beyondnetcode · beyondnetPeru · Aug 1, 2026 · Aug 1, 2026 · Aug 1, 2026 · Aug 1, 2026
@@ -21,14 +21,19 @@ const markdown = process.argv.includes("--markdown");
 
 const exists = (p) => fs.existsSync(path.join(root, p));
 const read = (p) => { try { return fs.readFileSync(path.join(root, p), "utf8"); } catch { return null; } };
+const skippedWalkDirs = new Set([".git", ".claude", ".mimocode", "node_modules", "dist", "build", "coverage"]);
+const looksLikePathReference = (ref) => ref.includes("/") || ref.endsWith(".rego") || ref.endsWith(".json");
 
-function walk(dir) {
+function walk(dir, seen = new Set()) {
   const files = [];
   const abs = path.join(root, dir);
   if (!fs.existsSync(abs)) return files;
+  const real = fs.realpathSync(abs);
+  if (seen.has(real)) return files;
+  seen.add(real);
   for (const entry of fs.readdirSync(abs, { withFileTypes: true })) {
     const rel = dir ? `${dir}/${entry.name}` : entry.name;
-    if (entry.isDirectory()) files.push(...walk(rel));
+    if (entry.isDirectory() && !skippedWalkDirs.has(entry.name)) files.push(...walk(rel, seen));
     else files.push(rel);
   }
   return files.sort();
@@ -118,8 +123,8 @@ function auditSdlc() {
   }
 
   // Check for structured phase/gate data (GT-280 resolution)
-  const phaseDataDir = "reference/core/sdlc/phases";
-  const gateDataDir = "reference/core/sdlc/gates";
+  const phaseDataDir = "reference/governance/sdlc/phases";
+  const gateDataDir = "reference/governance/sdlc/gates";
   const phaseJsonFiles2 = exists(phaseDataDir) ? walk(phaseDataDir).filter(f => f.endsWith(".json")) : [];
   const gateJsonFiles = exists(gateDataDir) ? walk(gateDataDir).filter(f => f.endsWith(".json")) : [];
 
@@ -141,7 +146,7 @@ function auditSdlc() {
       for (const art of (gate.requiredArtifacts || [])) {
         for (const rule of (art.rules || [])) {
           totalRegoRefs++;
-          if (!exists(rule)) allRegoRefsExist = false;
+          if (looksLikePathReference(rule) && !exists(rule)) allRegoRefsExist = false;
         }
       }
     } catch { /* skip invalid JSON */ }

@@ -11,8 +11,8 @@ import fs from "node:fs";
 import path from "node:path";
 
 const root = process.cwd();
-const phasesDir = "reference/core/sdlc/phases";
-const gatesDir = "reference/core/sdlc/gates";
+const phasesDir = "reference/governance/sdlc/phases";
+const gatesDir = "reference/governance/sdlc/gates";
 
 let exitCode = 0;
 const errors = [];
@@ -64,7 +64,12 @@ if (gateFiles.length === 0) {
   errors.push("No gate JSON files found");
 }
 
-const allRegoFiles = new Set();
+const allRuleRefs = new Set();
+const pathRuleRefs = new Set();
+
+function looksLikePathReference(ref) {
+  return ref.includes("/") || ref.endsWith(".rego") || ref.endsWith(".json");
+}
 
 for (const f of gateFiles) {
   const raw = fs.readFileSync(path.join(root, gatesDir, f), "utf8");
@@ -80,10 +85,13 @@ for (const f of gateFiles) {
           errors.push(`${f}: artifact "${art.artifact}" has no Rego rules`);
         }
         for (const rule of (art.rules || [])) {
-          if (!exists(rule)) {
+          if (typeof rule !== "string" || !rule.trim()) {
+            errors.push(`${f}: artifact "${art.artifact}" has an empty rule reference`);
+          } else if (looksLikePathReference(rule) && !exists(rule)) {
             errors.push(`${f}: artifact "${art.artifact}" references rego "${rule}" but file not found`);
           } else {
-            allRegoFiles.add(rule);
+            allRuleRefs.add(rule);
+            if (looksLikePathReference(rule)) pathRuleRefs.add(rule);
           }
         }
       }
@@ -109,7 +117,8 @@ if (errors.length > 0) {
   exitCode = 1;
 } else {
   console.log(`  ✅ All ${phaseFiles.length} phases and ${gateFiles.length} gates valid.`);
-  console.log(`     ${allRegoFiles.size} unique Rego files referenced — all exist.`);
+  console.log(`     ${allRuleRefs.size} unique rule reference(s) declared.`);
+  console.log(`     ${pathRuleRefs.size} path-like rule reference(s) checked on disk.`);
 }
 
 console.log();

@@ -485,16 +485,17 @@
         ".harness/scripts/ci/10-validate-contract-conformance.mjs",
         ".harness/scripts/validate-contract-conformance.test.mjs",
         "src/rulesets/contracts/evolith-machine-contracts.json",
+        "src/rulesets/contracts/fixtures/evolith-tracker-consumer.contract.json",
         "src/rulesets/contracts/README.md",
         ".github/workflows/docs.yml"
       ],
       "validationCommands": [
         "node --test .harness/scripts/validate-contract-conformance.test.mjs",
         "node .harness/scripts/ci/10-validate-contract-conformance.mjs",
-        "node .harness/scripts/ci/10-validate-contract-conformance.mjs --consumer ../evolith_tracker/contracts/evolith-core-contracts.json"
+        "node .harness/scripts/ci/10-validate-contract-conformance.mjs --consumer src/rulesets/contracts/fixtures/evolith-tracker-consumer.contract.json"
       ],
       "dependencyDisposition": "satisfied",
-      "dependencyRationale": "Evolith Tracker main commit 4256e7b pins contract 1.0.0 and executes the Core conformance validator in CI."
+      "dependencyRationale": "Core records a reproducible pinned Tracker consumer snapshot for evidence-command execution; the live evolith_tracker manifest remains owned by the external consumer repository."
     },
     {
       "id": "GT-44",

@@ -5522,11 +5522,11 @@ Serie histórica de gaps registrada en el antiguo `gap-analysis-core.es.md`, pre
 - **Evidencia Actual:** `node .harness/scripts/run-evolith-deep.mjs` — Dimensión "MODELO SDLC EJECUTABLE": **SÓLIDO**.
 - **Complejidad:** M
 - **Hecho Cuando:**
-  - [x] Cada fase tiene un archivo `phase-f*.json` en `reference/core/sdlc/phases/` con campos: `id`, `name`, `description`, `order`, `gates[]`.
-  - [x] Cada gate en `reference/core/sdlc/gates/` declara `requiredArtifacts[]` y `rules[]` con referencias a archivos `.rego`.
-  - [x] Existe un validador (`.harness/playbooks/sdlc-phase-gate-validator.mjs`) que verifica reglas Rego y artefactos requeridos.
+  - [x] Cada fase tiene un archivo `phase-f*.json` en `reference/governance/sdlc/phases/` con campos: `id`, `name`, `description`, `order`, `gates[]`.
+  - [x] Cada gate en `reference/governance/sdlc/gates/` declara `requiredArtifacts[]` y `rules[]`.
+  - [x] Existe un validador (`.harness/playbooks/sdlc-phase-gate-validator.mjs`) que verifica gates/fases, artefactos requeridos con reglas asociadas y cualquier referencia tipo ruta.
   - [x] `run-evolith-deep.mjs` reporta `SÓLIDO` para la dimensión "MODELO SDLC EJECUTABLE".
-- **Evidencia de Cierre:** Commit `661a8846` crea 5 phase files, 5 gate files, los schemas SDLC, el validador de phase/gate y reglas Rego SDLC. El audit profundo detecta datos estructurados y reporta `SÓLIDO`.
+- **Evidencia de Cierre:** Commit `661a8846` crea 5 phase files en `reference/governance/sdlc/phases/`, 5 gate files en `reference/governance/sdlc/gates/`, los schemas SDLC, el validador de phase/gate y reglas SDLC. El audit profundo detecta datos estructurados y reporta `SÓLIDO`.
 
 #### GT-281
 
@@ -7213,7 +7213,7 @@ Serie histórica de gaps registrada en el antiguo `gap-analysis-core.es.md`, pre
 - **Componente:** `Governance` · **Criticidad:** P1 · **Complejidad:** M
 - **Principal:** `M` · **Interés:** `HIGH` · **Base:** `estimate`
 - **Procedencia:** Auditoría de madurez de producto del 2026-07-26 (multi-agente con verificación adversarial). Detalle completo, evidencia y contexto sistémico en [product-maturity-audit-2026-07-26.es.md](../maturity-reports/product-maturity-audit-2026-07-26.es.md).
-- **Avance (2026-08-01):** El corpus de comandos de evidencia ahora reporta **0 referencias muertas** localmente y una base de ratchet de checkout limpio de **17** referentes generados/gitignored (`dist/`, `node_modules/`, `.harness/bin/`), así que CI bajó `--max-dead` a 17. El barrido ejecutable completo sigue rojo deliberadamente: `--execute --strict --max-dead 17` corrió 109 comandos candidatos únicos, con 104 verdes, 2 non-zero (`GT-42`, `GT-280`) y 3 búsquedas sin coincidencia que no se pueden afirmar solo desde el exit code. Por eso AC3 sigue abierto.
+- **Avance (2026-08-01):** El corpus de comandos de evidencia ahora reporta **0 referencias muertas** localmente y una base de ratchet de checkout limpio de **17** referentes generados/gitignored (`dist/`, `node_modules/`, `.harness/bin/`), así que CI bajó `--max-dead` a 17. Un seguimiento hizo pasar el barrido ejecutable estricto: `--execute --strict --max-dead 17` corrió 109 comandos candidatos únicos, con 106 exit 0, 0 non-zero y 3 búsquedas sin coincidencia que no se pueden afirmar solo desde el exit code. AC3 sigue abierto hasta convertir esas búsquedas inconclusas en comandos asertables y promover el camino de CI de ratchet/reporte a ejecución gobernada.
 - **Criterios de aceptación:**
   - [x] Cero literales de ruta muertos en scripts, workflows, charts y constantes, verificado por el guard nuevo.
   - [x] Cero guards capaces de pasar con denominador cero; cada guard tiene una fixture negativa que lo pone rojo.

@@ -5539,11 +5539,11 @@ Historical gap series tracked in the former `gap-analysis-core.md`, preserved fo
 - **Current Evidence:** `node .harness/scripts/run-evolith-deep.mjs` — Dimensión "MODELO SDLC EJECUTABLE": **SÓLIDO**.
 - **Complexity:** M
 - **Done when:**
-  - [x] Cada fase (F0–F4) tiene un archivo `phase-f*.json` en `reference/core/sdlc/phases/` con campos: `id`, `name`, `description`, `order`, `gates[]`.
-  - [x] Cada gate en `reference/core/sdlc/gates/` declara `requiredArtifacts[]` y `rules[]` (referencias a archivos `.rego` en `rulesets/`).
-  - [x] Existe un validador (`.harness/playbooks/sdlc-phase-gate-validator.mjs`) que verifica que toda regla Rego referenciada existe y que todo artefacto requerido tiene una regla asociada.
+  - [x] Cada fase (F0–F4) tiene un archivo `phase-f*.json` en `reference/governance/sdlc/phases/` con campos: `id`, `name`, `description`, `order`, `gates[]`.
+  - [x] Cada gate en `reference/governance/sdlc/gates/` declara `requiredArtifacts[]` y `rules[]`.
+  - [x] Existe un validador (`.harness/playbooks/sdlc-phase-gate-validator.mjs`) que verifica que cada gate/fase resuelve, que todo artefacto requerido tiene una regla asociada y que cualquier referencia tipo ruta existe.
   - [x] `run-evolith-deep.mjs` reporta `SÓLIDO` para la dimensión "MODELO SDLC EJECUTABLE".
-- **Closure Evidence:** 5 phase files (`phase-f1.json`…`phase-f5.json`) en `reference/core/sdlc/phases/`. 5 gate files (`gate-f1.json`…`gate-f5.json`) en `reference/core/sdlc/gates/`. 26 referencias Rego en total, todas existentes. Validador `sdlc-phase-gate-validator.mjs` pasa 0 errores. `sdlc-deep-audit.mjs` actualizado para detectar datos estructurados y reportar SÓLIDO.
+- **Closure Evidence:** 5 phase files (`phase-f1.json`…`phase-f5.json`) en `reference/governance/sdlc/phases/`. 5 gate files (`gate-f1.json`…`gate-f5.json`) en `reference/governance/sdlc/gates/`. Los gates declaran rule ids `EV-F*`; cualquier referencia tipo ruta se valida contra disco. Validador `sdlc-phase-gate-validator.mjs` pasa 0 errores. `sdlc-deep-audit.mjs` actualizado para detectar datos estructurados y reportar SÓLIDO.
 
 #### GT-281
 
@@ -7308,7 +7308,7 @@ Historical gap series tracked in the former `gap-analysis-core.md`, preserved fo
 - **Component:** `Governance` · **Criticality:** P1 · **Complexity:** M
 - **Principal:** `M` · **Interest:** `HIGH` · **Basis:** `estimate`
 - **Provenance:** Product maturity audit of 2026-07-26 (multi-agent with adversarial verification). Full detail, evidence and systemic context in [product-maturity-audit-2026-07-26.md](../maturity-reports/product-maturity-audit-2026-07-26.md).
-- **Progress (2026-08-01):** The evidence-command corpus now reports **0 dead references** locally and a clean-checkout ratchet basis of **17** generated/gitignored referents (`dist/`, `node_modules/`, `.harness/bin/`), so CI lowered `--max-dead` to 17. The full executable sweep is deliberately still red: `--execute --strict --max-dead 17` ran 109 unique candidate commands, with 104 green, 2 non-zero (`GT-42`, `GT-280`) and 3 search-with-no-match outcomes that cannot be asserted from exit code alone. AC3 therefore remains open.
+- **Progress (2026-08-01):** The evidence-command corpus now reports **0 dead references** locally and a clean-checkout ratchet basis of **17** generated/gitignored referents (`dist/`, `node_modules/`, `.harness/bin/`), so CI lowered `--max-dead` to 17. A follow-up made the strict executable sweep pass: `--execute --strict --max-dead 17` ran 109 unique candidate commands, with 106 exit 0, 0 non-zero and 3 search-with-no-match outcomes that cannot be asserted from exit code alone. AC3 remains open until those inconclusive searches are converted into assertable commands and the CI path is promoted from ratchet/reporting to governed execution.
 - **Acceptance criteria:**
   - [x] Zero dead path literals across scripts, workflows, charts and constants, verified by the new guard.
   - [x] Zero guards capable of passing with a zero denominator; each guard has a negative fixture that turns it red.