triad-plus 1.7.0 → 1.9.0

package/runtime/triad-evaluator-validate.mjs

@@ -0,0 +1,261 @@
+import { loadQualityBaseline, qualityCriteriaByScope, validateQualityBaselineManifest } from "./lib/quality-baseline.mjs";
+import { readFile, realpath } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const VERDICTS = new Set(["PASS", "FAIL", "INDETERMINATE"]);
+const SHA256 = /^[a-f0-9]{64}$/i;
+const DATE_TIME = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+
+function evaluatorError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function rejectUnknownProperties(value, allowed, label) {
+  for (const key of Object.keys(value)) {
+    if (!allowed.has(key)) throw evaluatorError("evaluator_result_invalid", `${label} contains unknown property: ${key}`);
+  }
+}
+
+function requireBaseResult(result) {
+  if (!result || typeof result !== "object" || Array.isArray(result)) throw evaluatorError("evaluator_result_invalid", "Evaluator+ result must be an object");
+  rejectUnknownProperties(result, new Set(["schema_version", "feature_id", "candidate_fingerprint", "quality_baseline_fingerprint", "verdict", "summary", "evidence_refs", "criteria", "created_at"]), "Evaluator+ result");
+  if (result.schema_version !== 1) throw evaluatorError("evaluator_result_invalid", "Evaluator+ schema_version must be 1");
+  if (typeof result.feature_id !== "string" || !result.feature_id.trim()) throw evaluatorError("evaluator_result_invalid", "Evaluator+ feature_id must be non-empty");
+  if (typeof result.candidate_fingerprint !== "string" || !result.candidate_fingerprint.trim()) throw evaluatorError("evaluator_result_invalid", "Evaluator+ candidate_fingerprint must be non-empty");
+  if (result.quality_baseline_fingerprint !== undefined && (typeof result.quality_baseline_fingerprint !== "string" || !SHA256.test(result.quality_baseline_fingerprint))) throw evaluatorError("evaluator_result_invalid", "Evaluator+ quality_baseline_fingerprint must be a SHA-256 hex digest");
+  if (!VERDICTS.has(result.verdict)) throw evaluatorError("evaluator_result_invalid", "Evaluator+ verdict must be PASS, FAIL, or INDETERMINATE");
+  if (typeof result.summary !== "string" || !result.summary.trim()) throw evaluatorError("evaluator_result_invalid", "Evaluator+ summary must be non-empty");
+  if (!Array.isArray(result.evidence_refs) || result.evidence_refs.some((ref) => typeof ref !== "string")) throw evaluatorError("evaluator_result_invalid", "Evaluator+ evidence_refs must be an array of strings");
+  if (typeof result.created_at !== "string" || !DATE_TIME.test(result.created_at) || Number.isNaN(Date.parse(result.created_at))) throw evaluatorError("evaluator_result_invalid", "Evaluator+ created_at must be an RFC 3339 date-time");
+}
+
+export function aggregateEvaluatorVerdict(criteria) {
+  if (!Array.isArray(criteria)) throw evaluatorError("evaluator_result_invalid", "Evaluator+ criteria must be an array");
+  if (criteria.some((criterion) => criterion.verdict === "FAIL")) return "FAIL";
+  if (criteria.some((criterion) => criterion.verdict === "INDETERMINATE")) return "INDETERMINATE";
+  return "PASS";
+}
+
+function validateCriterionShape(criterion) {
+  if (!criterion || typeof criterion !== "object" || Array.isArray(criterion)) throw evaluatorError("evaluator_result_invalid", "Evaluator+ criterion entries must be objects");
+  rejectUnknownProperties(criterion, new Set(["id", "scope", "verdict", "summary", "evidence_refs"]), "Evaluator+ criterion");
+  if (typeof criterion.id !== "string" || !criterion.id.trim()) throw evaluatorError("evaluator_result_invalid", "Evaluator+ criterion id must be non-empty");
+  if (criterion.scope !== "product_quality") throw evaluatorError("evaluator_result_invalid", `Evaluator+ criterion ${criterion.id} is not product_quality`);
+  if (!VERDICTS.has(criterion.verdict)) throw evaluatorError("evaluator_result_invalid", `Evaluator+ criterion ${criterion.id} has an invalid verdict`);
+  if (typeof criterion.summary !== "string" || !criterion.summary.trim()) throw evaluatorError("evaluator_result_invalid", `Evaluator+ criterion ${criterion.id} summary must be non-empty`);
+  if (!Array.isArray(criterion.evidence_refs) || criterion.evidence_refs.some((ref) => typeof ref !== "string")) throw evaluatorError("evaluator_result_invalid", `Evaluator+ criterion ${criterion.id} evidence_refs must be an array of strings`);
+}
+
+/**
+ * Validate an Evaluator+ result. Without a quality baseline the v1.7 legacy
+ * result contract remains valid. With a baseline, every product-quality
+ * criterion must be covered exactly once and the aggregate is deterministic.
+ */
+export function validateEvaluatorResult(result, { qualityBaseline = null, expectedCandidateFingerprint = null } = {}) {
+  requireBaseResult(result);
+  if (!qualityBaseline) {
+    if (result.criteria !== undefined) {
+      if (!Array.isArray(result.criteria)) throw evaluatorError("evaluator_result_invalid", "Evaluator+ criteria must be an array");
+      for (const criterion of result.criteria) validateCriterionShape(criterion);
+    }
+    return { valid: true, legacy: true, verdict: result.verdict, result };
+  }
+
+  const baseline = qualityBaseline.manifest ?? qualityBaseline;
+  const validatedBaseline = validateQualityBaselineManifest(baseline);
+  const expectedBaselineFingerprint = validatedBaseline.fingerprint;
+  if (qualityBaseline.fingerprint !== undefined && qualityBaseline.fingerprint !== expectedBaselineFingerprint) {
+    throw evaluatorError("evaluator_quality_baseline_mismatch", "loaded Quality Baseline fingerprint does not match its canonical content");
+  }
+  if (result.quality_baseline_fingerprint !== expectedBaselineFingerprint) {
+    throw evaluatorError("evaluator_quality_baseline_mismatch", "Evaluator+ result quality baseline fingerprint does not match the approved contract");
+  }
+  if (typeof expectedCandidateFingerprint !== "string" || !expectedCandidateFingerprint.trim()) {
+    throw evaluatorError("evaluator_candidate_binding_missing", "Quality Contract Evaluator+ validation requires an expected candidate fingerprint");
+  }
+  if (result.candidate_fingerprint !== expectedCandidateFingerprint) {
+    throw evaluatorError("evaluator_candidate_fingerprint_mismatch", "Evaluator+ result candidate fingerprint does not match the approved candidate");
+  }
+
+  const { product_quality: expectedCriteria, delivery_closure: deliveryCriteria } = qualityCriteriaByScope(baseline);
+  if (!Array.isArray(result.criteria)) throw evaluatorError("evaluator_result_invalid", "Quality Contract Evaluator+ result must include criteria");
+  const expectedById = new Map(expectedCriteria.map((criterion) => [criterion.id, criterion]));
+  const deliveryIds = new Set(deliveryCriteria.map((criterion) => criterion.id));
+  const seen = new Set();
+  for (const criterion of result.criteria) {
+    validateCriterionShape(criterion);
+    if (seen.has(criterion.id)) throw evaluatorError("evaluator_result_invalid", `duplicate Evaluator+ criterion: ${criterion.id}`);
+    seen.add(criterion.id);
+    if (deliveryIds.has(criterion.id)) throw evaluatorError("evaluator_result_invalid", `delivery_closure criterion was sent to Evaluator+: ${criterion.id}`);
+    if (!expectedById.has(criterion.id)) throw evaluatorError("evaluator_result_invalid", `unexpected product_quality criterion: ${criterion.id}`);
+  }
+  for (const criterion of expectedCriteria) {
+    if (!seen.has(criterion.id)) throw evaluatorError("evaluator_result_invalid", `missing product_quality criterion: ${criterion.id}`);
+  }
+  const aggregate = aggregateEvaluatorVerdict(result.criteria);
+  if (result.verdict !== aggregate) throw evaluatorError("evaluator_result_invalid", `Evaluator+ aggregate verdict must be ${aggregate}`);
+  return {
+    valid: true,
+    legacy: false,
+    verdict: aggregate,
+    quality_baseline_fingerprint: expectedBaselineFingerprint,
+    product_quality_criteria: result.criteria,
+    excluded_delivery_closure_ids: deliveryCriteria.map((criterion) => criterion.id),
+    result,
+  };
+}
+
+function validateClosureCriterion(criterion, expectedScope = "delivery_closure") {
+  if (!criterion || typeof criterion !== "object" || Array.isArray(criterion)) throw evaluatorError("delivery_closure_invalid", "delivery closure criteria must be objects");
+  const allowed = new Set(["id", "scope", "verdict", "summary", "evidence_refs"]);
+  for (const key of Object.keys(criterion)) if (!allowed.has(key)) throw evaluatorError("delivery_closure_invalid", `delivery closure criterion contains unknown property: ${key}`);
+  if (typeof criterion.id !== "string" || !criterion.id.trim()) throw evaluatorError("delivery_closure_invalid", "delivery closure criterion id must be non-empty");
+  if (criterion.scope !== expectedScope) throw evaluatorError("delivery_closure_invalid", `delivery closure criterion ${criterion.id} has the wrong scope`);
+  if (!VERDICTS.has(criterion.verdict)) throw evaluatorError("delivery_closure_invalid", `delivery closure criterion ${criterion.id} has an invalid verdict`);
+  if (typeof criterion.summary !== "string" || !criterion.summary.trim()) throw evaluatorError("delivery_closure_invalid", `delivery closure criterion ${criterion.id} summary must be non-empty`);
+  if (!Array.isArray(criterion.evidence_refs) || criterion.evidence_refs.some((ref) => typeof ref !== "string")) throw evaluatorError("delivery_closure_invalid", `delivery closure criterion ${criterion.id} evidence_refs must be an array of strings`);
+}
+
+/** Validate the separate delivery-closure criterion record. */
+export function validateDeliveryClosureCriteria(qualityBaseline, results) {
+  const baseline = qualityBaseline?.manifest ?? qualityBaseline;
+  const validatedBaseline = validateQualityBaselineManifest(baseline);
+  const expected = qualityCriteriaByScope(baseline).delivery_closure;
+  if (!Array.isArray(results)) throw evaluatorError("delivery_closure_invalid", "delivery closure results must be an array");
+  const expectedIds = new Set(expected.map((criterion) => criterion.id));
+  const seen = new Set();
+  for (const result of results) {
+    validateClosureCriterion(result);
+    if (seen.has(result.id)) throw evaluatorError("delivery_closure_invalid", `duplicate delivery closure criterion: ${result.id}`);
+    seen.add(result.id);
+    if (!expectedIds.has(result.id)) throw evaluatorError("delivery_closure_invalid", `unexpected delivery closure criterion: ${result.id}`);
+  }
+  for (const criterion of expected) {
+    if (!seen.has(criterion.id)) throw evaluatorError("delivery_closure_invalid", `missing delivery closure criterion: ${criterion.id}`);
+  }
+  const verdict = aggregateEvaluatorVerdict(results);
+  if (qualityBaseline?.fingerprint !== undefined && qualityBaseline.fingerprint !== validatedBaseline.fingerprint) {
+    throw evaluatorError("delivery_closure_invalid", "loaded Quality Baseline fingerprint does not match its canonical content");
+  }
+  return {
+    valid: true,
+    verdict,
+    can_deliver: verdict === "PASS",
+    quality_baseline_fingerprint: validatedBaseline.fingerprint,
+    criteria: results,
+  };
+}
+
+export { VERDICTS };
+
+function cliError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function parseArgs(argv) {
+  const args = { mode: null, project: process.cwd(), baseline: null, result: null, expectedCandidateFingerprint: null };
+  for (let index = 0; index < argv.length; index += 1) {
+    const flag = argv[index];
+    if (flag === "--help" || flag === "-h") {
+      process.stdout.write("Usage: node runtime/triad-evaluator-validate.mjs --mode <baseline|evaluator|delivery> --baseline <path> [--result <path>] [--project <root>] [--expected-candidate-fingerprint <sha256>]\n");
+      return null;
+    }
+    const key = {
+      "--mode": "mode",
+      "--project": "project",
+      "--baseline": "baseline",
+      "--result": "result",
+      "--expected-candidate-fingerprint": "expectedCandidateFingerprint",
+    }[flag];
+    if (!key) throw cliError("quality_contract_cli_invalid", `unknown option: ${flag}`);
+    const value = argv[index + 1];
+    if (!value || value.startsWith("--")) throw cliError("quality_contract_cli_invalid", `${flag} requires a value`);
+    args[key] = value;
+    index += 1;
+  }
+  if (!args.mode || !["baseline", "evaluator", "delivery"].includes(args.mode)) throw cliError("quality_contract_cli_invalid", "--mode must be baseline, evaluator, or delivery");
+  if (args.mode !== "baseline" && !args.result) throw cliError("quality_contract_cli_invalid", "--result is required");
+  if ((args.mode === "baseline" || args.mode === "delivery") && !args.baseline) throw cliError("quality_contract_cli_invalid", `--baseline is required for ${args.mode} validation`);
+  return args;
+}
+
+async function readJsonFile(root, value, label) {
+  const target = path.isAbsolute(value) ? value : path.resolve(root, value);
+  let source;
+  try {
+    source = await readFile(target, "utf8");
+  } catch (error) {
+    throw cliError("quality_contract_cli_invalid", `${label} cannot be read: ${error.message}`);
+  }
+  try {
+    return JSON.parse(source);
+  } catch (error) {
+    throw cliError("quality_contract_cli_invalid", `${label} is not valid JSON: ${error.message}`);
+  }
+}
+
+/**
+ * Explicit control-plane entry point. It reloads the baseline from disk on
+ * every invocation so Evaluator+ and delivery closure cannot rely on a stale
+ * manifest/source check performed earlier in the run.
+ */
+async function runCli() {
+  const args = parseArgs(process.argv.slice(2));
+  if (!args) return;
+  const projectRoot = await realpath(args.project);
+  const qualityBaseline = args.baseline
+    ? await loadQualityBaseline(args.baseline, { projectRoot })
+    : null;
+  if (args.mode === "baseline") {
+    process.stdout.write(`${JSON.stringify({
+      valid: true,
+      mode: "baseline",
+      quality_baseline_fingerprint: qualityBaseline.fingerprint,
+      sources: qualityBaseline.sources,
+    })}\n`);
+    return;
+  }
+  if (args.mode === "evaluator") {
+    const result = await readJsonFile(projectRoot, args.result, "Evaluator+ result");
+    if (qualityBaseline && (!args.expectedCandidateFingerprint || !SHA256.test(args.expectedCandidateFingerprint))) {
+      throw cliError("evaluator_candidate_binding_missing", "Quality Contract Evaluator+ validation requires --expected-candidate-fingerprint");
+    }
+    const validated = validateEvaluatorResult(result, {
+      qualityBaseline,
+      expectedCandidateFingerprint: qualityBaseline ? args.expectedCandidateFingerprint : null,
+    });
+    process.stdout.write(`${JSON.stringify({
+      valid: true,
+      mode: "evaluator",
+      legacy: validated.legacy,
+      verdict: validated.verdict,
+      quality_baseline_fingerprint: validated.quality_baseline_fingerprint ?? null,
+      candidate_fingerprint: result.candidate_fingerprint,
+      product_quality_criteria: validated.product_quality_criteria ?? null,
+    })}\n`);
+    return;
+  }
+
+  const results = await readJsonFile(projectRoot, args.result, "delivery closure results");
+  const validated = validateDeliveryClosureCriteria(qualityBaseline, results);
+  process.stdout.write(`${JSON.stringify({
+    valid: true,
+    mode: "delivery",
+    verdict: validated.verdict,
+    can_deliver: validated.can_deliver,
+    quality_baseline_fingerprint: validated.quality_baseline_fingerprint,
+    criteria: validated.criteria,
+  })}\n`);
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  runCli().catch((error) => {
+    process.stdout.write(`${JSON.stringify({ valid: false, error: { code: error.code ?? "quality_contract_cli_invalid", message: error.message } })}\n`);
+    process.exitCode = 2;
+  });
+}

package/runtime/triad-verify.mjs

@@ -6,7 +6,9 @@ import { fileURLToPath } from "node:url";
 import { writeAtomicJson } from "./lib/evidence.mjs";
 import { calculateCandidateFingerprint, collectCandidateChanges, worktreeBranch } from "./lib/fingerprint.mjs";
 import { executeGates, gateSelectionEvidence, loadTrustedGates, resolveGateSelection } from "./lib/gates.mjs";
+import { resolveQualityContract } from "./lib/quality-baseline.mjs";
 import { evaluateScopeContract, parseScopeContract } from "./lib/scope-contract.mjs";
+import { resolveAssignmentContext, validateAssignmentPacket } from "./lib/assignment-packet.mjs";
 
 const argv = process.argv.slice(2);
 const option = (name) => {
@@ -24,6 +26,10 @@ function sha256(value) {
   return createHash("sha256").update(value).digest("hex");
 }
 
+function evidenceFingerprint(value) {
+  return typeof value === "string" && /^[a-f0-9]{64}$/i.test(value) ? value : null;
+}
+
 async function sha256File(value) {
   return sha256(await readFile(value));
 }
@@ -65,7 +71,7 @@ async function resolveAssignment(projectRoot, trigger, explicitAssignment) {
   return { assignmentPath, assignment: JSON.parse(source), assignmentHash: sha256(source) };
 }
 
-async function buildInvalidEvidence({ runId, trigger, assignment, reason, outputPath, failureCode = "verification_context_invalid", gateSelection = null }) {
+async function buildInvalidEvidence({ runId, trigger, assignment, reason, outputPath, failureCode = "verification_context_invalid", gateSelection = null, qualityBaselineFingerprint = null, assignmentPacket = null }) {
   const evidence = {
     schema_version: 1,
     run_id: runId,
@@ -77,9 +83,13 @@ async function buildInvalidEvidence({ runId, trigger, assignment, reason, output
     baseline: {
       prd_sha256: assignment?.expected_prd_sha256 ?? null,
       card_sha256: assignment?.expected_card_sha256 ?? null,
+      quality_baseline_fingerprint: evidenceFingerprint(qualityBaselineFingerprint ?? assignment?.expected_quality_baseline_fingerprint),
       git_head: null,
       candidate_fingerprint: null,
     },
+    assignment_packet: assignmentPacket ?? (assignment?.assignment_packet_path || assignment?.assignment_packet_sha256
+      ? { path: assignment.assignment_packet_path ?? null, sha256: assignment.assignment_packet_sha256 ?? null }
+      : null),
     gates: [],
     required_gates_passed: false,
     status: "invalid_context",
@@ -147,6 +157,8 @@ async function main() {
   let assignmentPath;
   let outputPath;
   let gateSelection = null;
+  let qualityBaseline = null;
+  let assignmentPacket = null;
   try {
     let assignmentHash;
     ({ assignmentPath, assignment, assignmentHash } = await resolveAssignment(projectRoot, trigger, option("--assignment")));
@@ -160,12 +172,20 @@ async function main() {
     if (!assignment.assignment_id) throw new Error("assignment ID is required");
     if (assignment.agent_id !== trigger.agent_id || assignment.agent_type !== "triad_developer") throw new Error("developer assignment does not match trigger");
     if ((await realpath(path.resolve(assignment.project_root ?? projectRoot))) !== projectRoot) throw new Error("assignment project root mismatch");
-    const worktree = await realpath(path.resolve(projectRoot, assignment.worktree));
-    if (!worktree.startsWith(`${projectRoot}${path.sep}`) && !assignment.allow_external_worktree) throw new Error("undeclared external worktree");
+    const assignmentContext = await resolveAssignmentContext(assignment, { projectRoot });
+    const worktree = assignmentContext.worktree;
     const prdPath = path.resolve(projectRoot, assignment.prd_path ?? "artifacts/prd.md");
     const cardPath = path.resolve(projectRoot, assignment.card_path);
     await access(prdPath);
     await access(cardPath);
+    // The packet is an immutable, shared assignment contract. Validate its
+    // binding before skills, scope, or expensive gates so a stale packet is
+    // reported as invalid context and consumes no retry budget.
+    assignmentPacket = await validateAssignmentPacket(assignment, projectRoot);
+    // Resolve the optional immutable Quality Contract before any baseline or
+    // expensive-gate check so a bound source drift keeps its precise failure
+    // classification (including when the source is the PRD itself).
+    qualityBaseline = await resolveQualityContract(assignment, projectRoot);
     if ((await sha256File(prdPath)) !== assignment.expected_prd_sha256) throw new Error("PRD baseline hash mismatch");
     if ((await sha256File(cardPath)) !== assignment.expected_card_sha256) throw new Error("feature card hash mismatch");
     const repositorySkills = await validateRepositorySkills(assignment.required_repository_skills, worktree);
@@ -203,11 +223,13 @@ async function main() {
         baseline: {
           prd_sha256: assignment.expected_prd_sha256,
           card_sha256: assignment.expected_card_sha256,
+          quality_baseline_fingerprint: qualityBaseline?.fingerprint ?? null,
           gates_sha256: null,
           git_head: before.git_head,
           candidate_fingerprint: before.value,
           branch,
         },
+        assignment_packet: assignmentPacket,
         repository_skills: repositorySkills,
         scope,
         gates: [],
@@ -237,13 +259,15 @@ async function main() {
       trigger,
       assignment_ref: path.relative(projectRoot, assignmentPath),
       baseline: {
-        prd_sha256: assignment.expected_prd_sha256,
-        card_sha256: assignment.expected_card_sha256,
-        gates_sha256: trusted.actualHash,
+          prd_sha256: assignment.expected_prd_sha256,
+          card_sha256: assignment.expected_card_sha256,
+          quality_baseline_fingerprint: qualityBaseline?.fingerprint ?? null,
+          gates_sha256: trusted.actualHash,
         git_head: before.git_head,
         candidate_fingerprint: before.value,
         branch,
       },
+      assignment_packet: assignmentPacket,
       repository_skills: repositorySkills,
       scope,
       gate_selection: gateSelectionEvidence(gateSelection),
@@ -269,7 +293,9 @@ async function main() {
       reason: error.message,
       outputPath,
       failureCode: error.code ?? "verification_context_invalid",
-      gateSelection
+      gateSelection,
+      qualityBaselineFingerprint: qualityBaseline?.fingerprint ?? null,
+      assignmentPacket,
     });
     process.stdout.write(`${JSON.stringify({ run_id: runId, status: evidence.status, evidence: outputPath ?? null })}\n`);
     process.exitCode = 3;

package/schemas/evaluator-plus-result.schema.json

@@ -8,9 +8,25 @@
     "schema_version": { "const": 1 },
     "feature_id": { "type": "string", "minLength": 1 },
     "candidate_fingerprint": { "type": "string", "minLength": 1 },
+    "quality_baseline_fingerprint": { "type": "string", "pattern": "^[a-fA-F0-9]{64}$" },
     "verdict": { "enum": ["PASS", "FAIL", "INDETERMINATE"] },
     "summary": { "type": "string", "minLength": 1 },
     "evidence_refs": { "type": "array", "items": { "type": "string" } },
+    "criteria": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "scope", "verdict", "summary", "evidence_refs"],
+        "properties": {
+          "id": { "type": "string", "minLength": 1 },
+          "scope": { "const": "product_quality" },
+          "verdict": { "enum": ["PASS", "FAIL", "INDETERMINATE"] },
+          "summary": { "type": "string", "minLength": 1 },
+          "evidence_refs": { "type": "array", "items": { "type": "string" } }
+        },
+        "additionalProperties": false
+      }
+    },
     "created_at": { "type": "string", "format": "date-time" }
   },
   "additionalProperties": false

package/schemas/quality-baseline.schema.json

@@ -0,0 +1,42 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://triad.engineering/schemas/quality-baseline.schema.json",
+  "title": "Triad immutable Quality Baseline",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "id", "revision", "sources", "criteria", "fingerprint"],
+  "properties": {
+    "schema_version": { "const": 1 },
+    "id": { "type": "string", "minLength": 1 },
+    "revision": { "type": "integer", "minimum": 1 },
+    "sources": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "role", "path", "sha256"],
+        "properties": {
+          "id": { "type": "string", "minLength": 1 },
+          "role": { "type": "string", "minLength": 1 },
+          "path": { "type": "string", "minLength": 1, "pattern": "^(?![\\\\/])(?!.*(?:^|[\\\\/])\\.\\.(?:[\\\\/]|$)).+" },
+          "sha256": { "type": "string", "pattern": "^[a-fA-F0-9]{64}$" }
+        }
+      }
+    },
+    "criteria": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "scope", "requirement"],
+        "properties": {
+          "id": { "type": "string", "minLength": 1 },
+          "scope": { "enum": ["product_quality", "delivery_closure"] },
+          "requirement": { "type": "string", "minLength": 1 }
+        }
+      }
+    },
+    "fingerprint": { "type": "string", "pattern": "^[a-fA-F0-9]{64}$" }
+  }
+}

package/schemas/verification-evidence.schema.json

@@ -12,7 +12,15 @@
     "assignment_id": { "type": ["string", "null"] },
     "assignment_sha256": { "type": ["string", "null"] },
     "trigger": { "type": "object", "required": ["event", "agent_id", "agent_type"], "properties": { "event": { "type": "string" }, "agent_id": { "type": ["string", "null"] }, "agent_type": { "type": ["string", "null"] } } },
-    "baseline": { "type": "object", "required": ["prd_sha256", "card_sha256", "git_head", "candidate_fingerprint"], "properties": { "prd_sha256": { "type": ["string", "null"] }, "card_sha256": { "type": ["string", "null"] }, "git_head": { "type": ["string", "null"] }, "candidate_fingerprint": { "type": ["string", "null"] }, "branch": { "type": ["string", "null"] } } },
+    "baseline": { "type": "object", "required": ["prd_sha256", "card_sha256", "git_head", "candidate_fingerprint"], "properties": { "prd_sha256": { "type": ["string", "null"] }, "card_sha256": { "type": ["string", "null"] }, "quality_baseline_fingerprint": { "type": ["string", "null"], "pattern": "^[a-fA-F0-9]{64}$" }, "git_head": { "type": ["string", "null"] }, "candidate_fingerprint": { "type": ["string", "null"] }, "branch": { "type": ["string", "null"] } } },
+    "assignment_packet": {
+      "type": ["object", "null"],
+      "required": ["path", "sha256"],
+      "properties": {
+        "path": { "type": ["string", "null"] },
+        "sha256": { "type": ["string", "null"], "pattern": "^[a-fA-F0-9]{64}$" }
+      }
+    },
     "scope": {
       "type": "object",
       "properties": {

package/skills/triad-loop-bootstrap/SKILL.md

@@ -13,13 +13,36 @@ Collect only missing essentials: project ID/title, readable PRD source, target
 repositories with base/project branches and worktrees, measurable success
 conditions, runnable quality gates, practical-test need, and integration need.
 
+## Native BMAD planning boundary
+
+When the owner input is a native BMAD `epics.md` artifact, BMAD is the
+planning authority for Epic/Story boundaries and acceptance criteria. The
+canonical Stories in that read-only artifact are the sole planning boundaries:
+one canonical Story maps to one normal Triad Card. Bootstrap must not independently
+re-decompose the PRD into another feature-card plan, create a second Story set,
+or invoke an LLM to decide native Story boundaries. The native flow is
+BMAD `epics.md` → canonical Stories → Triad Cards; the generic PRD-only
+feature-plan step below does not apply to that input. Triad remains execution
+authority after the planning handoff.
+
 1. Create `<control-repository>/projects/<project-id>/`.
 2. Copy `assets/project.yaml` to `project.yaml`; register only declared product
    repositories, branches, and worktrees.
 3. Copy the approved PRD to `artifacts/prd.md`; record source, collection time,
    snapshot, revision when available, and SHA-256.
-4. Copy `assets/loop-template/` to `.loop/`, then create bounded feature cards
-   under `features/` and a complete `feature-plan.md`.
+4. Copy `assets/loop-template/` to `.loop/`. For ordinary PRD-only input,
+   create bounded feature cards under `features/` and a complete
+   `feature-plan.md`. For native BMAD input, ingest the canonical Stories and
+   materialize one normal Card per Story instead; do not perform a second
+   semantic decomposition.
+   When an owner-approved Quality Bar or additional intent/architecture source
+   exists, copy `assets/loop-template/quality-baseline.json`, fill only the
+   declared source hashes and criteria, compute its canonical fingerprint, and
+   bind `project.quality_contract.baseline` plus `fingerprint`. Use
+   `criteria: []` when no machine-readable Quality Bar was supplied; never
+   invent criteria. The manifest is immutable for the run and a requirement
+   change creates a new revision/rebaseline event rather than editing it in
+   place.
 5. Replace every gate placeholder. Gate executors in v1 are only
    `control-plane`; remove a non-applicable gate with a recorded reason instead
    of declaring manual or MCP execution.
@@ -39,10 +62,30 @@ conditions, runnable quality gates, practical-test need, and integration need.
 The normal state route is `draft → ready → in_progress → verifying → in_review
 → approved|rework|blocked`. The Orchestrator owns those records. Before each
 Developer dispatch, write an active assignment with a unique assignment ID,
-feature, attempt, expected branch, worktree, PRD/card/gate hashes, and verifier
-run ID. The verifier produces environment-derived evidence; it never changes
+   feature, repository ID, attempt, expected branch, worktree, PRD/card/gate
+   hashes, and verifier run ID. Populate only the packet's bounded `context`
+   fields (relevant excerpts, acceptance, verification mapping, touch points,
+   constraints, risks, and prior evidence). Then create its immutable Assignment Packet and bind the returned path
+and SHA-256 in that assignment:
+
+```bash
+node .triad-runtime/triad-assignment-packet.mjs \
+  --project /absolute/path/to/control-workspace \
+  --assignment .loop/runtime/assignments/<assignment-file>.json
+```
+
+The command returns JSON containing the packet path and the dispatch context;
+launch the delegated role with `dispatch.cwd` set to the declared product
+worktree. The verifier produces environment-derived evidence; it never changes
 card state.
 
+The control workspace and product worktree may be separate directories. An
+external worktree is authorized by an exact repository mapping in
+`project.yaml` (`repositories[].worktree`, falling back to `path`), not by an
+assignment escape hatch. A mapped external worktree is valid even when the
+legacy `allow_external_worktree` field is absent or false; an unmapped external
+path fails closed before dispatch or gate execution.
+
 Use local worktrees for enabled multi-repository integration and declare a final
 integration card. Do not publish packages, alter registry versions, or create a
 release as a bootstrap/integration step. Re-baseline only after an explicit owner

package/skills/triad-loop-bootstrap/assets/loop-template/handoff-report.template.md

@@ -22,6 +22,19 @@
 
 - Evidence/review chain: `<verification/review/evaluator references>`
 
+## Quality Contract closure
+
+- Quality Baseline: `<path, revision, fingerprint or legacy PRD-only mode>`
+- Product-quality Evaluator+ verdict: `<PASS|FAIL|INDETERMINATE|not configured>`
+
+| Criterion | Scope | Verdict | Evidence references |
+| --- | --- | --- | --- |
+| `<delivery criterion ID>` | `delivery_closure` | `<PASS|FAIL|INDETERMINATE>` | `<refs>` |
+
+Delivery is `delivered` only when every configured `delivery_closure` criterion
+is recorded as `PASS`. Product-quality criteria are evaluated by the fresh
+Evaluator+ packet and are never silently evaluated during delivery closure.
+
 ## Local-worktree integration
 
 | Card | Consumer worktree | Provider worktree | Branch/commit map | Setup command | Data/event/callback gate |

package/skills/triad-loop-bootstrap/assets/loop-template/quality-baseline.json

@@ -0,0 +1,15 @@
+{
+  "schema_version": 1,
+  "id": "REPLACE_ME_QUALITY_BASELINE_ID",
+  "revision": 1,
+  "sources": [
+    {
+      "id": "prd",
+      "role": "intent",
+      "path": "artifacts/prd.md",
+      "sha256": "REPLACE_ME_SHA256"
+    }
+  ],
+  "criteria": [],
+  "fingerprint": "REPLACE_ME_SHA256"
+}

package/skills/triad-loop-bootstrap/assets/loop-template/run-state.yaml

@@ -7,9 +7,16 @@ delivery:
   handoff: null
   branches: []
   evaluator_report: null
+  quality_criteria: [] # delivery_closure results; product_quality stays in Evaluator+
   delivered_at: null
   owner_message: null
 
+quality_contract:
+  baseline: null
+  fingerprint: null
+  revision: null
+  rebaseline_events: []
+
 feature_plan:
   path: feature-plan.md
   status: declared

package/skills/triad-loop-bootstrap/assets/loop-template/runtime/assignments/assignment.template.json

@@ -7,6 +7,7 @@
   "feature_id": "REPLACE_ME_FEATURE_ID",
   "attempt": 1,
   "project_root": "REPLACE_ME_ABSOLUTE_CONTROL_WORKSPACE",
+  "repository_id": "REPLACE_ME_REPOSITORY_ID",
   "worktree": "REPLACE_ME_DECLARED_WORKTREE_OR_ABSOLUTE_PATH",
   "expected_branch": "REPLACE_ME_PROJECT_BRANCH",
   "allow_external_worktree": false,
@@ -16,6 +17,8 @@
   "expected_prd_sha256": "REPLACE_ME_SHA256",
   "expected_card_sha256": "REPLACE_ME_SHA256",
   "expected_gates_sha256": "REPLACE_ME_SHA256",
+  "quality_baseline_path": null,
+  "expected_quality_baseline_fingerprint": null,
   "required_gate_ids": [],
   "scope_contract": null,
   "required_repository_skills": [
@@ -29,5 +32,17 @@
     }
   ],
   "verification_run_id": "REPLACE_ME_UUID",
-  "evidence_directory": ".loop/evidence/REPLACE_ME_FEATURE_ID/attempt-001"
+  "evidence_directory": ".loop/evidence/REPLACE_ME_FEATURE_ID/attempt-001",
+  "assignment_packet_path": null,
+  "assignment_packet_sha256": null,
+  "context": {
+    "relevant_prd_excerpts": [],
+    "relevant_adr_excerpts": [],
+    "acceptance_criteria": [],
+    "verification_mapping": [],
+    "expected_paths": [],
+    "constraints": [],
+    "risks": [],
+    "previous_evidence": []
+  }
 }

package/skills/triad-loop-bootstrap/assets/project.yaml

@@ -12,6 +12,11 @@ project:
     snapshot: artifacts/prd.md
     sha256: null
     source_revision: null
+  quality_contract:
+    # Optional immutable target for v1.8 projects. Leave both values null for
+    # legacy PRD-only behavior; bootstrap fills them only from declared sources.
+    baseline: null # artifacts/quality-baseline.json
+    fingerprint: null
   loop: .loop
   control_plane:
     verification: optional