manual-bbの失敗修正とreadiness入力仕様の確定

[RNA4219]

manual-bbで確認したbaseline誤参照、抑制YAMLと不正期限、policy入力検証、readiness IDとwarn_only、emit/SARIF、help、Viewerのversion表示を修正します。関連するfilter_low=falseの評価漏れも修正し、元の105ケースへ対照を追加しました。

未確定だったpartial_warning_thresholdは、v1に欠落割合の分子・母数がないため予約設定と仕様化します。completenessとallow_partialによる判定を12組合せで検証し、READMEのimport→analyze→export手順とrename表現も同期しました。artifact schemaは変更していません。

検証結果:

• manual-bb: 105/105成功、失敗0、保留0。native standard GateはGo（P0/P1・必須観点100%）。元10件と関連1件の不具合を解消。
• 全体3,859件、Tree-sitter 63件、保守15件成功。通常テストの既存skip 4件。
• 通常coverage: Statements 88.74%、Branches 80.60%、Functions 94.86%、Lines 89.66%。
• 変更行coverage: 185/205行、90.24%。追加1,049件成功・skip 1。
• build/lint/typecheck、fresh tgzインストールを含むpackage smoke、文書参照・配布状態・roadmap・Birdseyeが成功。
• 実ブラウザで検索0/1件、詳細展開、Graph/Test Seeds、ヘッダー・フッターの同一versionを確認。

検収記録: docs/acceptance/AC-20260911-05-manual-bb-fixes.md。Windowsローカル・非LLM主要フローのagentによる検収です。公開versionは1.6.0を維持し、変更はUnreleasedに記録します。Birdseyeの生成ID更新によりcapsule群も再生成しています。

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-11T10:13:01.187809Z	190a716	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 190a716427

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pass the actual producer version to the SARIF reporter

When analyze runs with its default output, --emit all, or --emit sarif, this invokes a reporter whose version is hard-coded to 0.1.0 in src/reporters/sarif-reporter.ts, so results.sarif advertises a different producer version from the accompanying findings and audit artifacts (currently 1.6.0). This gives version-aware code-scanning and provenance consumers incorrect metadata; pass reportedFindings.tool.version/the CLI version through to the reporter instead.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Canonicalize volatile SARIF fields before recording stable_hash

Adding results.sarif to generated causes buildGeneratedArtifactRefs to publish a stable_hash for it, but canonicalizeForStableHash only parses files ending in .json; for .sarif it uses line filtering that does not remove the reporter's startTimeUtc, endTimeUtc, or properties.runId. Consequently two otherwise identical analyses produce different stable hashes for this newly emitted-by-default artifact, defeating the audit hash's deterministic-comparison purpose. Handle SARIF as JSON and remove its volatile equivalents before hashing.

Useful? React with 👍 / 👎.

[github-actions]

code-to-gate PR Review

Gate Verdict

• Status: needs_review
• Readiness: passed
• Findings: 3 total, 0 critical, 0 high

Blocking Reasons

• No blocking reason was found.

Acceptable Risks

• [info] Readiness verdict is passed: All policy conditions met, release ready
• [info] No unsupported claims are present: LLM or imported claims that lack evidence are not present in findings.unsupported_claims.
• [info] Public docs, CLI, schema, and schema coverage are aligned: 8 spec drift checks passed without failures.

Suggested Tests

• [medium] Run src/tests/cli-all.test.ts: Test path matched changed source path. Command: npm test -- src/tests/cli-all.test.ts Source: test-plan-001, src/cli.ts
• [medium] Run src/tests/performance/analyze-performance.test.ts: Test path matched changed source path. Command: npm test -- src/tests/performance/analyze-performance.test.ts Source: test-plan-002, src/cli/analyze.ts
• [medium] Run src/tests/smoke/cli-smoke.test.ts: Test path matched changed source path. Command: npm test -- src/tests/smoke/cli-smoke.test.ts Source: test-plan-003, src/cli.ts
• [high] Run src/cli/tests/analyze-imports-security.test.ts: Test path matched changed source path. Command: npm test -- src/cli/tests/analyze-imports-security.test.ts Source: test-plan-004, src/cli.ts, src/cli/analyze.ts
• [high] Run src/cli/tests/analyze.test.ts: Test path matched changed source path. Command: npm test -- src/cli/tests/analyze.test.ts Source: test-plan-005, src/cli.ts, src/cli/tests/analyze.test.ts, src/cli/analyze.ts
• [medium] Run src/cli/tests/assurance.test.ts: Test path matched changed source path. Command: npm test -- src/cli/tests/assurance.test.ts Source: test-plan-006, src/cli.ts
• [medium] Run src/cli/tests/baseline-ledger.test.ts: Test path matched changed source path. Command: npm test -- src/cli/tests/baseline-ledger.test.ts Source: test-plan-007, src/cli.ts
• [high] Run src/cli/tests/cli-help.test.ts: Test path matched changed source path. Command: npm test -- src/cli/tests/cli-help.test.ts Source: test-plan-008, src/cli.ts, src/cli/tests/cli-help.test.ts
• [medium] Run src/cli/tests/diff-completeness.test.ts: Test path matched changed source path. Command: npm test -- src/cli/tests/diff-completeness.test.ts Source: test-plan-009, src/cli.ts
• [medium] Run src/cli/tests/diff-deletion.test.ts: Test path matched changed source path. Command: npm test -- src/cli/tests/diff-deletion.test.ts Source: test-plan-010, src/cli.ts
• [high] Define expected behavior for src/config/policy-types.ts and add a focused regression or manual black-box check.: No related automated test was found for this changed source file. Source: oracle-gap-001, src/config/policy-types.ts
• [high] Define expected behavior for src/viewer/report-sections.ts and add a focused regression or manual black-box check.: No related automated test was found for this changed source file. Source: oracle-gap-002, src/viewer/report-sections.ts

Spec Drift

• No spec drift was found or no spec-drift artifact was provided.

Drift Budget

• No drift budget summary is available.

Evidence Links

• Release readiness: .qh/release-readiness.json schema: release-readiness@v1 hash: 1cc385fd3c119347
• Findings: .qh/findings.json schema: findings@v1 hash: bf06ee9c84dfe4bf
• Auto test plan: .qh/test-plan.json schema: test-plan@v1 hash: cc701f9e16399e5f
• Spec drift: .qh/spec-drift.json schema: spec-drift@v1 hash: 7f244c182d015027
• Evidence DAG: .qh/evidence-dag.json schema: evidence-dag@v1 hash: cc68161ed59a0d1e
• QEG evidence input: .qh/qeg-code-to-gate.json schema: ctg.qeg-input/v1 hash: a01efd46a3cd1aea
• Published quality report: https://github.com/RNA4219/code-to-gate/actions/runs/34587776276

Suppression / Baseline Summary

• No baseline summary is available.

Gate Explainability

• No gate explainability summary is available.

---

Generated by code-to-gate v1.6.0