Close governance traceability tasks and finish T0-4/T0-5 hardening

.github/workflows/ci-gate.yml

@@ -153,6 +153,16 @@ jobs:
       - name: Check governance traceability contract (template + indexes + TODO linkage)
         run: ./scripts/ci/check_governance_traceability.sh
 
+  failure-ownership-map:
+    name: failure-ownership-map
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Verify failure-test ownership mapping
+        run: python scripts/ci/check_test_failure_ownership.py
+
   p0-gate:
     name: p0-gate
     runs-on: ubuntu-latest

dare_framework/checkpoint/__init__.py

@@ -11,15 +11,13 @@
     ScopePresets,
 )
 from dare_framework.checkpoint.factory import create_default_save_restore
-from dare_framework.checkpoint._internal.memory_store import MemoryCheckpointStore
-from dare_framework.checkpoint._internal.save_restore import DefaultCheckpointSaveRestore
-from dare_framework.checkpoint._internal.contributors.stm_contributor import StmContributor
-from dare_framework.checkpoint._internal.contributors.workspace_git_contributor import (
-    WorkspaceGitContributor,
-)
-from dare_framework.checkpoint._internal.contributors.session_contributor import (
-    SessionStateContributor,
+from dare_framework.checkpoint.defaults import (
+    DefaultCheckpointSaveRestore,
+    MemoryCheckpointStore,
     SessionContextContributor,
+    SessionStateContributor,
+    StmContributor,
+    WorkspaceGitContributor,
 )
 
 

dare_framework/checkpoint/defaults.py

@@ -0,0 +1,21 @@
+"""Supported default checkpoint implementations and contributors."""
+
+from dare_framework.checkpoint._internal.contributors.session_contributor import (
+    SessionContextContributor,
+    SessionStateContributor,
+)
+from dare_framework.checkpoint._internal.contributors.stm_contributor import StmContributor
+from dare_framework.checkpoint._internal.contributors.workspace_git_contributor import (
+    WorkspaceGitContributor,
+)
+from dare_framework.checkpoint._internal.memory_store import MemoryCheckpointStore
+from dare_framework.checkpoint._internal.save_restore import DefaultCheckpointSaveRestore
+
+__all__ = [
+    "MemoryCheckpointStore",
+    "DefaultCheckpointSaveRestore",
+    "StmContributor",
+    "WorkspaceGitContributor",
+    "SessionStateContributor",
+    "SessionContextContributor",
+]

dare_framework/embedding/__init__.py

@@ -1,8 +1,8 @@
 """embedding domain facade."""
 
-from dare_framework.embedding.interfaces import IEmbeddingAdapter
-from dare_framework.embedding.types import EmbeddingOptions, EmbeddingResult
-from dare_framework.embedding._internal.openai_embedding import OpenAIEmbeddingAdapter
+from dare_framework.embedding.interfaces import IEmbeddingAdapter
+from dare_framework.embedding.types import EmbeddingOptions, EmbeddingResult
+from dare_framework.embedding.defaults import OpenAIEmbeddingAdapter
 
 __all__ = [
     "IEmbeddingAdapter",

dare_framework/embedding/defaults.py

@@ -0,0 +1,5 @@
+"""Supported default embedding implementations."""
+
+from dare_framework.embedding._internal.openai_embedding import OpenAIEmbeddingAdapter
+
+__all__ = ["OpenAIEmbeddingAdapter"]

dare_framework/event/__init__.py

@@ -1,6 +1,6 @@
 """event domain facade."""
 
-from dare_framework.event._internal.sqlite_event_log import DefaultEventLog, SQLiteEventLog
+from dare_framework.event.defaults import DefaultEventLog, SQLiteEventLog
 from dare_framework.event.kernel import IEventLog
 from dare_framework.event.types import Event, RuntimeSnapshot
 

dare_framework/event/defaults.py

@@ -0,0 +1,5 @@
+"""Supported default event-log implementations."""
+
+from dare_framework.event._internal.sqlite_event_log import DefaultEventLog, SQLiteEventLog
+
+__all__ = ["SQLiteEventLog", "DefaultEventLog"]

dare_framework/hook/__init__.py

@@ -2,7 +2,7 @@
 
 from dare_framework.hook.interfaces import IHookManager
 from dare_framework.hook.kernel import IExtensionPoint, IHook, HookFn
-from dare_framework.hook._internal.hook_extension_point import HookExtensionPoint
+from dare_framework.hook.defaults import HookExtensionPoint
 from dare_framework.hook.types import HookDecision, HookEnvelope, HookPhase, HookResult
 
 __all__ = [

dare_framework/hook/defaults.py

@@ -0,0 +1,5 @@
+"""Supported default extension-point implementation."""
+
+from dare_framework.hook._internal.hook_extension_point import HookExtensionPoint
+
+__all__ = ["HookExtensionPoint"]

dare_framework/model/__init__.py

@@ -9,7 +9,7 @@
 from dare_framework.model.builtin_prompt_loader import BuiltInPromptLoader
 from dare_framework.model.filesystem_prompt_loader import FileSystemPromptLoader
 from dare_framework.model.layered_prompt_store import LayeredPromptStore
-from dare_framework.model.adapters import *
+from dare_framework.model.adapters import OpenAIModelAdapter, OpenRouterModelAdapter
 
 __all__ = [
     "IModelAdapter",

dare_framework/plan/__init__.py

@@ -23,8 +23,7 @@
     ValidatedStep,
     VerifyResult,
 )
-from dare_framework.plan._internal.default_planner import DefaultPlanner
-from dare_framework.plan._internal.default_remediator import DefaultRemediator
+from dare_framework.plan.defaults import DefaultPlanner, DefaultRemediator
 
 __all__ = [
     # Interfaces

dare_framework/plan/defaults.py

@@ -0,0 +1,6 @@
+"""Supported default planner/remediator implementations."""
+
+from dare_framework.plan._internal.default_planner import DefaultPlanner
+from dare_framework.plan._internal.default_remediator import DefaultRemediator
+
+__all__ = ["DefaultPlanner", "DefaultRemediator"]

dare_framework/security/__init__.py

@@ -1,14 +1,17 @@
 """Security domain facade."""
 
-from dare_framework.security._internal.default_security_boundary import DefaultSecurityBoundary
 from dare_framework.security.errors import (
     SECURITY_APPROVAL_MANAGER_MISSING,
     SECURITY_POLICY_CHECK_FAILED,
     SECURITY_POLICY_DENIED,
     SECURITY_TRUST_DERIVATION_FAILED,
     SecurityBoundaryError,
 )
-from dare_framework.security.impl import NoOpSecurityBoundary, PolicySecurityBoundary
+from dare_framework.security.impl import (
+    DefaultSecurityBoundary,
+    NoOpSecurityBoundary,
+    PolicySecurityBoundary,
+)
 from dare_framework.security.kernel import ISecurityBoundary
 from dare_framework.security.types import PolicyDecision, RiskLevel, SandboxSpec, TrustedInput
 

dare_framework/transport/__init__.py

@@ -16,7 +16,7 @@
     ActionHandlerDispatcher,
     ResourceAction,
 )
-from dare_framework.transport._internal import (
+from dare_framework.transport.adapters import (
     DefaultAgentChannel,
     DirectClientChannel,
     StdioClientChannel,

dare_framework/transport/adapters.py

@@ -0,0 +1,15 @@
+"""Supported default transport channel adapters."""
+
+from dare_framework.transport._internal import (
+    DefaultAgentChannel,
+    DirectClientChannel,
+    StdioClientChannel,
+    WebSocketClientChannel,
+)
+
+__all__ = [
+    "DefaultAgentChannel",
+    "DirectClientChannel",
+    "StdioClientChannel",
+    "WebSocketClientChannel",
+]

docs/design/Framework_MinSurface_Review.md

@@ -268,3 +268,8 @@ MCP adapters, etc.
 - Tight coupling to concrete classes prevents safe refactors.
 - External users rely on internal DTOs that must then be supported forever.
 - Increased likelihood of breaking changes with each internal improvement.
+
+## 5. Implementation Note (2026-03-04)
+- T0-4 facade compliance batch moved public-domain `__init__.py` imports away from direct `._internal` references into explicit public export layers (`defaults.py`, `impl`, `adapters`).
+- The following facades now import only public modules directly: `checkpoint`, `embedding`, `event`, `hook`, `plan`, `security`, `transport`.
+- A regression rule was added in `tests/unit/test_package_initializers_facade_pattern.py` to block future direct `._internal` imports from public facades.

docs/features/enhance-doc-governance-traceability.md

@@ -4,7 +4,7 @@ doc_kind: feature
 topics: ["documentation-governance", "traceability", "skills"]
 created: 2026-02-28
 updated: 2026-03-04
-status: active
+status: done
 mode: openspec
 ---
 
@@ -36,8 +36,8 @@ Unify documentation management structure, lifecycle governance, and SOP-to-skill
 - `openspec validate enhance-doc-governance-traceability --type change --strict --json --no-interactive`
 
 ### Results
-- `../../.venv/bin/python -m pytest -q tests/unit/test_governance_traceability_gate.py tests/unit/test_governance_evidence_truth_gate.py`: passed (`50 passed`) after extending the traceability gate regression suite to also cover stale active index entries, `Active Entries`-only membership checks, explicit checkpoint-to-skill pair rows, active/archive index path-family enforcement, README index-file exclusion for both active and archived entries, discrete `todo_ids` token matching, Claim Ledger-only TODO/change validation, same-record TODO/change validation, claim-scope range resolution, range-only claim-scope resolution without explicit todo tokens, full lifecycle checkpoint coverage, and date-prefixed archived change task discovery.
-- `./scripts/ci/check_governance_traceability.sh`: passed against the real repository tree after tightening active/archive index membership to canonical sections, rejecting index entries outside the correct feature-doc path family, excluding `docs/features/README.md` and `docs/features/archive/README.md` from valid feature-entry targets, requiring explicit checkpoint-to-skill pair rows in Section 7, and resolving pilot `todo_ids` only through Claim Ledger records, including same-claim scope ranges where the TODO id is only implied by the claim range.
+- `../../.venv/bin/python -m pytest -q tests/unit/test_governance_traceability_gate.py tests/unit/test_governance_evidence_truth_gate.py`: passed (`53 passed`) after extending the traceability gate regression suite to cover archived-feature frontmatter validation, TODO Claim (`active/done`) -> OpenSpec `tasks.md` completeness checks, and project master TODO `Detail Claim Ref` consistency against execution-board claims.
+- `./scripts/ci/check_governance_traceability.sh`: passed against the real repository tree after extending the gate to validate frontmatter contract on both active and archived feature aggregation docs, enforce Claim Ledger-to-OpenSpec task artifact mapping for executable claims, and enforce master TODO/detail-board claim reference consistency checks.
 - `./scripts/ci/check_governance_evidence_truth.sh`: passed, confirming the new traceability assets do not break the existing evidence-first contract.
 - `openspec validate enhance-doc-governance-traceability --type change --strict --json --no-interactive`: passed (`1/1` change valid, `0` issues).
 
@@ -69,17 +69,16 @@ Unify documentation management structure, lifecycle governance, and SOP-to-skill
 
 ### Structured Review Report
 - Changed Module Boundaries / Public API: governance scope only; no new runtime public API added.
-- New State: adds one new repository gate script, one new gate test file, and canonical docs/index/template assets under `docs/features/`.
+- New State: extends the existing governance traceability gate and regression suite with closeout checks for frontmatter scope, claim-to-task mapping, and master/detail claim consistency.
 - Concurrency / Timeout / Retry: no concurrency change; gate runs are single-process document scans with deterministic rerun behavior after fixes.
 - Side Effects and Idempotency: side effects are limited to CI/log output; repeated runs are idempotent against unchanged docs.
-- Coverage and Residual Risk: template/index/skill-mapping/TODO-linkage checks are covered; residual risk is that broader frontmatter enforcement across `docs/guides/**` and `docs/design/**` is still pending.
+- Coverage and Residual Risk: template/index/skill-mapping/TODO-linkage plus closeout-depth checks (`3.2-3.4`) are covered; residual risk is future expansion of frontmatter strictness from feature docs to additional governance doc families.
 
 ### Behavior Verification
 - Happy path: the repository now has a canonical feature aggregation template, explicit active/archive feature indexes, and a green traceability gate that resolves a pilot feature doc back to its TODO ledger and owning change-id through Claim Ledger records, including scope ranges such as `D2-1~D2-4, D4-1~D4-4`, even when the concrete TODO id does not appear elsewhere in the file.
 - Error/fallback path: the new gate fails deterministically when a feature doc is missing from the `## Active Entries` section, when an active/archive index entry points at the wrong doc family, when Section 7 keeps checkpoint names but drops the actual `checkpoint -> skill` mapping rows, or when `todo_ids` and `change_ids` only co-occur in detail-board/prose lines without a matching Claim Ledger record.
 
 ### Risks and Rollback
-- Risk: `3.2-3.4` are still open, so the new gate does not yet enforce full frontmatter coverage for every governance-tracked doc family or full master-TODO/task completeness.
 - Risk: active/archive indexes are now explicit manual ledgers, so closeout changes that forget to update them will fail the new gate.
 - Rollback: remove `governance-traceability` from `.github/workflows/ci-gate.yml` and revert the template/index additions if the new gate produces unexpected false positives.
 
@@ -103,4 +102,4 @@ Unify documentation management structure, lifecycle governance, and SOP-to-skill
   - `https://github.com/zts212653/Deterministic-Agent-Runtime-Engine/pull/175#discussion_r2881421738`
 
 ## Next Milestone
-Implement the remaining CI depth tasks: widen frontmatter enforcement beyond feature docs and add machine-checkable TODO/task and master-TODO/change-slice consistency checks before closeout.
+Promote `p0-gate` to branch protection required check and then archive this change entry in the next closeout pass.

docs/features/p0-conformance-gate.md

@@ -3,7 +3,7 @@ change_ids: ["p0-conformance-gate"]
 doc_kind: feature
 topics: ["p0", "conformance", "ci-gate", "runtime-validation"]
 created: 2026-03-03
-updated: 2026-03-03
+updated: 2026-03-04
 status: active
 mode: openspec
 ---
@@ -44,6 +44,7 @@ mode: openspec
 - `../../.venv/bin/python -m pytest -q tests/unit/test_dare_agent_security_policy_gate.py tests/unit/test_dare_agent_security_boundary.py tests/unit/test_five_layer_agent.py`
 - `../../.venv/bin/python -m pytest -q tests/unit/test_p0_gate_ci.py`
 - `../../.venv/bin/python scripts/ci/p0_gate.py`
+- `python scripts/ci/check_test_failure_ownership.py`
 - `openspec validate p0-conformance-gate --type change --strict --json --no-interactive`
 - `./scripts/ci/check_governance_evidence_truth.sh`
 
@@ -63,9 +64,11 @@ mode: openspec
   `- STEP_EXEC_REGRESSION: 0 failures`
   `- AUDIT_CHAIN_REGRESSION: 0 failures`
   which confirms the repository now has a single deterministic command entrypoint for the three frozen P0 categories.
+- `python scripts/ci/check_test_failure_ownership.py`: passed and now enforces category-level failure ownership integrity (`test selector -> module scope -> owner`) as a machine-checkable precondition; `.github/workflows/ci-gate.yml` now runs this as `failure-ownership-map`.
 - `openspec validate p0-conformance-gate --type change --strict --json --no-interactive`: passed (`1/1` change valid, `0` issues) after restoring the missing active feature aggregation record for this change.
 - `./scripts/ci/check_governance_evidence_truth.sh`: initially failed because the restored feature doc lacked historical PR/review links; after linking the already-landed P0 evidence PRs, the governance gate passed, and remained green after task `1.1-1.3` synchronized the gate scope matrix and rollout contract into the active docs/spec set.
 - `./scripts/ci/check_governance_evidence_truth.sh`: remained green after adding `docs/guides/P0_Gate_Runbook.md` plus the new navigation links in `docs/README.md` and `docs/guides/Team_Agent_Collab_Playbook.md`, confirming the operationalization docs did not break the governance acceptance pack.
+- `docs/governance/branch-protection.md`: now includes a dedicated `p0-gate` required-check rollout checklist (preconditions, execution, acceptance, and evidence fields) so task `3.2` can be closed with deterministic admin-side proof.
 
 ### Behavior Verification
 
@@ -105,4 +108,4 @@ mode: openspec
 
 ## Next Milestone
 
-Schedule the repo-admin follow-up for task `3.2`: add `p0-gate` to the protected-branch required checks / ruleset after this change merges.
+Execute the admin rollout checklist in `docs/governance/branch-protection.md` (`P0-Gate Required Check Rollout`) and then close task `3.2` with settings + blocked/pass run evidence links.

docs/governance/branch-protection.md

@@ -36,6 +36,39 @@ If your GitHub plan supports merge queue:
   - summary contract: `p0-gate` must emit deterministic category labels and failing test/module pointers before it can become a required branch check
   - repo-admin action: after this change merges, add `p0-gate` to the protected-branch required checks list / ruleset
 
+## P0-Gate Required Check Rollout (Admin Checklist)
+
+> Tracking scope: `openspec/changes/p0-conformance-gate/tasks.md` item `3.2`.
+
+### Preconditions
+
+1. `p0-conformance-gate` change has been merged to `main`.
+2. Latest `main` run shows `p0-gate` green with all three categories reported.
+3. `.github/workflows/ci-gate.yml` still contains job name `p0-gate` (required-check name must match exactly).
+
+### Execution Steps
+
+1. Open `Settings -> Branches` (or repository Rulesets) for `main`.
+2. Enable `Require status checks to pass before merging` if not already enabled.
+3. Add `p0-gate` to required status checks.
+4. Keep existing required checks (`lint`, `build`, and other active phases) unchanged.
+5. Save the branch protection / ruleset change.
+
+### Acceptance
+
+1. Open a test PR targeting `main` and force one `p0-gate` anchor failure; merge must be blocked.
+2. Fix the failure and rerun; merge must be unblocked only after `p0-gate` is green.
+3. Verify merge-queue path (if enabled) also enforces `p0-gate` on `merge_group`.
+
+### Evidence to Record
+
+1. Branch protection / ruleset screenshot or settings URL proving `p0-gate` is required.
+2. One blocked PR run URL where `p0-gate` failed.
+3. One unblocked PR run URL where `p0-gate` passed.
+4. Update:
+   - `openspec/changes/p0-conformance-gate/tasks.md` item `3.2` to `done` with links
+   - `docs/features/p0-conformance-gate.md` `Results` and `Next Milestone`
+
 ## Fallback if Merge Queue Is Unavailable
 Use pre-merge combined checks:
 

docs/guides/P0_Gate_Runbook.md

@@ -21,6 +21,23 @@ p0-gate: PASS
 
 The same command is used by `.github/workflows/ci-gate.yml` job `p0-gate`.
 
+## 1.1 Ownership Mapping Health Check
+
+Run ownership-map巡检 from repository root:
+
+```bash
+python scripts/ci/check_test_failure_ownership.py
+```
+
+Expected success output starts with:
+
+```text
+[failure-ownership] passed
+```
+
+This command is used by `.github/workflows/ci-gate.yml` job `failure-ownership-map` and enforces the
+`失败测试 -> 责任模块 -> owner` mapping integrity for `p0-gate` categories.
+
 ## 2. Category Mapping
 
 ### SECURITY_REGRESSION