:
+    baseline: artifacts/quality-baseline.json
+    fingerprint: <sha256 of the canonical manifest>
+```
+
+The JSON manifest must contain at least one hashed, project-relative source and
+may contain criteria scoped only to `product_quality` or `delivery_closure`.
+The fingerprint is deterministic and independent of JSON whitespace or object
+key order. A configured contract is validated before expensive verification
+gates; malformed manifests and source drift fail closed. Omitting the section
+preserves the 1.7 legacy PRD baseline behavior. A rebaseline is a new manifest
+revision and explicit owner event, never an in-place edit.

package/docs/evaluator-plus.md

@@ -12,3 +12,12 @@ attempt history unless the owner explicitly requires it. It reports `PASS`,
 
 An Evaluator+ `FAIL` does not reopen Triad, change the approved state, or start
 repair. An owner or a later Orchestrator may use it as input to a new run.
+
+When a project declares an immutable Quality Contract, the packet also carries
+the approved Quality Baseline fingerprint and exactly one result for each
+`product_quality` criterion. `delivery_closure` criteria are deliberately
+excluded and are evaluated by delivery closure. The control plane validates
+fingerprint, candidate binding, criterion coverage, and the deterministic
+aggregate (`FAIL` over `INDETERMINATE` over `PASS`) before recording the report.
+Formatting a manifest or changing a bound source invalidates the contract; it
+never starts a product retry.

package/docs/operating-guide.it.md

@@ -51,6 +51,16 @@ selezionati possono essere saltati. Lista assente o vuota mantiene il
 comportamento legacy. Triad collega e registra gli ID senza attribuire loro un
 significato visuale o di altro dominio.
 
+## Target di qualità immutabile
+
+Un progetto può optare per `project.quality_contract`, che collega al run un
+fingerprint canonico del Quality Baseline JSON e verifica le source hashate prima
+del dispatch e dei gate costosi. Drift o manifest invalido fermano il run come
+contesto invalido senza consumare il budget di retry del prodotto. I criteri
+`product_quality` vengono inviati al nuovo Evaluator+; quelli
+`delivery_closure` sono verificati separatamente prima di `delivered`. Senza
+questo opt-in i progetti legacy restano invariati.
+
 ## Retry e scope del candidato
 
 Gli attempt sono record storici di esecuzione. I nuovi workspace separano e

package/docs/operating-guide.md

@@ -51,6 +51,16 @@ become required for that card, and unselected optional gates may be skipped. An
 absent or empty list preserves the legacy behavior. Triad binds and records the
 IDs but does not attach visual or other domain-specific meaning to them.
 
+## Immutable quality target
+
+When a project opts in with `project.quality_contract`, the control plane binds a
+canonical JSON Quality Baseline fingerprint and verifies its hashed sources before
+dispatch or expensive gates. A source drift or invalid manifest stops the run as
+context invalid, without consuming product retry budget. Product-quality criteria
+are sent to the fresh Evaluator+ one at a time; delivery-closure criteria are
+checked separately before `delivered`. The contract is optional, and legacy
+projects without it are unchanged.
+
 ## Retry accounting and candidate scope
 
 Attempts are historical execution records. New workspaces separately bound

package/docs/quality-contract.md

@@ -0,0 +1,119 @@
+# Immutable Quality Contract
+
+Triad+ 1.8 optionally binds a run to an owner-approved, machine-readable
+Quality Baseline. It is an additional target record, not a second control
+plane and not a replacement for the PRD, card baseline, or candidate
+fingerprint.
+
+```text
+Quality Baseline fingerprint  = what the run was meant to satisfy
+Repository/card baseline     = where implementation started
+Candidate fingerprint        = what implementation produced
+```
+
+## Manifest
+
+The manifest is JSON and is normally stored at
+`artifacts/quality-baseline.json`:
+
+```json
+{
+  "schema_version": 1,
+  "id": "my-project-quality-baseline",
+  "revision": 1,
+  "sources": [
+    {
+      "id": "prd",
+      "role": "intent",
+      "path": "artifacts/prd.md",
+      "sha256": "<64-hex-digest>"
+    }
+  ],
+  "criteria": [
+    { "id": "QB-001", "scope": "product_quality", "requirement": "..." },
+    { "id": "QB-010", "scope": "delivery_closure", "requirement": "..." }
+  ],
+  "fingerprint": "<sha256-of-canonical-manifest-without-fingerprint>"
+}
+```
+
+The manifest requires a positive revision, at least one source, unique source
+and criterion IDs, project-relative source paths, SHA-256 for every source, and
+non-empty requirements. Version 1 has exactly two criterion scopes:
+`product_quality` and `delivery_closure`.
+
+The fingerprint is SHA-256 over canonical JSON with object keys sorted
+recursively, array order preserved, and the `fingerprint` field excluded from
+the payload. Whitespace and object formatting therefore do not change it.
+
+## Binding and drift
+
+When `project.quality_contract` is present, the Orchestrator binds both the
+manifest path and its fingerprint in every active Developer assignment:
+
+```json
+{
+  "quality_baseline_path": "artifacts/quality-baseline.json",
+  "expected_quality_baseline_fingerprint": "<sha256>"
+}
+```
+
+`triad-verify` validates the manifest and all source hashes before expensive
+gates. A malformed manifest or fingerprint mismatch is
+`quality_baseline_invalid`; a valid manifest whose declared sources or
+assignment fingerprint no longer match is `quality_baseline_drift`. Both are
+`invalid_context`: no Developer dispatch, expensive gates, or retry budget.
+
+Projects without `quality_contract` retain the legacy PRD-only path. A
+rebaseline is never an in-place edit: create a new revision/fingerprint and
+record an explicit lineage event. Historical evidence is not silently
+reinterpreted.
+
+## Phase ownership
+
+`product_quality` criteria are included in the fresh, blind Evaluator+ packet.
+The packet carries the baseline fingerprint, final candidate fingerprint,
+criteria, approved source material, and bounded verifier evidence. It never
+includes delivery criteria, queue state, handoff state, or attempt history.
+
+Evaluator+ returns one result per product criterion. The control plane validates
+coverage, uniqueness, scope, candidate/baseline fingerprints, and the overall
+verdict. Aggregation is deterministic:
+
+```text
+any FAIL               -> FAIL
+else any INDETERMINATE -> INDETERMINATE
+else                   -> PASS
+```
+
+`delivery_closure` criteria are evaluated separately during delivery closure
+and recorded with criterion ID, verdict, and evidence references. A run is not
+`delivered` when any configured delivery criterion is `FAIL` or
+`INDETERMINATE`. Quality Bar evaluation is not a required-gate replacement,
+and an Evaluator+ failure never repairs or reopens Triad automatically.
+
+## Explicit control-plane validation
+
+The installed runtime exposes deterministic commands for the two phase
+boundaries. Run the baseline preflight before dispatch, then run the phase
+validators from the control workspace so the baseline is reloaded from disk:
+
+```bash
+node .triad-runtime/triad-evaluator-validate.mjs --mode baseline \
+  --project /absolute/path/to/control \
+  --baseline artifacts/quality-baseline.json
+
+node .triad-runtime/triad-evaluator-validate.mjs --mode evaluator \
+  --project /absolute/path/to/control \
+  --baseline artifacts/quality-baseline.json \
+  --result artifacts/evaluator-plus/evaluation.json \
+  --expected-candidate-fingerprint <final-candidate-fingerprint>
+
+node .triad-runtime/triad-evaluator-validate.mjs --mode delivery \
+  --project /absolute/path/to/control \
+  --baseline artifacts/quality-baseline.json \
+  --result artifacts/delivery-closure.json
+```
+
+Each command emits one machine-readable JSON result and exits non-zero for an
+invalid contract, source drift, stale candidate binding, or invalid result.

package/docs/verification.md

@@ -17,6 +17,23 @@ An agent-reported claim is not the same as verification evidence. A Developer ca
 report the commands it ran; `triad-verify` independently observes declared
 required `control-plane` gates and writes atomic evidence.
 
+## Immutable Quality Contract
+
+Projects may opt into `project.quality_contract` with a project-relative JSON
+manifest and its expected SHA-256 fingerprint. The shared
+`runtime/lib/quality-baseline.mjs` loader canonicalizes the manifest (excluding
+its self-declared `fingerprint`), validates source paths, IDs, scopes, and hashes,
+then verifies every bound source before any expensive gate runs. A malformed,
+missing, or mismatched contract is `invalid_context`; a valid manifest whose
+bound source content has changed is `quality_baseline_drift`. Both fail closed:
+no Developer dispatch, gate execution, or retry budget consumption is allowed.
+
+The verifier records `baseline.quality_baseline_fingerprint` when configured and
+records `null` for legacy projects. The Quality Contract is distinct from the
+repository/card baseline and the candidate fingerprint: it says what the run is
+trying to satisfy, not which Git commit was checked out or what the candidate
+changed.
+
 Before gates run, the verifier validates the active assignment, PRD/card/gate
 hashes, worktree, expected branch, and candidate fingerprint. It records the
 assignment ID/hash and run ID, executes deterministic commands with a bounded

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "triad-plus",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "A lightweight, evidence-backed engineering loop for coding agents.",
   "license": "Apache-2.0",
   "type": "module",
@@ -28,7 +28,7 @@
     "node": ">=20"
   },
   "scripts": {
-    "test": "node tests/runtime-forward-test.mjs && node tests/retry-scope-contracts-test.mjs && node tests/cli-install-test.mjs && node tests/codex-liveness-test.mjs && node tests/bmad-story-importer-test.mjs",
+    "test": "node tests/runtime-forward-test.mjs && node tests/retry-scope-contracts-test.mjs && node tests/cli-install-test.mjs && node tests/codex-liveness-test.mjs && node tests/bmad-story-importer-test.mjs && node tests/immutable-quality-contract-test.mjs",
     "pack:check": "npm pack --dry-run"
   },
   "repository": {

package/runtime/lib/quality-baseline.mjs

@@ -0,0 +1,205 @@
+import { createHash } from "node:crypto";
+import { readFile, realpath } from "node:fs/promises";
+import path from "node:path";
+
+const SHA256 = /^[a-f0-9]{64}$/i;
+const QUALITY_SCOPES = new Set(["product_quality", "delivery_closure"]);
+
+function qualityError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function objectLike(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+/**
+ * Return a JSON-compatible value with object keys sorted recursively. Arrays
+ * intentionally retain their declared order: source and criterion order is
+ * part of the authored contract, while object formatting is not.
+ */
+export function canonicalizeQualityValue(value) {
+  if (Array.isArray(value)) return value.map(canonicalizeQualityValue);
+  if (!objectLike(value)) return value;
+  return Object.fromEntries(
+    Object.keys(value)
+      .sort()
+      .map((key) => [key, canonicalizeQualityValue(value[key])])
+  );
+}
+
+export function qualityBaselinePayload(manifest) {
+  if (!objectLike(manifest)) return manifest;
+  const { fingerprint: _fingerprint, ...payload } = manifest;
+  return canonicalizeQualityValue(payload);
+}
+
+export function qualityBaselineFingerprint(manifest) {
+  const canonical = JSON.stringify(qualityBaselinePayload(manifest));
+  return createHash("sha256").update(canonical).digest("hex");
+}
+
+function projectRelativePath(root, value, label) {
+  if (typeof value !== "string" || !value.trim() || path.isAbsolute(value)) {
+    throw qualityError("quality_baseline_invalid", `${label} must be a non-empty project-relative path`);
+  }
+  const normalized = value.replaceAll("\\", "/");
+  const posix = path.posix.normalize(normalized);
+  if (posix === "." || posix === ".." || posix.startsWith("../") || normalized.split("/").includes("..")) {
+    throw qualityError("quality_baseline_invalid", `${label} escapes the project root`);
+  }
+  const resolved = path.resolve(root, normalized);
+  if (!resolved.startsWith(`${root}${path.sep}`)) {
+    throw qualityError("quality_baseline_invalid", `${label} escapes the project root`);
+  }
+  return resolved;
+}
+
+function validateSha(value, label) {
+  if (typeof value !== "string" || !SHA256.test(value)) {
+    throw qualityError("quality_baseline_invalid", `${label} must be a SHA-256 hex digest`);
+  }
+}
+
+function rejectUnknownProperties(value, allowed, label) {
+  for (const key of Object.keys(value)) {
+    if (!allowed.has(key)) throw qualityError("quality_baseline_invalid", `${label} contains unknown property: ${key}`);
+  }
+}
+
+/**
+ * Validate the manifest shape and its self-declared fingerprint without
+ * touching source files. This is useful to callers that only need to inspect
+ * the immutable contract before resolving it against a project.
+ */
+export function validateQualityBaselineManifest(manifest) {
+  if (!objectLike(manifest)) throw qualityError("quality_baseline_invalid", "quality baseline must be a JSON object");
+  rejectUnknownProperties(manifest, new Set(["schema_version", "id", "revision", "sources", "criteria", "fingerprint"]), "quality baseline manifest");
+  if (manifest.schema_version !== 1) throw qualityError("quality_baseline_invalid", "quality baseline schema_version must be 1");
+  if (typeof manifest.id !== "string" || !manifest.id.trim()) throw qualityError("quality_baseline_invalid", "quality baseline id must be non-empty");
+  if (!Number.isInteger(manifest.revision) || manifest.revision < 1) throw qualityError("quality_baseline_invalid", "quality baseline revision must be a positive integer");
+  if (!Array.isArray(manifest.sources) || manifest.sources.length === 0) throw qualityError("quality_baseline_invalid", "quality baseline must declare at least one source");
+  if (!Array.isArray(manifest.criteria)) throw qualityError("quality_baseline_invalid", "quality baseline criteria must be an array");
+
+  const sourceIds = new Set();
+  for (const source of manifest.sources) {
+    if (!objectLike(source)) throw qualityError("quality_baseline_invalid", "quality baseline sources must contain objects");
+    rejectUnknownProperties(source, new Set(["id", "role", "path", "sha256"]), "quality baseline source");
+    if (typeof source.id !== "string" || !source.id.trim()) throw qualityError("quality_baseline_invalid", "quality baseline source id must be non-empty");
+    if (sourceIds.has(source.id)) throw qualityError("quality_baseline_invalid", `duplicate quality baseline source id: ${source.id}`);
+    sourceIds.add(source.id);
+    if (typeof source.role !== "string" || !source.role.trim()) throw qualityError("quality_baseline_invalid", `quality baseline source role is missing: ${source.id}`);
+    if (typeof source.path !== "string" || !source.path.trim() || path.isAbsolute(source.path)) throw qualityError("quality_baseline_invalid", `quality baseline source path must be project-relative: ${source.id}`);
+    const normalizedSourcePath = path.posix.normalize(source.path.replaceAll("\\", "/"));
+    if (normalizedSourcePath === "." || normalizedSourcePath === ".." || normalizedSourcePath.startsWith("../") || source.path.replaceAll("\\", "/").split("/").includes("..")) throw qualityError("quality_baseline_invalid", `quality baseline source path escapes the project root: ${source.id}`);
+    validateSha(source.sha256, `quality baseline source ${source.id}`);
+  }
+
+  const criterionIds = new Set();
+  for (const criterion of manifest.criteria) {
+    if (!objectLike(criterion)) throw qualityError("quality_baseline_invalid", "quality baseline criteria must contain objects");
+    rejectUnknownProperties(criterion, new Set(["id", "scope", "requirement"]), "quality baseline criterion");
+    if (typeof criterion.id !== "string" || !criterion.id.trim()) throw qualityError("quality_baseline_invalid", "quality baseline criterion id must be non-empty");
+    if (criterionIds.has(criterion.id)) throw qualityError("quality_baseline_invalid", `duplicate quality baseline criterion id: ${criterion.id}`);
+    criterionIds.add(criterion.id);
+    if (!QUALITY_SCOPES.has(criterion.scope)) throw qualityError("quality_baseline_invalid", `invalid quality baseline criterion scope: ${criterion.id}`);
+    if (typeof criterion.requirement !== "string" || !criterion.requirement.trim()) throw qualityError("quality_baseline_invalid", `quality baseline criterion requirement must be non-empty: ${criterion.id}`);
+  }
+
+  validateSha(manifest.fingerprint, "quality baseline fingerprint");
+  const calculatedFingerprint = qualityBaselineFingerprint(manifest);
+  if (manifest.fingerprint.toLowerCase() !== calculatedFingerprint) {
+    throw qualityError("quality_baseline_invalid", "quality baseline declared fingerprint does not match its canonical content");
+  }
+  return { manifest, fingerprint: calculatedFingerprint };
+}
+
+async function verifySources(manifest, root) {
+  const verifiedSources = [];
+  for (const source of manifest.sources) {
+    const sourcePath = projectRelativePath(root, source.path, `quality baseline source ${source.id}`);
+    let resolvedSource;
+    try {
+      resolvedSource = await realpath(sourcePath);
+    } catch {
+      throw qualityError("quality_baseline_invalid", `quality baseline source is missing: ${source.path}`);
+    }
+    if (!resolvedSource.startsWith(`${root}${path.sep}`)) {
+      throw qualityError("quality_baseline_invalid", `quality baseline source escapes the project root: ${source.path}`);
+    }
+    let content;
+    try {
+      content = await readFile(resolvedSource);
+    } catch {
+      throw qualityError("quality_baseline_invalid", `quality baseline source cannot be read: ${source.path}`);
+    }
+    const actual = createHash("sha256").update(content).digest("hex");
+    if (actual !== source.sha256.toLowerCase()) {
+      throw qualityError("quality_baseline_drift", `quality baseline source hash mismatch: ${source.path}`);
+    }
+    verifiedSources.push({ id: source.id, path: source.path, sha256: actual });
+  }
+  return verifiedSources;
+}
+
+/**
+ * Load, validate, fingerprint, and resolve the immutable quality contract
+ * against source files under the project root.
+ */
+export async function loadQualityBaseline(manifestPath, { projectRoot = process.cwd(), expectedFingerprint = null } = {}) {
+  const root = await realpath(projectRoot);
+  const resolvedManifestPath = projectRelativePath(root, manifestPath, "quality baseline path");
+  let source;
+  try {
+    source = await readFile(resolvedManifestPath, "utf8");
+  } catch {
+    throw qualityError("quality_baseline_invalid", `quality baseline manifest is missing: ${manifestPath}`);
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(source);
+  } catch (error) {
+    throw qualityError("quality_baseline_invalid", `quality baseline manifest is not valid JSON: ${error.message}`);
+  }
+  const validated = validateQualityBaselineManifest(manifest);
+  if (expectedFingerprint !== null && expectedFingerprint !== undefined) {
+    validateSha(expectedFingerprint, "expected quality baseline fingerprint");
+    if (expectedFingerprint.toLowerCase() !== validated.fingerprint) {
+      throw qualityError("quality_baseline_drift", "quality baseline fingerprint does not match the assignment binding");
+    }
+  }
+  const sources = await verifySources(manifest, root);
+  return {
+    manifest,
+    path: path.relative(root, resolvedManifestPath),
+    fingerprint: validated.fingerprint,
+    sources,
+    criteria: manifest.criteria,
+  };
+}
+
+/** Resolve the optional assignment binding while preserving legacy mode. */
+export async function resolveQualityContract(assignment, projectRoot) {
+  const manifestPath = assignment?.quality_baseline_path;
+  const expectedFingerprint = assignment?.expected_quality_baseline_fingerprint;
+  const pathPresent = typeof manifestPath === "string" && manifestPath.trim();
+  const fingerprintPresent = typeof expectedFingerprint === "string" && expectedFingerprint.trim();
+  if (!pathPresent && !fingerprintPresent) return null;
+  if (!pathPresent || !fingerprintPresent) {
+    throw qualityError("quality_baseline_invalid", "quality contract requires quality_baseline_path and expected_quality_baseline_fingerprint together");
+  }
+  return loadQualityBaseline(manifestPath, { projectRoot, expectedFingerprint });
+}
+
+export function qualityCriteriaByScope(manifestOrContract) {
+  const manifest = manifestOrContract?.manifest ?? manifestOrContract;
+  if (!objectLike(manifest) || !Array.isArray(manifest.criteria)) throw qualityError("quality_baseline_invalid", "quality baseline criteria are unavailable");
+  return {
+    product_quality: manifest.criteria.filter((criterion) => criterion.scope === "product_quality"),
+    delivery_closure: manifest.criteria.filter((criterion) => criterion.scope === "delivery_closure"),
+  };
+}
+
+export { QUALITY_SCOPES };

package/runtime/triad-evaluator-validate.mjs

@@ -0,0 +1,261 @@
+import { loadQualityBaseline, qualityCriteriaByScope, validateQualityBaselineManifest } from "./lib/quality-baseline.mjs";
+import { readFile, realpath } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const VERDICTS = new Set(["PASS", "FAIL", "INDETERMINATE"]);
+const SHA256 = /^[a-f0-9]{64}$/i;
+const DATE_TIME = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+
+function evaluatorError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function rejectUnknownProperties(value, allowed, label) {
+  for (const key of Object.keys(value)) {
+    if (!allowed.has(key)) throw evaluatorError("evaluator_result_invalid", `${label} contains unknown property: ${key}`);
+  }
+}
+
+function requireBaseResult(result) {
+  if (!result || typeof result !== "object" || Array.isArray(result)) throw evaluatorError("evaluator_result_invalid", "Evaluator+ result must be an object");
+  rejectUnknownProperties(result, new Set(["schema_version", "feature_id", "candidate_fingerprint", "quality_baseline_fingerprint", "verdict", "summary", "evidence_refs", "criteria", "created_at"]), "Evaluator+ result");
+  if (result.schema_version !== 1) throw evaluatorError("evaluator_result_invalid", "Evaluator+ schema_version must be 1");
+  if (typeof result.feature_id !== "string" || !result.feature_id.trim()) throw evaluatorError("evaluator_result_invalid", "Evaluator+ feature_id must be non-empty");
+  if (typeof result.candidate_fingerprint !== "string" || !result.candidate_fingerprint.trim()) throw evaluatorError("evaluator_result_invalid", "Evaluator+ candidate_fingerprint must be non-empty");
+  if (result.quality_baseline_fingerprint !== undefined && (typeof result.quality_baseline_fingerprint !== "string" || !SHA256.test(result.quality_baseline_fingerprint))) throw evaluatorError("evaluator_result_invalid", "Evaluator+ quality_baseline_fingerprint must be a SHA-256 hex digest");
+  if (!VERDICTS.has(result.verdict)) throw evaluatorError("evaluator_result_invalid", "Evaluator+ verdict must be PASS, FAIL, or INDETERMINATE");
+  if (typeof result.summary !== "string" || !result.summary.trim()) throw evaluatorError("evaluator_result_invalid", "Evaluator+ summary must be non-empty");
+  if (!Array.isArray(result.evidence_refs) || result.evidence_refs.some((ref) => typeof ref !== "string")) throw evaluatorError("evaluator_result_invalid", "Evaluator+ evidence_refs must be an array of strings");
+  if (typeof result.created_at !== "string" || !DATE_TIME.test(result.created_at) || Number.isNaN(Date.parse(result.created_at))) throw evaluatorError("evaluator_result_invalid", "Evaluator+ created_at must be an RFC 3339 date-time");
+}
+
+export function aggregateEvaluatorVerdict(criteria) {
+  if (!Array.isArray(criteria)) throw evaluatorError("evaluator_result_invalid", "Evaluator+ criteria must be an array");
+  if (criteria.some((criterion) => criterion.verdict === "FAIL")) return "FAIL";
+  if (criteria.some((criterion) => criterion.verdict === "INDETERMINATE")) return "INDETERMINATE";
+  return "PASS";
+}
+
+function validateCriterionShape(criterion) {
+  if (!criterion || typeof criterion !== "object" || Array.isArray(criterion)) throw evaluatorError("evaluator_result_invalid", "Evaluator+ criterion entries must be objects");
+  rejectUnknownProperties(criterion, new Set(["id", "scope", "verdict", "summary", "evidence_refs"]), "Evaluator+ criterion");
+  if (typeof criterion.id !== "string" || !criterion.id.trim()) throw evaluatorError("evaluator_result_invalid", "Evaluator+ criterion id must be non-empty");
+  if (criterion.scope !== "product_quality") throw evaluatorError("evaluator_result_invalid", `Evaluator+ criterion ${criterion.id} is not product_quality`);
+  if (!VERDICTS.has(criterion.verdict)) throw evaluatorError("evaluator_result_invalid", `Evaluator+ criterion ${criterion.id} has an invalid verdict`);
+  if (typeof criterion.summary !== "string" || !criterion.summary.trim()) throw evaluatorError("evaluator_result_invalid", `Evaluator+ criterion ${criterion.id} summary must be non-empty`);
+  if (!Array.isArray(criterion.evidence_refs) || criterion.evidence_refs.some((ref) => typeof ref !== "string")) throw evaluatorError("evaluator_result_invalid", `Evaluator+ criterion ${criterion.id} evidence_refs must be an array of strings`);
+}
+
+/**
+ * Validate an Evaluator+ result. Without a quality baseline the v1.7 legacy
+ * result contract remains valid. With a baseline, every product-quality
+ * criterion must be covered exactly once and the aggregate is deterministic.
+ */
+export function validateEvaluatorResult(result, { qualityBaseline = null, expectedCandidateFingerprint = null } = {}) {
+  requireBaseResult(result);
+  if (!qualityBaseline) {
+    if (result.criteria !== undefined) {
+      if (!Array.isArray(result.criteria)) throw evaluatorError("evaluator_result_invalid", "Evaluator+ criteria must be an array");
+      for (const criterion of result.criteria) validateCriterionShape(criterion);
+    }
+    return { valid: true, legacy: true, verdict: result.verdict, result };
+  }
+
+  const baseline = qualityBaseline.manifest ?? qualityBaseline;
+  const validatedBaseline = validateQualityBaselineManifest(baseline);
+  const expectedBaselineFingerprint = validatedBaseline.fingerprint;
+  if (qualityBaseline.fingerprint !== undefined && qualityBaseline.fingerprint !== expectedBaselineFingerprint) {
+    throw evaluatorError("evaluator_quality_baseline_mismatch", "loaded Quality Baseline fingerprint does not match its canonical content");
+  }
+  if (result.quality_baseline_fingerprint !== expectedBaselineFingerprint) {
+    throw evaluatorError("evaluator_quality_baseline_mismatch", "Evaluator+ result quality baseline fingerprint does not match the approved contract");
+  }
+  if (typeof expectedCandidateFingerprint !== "string" || !expectedCandidateFingerprint.trim()) {
+    throw evaluatorError("evaluator_candidate_binding_missing", "Quality Contract Evaluator+ validation requires an expected candidate fingerprint");
+  }
+  if (result.candidate_fingerprint !== expectedCandidateFingerprint) {
+    throw evaluatorError("evaluator_candidate_fingerprint_mismatch", "Evaluator+ result candidate fingerprint does not match the approved candidate");
+  }
+
+  const { product_quality: expectedCriteria, delivery_closure: deliveryCriteria } = qualityCriteriaByScope(baseline);
+  if (!Array.isArray(result.criteria)) throw evaluatorError("evaluator_result_invalid", "Quality Contract Evaluator+ result must include criteria");
+  const expectedById = new Map(expectedCriteria.map((criterion) => [criterion.id, criterion]));
+  const deliveryIds = new Set(deliveryCriteria.map((criterion) => criterion.id));
+  const seen = new Set();
+  for (const criterion of result.criteria) {
+    validateCriterionShape(criterion);
+    if (seen.has(criterion.id)) throw evaluatorError("evaluator_result_invalid", `duplicate Evaluator+ criterion: ${criterion.id}`);
+    seen.add(criterion.id);
+    if (deliveryIds.has(criterion.id)) throw evaluatorError("evaluator_result_invalid", `delivery_closure criterion was sent to Evaluator+: ${criterion.id}`);
+    if (!expectedById.has(criterion.id)) throw evaluatorError("evaluator_result_invalid", `unexpected product_quality criterion: ${criterion.id}`);
+  }
+  for (const criterion of expectedCriteria) {
+    if (!seen.has(criterion.id)) throw evaluatorError("evaluator_result_invalid", `missing product_quality criterion: ${criterion.id}`);
+  }
+  const aggregate = aggregateEvaluatorVerdict(result.criteria);
+  if (result.verdict !== aggregate) throw evaluatorError("evaluator_result_invalid", `Evaluator+ aggregate verdict must be ${aggregate}`);
+  return {
+    valid: true,
+    legacy: false,
+    verdict: aggregate,
+    quality_baseline_fingerprint: expectedBaselineFingerprint,
+    product_quality_criteria: result.criteria,
+    excluded_delivery_closure_ids: deliveryCriteria.map((criterion) => criterion.id),
+    result,
+  };
+}
+
+function validateClosureCriterion(criterion, expectedScope = "delivery_closure") {
+  if (!criterion || typeof criterion !== "object" || Array.isArray(criterion)) throw evaluatorError("delivery_closure_invalid", "delivery closure criteria must be objects");
+  const allowed = new Set(["id", "scope", "verdict", "summary", "evidence_refs"]);
+  for (const key of Object.keys(criterion)) if (!allowed.has(key)) throw evaluatorError("delivery_closure_invalid", `delivery closure criterion contains unknown property: ${key}`);
+  if (typeof criterion.id !== "string" || !criterion.id.trim()) throw evaluatorError("delivery_closure_invalid", "delivery closure criterion id must be non-empty");
+  if (criterion.scope !== expectedScope) throw evaluatorError("delivery_closure_invalid", `delivery closure criterion ${criterion.id} has the wrong scope`);
+  if (!VERDICTS.has(criterion.verdict)) throw evaluatorError("delivery_closure_invalid", `delivery closure criterion ${criterion.id} has an invalid verdict`);
+  if (typeof criterion.summary !== "string" || !criterion.summary.trim()) throw evaluatorError("delivery_closure_invalid", `delivery closure criterion ${criterion.id} summary must be non-empty`);
+  if (!Array.isArray(criterion.evidence_refs) || criterion.evidence_refs.some((ref) => typeof ref !== "string")) throw evaluatorError("delivery_closure_invalid", `delivery closure criterion ${criterion.id} evidence_refs must be an array of strings`);
+}
+
+/** Validate the separate delivery-closure criterion record. */
+export function validateDeliveryClosureCriteria(qualityBaseline, results) {
+  const baseline = qualityBaseline?.manifest ?? qualityBaseline;
+  const validatedBaseline = validateQualityBaselineManifest(baseline);
+  const expected = qualityCriteriaByScope(baseline).delivery_closure;
+  if (!Array.isArray(results)) throw evaluatorError("delivery_closure_invalid", "delivery closure results must be an array");
+  const expectedIds = new Set(expected.map((criterion) => criterion.id));
+  const seen = new Set();
+  for (const result of results) {
+    validateClosureCriterion(result);
+    if (seen.has(result.id)) throw evaluatorError("delivery_closure_invalid", `duplicate delivery closure criterion: ${result.id}`);
+    seen.add(result.id);
+    if (!expectedIds.has(result.id)) throw evaluatorError("delivery_closure_invalid", `unexpected delivery closure criterion: ${result.id}`);
+  }
+  for (const criterion of expected) {
+    if (!seen.has(criterion.id)) throw evaluatorError("delivery_closure_invalid", `missing delivery closure criterion: ${criterion.id}`);
+  }
+  const verdict = aggregateEvaluatorVerdict(results);
+  if (qualityBaseline?.fingerprint !== undefined && qualityBaseline.fingerprint !== validatedBaseline.fingerprint) {
+    throw evaluatorError("delivery_closure_invalid", "loaded Quality Baseline fingerprint does not match its canonical content");
+  }
+  return {
+    valid: true,
+    verdict,
+    can_deliver: verdict === "PASS",
+    quality_baseline_fingerprint: validatedBaseline.fingerprint,
+    criteria: results,
+  };
+}
+
+export { VERDICTS };
+
+function cliError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function parseArgs(argv) {
+  const args = { mode: null, project: process.cwd(), baseline: null, result: null, expectedCandidateFingerprint: null };
+  for (let index = 0; index < argv.length; index += 1) {
+    const flag = argv[index];
+    if (flag === "--help" || flag === "-h") {
+      process.stdout.write("Usage: node runtime/triad-evaluator-validate.mjs --mode <baseline|evaluator|delivery> --baseline <path> [--result <path>] [--project <root>] [--expected-candidate-fingerprint <sha256>]\n");
+      return null;
+    }
+    const key = {
+      "--mode": "mode",
+      "--project": "project",
+      "--baseline": "baseline",
+      "--result": "result",
+      "--expected-candidate-fingerprint": "expectedCandidateFingerprint",
+    }[flag];
+    if (!key) throw cliError("quality_contract_cli_invalid", `unknown option: ${flag}`);
+    const value = argv[index + 1];
+    if (!value || value.startsWith("--")) throw cliError("quality_contract_cli_invalid", `${flag} requires a value`);
+    args[key] = value;
+    index += 1;
+  }
+  if (!args.mode || !["baseline", "evaluator", "delivery"].includes(args.mode)) throw cliError("quality_contract_cli_invalid", "--mode must be baseline, evaluator, or delivery");
+  if (args.mode !== "baseline" && !args.result) throw cliError("quality_contract_cli_invalid", "--result is required");
+  if ((args.mode === "baseline" || args.mode === "delivery") && !args.baseline) throw cliError("quality_contract_cli_invalid", `--baseline is required for ${args.mode} validation`);
+  return args;
+}
+
+async function readJsonFile(root, value, label) {
+  const target = path.isAbsolute(value) ? value : path.resolve(root, value);
+  let source;
+  try {
+    source = await readFile(target, "utf8");
+  } catch (error) {
+    throw cliError("quality_contract_cli_invalid", `${label} cannot be read: ${error.message}`);
+  }
+  try {
+    return JSON.parse(source);
+  } catch (error) {
+    throw cliError("quality_contract_cli_invalid", `${label} is not valid JSON: ${error.message}`);
+  }
+}
+
+/**
+ * Explicit control-plane entry point. It reloads the baseline from disk on
+ * every invocation so Evaluator+ and delivery closure cannot rely on a stale
+ * manifest/source check performed earlier in the run.
+ */
+async function runCli() {
+  const args = parseArgs(process.argv.slice(2));
+  if (!args) return;
+  const projectRoot = await realpath(args.project);
+  const qualityBaseline = args.baseline
+    ? await loadQualityBaseline(args.baseline, { projectRoot })
+    : null;
+  if (args.mode === "baseline") {
+    process.stdout.write(`${JSON.stringify({
+      valid: true,
+      mode: "baseline",
+      quality_baseline_fingerprint: qualityBaseline.fingerprint,
+      sources: qualityBaseline.sources,
+    })}\n`);
+    return;
+  }
+  if (args.mode === "evaluator") {
+    const result = await readJsonFile(projectRoot, args.result, "Evaluator+ result");
+    if (qualityBaseline && (!args.expectedCandidateFingerprint || !SHA256.test(args.expectedCandidateFingerprint))) {
+      throw cliError("evaluator_candidate_binding_missing", "Quality Contract Evaluator+ validation requires --expected-candidate-fingerprint");
+    }
+    const validated = validateEvaluatorResult(result, {
+      qualityBaseline,
+      expectedCandidateFingerprint: qualityBaseline ? args.expectedCandidateFingerprint : null,
+    });
+    process.stdout.write(`${JSON.stringify({
+      valid: true,
+      mode: "evaluator",
+      legacy: validated.legacy,
+      verdict: validated.verdict,
+      quality_baseline_fingerprint: validated.quality_baseline_fingerprint ?? null,
+      candidate_fingerprint: result.candidate_fingerprint,
+      product_quality_criteria: validated.product_quality_criteria ?? null,
+    })}\n`);
+    return;
+  }
+
+  const results = await readJsonFile(projectRoot, args.result, "delivery closure results");
+  const validated = validateDeliveryClosureCriteria(qualityBaseline, results);
+  process.stdout.write(`${JSON.stringify({
+    valid: true,
+    mode: "delivery",
+    verdict: validated.verdict,
+    can_deliver: validated.can_deliver,
+    quality_baseline_fingerprint: validated.quality_baseline_fingerprint,
+    criteria: validated.criteria,
+  })}\n`);
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  runCli().catch((error) => {
+    process.stdout.write(`${JSON.stringify({ valid: false, error: { code: error.code ?? "quality_contract_cli_invalid", message: error.message } })}\n`);
+    process.exitCode = 2;
+  });
+}

package/runtime/triad-verify.mjs

@@ -6,6 +6,7 @@ import { fileURLToPath } from "node:url";
 import { writeAtomicJson } from "./lib/evidence.mjs";
 import { calculateCandidateFingerprint, collectCandidateChanges, worktreeBranch } from "./lib/fingerprint.mjs";
 import { executeGates, gateSelectionEvidence, loadTrustedGates, resolveGateSelection } from "./lib/gates.mjs";
+import { resolveQualityContract } from "./lib/quality-baseline.mjs";
 import { evaluateScopeContract, parseScopeContract } from "./lib/scope-contract.mjs";
 
 const argv = process.argv.slice(2);
@@ -24,6 +25,10 @@ function sha256(value) {
   return createHash("sha256").update(value).digest("hex");
 }
 
+function evidenceFingerprint(value) {
+  return typeof value === "string" && /^[a-f0-9]{64}$/i.test(value) ? value : null;
+}
+
 async function sha256File(value) {
   return sha256(await readFile(value));
 }
@@ -65,7 +70,7 @@ async function resolveAssignment(projectRoot, trigger, explicitAssignment) {
   return { assignmentPath, assignment: JSON.parse(source), assignmentHash: sha256(source) };
 }
 
-async function buildInvalidEvidence({ runId, trigger, assignment, reason, outputPath, failureCode = "verification_context_invalid", gateSelection = null }) {
+async function buildInvalidEvidence({ runId, trigger, assignment, reason, outputPath, failureCode = "verification_context_invalid", gateSelection = null, qualityBaselineFingerprint = null }) {
   const evidence = {
     schema_version: 1,
     run_id: runId,
@@ -77,6 +82,7 @@ async function buildInvalidEvidence({ runId, trigger, assignment, reason, output
     baseline: {
       prd_sha256: assignment?.expected_prd_sha256 ?? null,
       card_sha256: assignment?.expected_card_sha256 ?? null,
+      quality_baseline_fingerprint: evidenceFingerprint(qualityBaselineFingerprint ?? assignment?.expected_quality_baseline_fingerprint),
       git_head: null,
       candidate_fingerprint: null,
     },
@@ -147,6 +153,7 @@ async function main() {
   let assignmentPath;
   let outputPath;
   let gateSelection = null;
+  let qualityBaseline = null;
   try {
     let assignmentHash;
     ({ assignmentPath, assignment, assignmentHash } = await resolveAssignment(projectRoot, trigger, option("--assignment")));
@@ -166,6 +173,10 @@ async function main() {
     const cardPath = path.resolve(projectRoot, assignment.card_path);
     await access(prdPath);
     await access(cardPath);
+    // Resolve the optional immutable Quality Contract before any baseline or
+    // expensive-gate check so a bound source drift keeps its precise failure
+    // classification (including when the source is the PRD itself).
+    qualityBaseline = await resolveQualityContract(assignment, projectRoot);
     if ((await sha256File(prdPath)) !== assignment.expected_prd_sha256) throw new Error("PRD baseline hash mismatch");
     if ((await sha256File(cardPath)) !== assignment.expected_card_sha256) throw new Error("feature card hash mismatch");
     const repositorySkills = await validateRepositorySkills(assignment.required_repository_skills, worktree);
@@ -203,6 +214,7 @@ async function main() {
         baseline: {
           prd_sha256: assignment.expected_prd_sha256,
           card_sha256: assignment.expected_card_sha256,
+          quality_baseline_fingerprint: qualityBaseline?.fingerprint ?? null,
           gates_sha256: null,
           git_head: before.git_head,
           candidate_fingerprint: before.value,
@@ -237,9 +249,10 @@ async function main() {
       trigger,
       assignment_ref: path.relative(projectRoot, assignmentPath),
       baseline: {
-        prd_sha256: assignment.expected_prd_sha256,
-        card_sha256: assignment.expected_card_sha256,
-        gates_sha256: trusted.actualHash,
+          prd_sha256: assignment.expected_prd_sha256,
+          card_sha256: assignment.expected_card_sha256,
+          quality_baseline_fingerprint: qualityBaseline?.fingerprint ?? null,
+          gates_sha256: trusted.actualHash,
         git_head: before.git_head,
         candidate_fingerprint: before.value,
         branch,
@@ -269,7 +282,8 @@ async function main() {
       reason: error.message,
       outputPath,
       failureCode: error.code ?? "verification_context_invalid",
-      gateSelection
+      gateSelection,
+      qualityBaselineFingerprint: qualityBaseline?.fingerprint ?? null
     });
     process.stdout.write(`${JSON.stringify({ run_id: runId, status: evidence.status, evidence: outputPath ?? null })}\n`);
     process.exitCode = 3;

package/schemas/evaluator-plus-result.schema.json

@@ -8,9 +8,25 @@
     "schema_version": { "const": 1 },
     "feature_id": { "type": "string", "minLength": 1 },
     "candidate_fingerprint": { "type": "string", "minLength": 1 },
+    "quality_baseline_fingerprint": { "type": "string", "pattern": "^[a-fA-F0-9]{64}$" },
     "verdict": { "enum": ["PASS", "FAIL", "INDETERMINATE"] },
     "summary": { "type": "string", "minLength": 1 },
     "evidence_refs": { "type": "array", "items": { "type": "string" } },
+    "criteria": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "scope", "verdict", "summary", "evidence_refs"],
+        "properties": {
+          "id": { "type": "string", "minLength": 1 },
+          "scope": { "const": "product_quality" },
+          "verdict": { "enum": ["PASS", "FAIL", "INDETERMINATE"] },
+          "summary": { "type": "string", "minLength": 1 },
+          "evidence_refs": { "type": "array", "items": { "type": "string" } }
+        },
+        "additionalProperties": false
+      }
+    },
     "created_at": { "type": "string", "format": "date-time" }
   },
   "additionalProperties": false

package/schemas/quality-baseline.schema.json

@@ -0,0 +1,42 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://triad.engineering/schemas/quality-baseline.schema.json",
+  "title": "Triad immutable Quality Baseline",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "id", "revision", "sources", "criteria", "fingerprint"],
+  "properties": {
+    "schema_version": { "const": 1 },
+    "id": { "type": "string", "minLength": 1 },
+    "revision": { "type": "integer", "minimum": 1 },
+    "sources": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "role", "path", "sha256"],
+        "properties": {
+          "id": { "type": "string", "minLength": 1 },
+          "role": { "type": "string", "minLength": 1 },
+          "path": { "type": "string", "minLength": 1, "pattern": "^(?![\\\\/])(?!.*(?:^|[\\\\/])\\.\\.(?:[\\\\/]|$)).+" },
+          "sha256": { "type": "string", "pattern": "^[a-fA-F0-9]{64}$" }
+        }
+      }
+    },
+    "criteria": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "scope", "requirement"],
+        "properties": {
+          "id": { "type": "string", "minLength": 1 },
+          "scope": { "enum": ["product_quality", "delivery_closure"] },
+          "requirement": { "type": "string", "minLength": 1 }
+        }
+      }
+    },
+    "fingerprint": { "type": "string", "pattern": "^[a-fA-F0-9]{64}$" }
+  }
+}

package/schemas/verification-evidence.schema.json

@@ -12,7 +12,7 @@
     "assignment_id": { "type": ["string", "null"] },
     "assignment_sha256": { "type": ["string", "null"] },
     "trigger": { "type": "object", "required": ["event", "agent_id", "agent_type"], "properties": { "event": { "type": "string" }, "agent_id": { "type": ["string", "null"] }, "agent_type": { "type": ["string", "null"] } } },
-    "baseline": { "type": "object", "required": ["prd_sha256", "card_sha256", "git_head", "candidate_fingerprint"], "properties": { "prd_sha256": { "type": ["string", "null"] }, "card_sha256": { "type": ["string", "null"] }, "git_head": { "type": ["string", "null"] }, "candidate_fingerprint": { "type": ["string", "null"] }, "branch": { "type": ["string", "null"] } } },
+    "baseline": { "type": "object", "required": ["prd_sha256", "card_sha256", "git_head", "candidate_fingerprint"], "properties": { "prd_sha256": { "type": ["string", "null"] }, "card_sha256": { "type": ["string", "null"] }, "quality_baseline_fingerprint": { "type": ["string", "null"], "pattern": "^[a-fA-F0-9]{64}$" }, "git_head": { "type": ["string", "null"] }, "candidate_fingerprint": { "type": ["string", "null"] }, "branch": { "type": ["string", "null"] } } },
     "scope": {
       "type": "object",
       "properties": {

package/skills/triad-loop-bootstrap/SKILL.md

@@ -20,6 +20,14 @@ conditions, runnable quality gates, practical-test need, and integration need.
    snapshot, revision when available, and SHA-256.
 4. Copy `assets/loop-template/` to `.loop/`, then create bounded feature cards
    under `features/` and a complete `feature-plan.md`.
+   When an owner-approved Quality Bar or additional intent/architecture source
+   exists, copy `assets/loop-template/quality-baseline.json`, fill only the
+   declared source hashes and criteria, compute its canonical fingerprint, and
+   bind `project.quality_contract.baseline` plus `fingerprint`. Use
+   `criteria: []` when no machine-readable Quality Bar was supplied; never
+   invent criteria. The manifest is immutable for the run and a requirement
+   change creates a new revision/rebaseline event rather than editing it in
+   place.
 5. Replace every gate placeholder. Gate executors in v1 are only
    `control-plane`; remove a non-applicable gate with a recorded reason instead
    of declaring manual or MCP execution.

package/skills/triad-loop-bootstrap/assets/loop-template/handoff-report.template.md

@@ -22,6 +22,19 @@
 
 - Evidence/review chain: `<verification/review/evaluator references>`
 
+## Quality Contract closure
+
+- Quality Baseline: `<path, revision, fingerprint or legacy PRD-only mode>`
+- Product-quality Evaluator+ verdict: `<PASS|FAIL|INDETERMINATE|not configured>`
+
+| Criterion | Scope | Verdict | Evidence references |
+| --- | --- | --- | --- |
+| `<delivery criterion ID>` | `delivery_closure` | `<PASS|FAIL|INDETERMINATE>` | `<refs>` |
+
+Delivery is `delivered` only when every configured `delivery_closure` criterion
+is recorded as `PASS`. Product-quality criteria are evaluated by the fresh
+Evaluator+ packet and are never silently evaluated during delivery closure.
+
 ## Local-worktree integration
 
 | Card | Consumer worktree | Provider worktree | Branch/commit map | Setup command | Data/event/callback gate |

package/skills/triad-loop-bootstrap/assets/loop-template/quality-baseline.json

@@ -0,0 +1,15 @@
+{
+  "schema_version": 1,
+  "id": "REPLACE_ME_QUALITY_BASELINE_ID",
+  "revision": 1,
+  "sources": [
+    {
+      "id": "prd",
+      "role": "intent",
+      "path": "artifacts/prd.md",
+      "sha256": "REPLACE_ME_SHA256"
+    }
+  ],
+  "criteria": [],
+  "fingerprint": "REPLACE_ME_SHA256"
+}

package/skills/triad-loop-bootstrap/assets/loop-template/run-state.yaml

@@ -7,9 +7,16 @@ delivery:
   handoff: null
   branches: []
   evaluator_report: null
+  quality_criteria: [] # delivery_closure results; product_quality stays in Evaluator+
   delivered_at: null
   owner_message: null
 
+quality_contract:
+  baseline: null
+  fingerprint: null
+  revision: null
+  rebaseline_events: []
+
 feature_plan:
   path: feature-plan.md
   status: declared

package/skills/triad-loop-bootstrap/assets/loop-template/runtime/assignments/assignment.template.json

@@ -16,6 +16,8 @@
   "expected_prd_sha256": "REPLACE_ME_SHA256",
   "expected_card_sha256": "REPLACE_ME_SHA256",
   "expected_gates_sha256": "REPLACE_ME_SHA256",
+  "quality_baseline_path": null,
+  "expected_quality_baseline_fingerprint": null,
   "required_gate_ids": [],
   "scope_contract": null,
   "required_repository_skills": [

package/skills/triad-loop-bootstrap/assets/project.yaml

@@ -12,6 +12,11 @@ project:
     snapshot: artifacts/prd.md
     sha256: null
     source_revision: null
+  quality_contract:
+    # Optional immutable target for v1.8 projects. Leave both values null for
+    # legacy PRD-only behavior; bootstrap fills them only from declared sources.
+    baseline: null # artifacts/quality-baseline.json
+    fingerprint: null
   loop: .loop
   control_plane:
     verification: optional

package/skills/triad-loop-evaluator/SKILL.md

@@ -31,13 +31,23 @@ values in the evaluation report. A missing or mismatched binding makes the
 evaluation `INDETERMINATE`; it never starts repair or changes the closed Triad
 result.
 
-Return a report conforming to `schemas/evaluator-plus-result.schema.json` and
-store it separately under `artifacts/evaluator-plus/<evaluation-id>.json`:
+When the approved packet declares an immutable Quality Contract, receive its
+fingerprint and only the criteria whose scope is `product_quality`. Do not
+receive or evaluate `delivery_closure` criteria; those belong to the delivery
+gate. Return a report conforming to `schemas/evaluator-plus-result.schema.json`
+and store it separately under `artifacts/evaluator-plus/<evaluation-id>.json`:
 
 - `PASS`: the final artifact meets the supplied target;
 - `FAIL`: the target is not met, with direct evidence/references;
 - `INDETERMINATE`: the artifact or target cannot be observed reliably.
 
+For a Quality Contract result, include `quality_baseline_fingerprint` and one
+criterion result for every product-quality criterion, exactly once. Use only
+`PASS`, `FAIL`, or `INDETERMINATE` per criterion. The overall `verdict` is
+deterministically checked by `runtime/triad-evaluator-validate.mjs`: any FAIL
+wins, otherwise any INDETERMINATE wins, otherwise PASS. A mismatch or missing
+criterion is invalid evidence, not a product verdict.
+
 Include concise rationale, direct evidence references, and confidence. Do not
 edit source, change the Triad queue/state, commit, push, approve delivery, or
 request automatic repair, and never reopen the Triad run. A `FAIL` leaves the

package/skills/triad-loop-orchestrator/SKILL.md

@@ -52,6 +52,14 @@ presentation for this invocation, do not repeat it.
    that exact card baseline for every rework attempt: preserved candidate changes
    are normal during rework. Do not create the first scope-bound assignment from
    unattributable dirty product changes; record `invalid_context` instead.
+   If `project.quality_contract` is configured, load and validate its
+   project-relative JSON manifest before dispatch. Verify the canonical
+   fingerprint and every bound source SHA-256, then bind
+   `quality_baseline_path` and `expected_quality_baseline_fingerprint` on the
+   assignment. A `quality_baseline_invalid` or `quality_baseline_drift`
+   result is `invalid_context`: do not dispatch the Developer, run expensive
+   gates, or consume retry/remediation budget. Legacy projects without the
+   quality contract retain PRD-only behavior.
 2. Choose one dependency-approved `ready` card, mark it `in_progress`, append an
    attempt, and create an active assignment before delegating. Before each
    delegation, publish an owner-facing activation notice that attributes the
@@ -80,6 +88,9 @@ presentation for this invocation, do not repeat it.
    catalog and fails closed if a stale assignment names a missing or invalid
    gate. It records the selection mode, card IDs, effective IDs, and required
    IDs in the verification evidence.
+   When a Quality Contract is bound, `triad-verify` performs that baseline
+   preflight before the expensive gates and records its fingerprint in
+   `evidence.baseline.quality_baseline_fingerprint`.
 5. A passing verifier result is **environment-derived evidence**. Move only then
    to `in_review`. Missing, stale, failed, timed-out, invalid-context, or
    invalidated evidence never advances the card.
@@ -196,3 +207,43 @@ or change the already closed Triad run. A per-run `--evaluator` or
 `--no-evaluator` request may override the configuration when the host exposes it.
 Before dispatching it, publish the corresponding attributed Evaluator+
 activation notice.
+
+When `project.quality_contract` is configured, the approved packet additionally
+binds the immutable Quality Baseline fingerprint and includes only criteria whose
+scope is `product_quality`. Never send `delivery_closure` criteria, queue state,
+handoff state, or attempt history to Evaluator+. Validate the returned report
+with a fresh source-integrity preflight from the control workspace first:
+
+```bash
+node .triad-runtime/triad-evaluator-validate.mjs --mode baseline \
+  --project /absolute/path/to/control-workspace \
+  --baseline artifacts/quality-baseline.json
+```
+
+Only after that command returns JSON `valid: true` may Evaluator+ be dispatched.
+Then validate the returned report with this exact command (substituting the real
+paths/fingerprint):
+
+```bash
+node .triad-runtime/triad-evaluator-validate.mjs --mode evaluator \
+  --project /absolute/path/to/control-workspace \
+  --baseline artifacts/quality-baseline.json \
+  --result artifacts/evaluator-plus/evaluation.json \
+  --expected-candidate-fingerprint <final-candidate-fingerprint>
+```
+
+The command reloads the baseline and every bound source immediately before
+dispatch; a non-zero result is a closed validation failure. The control-plane
+aggregate (FAIL over INDETERMINATE over PASS) is authoritative rather than an
+LLM-supplied summary. Immediately before delivery closure, run this second exact
+command with the delivery result array:
+
+```bash
+node .triad-runtime/triad-evaluator-validate.mjs --mode delivery \
+  --project /absolute/path/to/control-workspace \
+  --baseline artifacts/quality-baseline.json \
+  --result artifacts/delivery-closure.json
+```
+
+Record each delivery criterion and its evidence reference in the run/handoff,
+and declare delivery only when every required delivery criterion is `PASS`.