verification_receipt:
  # Overall status (gates progression)
  status: PASS | FAIL | PENDING
  
  # Verification metadata
  verification_id: "VER-2026-020"
  timestamp: "2026-01-31T15:30:00Z"
  verifier_version: "v1.5.0"
  workflow_stage: "CODE_REVIEW | DEPLOY_GATE | RELEASE_GATE"
  
  # Checks performed (20+ checks)
  checks_performed:
    - check: "SPEC Card completeness"
      status: PASS
      evidence: "/docs/PRD.md exists, 320 lines, 18 user stories, 7 functional reqs, 6 NFRs"
      
    - check: "TEST Card coverage"
      status: PASS
      evidence: "/docs/TEST_PLAN.md exists, 2,547 tests defined, 80.5% coverage"
      
    - check: "Code artifacts exist"
      status: PASS
      evidence: "/src/**/*.ts: 19 files, 2,100+ lines, TypeScript strict mode"
      
    - check: "INV-001: JWT Authentication"
      status: PASS
      evidence: "/src/middleware/auth.ts implements JWT RS256, /tests/auth.test.ts validates"
      
    - check: "INV-002: RBAC"
      status: FAIL
      evidence: "RBAC implemented in /src/middleware/rbac.ts but tests missing for 'manager' role"
      remediation: "Add tests for manager role in /tests/rbac.test.ts (3 test cases required)"
      
    - check: "SPEC ↔ TEST alignment"
      status: PASS
      evidence: "18 user stories in PRD.md, 18 test suites in /tests/**/*.test.ts (1:1 mapping)"
  
  # Evidence verified (concrete paths)
  evidence_verified:
    prd: "/docs/PRD.md"
    architecture: "/docs/ARCHITECTURE.md"
    domain_model: "/docs/DOMAIN_MODEL.md"
    code: "/src/**/*.ts (19 files)"
    tests: "/tests/**/*.test.ts (12 files)"
    cicd_pipeline: "/.github/workflows/ci.yml"
    cicd_evidence: "/docs/CI_CD_EVIDENCE.md"
  
  # Invariant compliance (35 invariants)
  invariant_compliance:
    total: 35
    compliant: 18
    violated: 2
    not_applicable: 15
    
    violations:
      - invariant: "INV-002: RBAC"
        severity: MEDIUM
        description: "Role-Based Access Control tests incomplete (manager role not tested)"
        remediation: "Add 3 test cases for manager role in /tests/rbac.test.ts"
        blocking: false
        
      - invariant: "INV-021: Automated Testing 80%+"
        severity: HIGH
        description: "Code coverage 78.3% (target 80%+)"
        remediation: "Add tests for /src/utils/validators.ts (currently 45% coverage)"
        blocking: true
  
  # Gaps / missing evidence
  gaps_missing_evidence:
    - gap: "Load testing results missing"
      severity: MEDIUM
      impact: "Cannot verify INV-022 (performance testing) compliance"
      required_action: "Run k6 load test for /api/orders endpoint, target 1000 req/s"
      
    - gap: "Security scan report not in evidence"
      severity: HIGH
      impact: "Cannot verify INV-042 (security testing) compliance"
      required_action: "Upload Snyk/CodeQL SARIF report to /docs/security-scan.sarif"
  
  # Required approvals
  required_approvals:
    engineering_lead: APPROVED
    product_manager: APPROVED
    security_team: PENDING  # Waiting for security scan results
    compliance_team: NOT_REQUIRED  # No regulated data in this release
  
  approvals_missing:
    - role: "Security Team"
      reason: "Security scan report missing (INV-042 violation)"
      blocking: true
      eta: "2 hours (run Snyk scan, upload report)"
  
  # Cross-agent consistency checks
  consistency_checks:
    - check: "SPEC ↔ TEST alignment"
      status: PASS
      details: "18 user stories in SPEC, 18 test suites in TEST Card (1:1 mapping)"
      
    - check: "Architecture ↔ Code alignment"
      status: PASS
      details: "4 services in Architecture, 4 modules in /src (orders, products, users, payments)"
      
    - check: "Domain Model ↔ Database schema alignment"
      status: FAIL
      details: "Domain Model has 8 entities, Prisma schema has 7 models (missing 'AuditLog' model)"
      remediation: "Add AuditLog model to /prisma/schema.prisma for INV-029 compliance"
  
  # Risk assessment
  risk_assessment:
    overall_risk: MEDIUM
    risk_factors:
      - factor: "Coverage below 80% threshold"
        severity: HIGH
        mitigation: "Add 15 tests to reach 80.1% coverage"
        
      - factor: "Security scan pending"
        severity: MEDIUM
        mitigation: "Run Snyk scan (ETA 30 min)"
    
    unacknowledged_high_drift: []  # No HIGH drift detected
  
  # Recommendation (next action)
  recommendation: "CONDITIONAL_PASS: Fix 2 blocking issues within 4 hours, then re-verify"
  
  next_actions:
    - action: "Add RBAC tests for manager role"
      priority: P1
      assignee: "@backend-team"
      eta: "2 hours"
      
    - action: "Add tests to /src/utils/validators.ts to reach 80% coverage"
      priority: P0
      assignee: "@backend-team"
      eta: "2 hours"
      
    - action: "Run Snyk security scan, upload SARIF report"
      priority: P0
      assignee: "@security-team"
      eta: "30 minutes"
      
    - action: "Add AuditLog model to Prisma schema"
      priority: P1
      assignee: "@backend-team"
      eta: "1 hour"
  
  # Audit trail
  audit_trail:
    created_at: "2026-01-31T15:30:00Z"
    created_by: "VerifierAgent v1.5.0"
    evidence_hash: "sha256:abc123def456..."  # Hash of all evidence files
    previous_verification: "VER-2026-019"
    verification_duration: "45 seconds"

prd_verification:
  - check: "File exists"
    path: "/docs/PRD.md"
    validation: "File size >10KB (non-trivial)"
    
  - check: "User stories defined"
    validation: "Count ≥5 user stories with As/I want/So that format"
    example: "As a customer, I want to view order history, so that I can track my purchases"
    
  - check: "Functional requirements"
    validation: "Count ≥3 functional requirements with acceptance criteria"
    example: "FR-001: API must return order list within 200ms (p95)"
    
  - check: "Non-functional requirements"
    validation: "NFRs for performance, security, scalability defined"
    required_nfrs: ["Performance", "Security", "Scalability", "Availability", "Maintainability"]
    
  - check: "Success criteria"
    validation: "Measurable outcomes defined (not vague)"
    example_good: "Reduce checkout time by 30% (from 120s to 84s)"
    example_bad: "Improve user experience" (NOT measurable)
    
  - check: "Constraints documented"
    validation: "Budget, timeline, technology stack specified"
    
  - check: "Stakeholders identified"
    validation: "Engineering Lead, Product Manager, target users listed"
    
  - check: "Assumptions documented"
    validation: "≥3 assumptions explicitly stated"
    example: "Assume payment gateway (Stripe) has 99.9% uptime"
    
  - check: "Out of scope"
    validation: "Features explicitly excluded to prevent scope creep"
    
  - check: "Approval status"
    validation: "Product Manager approval recorded"

prd_verification_receipt:
  status: PASS
  checks_passed: 10
  checks_failed: 0
  evidence:
    file_path: "/docs/PRD.md"
    file_size: "24KB"
    user_stories: 18
    functional_requirements: 7
    nfrs: 6
    success_criteria: 5
    stakeholders: 8
  recommendation: "PRD complete, proceed to solution architecture"

prd_verification_receipt:
  status: FAIL
  checks_passed: 7
  checks_failed: 3
  violations:
    - check: "Success criteria"
      reason: "Vague: 'Improve performance' (not measurable)"
      remediation: "Specify target: 'Reduce p95 latency from 500ms to 200ms'"
      
    - check: "NFRs"
      reason: "Missing security NFR (no mention of authentication, RBAC, encryption)"
      remediation: "Add security NFR: JWT auth, RBAC with 3 roles, PII encryption at rest"
      
    - check: "Approval status"
      reason: "Product Manager approval not recorded"
      remediation: "Get Product Manager sign-off before proceeding"
  
  recommendation: "FAIL - Fix 3 issues, then re-verify. Do NOT proceed to architecture."

architecture_verification:
  - check: "File exists"
    path: "/docs/ARCHITECTURE.md"
    validation: "File size >20KB (comprehensive)"
    
  - check: "C4 Context diagram"
    validation: "System context showing users, external systems, boundaries"
    
  - check: "C4 Container diagram"
    validation: "Containers (web app, API, database, cache) with relationships"
    
  - check: "C4 Component diagram"
    validation: "Components within each container (controllers, services, repositories)"
    
  - check: "Technology stack"
    validation: "Languages, frameworks, databases, infrastructure specified"
    example: "Node.js 20, TypeScript 5.3, Express 4.x, PostgreSQL 16, Redis 7, Docker"
    
  - check: "Architecture Decision Records (ADRs)"
    validation: "≥3 ADRs documenting key decisions"
    example_adr: "ADR-001: Chose PostgreSQL over MongoDB for ACID transactions"
    
  - check: "Security architecture"
    validation: "Authentication, authorization, encryption, secrets management documented"
    
  - check: "Data flow diagrams"
    validation: "Critical user journeys documented (e.g., checkout flow, auth flow)"
    
  - check: "Failure modes"
    validation: "≥3 failure scenarios with mitigation (database down, API timeout, cache miss)"
    
  - check: "Scalability plan"
    validation: "Horizontal scaling approach (load balancer, stateless services, DB read replicas)"
    
  - check: "Observability design"
    validation: "Logging, metrics, tracing, health endpoints specified"
    
  - check: "Alignment with SPEC"
    validation: "All user stories from PRD mapped to architecture components"

spec_architecture_alignment:
  spec_user_stories: 18
  architecture_components: 4  # orders, products, users, payments
  
  mapping:
    - user_story: "US-001: View product catalog"
      component: "ProductService"
      endpoints: ["GET /api/products", "GET /api/products/:id"]
      
    - user_story: "US-002: Add product to cart"
      component: "OrderService"
      endpoints: ["POST /api/cart/items"]
  
  validation: "18 user stories ↔ 18 endpoints (1:1 mapping) = PASS"

code_verification:
  - check: "Files exist"
    path: "/src/**/*.ts"
    validation: "≥10 implementation files (non-trivial project)"
    
  - check: "TypeScript strict mode"
    validation: "tsconfig.json has strict: true, no `any` types used"
    
  - check: "Linter clean"
    validation: "eslint reports 0 errors (warnings OK if documented)"
    
  - check: "Code formatting"
    validation: "Prettier applied, consistent style (2 spaces, single quotes)"
    
  - check: "Code review"
    validation: "≥1 approver (2+ for critical changes), review comments addressed"
    
  - check: "Architecture alignment"
    validation: "Code structure matches architecture diagram (4 services → 4 src/ folders)"
    
  - check: "Test coverage"
    validation: "≥80% line coverage, ≥70% branch coverage"
    
  - check: "Security implemented"
    validation: "JWT auth, RBAC middleware, input validation, SQL injection prevention"
    
  - check: "Error handling"
    validation: "Try-catch blocks, error middleware, 4xx/5xx responses structured (RFC 7807)"
    
  - check: "Logging"
    validation: "Structured logs (JSON), PII masked, correlation IDs, log levels (DEBUG/INFO/WARN/ERROR)"
    
  - check: "Environment variables"
    validation: "No hardcoded secrets, .env.example provided, validation on startup"
    
  - check: "Database migrations"
    validation: "Prisma migrations exist, backward-compatible, rollback tested"
    
  - check: "API documentation"
    validation: "OpenAPI spec OR README with endpoint documentation"
    
  - check: "Dependencies"
    validation: "No critical/high vulnerabilities (npm audit / Snyk)"
    
  - check: "Docker support"
    validation: "Dockerfile + docker-compose.yml exist, multi-stage build, non-root user"

test_verification:
  - check: "Test files exist"
    path: "/tests/**/*.test.ts"
    validation: "≥10 test files (non-trivial coverage)"
    
  - check: "Test types coverage"
    validation: "Unit tests (isolated), Integration tests (API), E2E tests (user flows)"
    
  - check: "Coverage threshold"
    validation: "≥80% line coverage enforced in CI/CD pipeline (jest.config.js)"
    
  - check: "Test quality"
    validation: "No empty tests, no skipped tests (.skip / .todo removed before merge)"
    
  - check: "SPEC alignment"
    validation: "Each user story has ≥1 test suite (18 user stories → 18 test suites)"
    
  - check: "Edge cases"
    validation: "Error cases tested (400/404/500 responses, validation failures, auth failures)"
    
  - check: "Security tests"
    validation: "Auth tests (JWT validation, RBAC, expired tokens), SQL injection tests, XSS tests"
    
  - check: "Performance tests"
    validation: "Load tests (k6 / Artillery), benchmark target: 1000 req/s p95 <200ms"
    
  - check: "Test data"
    validation: "Fixtures / factories for test data (no hardcoded IDs, use faker.js)"
    
  - check: "CI/CD integration"
    validation: "Tests run on every commit, failures block merge"

spec_test_alignment:
  spec_user_stories:
    - "US-001: View product catalog"
    - "US-002: Add to cart"
    - "US-003: Checkout with Stripe"
    # ... 15 more
  
  test_suites:
    - "products.test.ts: describe('Product Catalog', ...)"  # US-001
    - "cart.test.ts: describe('Cart Management', ...)"      # US-002
    - "checkout.test.ts: describe('Checkout Flow', ...)"    # US-003
    # ... 15 more
  
  alignment_score: "18/18 user stories have test coverage = PASS"
  
  missing_tests: []
  extra_tests: ["auth.test.ts"]  # OK, security not in user stories but required for security

test_verification_receipt:
  status: FAIL
  checks_passed: 8
  checks_failed: 2
  
  violations:
    - check: "Coverage threshold"
      current: "78.3%"
      target: "80.0%"
      gap: "1.7%"
      remediation: "Add 15 tests to /src/utils/validators.ts (currently 45% coverage)"
      
    - check: "SPEC alignment"
      user_stories_with_tests: 16
      user_stories_without_tests: 2
      missing:
        - "US-015: Apply discount code"
        - "US-017: Generate invoice PDF"
      remediation: "Add test suites: discounts.test.ts, invoices.test.ts"
  
  recommendation: "FAIL - Add missing tests, then re-verify"

deploy_verification:
  # Code quality (5 checks)
  - check: "All previous verifications PASS"
    validation: "PRD ✅, Architecture ✅, Code ✅, Test ✅"
    
  - check: "Code review approved"
    validation: "≥1 approver, no unresolved comments"
    
  - check: "Branch protection"
    validation: "Main branch protected, requires PR with review"
    
  - check: "No WIP commits"
    validation: "No commits with 'WIP', 'TODO', 'FIXME' in message"
    
  - check: "Version bumped"
    validation: "package.json version updated (semver: major.minor.patch)"
    
  # Security (5 checks)
  - check: "Security scans PASS"
    validation: "SAST (CodeQL/Snyk), DAST (OWASP ZAP), dependency scan (npm audit)"
    
  - check: "Secrets management"
    validation: "No secrets in .env committed, secrets in vault (AWS Secrets Manager / HashiCorp Vault)"
    
  - check: "Authentication tested"
    validation: "JWT validation, RBAC, MFA (if required) tested"
    
  - check: "Vulnerability scan"
    validation: "Docker image scanned (Trivy / Snyk), no critical/high vulnerabilities"
    
  - check: "Security approval"
    validation: "Security team approved (for security-sensitive changes)"
    
  # Infrastructure (5 checks)
  - check: "CI/CD pipeline PASS"
    validation: "All tests passed, build successful, artifacts published"
    
  - check: "Staging deployment successful"
    validation: "Deployed to staging, smoke tests passed, no errors in logs"
    
  - check: "Database migrations tested"
    validation: "Migrations ran in staging, backward-compatible, rollback tested"
    
  - check: "Rollback plan documented"
    validation: "Step-by-step rollback instructions, MTTR target <5 min"
    
  - check: "Monitoring configured"
    validation: "Error rate, latency, traffic alerts configured (Prometheus / Datadog)"
    
  # Business (5 checks)
  - check: "Product approval"
    validation: "Product Manager approved (for user-facing changes)"
    
  - check: "Release notes prepared"
    validation: "Changelog, migration guide, breaking changes documented"
    
  - check: "Stakeholders notified"
    validation: "Engineering, Customer Success, Support teams notified 4h before deployment"
    
  - check: "On-call assigned"
    validation: "On-call engineer acknowledged, PagerDuty configured"
    
  - check: "Release window validated"
    validation: "Deployment scheduled during low-traffic window (2am UTC Sat night)"

deploy_gate_decision:
  status: GO | NO-GO | CONDITIONAL
  
  criteria_passed: 18 / 20
  criteria_failed: 2
  
  blocking_failures:
    - check: "Security scans PASS"
      status: FAIL
      reason: "Snyk found 1 high vulnerability (CVE-2025-1234 in lodash@4.17.20)"
      remediation: "Update lodash to 4.17.21+ (npm update lodash)"
      eta: "30 minutes"
      
    - check: "Test coverage"
      status: FAIL
      reason: "Coverage 78.3% (target 80%)"
      remediation: "Add 15 tests to validators.ts"
      eta: "2 hours"
  
  decision: NO-GO
  recommendation: "Fix 2 blocking issues (ETA 2.5h), then re-verify. Do NOT deploy until both PASS."

invariant_check_inv_001:
  invariant: "INV-001: JWT Authentication Required"
  description: "All API endpoints (except /health, /login) must require JWT authentication"
  
  validation_steps:
    1. "Check /src/middleware/auth.ts exists"
    2. "Verify JWT verification logic (jsonwebtoken library, RS256 algorithm)"
    3. "Check Express app.use() applies auth middleware globally"
    4. "Verify exceptions: /health, /login, /register excluded"
    5. "Check tests: /tests/auth.test.ts validates expired tokens, invalid signatures, missing tokens"
  
  evidence:
    code: "/src/middleware/auth.ts (48 lines)"
    tests: "/tests/auth.test.ts (12 test cases)"
    config: "/src/app.ts applies middleware: app.use('/api', authMiddleware)"
  
  result: PASS

invariant_violation_inv_001:
  invariant: "INV-001"
  status: FAIL
  reason: "Auth middleware not applied to /api/orders endpoint"
  evidence: "/src/routes/orders.ts missing authMiddleware import"
  impact: "Unauthenticated users can view all orders (security breach)"
  severity: CRITICAL
  remediation: |
    1. Import authMiddleware: `import { authMiddleware } from '../middleware/auth';`
    2. Apply to router: `router.use(authMiddleware);`
    3. Add test: `/tests/orders.test.ts should return 401 for unauthenticated request`
  blocking: true

invariant_check_inv_002:
  invariant: "INV-002: Role-Based Access Control (RBAC)"
  description: "System must enforce role-based permissions (admin, manager, user)"
  
  validation_steps:
    1. "Check /src/middleware/rbac.ts exists"
    2. "Verify 3 roles defined: admin (full access), manager (read/write), user (read only)"
    3. "Check permission checks on sensitive endpoints (DELETE, PUT require admin)"
    4. "Verify role stored in JWT token payload"
    5. "Check tests: All 3 roles tested with access control scenarios"
  
  evidence:
    code: "/src/middleware/rbac.ts (authorization logic)"
    tests: "/tests/rbac.test.ts (9 test cases: 3 roles × 3 operations)"
    endpoints: "DELETE /api/orders/:id requires 'admin' role"
  
  result: PASS

invariant_violation_inv_002:
  invariant: "INV-002"
  status: FAIL
  reason: "RBAC tests incomplete (manager role not tested)"
  evidence: "/tests/rbac.test.ts has tests for admin + user, missing manager"
  impact: "Cannot verify manager permissions work correctly"
  severity: MEDIUM
  remediation: |
    Add 3 test cases to /tests/rbac.test.ts:
    1. `it('allows manager to update order')`
    2. `it('prevents manager from deleting order')` (only admin can delete)
    3. `it('allows manager to view all orders')`
  blocking: false  # Can deploy but must fix within 1 week

invariant_check_inv_021:
  invariant: "INV-021: Automated Testing (80%+ Coverage)"
  description: "Code coverage must be ≥80% line coverage, ≥70% branch coverage"
  
  validation_steps:
    1. "Run coverage report: `npm test -- --coverage`"
    2. "Check jest.config.js has coverageThreshold: { global: { lines: 80, branches: 70 } }"
    3. "Verify CI/CD pipeline enforces threshold (build fails if coverage <80%)"
    4. "Check coverage report uploaded to Codecov for trend tracking"
  
  evidence:
    coverage_report: "Lines: 80.5% (2,123/2,637), Branches: 72.1% (568/788)"
    ci_config: "/.github/workflows/ci.yml fails build if coverage <80%"
    codecov: "https://codecov.io/gh/myorg/myapp"
  
  result: PASS

invariant_violation_inv_021:
  invariant: "INV-021"
  status: FAIL
  reason: "Code coverage 78.3% (target 80%)"
  evidence: |
    Coverage report:
    - Lines: 78.3% (2,065/2,637) - BELOW THRESHOLD
    - Branches: 72.1% (568/788) - OK
    
    Uncovered files:
    - /src/utils/validators.ts: 45% coverage (31/68 lines)
    - /src/utils/formatters.ts: 60% coverage (24/40 lines)
  
  impact: "Risk of untested code paths causing bugs in production"
  severity: HIGH
  remediation: |
    Add 15 tests to reach 80.1% coverage:
    1. /tests/validators.test.ts: Add 8 tests for email, phone, date validators
    2. /tests/formatters.test.ts: Add 7 tests for currency, date, number formatters
    
    Command: `npx jest --coverage --collectCoverageFrom='src/utils/**'`
  blocking: true

invariant_check_inv_042:
  invariant: "INV-042: Security Testing Mandatory"
  description: "SAST, DAST, dependency scans required before production deployment"
  
  validation_steps:
    1. "Check SAST scan ran (CodeQL / Snyk / Semgrep)"
    2. "Check DAST scan ran (OWASP ZAP / Burp Suite)"
    3. "Check dependency scan ran (npm audit / Snyk / Safety)"
    4. "Verify no critical/high vulnerabilities in reports"
    5. "Check SARIF report uploaded for audit trail"
  
  evidence:
    sast: "CodeQL scan: 0 critical, 0 high, 2 medium (false positives documented)"
    dast: "OWASP ZAP scan: No SQL injection, XSS, CSRF vulnerabilities"
    dependencies: "npm audit: 0 vulnerabilities (585 packages scanned)"
    sarif: "/docs/security-scan.sarif (uploaded to GitHub Security tab)"
  
  result: PASS

invariant_violation_inv_042:
  invariant: "INV-042"
  status: FAIL
  reason: "Security scan report missing (SAST not run)"
  evidence: "No CodeQL / Snyk SARIF report in /docs or GitHub Security tab"
  impact: "Cannot verify application is free from security vulnerabilities"
  severity: CRITICAL
  remediation: |
    1. Run Snyk SAST scan:
       ```bash
       npm install -g snyk
       snyk test --sarif-file-output=snyk.sarif
       ```
    
    2. Upload SARIF to GitHub:
       ```bash
       gh api repos/:owner/:repo/code-scanning/sarifs --field sarif=@snyk.sarif
       ```
    
    3. Review report, fix critical/high vulnerabilities
    
    4. Re-verify after scan complete (ETA: 30 minutes)
  blocking: true

spec_test_consistency:
  spec_user_stories: 18
  test_suites: 18
  
  mapping:
    - user_story: "US-001: View product catalog"
      test_suite: "products.test.ts: GET /api/products"
      status: MAPPED
      
    - user_story: "US-002: Add to cart"
      test_suite: "cart.test.ts: POST /api/cart/items"
      status: MAPPED
    
    # ... 16 more mappings
  
  unmapped_user_stories: []
  unmapped_test_suites: ["auth.test.ts"]  # OK, security testing not in user stories
  
  alignment_status: PASS
  alignment_score: "18/18 user stories have test coverage (100%)"

spec_test_misalignment:
  unmapped_user_stories:
    - "US-015: Apply discount code"
    - "US-017: Generate invoice PDF"
  
  impact: "2 user stories without tests = risk of unvalidated functionality in production"
  severity: HIGH
  remediation: |
    Add 2 test suites:
    1. /tests/discounts.test.ts: Test discount code validation, percentage calculation, max discount limit
    2. /tests/invoices.test.ts: Test PDF generation, email delivery, S3 upload
  
  status: FAIL

architecture_code_consistency:
  architecture_components:
    - "OrderService (handles orders, cart, checkout)"
    - "ProductService (product catalog, search, inventory)"
    - "UserService (authentication, authorization, profiles)"
    - "PaymentService (Stripe integration, invoices, refunds)"
  
  code_modules:
    - "/src/orders/ (orders.controller.ts, orders.service.ts, orders.repository.ts)"
    - "/src/products/ (products.controller.ts, products.service.ts, products.repository.ts)"
    - "/src/users/ (users.controller.ts, users.service.ts, users.repository.ts)"
    - "/src/payments/ (payments.controller.ts, payments.service.ts, payments.repository.ts)"
  
  alignment_status: PASS
  alignment_score: "4/4 services ↔ 4 code modules (100% match)"

architecture_code_misalignment:
  architecture_has_but_code_missing:
    - "NotificationService (email, SMS, push notifications)"
  
  code_has_but_architecture_missing: []
  
  impact: "Architecture mentions NotificationService but no implementation exists"
  severity: MEDIUM
  remediation: |
    Option 1: Remove NotificationService from architecture (defer to v2.6.0)
    Option 2: Implement /src/notifications/ with email service (8h effort)
  
  status: FAIL

domain_schema_consistency:
  domain_entities:
    - "Order (aggregate root: orderId, customerId, status, total)"
    - "OrderItem (orderId, productId, quantity, price)"
    - "Product (productId, name, price, inventory)"
    - "Customer (customerId, email, name, role)"
    - "Payment (paymentId, orderId, amount, stripePaymentIntentId)"
    - "Tenant (tenantId, name, subscriptionPlan)"
    - "AuditLog (for INV-029 compliance)"
    - "Session (for MFA support)"
  
  database_tables:
    - "orders (id, tenant_id, customer_id, status, total, created_at)"
    - "order_items (id, order_id, product_id, quantity, price)"
    - "products (id, tenant_id, name, price, inventory_count)"
    - "users (id, tenant_id, email, password_hash, role)"
    - "payments (id, order_id, amount, stripe_payment_intent_id)"
    - "tenants (id, name, subscription_plan)"
    - "sessions (id, user_id, token, expires_at)"
  
  missing_in_database:
    - "AuditLog (required for INV-029: 7-year audit retention)"
  
  alignment_status: FAIL
  remediation: |
    Add audit_logs table to Prisma schema:
    ```prisma
    model AuditLog {
      id        String   @id @default(cuid())
      tenantId  String
      userId    String
      action    String   // CREATE, UPDATE, DELETE
      resource  String   // orders, products, users
      resourceId String
      changes   Json     // Old vs new values
      ipAddress String
      createdAt DateTime @default(now())
      
      tenant Tenant @relation(fields: [tenantId], references: [id])
      user   User   @relation(fields: [userId], references: [id])
      
      @@index([tenantId])
      @@index([userId])
      @@index([createdAt])
    }
    ```
  
  status: FAIL

it('should throw DatabaseConnectionError when connection fails', async () => {
  const client = new DatabaseClient({ connectionString: 'invalid' });
  await expect(client.connect()).rejects.toThrow(DatabaseConnectionError);
});

# Bad: No file path validation
checks:
  - check: "Test coverage"
    status: PASS
    evidence: "Tests exist"  # Vague, not verifiable

# Good: Concrete file paths with metrics
checks:
  - check: "Test coverage"
    status: PASS
    evidence: "59 tests in /tests/**/*.test.ts, coverage: 87.68%/72.95%/91.54%/87.75%"

# Bad: Non-measurable success criteria
success_criteria:
  - "Improve performance"  # HOW MUCH?
  - "Better user experience"  # NOT MEASURABLE

# Good: Specific, measurable targets
success_criteria:
  - "Reduce migration execution time from 5s to <2s for 100 migrations (60% improvement)"
  - "Achieve 80%+ test coverage (statements, branches, functions, lines)"

# Bad: Marking PASS despite violations
checks:
  - check: "Branch coverage"
    status: PASS  # Lying!
    actual: "67.62%"
    threshold: "70%"

# Good: Honest failure, remediation plan
checks:
  - check: "Branch coverage"
    status: FAIL
    actual: "67.62%"
    threshold: "70%"
    gap: "2.38% (6 branches)"
    remediation: "Add error path tests for database.ts (connection failures, query errors)"
    blocking: true

# Future CLI tool (not yet implemented)
npx verify-stage CODE --project . --output VERIFICATION_RECEIPT_CODE.md

# Features:
# - Auto-discover evidence paths (test files, build artifacts)
# - Parse coverage reports (jest-coverage.json)
# - Validate against invariants (INV-001 to INV-042)
# - Generate YAML receipt with PASS/FAIL status
# - Suggest remediations for violations

openspec_detection:
  indicators:
    - folder_exists: "openspec/" or ".openspec/"
    - package_json: "dependencies['@fission-ai/openspec']" exists
    - change_folders: "openspec/changes/" contains active changes
  
  detection_result:
    is_openspec_project: true
    active_changes:
      - "add-payment-gateway"
      - "implement-dark-mode"

active_change_context:
  change_name: "add-payment-gateway"
  change_path: "openspec/changes/add-payment-gateway"
  artifacts_present:
    proposal_md: true
    specs_folder: true
    design_md: true
    tasks_md: true
  spec_files:
    requirements: "openspec/changes/add-payment-gateway/specs/requirements.md"
    scenarios: "openspec/changes/add-payment-gateway/specs/scenarios.md"

openspec_verification:
  # Artifact validation (5 checks)
  - check: "Proposal exists"
    path: "openspec/changes/{change-name}/proposal.md"
    validation: "File size >1KB, has Intent/Scope/Approach sections"
    
  - check: "Requirements defined"
    path: "openspec/changes/{change-name}/specs/requirements.md"
    validation: "≥3 requirements with SHALL/MUST/SHOULD keywords (RFC 2119)"
    
  - check: "Scenarios defined"
    path: "openspec/changes/{change-name}/specs/scenarios.md"
    validation: "≥5 scenarios with GIVEN/WHEN/THEN format"
    
  - check: "Design documented"
    path: "openspec/changes/{change-name}/design.md"
    validation: "Technical approach, architecture decisions, file changes listed"
    
  - check: "Tasks defined"
    path: "openspec/changes/{change-name}/tasks.md"
    validation: "≥5 tasks with hierarchical numbering (1.1, 1.2, etc.)"
  
  # Implementation validation (5 checks)
  - check: "All requirements implemented"
    validation: "For each requirement in specs/requirements.md, corresponding code exists"
    mapping: |
      Requirement: "The system SHALL issue JWT token upon login"
      Code: src/auth/login.ts implements JWT.sign()
      Test: tests/auth.test.ts validates token issuance
    
  - check: "All scenarios covered by tests"
    validation: "For each scenario in specs/scenarios.md, corresponding test exists"
    mapping: |
      Scenario: "GIVEN valid credentials WHEN user submits login THEN JWT returned"
      Test: tests/auth.test.ts describe('Login with valid credentials', ...)
    
  - check: "Architecture matches design"
    validation: "File structure, tech stack, patterns match design.md decisions"
    example: |
      Design.md: "Use Express + Stripe SDK + PostgreSQL"
      Code: package.json has express@4.18, stripe@11.1, pg@8.10
    
  - check: "All tasks checked off"
    validation: "All [x] checkboxes in tasks.md are checked"
    current: "15/15 tasks completed (100%)"
    
 - check: "No spec drift"
    validation: "Code doesn't implement features NOT in OpenSpec specs"
    anti_pattern: "Code has 'admin panel' but specs don't mention admin features"
  
  # OpenSpec metadata (5 checks)
  - check: "Change not archived prematurely"
    validation: "Change still in openspec/changes/, not in openspec/changes/archive/"
    
  - check: "Delta specs format"
    validation: "If modifying existing specs, use ADDED/MODIFIED/REMOVED sections"
    
  - check: "Proposal scope respected"
    validation: "Implementation doesn't exceed 'In Scope' or implement 'Out of Scope'"
    
  - check: "Design decisions justified"
    validation: "All tech stack choices in code match design.md rationale"
    
  - check: "OpenSpec CLI version"
    validation: "package.json has @fission-ai/openspec ≥1.0.0 (latest stable)"

verification_receipt:
  status: PASS
  verification_id: "VER-2026-OPENSPEC-001"
  timestamp: "2026-02-05T10:15:00Z"
  project_type: "openspec_integration"
  
  openspec_context:
    change_name: "add-payment-gateway"
    change_path: "openspec/changes/add-payment-gateway"
    artifacts_verified:
      proposal_md: "openspec/changes/add-payment-gateway/proposal.md (3.5KB)"
      requirements_md: "openspec/changes/add-payment-gateway/specs/requirements.md (8 requirements)"
      scenarios_md: "openspec/changes/add-payment-gateway/specs/scenarios.md (12 scenarios)"
      design_md: "openspec/changes/add-payment-gateway/design.md (Architecture decisions)"
      tasks_md: "openspec/changes/add-payment-gateway/tasks.md (15/15 tasks completed)"
  
  checks_performed:
    - check: "All OpenSpec requirements implemented"
      status: PASS
      evidence: |
        Requirement #1: "System SHALL integrate Stripe API for payments"
        → Code: src/payment-gateway.ts uses Stripe SDK v11.1
        → Test: tests/payment-gateway.test.ts validates Stripe API calls
        
        Requirement #2: "System MUST store payment records in PostgreSQL"
        → Code: prisma/schema.prisma has Payment model
        → Test: tests/payment.test.ts validates database writes
        
        ... (6 more requirements verified)
      
    - check: "All OpenSpec scenarios covered by tests"
      status: PASS
      evidence: |
        Scenario #1: "GIVEN valid card WHEN user pays THEN payment succeeds"
        → Test: tests/payment-gateway.test.ts describe('Successful payment', ...)
        
        Scenario #2: "GIVEN invalid card WHEN user pays THEN error returned"
        → Test: tests/payment-gateway.test.ts describe('Card declined', ...)
        
        ... (10 more scenarios verified)
      
    - check: "Architecture matches OpenSpec design.md"
      status: PASS
      evidence: |
        Design Decision #1: "Use Express + Stripe SDK + PostgreSQL"
        → package.json: express@4.18, stripe@11.1, pg@8.10 ✅
        
        Design Decision #2: "Implement webhook handler for async events"
        → Code: src/webhooks/stripe.ts handles payment.succeeded ✅
        
        Design Decision #3: "Use Prisma ORM for type-safe queries"
        → prisma/schema.prisma exists, TypeScript types generated ✅
      
    - check: "All tasks.md items completed"
      status: PASS
      evidence: |
        Tasks completed: 15/15 (100%)
        [x] 1.1 Install Stripe SDK
        [x] 1.2 Configure Stripe API keys
        [x] 2.1 Implement payment endpoint
        [x] 2.2 Add Prisma Payment model
        ... (11 more tasks checked off)
  
  evidence_verified:
    intent_contract: "openspec/changes/add-payment-gateway/proposal.md"
    requirements: "openspec/changes/add-payment-gateway/specs/requirements.md"
    test_scenarios: "openspec/changes/add-payment-gateway/specs/scenarios.md"
    architecture: "openspec/changes/add-payment-gateway/design.md"
    implementation: "src/payment-gateway.ts, src/webhooks/stripe.ts"
    tests: "tests/payment-gateway.test.ts, tests/webhooks.test.ts"
    database: "prisma/schema.prisma (Payment model)"
  
  recommendation: |
    ✅ PASS - Feature fully implemented per OpenSpec change artifacts.
    
    Next steps:
    1. Archive OpenSpec change: `npx openspec archive add-payment-gateway`
    2. Merge delta specs into main specs: `openspec/changes/archive/`
    3. Deploy to production: Ready for release
  
  notes: |
    This verification used OpenSpec artifacts as primary source of truth instead of 
    generating PRD/ARCHITECTURE.md. SDLC swarm supplemented OpenSpec with:
    - Evidence-gated validation (this receipt)
    - Test generation from scenarios (automated)
    - Invariant compliance checking (INV-001 to INV-042)

verification_receipt:
  status: FAIL
  verification_id: "VER-2026-OPENSPEC-002"
  timestamp: "2026-02-05T10:30:00Z"
  project_type: "openspec_integration"
  
  openspec_context:
    change_name: "add-dark-mode"
    change_path: "openspec/changes/add-dark-mode"
  
  checks_performed:
    - check: "All OpenSpec requirements implemented"
      status: FAIL
      violations:
        - requirement: "System MUST persist theme preference in localStorage"
          missing: "No localStorage code found in src/contexts/ThemeContext.tsx"
          remediation: "Add localStorage.setItem('theme', theme) in ThemeProvider"
        
        - requirement: "System MUST detect system preference on first load"
          missing: "No window.matchMedia('(prefers-color-scheme: dark)') check"
          remediation: "Add system preference detection in useEffect hook"
    
    - check: "All OpenSpec scenarios covered by tests"
      status: FAIL
      violations:
        - scenario: "GIVEN user toggles theme WHEN page reloads THEN preference persists"
          missing: "No test for localStorage persistence in tests/ThemeContext.test.tsx"
          remediation: "Add test: 'should persist theme preference across page reloads'"
    
    - check: "All tasks.md items completed"
      status: FAIL
      current: "7/10 tasks completed (70%)"
      uncompleted_tasks:
        - "[ ] 2.2 Add CSS custom properties for dark theme colors"
        - "[ ] 3.1 Test contrast ratios for accessibility"
        - "[ ] 3.2 Add ThemeToggle to settings page"
      remediation: "Complete remaining 3 tasks before re-verification"
  
  recommendation: |
    ❌ FAIL - Implementation incomplete. 3 requirements not met, 1 scenario missing tests, 3 tasks uncompleted.
    
    Next actions:
    1. Add localStorage persistence (2 hours)
    2. Add system preference detection (1 hour)
    3. Add missing test case (30 min)
    4. Complete tasks 2.2, 3.1, 3.2 (3 hours)
    5. Re-verify after fixes (ETA: 1 day)