Close governance traceability tasks and finish T0-4/T0-5 hardening

.github/workflows/ci-gate.yml

@@ -157,6 +157,17 @@ jobs:
       - name: Check governance traceability contract (template + indexes + TODO linkage)
         run: ./scripts/ci/check_governance_traceability.sh
 
+  failure-ownership-map:
+    name: failure-ownership-map
+
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Verify failure-test ownership mapping
+        run: python scripts/ci/check_test_failure_ownership.py
+
   governance-intent-gate:
     name: governance-intent-gate
     if: github.event_name == 'pull_request' || github.event_name == 'merge_group'

dare_framework/checkpoint/defaults.py

@@ -0,0 +1,21 @@
+"""Supported default checkpoint implementations and contributors."""
+
+from dare_framework.checkpoint._internal.contributors.session_contributor import (
+    SessionContextContributor,
+    SessionStateContributor,
+)
+from dare_framework.checkpoint._internal.contributors.stm_contributor import StmContributor
+from dare_framework.checkpoint._internal.contributors.workspace_git_contributor import (
+    WorkspaceGitContributor,
+)
+from dare_framework.checkpoint._internal.memory_store import MemoryCheckpointStore
+from dare_framework.checkpoint._internal.save_restore import DefaultCheckpointSaveRestore
+
+__all__ = [
+    "MemoryCheckpointStore",
+    "DefaultCheckpointSaveRestore",
+    "StmContributor",
+    "WorkspaceGitContributor",
+    "SessionStateContributor",
+    "SessionContextContributor",
+]

dare_framework/embedding/__init__.py

@@ -1,8 +1,8 @@
 """embedding domain facade."""
 
-from dare_framework.embedding.interfaces import IEmbeddingAdapter
-from dare_framework.embedding.types import EmbeddingOptions, EmbeddingResult
-from dare_framework.embedding._internal.openai_embedding import OpenAIEmbeddingAdapter
+from dare_framework.embedding.interfaces import IEmbeddingAdapter
+from dare_framework.embedding.types import EmbeddingOptions, EmbeddingResult
+from dare_framework.embedding.defaults import OpenAIEmbeddingAdapter
 
 __all__ = [
     "IEmbeddingAdapter",

dare_framework/embedding/defaults.py

@@ -0,0 +1,5 @@
+"""Supported default embedding implementations."""
+
+from dare_framework.embedding._internal.openai_embedding import OpenAIEmbeddingAdapter
+
+__all__ = ["OpenAIEmbeddingAdapter"]

dare_framework/event/__init__.py

@@ -1,6 +1,6 @@
 """event domain facade."""
 
-from dare_framework.event._internal.sqlite_event_log import DefaultEventLog, SQLiteEventLog
+from dare_framework.event.defaults import DefaultEventLog, SQLiteEventLog
 from dare_framework.event.kernel import IEventLog
 from dare_framework.event.types import Event, RuntimeSnapshot
 

dare_framework/event/defaults.py

@@ -0,0 +1,5 @@
+"""Supported default event-log implementations."""
+
+from dare_framework.event._internal.sqlite_event_log import DefaultEventLog, SQLiteEventLog
+
+__all__ = ["SQLiteEventLog", "DefaultEventLog"]

dare_framework/hook/__init__.py

@@ -2,7 +2,7 @@
 
 from dare_framework.hook.interfaces import IHookManager
 from dare_framework.hook.kernel import IExtensionPoint, IHook, HookFn
-from dare_framework.hook._internal.hook_extension_point import HookExtensionPoint
+from dare_framework.hook.defaults import HookExtensionPoint
 from dare_framework.hook.types import HookDecision, HookEnvelope, HookPhase, HookResult
 
 __all__ = [

dare_framework/hook/defaults.py

@@ -0,0 +1,5 @@
+"""Supported default extension-point implementation."""
+
+from dare_framework.hook._internal.hook_extension_point import HookExtensionPoint
+
+__all__ = ["HookExtensionPoint"]

dare_framework/plan/__init__.py

@@ -23,8 +23,7 @@
     ValidatedStep,
     VerifyResult,
 )
-from dare_framework.plan._internal.default_planner import DefaultPlanner
-from dare_framework.plan._internal.default_remediator import DefaultRemediator
+from dare_framework.plan.defaults import DefaultPlanner, DefaultRemediator
 
 __all__ = [
     # Interfaces

dare_framework/plan/defaults.py

@@ -0,0 +1,6 @@
+"""Supported default planner/remediator implementations."""
+
+from dare_framework.plan._internal.default_planner import DefaultPlanner
+from dare_framework.plan._internal.default_remediator import DefaultRemediator
+
+__all__ = ["DefaultPlanner", "DefaultRemediator"]

dare_framework/security/__init__.py

@@ -1,14 +1,17 @@
 """Security domain facade."""
 
-from dare_framework.security._internal.default_security_boundary import DefaultSecurityBoundary
 from dare_framework.security.errors import (
     SECURITY_APPROVAL_MANAGER_MISSING,
     SECURITY_POLICY_CHECK_FAILED,
     SECURITY_POLICY_DENIED,
     SECURITY_TRUST_DERIVATION_FAILED,
     SecurityBoundaryError,
 )
-from dare_framework.security.impl import NoOpSecurityBoundary, PolicySecurityBoundary
+from dare_framework.security.impl import (
+    DefaultSecurityBoundary,
+    NoOpSecurityBoundary,
+    PolicySecurityBoundary,
+)
 from dare_framework.security.kernel import ISecurityBoundary
 from dare_framework.security.types import PolicyDecision, RiskLevel, SandboxSpec, TrustedInput
 

dare_framework/security/impl/default_security_boundary.py

@@ -5,6 +5,9 @@
 import inspect
 from typing import Any, Callable, Iterable
 
+from dare_framework.security._internal.default_security_boundary import (
+    DefaultSecurityBoundary as LegacyDefaultSecurityBoundary,
+)
 from dare_framework.security.errors import (
     SECURITY_TRUST_DERIVATION_FAILED,
     SecurityBoundaryError,
@@ -259,8 +262,8 @@ async def execute_safe(
         return await _execute_callable(fn)
 
 
-# Backward-compatible alias for legacy references.
-DefaultSecurityBoundary = PolicySecurityBoundary
+# Preserve historical facade behavior where `DefaultSecurityBoundary` is permissive.
+DefaultSecurityBoundary = LegacyDefaultSecurityBoundary
 
 
 __all__ = [

dare_framework/transport/__init__.py

@@ -16,7 +16,7 @@
     ActionHandlerDispatcher,
     ResourceAction,
 )
-from dare_framework.transport._internal import (
+from dare_framework.transport.adapters import (
     DefaultAgentChannel,
     DirectClientChannel,
     StdioClientChannel,

dare_framework/transport/adapters.py

@@ -0,0 +1,15 @@
+"""Supported default transport channel adapters."""
+
+from dare_framework.transport._internal import (
+    DefaultAgentChannel,
+    DirectClientChannel,
+    StdioClientChannel,
+    WebSocketClientChannel,
+)
+
+__all__ = [
+    "DefaultAgentChannel",
+    "DirectClientChannel",
+    "StdioClientChannel",
+    "WebSocketClientChannel",
+]

docs/design/Framework_MinSurface_Review.md

@@ -268,3 +268,8 @@ MCP adapters, etc.
 - Tight coupling to concrete classes prevents safe refactors.
 - External users rely on internal DTOs that must then be supported forever.
 - Increased likelihood of breaking changes with each internal improvement.
+
+## 5. Implementation Note (2026-03-04)
+- T0-4 facade compliance batch moved public-domain `__init__.py` imports away from direct `._internal` references into explicit public export layers (`defaults.py`, `impl`, `adapters`).
+- The following facades now import only public modules directly: `checkpoint`, `embedding`, `event`, `hook`, `plan`, `security`, `transport`.
+- A regression rule was added in `tests/unit/test_package_initializers_facade_pattern.py` to block future direct `._internal` imports from public facades.

docs/features/enhance-doc-governance-traceability.md

@@ -39,6 +39,7 @@ Unify documentation management structure, lifecycle governance, and SOP-to-skill
 ### Results
 - `../../.venv/bin/python -m pytest -q tests/unit/test_governance_intent_gate.py tests/unit/test_governance_traceability_gate.py tests/unit/test_governance_evidence_truth_gate.py`: passed (`56 passed`) after adding intent-gate regression coverage for docs-only skip behavior, implementation-path gating, governed feature-doc requirement, intent PR link extraction, merged-state enforcement, and draft-status exclusion while preserving existing traceability/evidence truth coverage.
 - `./scripts/ci/check_governance_traceability.sh`: passed against the real repository tree after tightening active/archive index membership to canonical sections, rejecting index entries outside the correct feature-doc path family, excluding `docs/features/README.md` and `docs/features/archive/README.md` from valid feature-entry targets, requiring explicit checkpoint-to-skill pair rows in Section 7, and resolving pilot `todo_ids` only through Claim Ledger records, including same-claim scope ranges where the TODO id is only implied by the claim range.
+- Closeout sync update: traceability checks now also cover archived-feature frontmatter validation and master/detail claim consistency against OpenSpec `tasks.md` completeness for executable claims.
 - `./scripts/ci/check_governance_evidence_truth.sh`: passed, confirming the new traceability assets do not break the existing evidence-first contract.
 - `GOVERNANCE_INTENT_GATE_CHANGED_FILES=$'client/main.py\ndocs/features/enhance-doc-governance-traceability.md' GOVERNANCE_INTENT_GATE_PR_STATE_FIXTURE='zts212653/Deterministic-Agent-Runtime-Engine#126=merged' ./scripts/ci/check_governance_intent_gate.sh`: passed, confirming implementation-path changes are now hard-blocked unless governed feature docs carry a merged `Intent PR`.
 - `openspec validate enhance-doc-governance-traceability --type change --strict --json --no-interactive`: passed (`1/1` change valid, `0` issues).
@@ -74,17 +75,17 @@ Unify documentation management structure, lifecycle governance, and SOP-to-skill
 
 ### Structured Review Report
 - Changed Module Boundaries / Public API: governance scope only; no new runtime public API added.
-- New State: adds intent gate policy state (`implementation-path diff -> governed feature doc -> merged intent PR`) with one new gate script and one new regression test suite.
+- New State: adds intent gate policy state (`implementation-path diff -> governed feature doc -> merged intent PR`) and extends traceability closeout checks for claim-to-task and master/detail consistency.
 - Concurrency / Timeout / Retry: no concurrency change; gate runs are single-process document scans with deterministic rerun behavior after fixes.
 - Side Effects and Idempotency: side effects are limited to CI/log output; repeated runs are idempotent against unchanged docs.
-- Coverage and Residual Risk: intent-merge gating plus existing template/index/skill-mapping/TODO-linkage checks are covered; residual risk is that broader frontmatter enforcement across `docs/guides/**` and `docs/design/**` is still pending.
+- Coverage and Residual Risk: intent-merge gating plus template/index/skill-mapping/TODO-linkage checks are covered; residual risk remains broader frontmatter enforcement expansion across additional governance doc families.
 
 ### Behavior Verification
 - Happy path: when implementation files change, CI now requires a same-PR governed feature-doc update and validates that the referenced `Intent PR` is already merged before allowing merge.
 - Error/fallback path: the intent gate fails deterministically when implementation changes omit governed feature docs, when feature docs miss `Intent PR` links, or when the referenced intent PR state is not `merged`.
 
 ### Risks and Rollback
-- Risk: `3.2-3.4` are still open, so the governance suite still does not enforce full frontmatter coverage for every governance-tracked doc family or full master-TODO/task completeness.
+- Risk: promoting `p0-gate` to a required check still depends on repository-admin permissions outside this change scope.
 - Risk: active/archive indexes are now explicit manual ledgers, so closeout changes that forget to update them will fail the new gate.
 - Risk: local runs without `GITHUB_TOKEN` need PR-state fixture or CI context for merged-state lookup.
 - Rollback: remove `governance-intent-gate` from `.github/workflows/ci-gate.yml` and revert `scripts/ci/check_governance_intent_gate.sh` if false positives block delivery.
@@ -110,4 +111,4 @@ Unify documentation management structure, lifecycle governance, and SOP-to-skill
   - `https://github.com/zts212653/Deterministic-Agent-Runtime-Engine/pull/175#discussion_r2881421738`
 
 ## Next Milestone
-Implement the remaining CI depth tasks: widen frontmatter enforcement beyond feature docs and add machine-checkable TODO/task and master-TODO/change-slice consistency checks before closeout.
+Promote `p0-gate` to branch protection required check and then archive this change entry in the next closeout pass.

docs/features/p0-conformance-gate.md

@@ -3,7 +3,7 @@ change_ids: ["p0-conformance-gate"]
 doc_kind: feature
 topics: ["p0", "conformance", "ci-gate", "runtime-validation"]
 created: 2026-03-03
-updated: 2026-03-03
+updated: 2026-03-04
 status: active
 mode: openspec
 ---
@@ -44,6 +44,7 @@ mode: openspec
 - `../../.venv/bin/python -m pytest -q tests/unit/test_dare_agent_security_policy_gate.py tests/unit/test_dare_agent_security_boundary.py tests/unit/test_five_layer_agent.py`
 - `../../.venv/bin/python -m pytest -q tests/unit/test_p0_gate_ci.py`
 - `../../.venv/bin/python scripts/ci/p0_gate.py`
+- `python scripts/ci/check_test_failure_ownership.py`
 - `openspec validate p0-conformance-gate --type change --strict --json --no-interactive`
 - `./scripts/ci/check_governance_evidence_truth.sh`
 
@@ -63,9 +64,11 @@ mode: openspec
   `- STEP_EXEC_REGRESSION: 0 failures`
   `- AUDIT_CHAIN_REGRESSION: 0 failures`
   which confirms the repository now has a single deterministic command entrypoint for the three frozen P0 categories.
+- `python scripts/ci/check_test_failure_ownership.py`: passed and now enforces category-level failure ownership integrity (`test selector -> module scope -> owner`) as a machine-checkable precondition; `.github/workflows/ci-gate.yml` now runs this as `failure-ownership-map`.
 - `openspec validate p0-conformance-gate --type change --strict --json --no-interactive`: passed (`1/1` change valid, `0` issues) after restoring the missing active feature aggregation record for this change.
 - `./scripts/ci/check_governance_evidence_truth.sh`: initially failed because the restored feature doc lacked historical PR/review links; after linking the already-landed P0 evidence PRs, the governance gate passed, and remained green after task `1.1-1.3` synchronized the gate scope matrix and rollout contract into the active docs/spec set.
 - `./scripts/ci/check_governance_evidence_truth.sh`: remained green after adding `docs/guides/P0_Gate_Runbook.md` plus the new navigation links in `docs/README.md` and `docs/guides/Team_Agent_Collab_Playbook.md`, confirming the operationalization docs did not break the governance acceptance pack.
+- `docs/governance/branch-protection.md`: now includes a dedicated `p0-gate` required-check rollout checklist (preconditions, execution, acceptance, and evidence fields) so task `3.2` can be closed with deterministic admin-side proof.
 
 ### Behavior Verification
 
@@ -105,4 +108,4 @@ mode: openspec
 
 ## Next Milestone
 
-Schedule the repo-admin follow-up for task `3.2`: add `p0-gate` to the protected-branch required checks / ruleset after this change merges.
+Execute the admin rollout checklist in `docs/governance/branch-protection.md` (`P0-Gate Required Check Rollout`) and then close task `3.2` with settings + blocked/pass run evidence links.

docs/governance/branch-protection.md

@@ -36,6 +36,39 @@ If your GitHub plan supports merge queue:
   - summary contract: `p0-gate` must emit deterministic category labels and failing test/module pointers before it can become a required branch check
   - repo-admin action: after this change merges, add `p0-gate` to the protected-branch required checks list / ruleset
 
+## P0-Gate Required Check Rollout (Admin Checklist)
+
+> Tracking scope: `openspec/changes/p0-conformance-gate/tasks.md` item `3.2`.
+
+### Preconditions
+
+1. `p0-conformance-gate` change has been merged to `main`.
+2. Latest `main` run shows `p0-gate` green with all three categories reported.
+3. `.github/workflows/ci-gate.yml` still contains job name `p0-gate` (required-check name must match exactly).
+
+### Execution Steps
+
+1. Open `Settings -> Branches` (or repository Rulesets) for `main`.
+2. Enable `Require status checks to pass before merging` if not already enabled.
+3. Add `p0-gate` to required status checks.
+4. Keep existing required checks (`lint`, `build`, and other active phases) unchanged.
+5. Save the branch protection / ruleset change.
+
+### Acceptance
+
+1. Open a test PR targeting `main` and force one `p0-gate` anchor failure; merge must be blocked.
+2. Fix the failure and rerun; merge must be unblocked only after `p0-gate` is green.
+3. Verify merge-queue path (if enabled) also enforces `p0-gate` on `merge_group`.
+
+### Evidence to Record
+
+1. Branch protection / ruleset screenshot or settings URL proving `p0-gate` is required.
+2. One blocked PR run URL where `p0-gate` failed.
+3. One unblocked PR run URL where `p0-gate` passed.
+4. Update:
+   - `openspec/changes/p0-conformance-gate/tasks.md` item `3.2` to `done` with links
+   - `docs/features/p0-conformance-gate.md` `Results` and `Next Milestone`
+
 ## Fallback if Merge Queue Is Unavailable
 Use pre-merge combined checks:
 

docs/guides/P0_Gate_Runbook.md

@@ -21,6 +21,23 @@ p0-gate: PASS
 
 The same command is used by `.github/workflows/ci-gate.yml` job `p0-gate`.
 
+## 1.1 Ownership Mapping Health Check
+
+Run ownership-map巡检 from repository root:
+
+```bash
+python scripts/ci/check_test_failure_ownership.py
+```
+
+Expected success output starts with:
+
+```text
+[failure-ownership] passed
+```
+
+This command is used by `.github/workflows/ci-gate.yml` job `failure-ownership-map` and enforces the
+`失败测试 -> 责任模块 -> owner` mapping integrity for `p0-gate` categories.
+
 ## 2. Category Mapping
 
 ### SECURITY_REGRESSION