devrites 3.0.4 → 3.0.6

package/engine/internal/lib/packageexistence_test.go

@@ -0,0 +1,343 @@
+package lib
+
+import (
+	"bytes"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestPackageExistenceJavaScriptWorkspaces(t *testing.T) {
+	tests := []struct {
+		name        string
+		sourcePath  string
+		workingDir  string
+		importLine  string
+		files       map[string]string
+		wantCode    int
+		wantFinding string
+	}{
+		{
+			name:       "nested workspace",
+			sourcePath: "frontend/src/example.ts",
+			workingDir: "frontend",
+			importLine: `import { Dialog } from "@ark-ui/svelte/dialog";`,
+			files: map[string]string{
+				"frontend/package.json": `{"dependencies":{"@ark-ui/svelte":"^5.22.1"}}`,
+			},
+		},
+		{
+			name:       "scoped package subpath",
+			sourcePath: "app/src/example.ts",
+			importLine: `import value from "@scope/package/subpath";`,
+			files: map[string]string{
+				"app/package.json": `{"devDependencies":{"@scope/package":"1.0.0"}}`,
+			},
+		},
+		{
+			name:       "wildcard alias",
+			sourcePath: "frontend/src/example.ts",
+			importLine: `import Button from "$lib/components/button";`,
+			files: map[string]string{
+				"frontend/package.json":              `{}`,
+				"frontend/tsconfig.json":             "{\n  // SvelteKit generates the inherited aliases.\n  \"extends\": \"./.svelte-kit/tsconfig.json\"\n}",
+				"frontend/.svelte-kit/tsconfig.json": `{"compilerOptions":{"paths":{"$lib/*":["../src/lib/*"]}}}`,
+			},
+		},
+		{
+			name:       "exact alias",
+			sourcePath: "frontend/src/example.ts",
+			importLine: `import library from "$lib";`,
+			files: map[string]string{
+				"frontend/package.json":  `{}`,
+				"frontend/tsconfig.json": `{"compilerOptions":{"paths":{"$lib":["./src/lib"]}}}`,
+			},
+		},
+		{
+			name:       "package shaped alias",
+			sourcePath: "frontend/src/example.svelte",
+			importLine: `import { css } from "styled-system/css";`,
+			files: map[string]string{
+				"frontend/package.json":  `{}`,
+				"frontend/jsconfig.json": `{"compilerOptions":{"paths":{"styled-system/*":["./styled-system/*"]}}}`,
+			},
+		},
+		{
+			name:        "undeclared dependency",
+			sourcePath:  "frontend/src/example.ts",
+			importLine:  `import missing from "definitely-missing-package";`,
+			files:       map[string]string{"frontend/package.json": `{}`},
+			wantCode:    3,
+			wantFinding: "definitely-missing-package",
+		},
+		{
+			name:       "sibling isolation",
+			sourcePath: "workspace-a/src/example.ts",
+			importLine: `import sibling from "sibling-only-package";`,
+			files: map[string]string{
+				"workspace-a/package.json": `{}`,
+				"workspace-b/package.json": `{"dependencies":{"sibling-only-package":"1.0.0"}}`,
+			},
+			wantCode:    3,
+			wantFinding: "sibling-only-package",
+		},
+		{
+			name:       "malformed config does not allow alias",
+			sourcePath: "frontend/src/example.ts",
+			importLine: `import { css } from "styled-system/css";`,
+			files: map[string]string{
+				"frontend/package.json":  `{}`,
+				"frontend/tsconfig.json": `{"compilerOptions":{"paths":{"styled-system/*":["./styled-system/*"]}}`,
+			},
+			wantCode:    3,
+			wantFinding: "styled-system",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			repo := t.TempDir()
+			writePackageExistenceFile(t, repo, "Cargo.toml", "[package]\nname = \"fixture\"\nversion = \"0.1.0\"\n")
+			writePackageExistenceFile(t, repo, test.sourcePath, "// baseline\n")
+			for path, content := range test.files {
+				writePackageExistenceFile(t, repo, path, content+"\n")
+			}
+			gitPackageExistence(t, repo, "init", "-q")
+			gitPackageExistence(t, repo, "config", "user.email", "test@example.com")
+			gitPackageExistence(t, repo, "config", "user.name", "Test")
+			gitPackageExistence(t, repo, "add", ".")
+			gitPackageExistence(t, repo, "commit", "-qm", "baseline")
+			if err := os.MkdirAll(featureDir(repo, "feat"), 0o755); err != nil {
+				t.Fatal(err)
+			}
+			writePackageExistenceFile(t, repo, test.sourcePath, "// baseline\n"+test.importLine+"\n")
+			t.Chdir(filepath.Join(repo, test.workingDir))
+
+			var stdout, stderr bytes.Buffer
+			gotCode := PackageExistence(repo, []string{"feat"}, &stdout, &stderr)
+			if gotCode != test.wantCode {
+				t.Fatalf("code = %d, want %d\nstdout: %s\nstderr: %s", gotCode, test.wantCode, stdout.String(), stderr.String())
+			}
+			if test.wantFinding != "" && !strings.Contains(stderr.String(), test.wantFinding) {
+				t.Fatalf("stderr does not name %q: %s", test.wantFinding, stderr.String())
+			}
+		})
+	}
+}
+
+func TestPackageExistenceNonJavaScriptWorkspaces(t *testing.T) {
+	tests := []struct {
+		name        string
+		sourcePath  string
+		addedSource string
+		files       map[string]string
+		wantCode    int
+		wantFinding string
+	}{
+		{
+			name:        "go import block rejects undeclared module",
+			sourcePath:  "main.go",
+			addedSource: "package main\n\nimport (\n\t\"definitely.invalid/missing\"\n)\n",
+			files:       map[string]string{"go.mod": "module example.com/app\n\ngo 1.26\n"},
+			wantCode:    3,
+			wantFinding: "definitely.invalid/missing",
+		},
+		{
+			name:        "go modules do not collide by hostname",
+			sourcePath:  "main.go",
+			addedSource: "package main\n\nimport \"github.com/evil/missing\"\n",
+			files:       map[string]string{"go.mod": "module example.com/app\n\ngo 1.26\n\nrequire github.com/good/pkg v1.0.0\n"},
+			wantCode:    3,
+			wantFinding: "github.com/evil/missing",
+		},
+		{
+			name:        "nested go module declaration",
+			sourcePath:  "backend/main.go",
+			addedSource: "package main\n\nimport \"github.com/good/pkg/sub\"\n",
+			files: map[string]string{
+				"Cargo.toml":     "[package]\nname = \"root\"\nversion = \"0.1.0\"\n",
+				"backend/go.mod": "module example.com/backend\n\ngo 1.26\n\nrequire github.com/good/pkg v1.0.0\n",
+			},
+		},
+		{
+			name:        "go standard library subpackage",
+			sourcePath:  "main.go",
+			addedSource: "package main\n\nimport \"encoding/json\"\n",
+			files:       map[string]string{"go.mod": "module example.com/app\n\ngo 1.26\n"},
+		},
+		{
+			name:        "go standard library typo remains undeclared",
+			sourcePath:  "main.go",
+			addedSource: "package main\n\nimport \"encoding/josn\"\n",
+			files:       map[string]string{"go.mod": "module example.com/app\n\ngo 1.26\n"},
+			wantCode:    3,
+			wantFinding: "encoding/josn",
+		},
+		{
+			name:        "malformed go manifest does not declare import",
+			sourcePath:  "main.go",
+			addedSource: "package main\n\nimport \"github.com/missing/pkg\"\n",
+			files:       map[string]string{"go.mod": "module example.com/app\n\ngo 1.26\n\nrequire (\n  github.com/missing/pkg v1.0.0\n"},
+			wantCode:    3,
+			wantFinding: "github.com/missing/pkg",
+		},
+		{
+			name:        "rust rejects undeclared crate",
+			sourcePath:  "src/main.rs",
+			addedSource: "use definitely_missing_crate::Thing;\n",
+			files:       map[string]string{"Cargo.toml": "[package]\nname = \"fixture\"\nversion = \"0.1.0\"\n\n[dependencies]\n"},
+			wantCode:    3,
+			wantFinding: "definitely_missing_crate",
+		},
+		{
+			name:        "nested rust dependency and hyphen normalization",
+			sourcePath:  "crates/app/src/main.rs",
+			addedSource: "use serde_json::Value;\n",
+			files: map[string]string{
+				"Cargo.toml":            "[workspace]\nmembers = [\"crates/app\"]\n",
+				"crates/app/Cargo.toml": "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n[dependencies.serde-json]\nversion = \"1\"\n",
+			},
+		},
+		{
+			name:        "python dotted import uses top-level module",
+			sourcePath:  "app.py",
+			addedSource: "from requests.sessions import Session\n",
+			files:       map[string]string{"requirements.txt": "requests==2.32.0\n"},
+		},
+		{
+			name:        "python standard library module",
+			sourcePath:  "app.py",
+			addedSource: "import asyncio\n",
+			files:       map[string]string{"requirements.txt": "requests==2.32.0\n"},
+		},
+		{
+			name:        "nested python manifest declaration",
+			sourcePath:  "backend/app.py",
+			addedSource: "import requests\n",
+			files: map[string]string{
+				"Cargo.toml":               "[package]\nname = \"root\"\nversion = \"0.1.0\"\n",
+				"backend/requirements.txt": "requests==2.32.0\n",
+			},
+		},
+		{
+			name:        "pyproject dependency declaration",
+			sourcePath:  "service/app.py",
+			addedSource: "import requests\n",
+			files: map[string]string{
+				"service/pyproject.toml": "[project]\ndependencies = [\n  \"requests[socks]>=2.32\",\n]\n",
+			},
+		},
+		{
+			name:        "pipfile dependency declaration",
+			sourcePath:  "service/app.py",
+			addedSource: "import requests\n",
+			files: map[string]string{
+				"service/Pipfile": "[packages]\nrequests = \"*\"\n",
+			},
+		},
+		{
+			name:        "malformed pyproject does not declare import",
+			sourcePath:  "service/app.py",
+			addedSource: "import definitely_missing\n",
+			files: map[string]string{
+				"service/pyproject.toml": "[project]\ndependencies = [\n  \"definitely_missing\"\n",
+			},
+			wantCode:    3,
+			wantFinding: "definitely_missing",
+		},
+		{
+			name:        "python multiple imports reject undeclared module",
+			sourcePath:  "app.py",
+			addedSource: "import requests, definitely_missing\n",
+			files:       map[string]string{"requirements.txt": "requests==2.32.0\n"},
+			wantCode:    3,
+			wantFinding: "definitely_missing",
+		},
+		{
+			name:        "comments and other ecosystems do not declare python imports",
+			sourcePath:  "app.py",
+			addedSource: "import definitely_missing\n",
+			files: map[string]string{
+				"Cargo.toml":       "[package]\nname = \"definitely_missing\"\nversion = \"0.1.0\"\n",
+				"requirements.txt": "# definitely_missing is intentionally absent\n",
+			},
+			wantCode:    3,
+			wantFinding: "definitely_missing",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			repo := t.TempDir()
+			for path, content := range test.files {
+				writePackageExistenceFile(t, repo, path, content)
+			}
+			writePackageExistenceFile(t, repo, test.sourcePath, "// baseline\n")
+			gitPackageExistence(t, repo, "init", "-q")
+			gitPackageExistence(t, repo, "config", "user.email", "test@example.com")
+			gitPackageExistence(t, repo, "config", "user.name", "Test")
+			gitPackageExistence(t, repo, "add", ".")
+			gitPackageExistence(t, repo, "commit", "-qm", "baseline")
+			if err := os.MkdirAll(featureDir(repo, "feat"), 0o755); err != nil {
+				t.Fatal(err)
+			}
+			writePackageExistenceFile(t, repo, test.sourcePath, test.addedSource)
+			t.Chdir(repo)
+
+			var stdout, stderr bytes.Buffer
+			gotCode := PackageExistence(repo, []string{"feat"}, &stdout, &stderr)
+			if gotCode != test.wantCode {
+				t.Fatalf("code = %d, want %d\nstdout: %s\nstderr: %s", gotCode, test.wantCode, stdout.String(), stderr.String())
+			}
+			if test.wantFinding != "" && !strings.Contains(stderr.String(), test.wantFinding) {
+				t.Fatalf("stderr does not name %q: %s", test.wantFinding, stderr.String())
+			}
+		})
+	}
+}
+
+func TestPackageExistenceGenericResolverFailsClosed(t *testing.T) {
+	repo := t.TempDir()
+	writePackageExistenceFile(t, repo, "package.json", `{"dependencies":{"definitely-missing-package":"1.0.0"}}`)
+	writePackageExistenceFile(t, repo, "src/example.custom", "// baseline\n")
+	gitPackageExistence(t, repo, "init", "-q")
+	gitPackageExistence(t, repo, "config", "user.email", "test@example.com")
+	gitPackageExistence(t, repo, "config", "user.name", "Test")
+	gitPackageExistence(t, repo, "add", ".")
+	gitPackageExistence(t, repo, "commit", "-qm", "baseline")
+	if err := os.MkdirAll(featureDir(repo, "feat"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	writePackageExistenceFile(t, repo, "src/example.custom", "import \"definitely-missing-package\"\n")
+	t.Chdir(repo)
+
+	var stdout, stderr bytes.Buffer
+	gotCode := PackageExistence(repo, []string{"feat"}, &stdout, &stderr)
+	if gotCode != 3 {
+		t.Fatalf("code = %d, want 3\nstdout: %s\nstderr: %s", gotCode, stdout.String(), stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "definitely-missing-package") {
+		t.Fatalf("stderr does not name unresolved import: %s", stderr.String())
+	}
+}
+
+func writePackageExistenceFile(t *testing.T, root, path, content string) {
+	t.Helper()
+	fullPath := filepath.Join(root, filepath.FromSlash(path))
+	if err := os.MkdirAll(filepath.Dir(fullPath), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(fullPath, []byte(content), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func gitPackageExistence(t *testing.T, root string, args ...string) {
+	t.Helper()
+	cmd := exec.Command("git", append([]string{"-C", root}, args...)...)
+	if out, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("git %s: %v\n%s", strings.Join(args, " "), err, out)
+	}
+}

package/engine/internal/lib/preamble.go

@@ -11,7 +11,7 @@ import (
 	"github.com/devrites/devrites/internal/workflow"
 )
 
-// spaceChars is the POSIX [[:space:]] set under the C locale — the collation the
+// spaceChars is the POSIX [[:space:]] set under the C locale: the collation the
 // parity oracle pins (LC_ALL=C), so trimming matches the bash awk/sed exactly.
 const spaceChars = " \t\n\v\f\r"
 
@@ -22,7 +22,7 @@ func featureDir(root, slug string) string {
 }
 
 // activeSlug reads the active-feature pointer at <root>/ACTIVE (trimmed), or ""
-// when absent — the new-schema replacement for the old .devrites/ACTIVE lookup.
+// when absent: the new-schema replacement for the old .devrites/ACTIVE lookup.
 func activeSlug(root string) string {
 	slug, err := devritespaths.ActiveSlug(root)
 	if err != nil {
@@ -32,7 +32,7 @@ func activeSlug(root string) string {
 }
 
 // preambleArtifacts is the fixed order preamble.sh scans for present artifacts.
-// It is NOT sorted — the display order is the workflow order, so the port keeps
+// It is NOT sorted: the display order is the workflow order, so the port keeps
 // the literal list.
 var preambleArtifacts = []string{
 	"brief", "spec", "references", "strategy", "plan", "tasks", "eng-review",
@@ -41,7 +41,7 @@ var preambleArtifacts = []string{
 	"polish-report", "review", "seal", "ship", "handoff",
 }
 
-// Preamble prints the active feature's workspace state — the orientation every
+// Preamble prints the active feature's workspace state: the orientation every
 // workspace-operating rite-* skill runs first (step 0). Read-only. root is the
 // .devrites directory; slug defaults to the active feature at <root>/ACTIVE.
 // Always exits 0: orientation is never a hard dependency.
@@ -63,7 +63,7 @@ func Preamble(root string, args []string, stdout, stderr io.Writer) int {
 
 	if state, err := os.ReadFile(filepath.Join(workDir, "state.md")); err == nil {
 		fmt.Fprintln(stdout, "### state.md")
-		// Emit the file verbatim, like `cat` — no added trailing newline.
+		// Emit the file verbatim, like `cat`: no added trailing newline.
 		_, _ = stdout.Write(state)
 	}
 
@@ -148,7 +148,7 @@ func isHeadingLine(line string) bool {
 
 // splitLinesNoTrailing splits data into lines on '\n', dropping a single trailing
 // newline's empty final element so a "\n"-terminated file yields N lines, not N+1
-// — matching how awk/grep iterate records.
+// : matching how awk/grep iterate records.
 func splitLinesNoTrailing(data []byte) []string {
 	s := string(data)
 	s = strings.TrimSuffix(s, "\n")

package/engine/internal/lib/progress.go

@@ -12,18 +12,18 @@ import (
 )
 
 // State-parsing patterns ported verbatim from progress.sh's awk. Each name-strip
-// sub is anchored (^ or $), so it matches at most once per line — ReplaceAllString
+// sub is anchored (^ or $), so it matches at most once per line: ReplaceAllString
 // is therefore equivalent to awk's single-match sub.
 var (
 	sliceCheckRe   = regexp.MustCompile(`^- \[[^\]]*\][[:space:]]*`)             // drop "- [x] "
 	sliceNameRe    = regexp.MustCompile(`^Slice[[:space:]]*[0-9]+:[[:space:]]*`) // drop "Slice N: "
 	sliceStateRe   = regexp.MustCompile(`[[:space:]]+(built|pending)[[:space:]]*$`)
-	sliceSepRe     = regexp.MustCompile(`[[:space:]]+[^[:alnum:][:space:]]+[[:space:]]*$`) // drop " — "
+	sliceSepRe     = regexp.MustCompile(`[[:space:]]+[^[:alnum:][:space:]]+[[:space:]]*$`) // drop " · "
 	sliceCheckedRe = regexp.MustCompile(`\[[xX]\]`)
 	sliceHeadingRe = regexp.MustCompile(`^##[[:space:]]+(SLICE-[0-9]{3})(?:[[:space:]]+(.*))?$`)
 )
 
-// Progress renders the active feature's position — the deterministic footer every
+// Progress renders the active feature's position: the deterministic footer every
 // workspace-operating rite-* skill prints last. Read-only. Prints nothing and
 // exits 0 when there is no active workspace, so pre-spec callers stay silent. root
 // is the .devrites directory; slug defaults to the active feature at <root>/ACTIVE.
@@ -38,7 +38,7 @@ func Progress(root string, args []string, stdout, stderr io.Writer) int {
 	workDir := featureDir(root, slug)
 	statePath := filepath.Join(workDir, "state.md")
 	if slug == "" || !isFile(statePath) {
-		return 0 // silent — no active workspace
+		return 0 // silent: no active workspace
 	}
 	stateBytes, err := os.ReadFile(statePath)
 	if err != nil {
@@ -180,7 +180,7 @@ func parsePhase(lines []string) string {
 }
 
 // tallySlices reads the "## Slice progress" block: total slice lines, how many are
-// checked, and the display name of the last checked one — the awk in progress.sh.
+// checked, and the display name of the last checked one: the awk in progress.sh.
 func tallySlices(lines []string) (total, built int, lastbuilt string) {
 	inp := false
 	for _, line := range lines {

package/engine/internal/lib/reconcile.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 )
 
-// Reconcile enforces that the orchestrator never edits source itself — only the
+// Reconcile enforces that the orchestrator never edits source itself: only the
 // dispatched slice-wright writes code and tests, while the orchestrator writes
 // bookkeeping under .devrites/. `snapshot` records the working tree just before
 // the wright runs; `check` diffs it afterward and flags any changed path that is
@@ -17,8 +17,8 @@ import (
 // <root>/features/<slug>.
 //
 //	0  clean check, snapshot written, inline fallback, or skipped (not a git repo)
-//	5  VIOLATION — source changed outside the wright's claimed set
-//	6  setup error — bad args, missing snapshot, or missing claimed manifest
+//	5  VIOLATION: source changed outside the wright's claimed set
+//	6  setup error: bad args, missing snapshot, or missing claimed manifest
 func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 	mode := argAt(args, 0)
 	slug := argAt(args, 1)
@@ -29,7 +29,7 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 	cwd, _ := os.Getwd()
 	gitRoot := gitToplevel(cwd)
 	if gitRoot == "" {
-		fmt.Fprintln(stderr, "reconcile: not a git repo — gate skipped, verify the diff by hand.")
+		fmt.Fprintln(stderr, "reconcile: not a git repo: gate skipped, verify the diff by hand.")
 		return 0
 	}
 
@@ -37,28 +37,37 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 	base := filepath.Join(d, ".reconcile-base")
 	claimed := filepath.Join(d, ".reconcile-claimed")
 	inline := filepath.Join(d, ".reconcile-inline")
+	objects := filepath.Join(d, ".reconcile-objects")
 
 	if slug == "" || !isDir(d) {
 		s := slug
 		if s == "" {
 			s = "<unset>"
 		}
-		fmt.Fprintf(stderr, "reconcile: no active workspace (slug=%s) — nothing to reconcile.\n", s)
+		fmt.Fprintf(stderr, "reconcile: no active workspace (slug=%s): nothing to reconcile.\n", s)
 		return 6
 	}
 
-	closeWindow := func() { _ = os.Remove(base); _ = os.Remove(claimed); _ = os.Remove(inline) }
+	closeWindow := func() {
+		_ = os.Remove(base)
+		_ = os.Remove(claimed)
+		_ = os.Remove(inline)
+		_ = os.RemoveAll(objects)
+	}
 
 	switch mode {
 	case "snapshot":
 		_ = os.Remove(inline) // clear any stale sentinel / prior-slice manifest
 		_ = os.Remove(claimed)
-		tree, err := worktreeTree(gitRoot)
+		_ = os.RemoveAll(objects)
+		tree, err := worktreeTree(gitRoot, objects)
 		if err != nil {
+			_ = os.RemoveAll(objects)
 			fmt.Fprintf(stderr, "reconcile: cannot snapshot worktree: %v\n", err)
 			return 6
 		}
 		if err := os.WriteFile(base, []byte(tree+"\n"), 0o644); err != nil {
+			_ = os.RemoveAll(objects)
 			fmt.Fprintf(stderr, "reconcile: cannot write snapshot: %v\n", err)
 			return 6
 		}
@@ -67,16 +76,16 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 
 	case "check":
 		if isFile(inline) {
-			fmt.Fprintln(stderr, "reconcile: inline-fallback run (no wright dispatched) — gate skipped.")
+			fmt.Fprintln(stderr, "reconcile: inline-fallback run (no wright dispatched): gate skipped.")
 			closeWindow()
 			return 0
 		}
 		if !isFile(base) {
-			fmt.Fprintln(stderr, `reconcile: no snapshot (.reconcile-base) — run "devrites-engine reconcile snapshot" before dispatch.`)
+			fmt.Fprintln(stderr, `reconcile: no snapshot (.reconcile-base): run "devrites-engine reconcile snapshot" before dispatch.`)
 			return 6
 		}
 		if !isFile(claimed) {
-			fmt.Fprintln(stderr, "reconcile: no claimed manifest (.reconcile-claimed) — write the wright Files-changed paths first.")
+			fmt.Fprintln(stderr, "reconcile: no claimed manifest (.reconcile-claimed): write the wright Files-changed paths first.")
 			return 6
 		}
 		baseBytes, err := os.ReadFile(base)
@@ -86,19 +95,34 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 		}
 		baseTree := strings.TrimSpace(string(baseBytes))
 		if baseTree == "" {
-			fmt.Fprintln(stderr, "reconcile: empty snapshot (.reconcile-base) — re-run \"devrites-engine reconcile snapshot\" before dispatch.")
+			fmt.Fprintln(stderr, "reconcile: empty snapshot (.reconcile-base): re-run \"devrites-engine reconcile snapshot\" before dispatch.")
+			return 6
+		}
+		if !isDir(objects) {
+			fmt.Fprintln(stderr, "reconcile: missing snapshot object database (.reconcile-objects): re-run \"devrites-engine reconcile snapshot\" before dispatch.")
 			return 6
 		}
-		nowTree, err := worktreeTree(gitRoot)
+		nowTree, err := worktreeTree(gitRoot, objects)
 		if err != nil {
 			fmt.Fprintf(stderr, "reconcile: cannot capture worktree: %v\n", err)
 			return 6
 		}
+		diff := exec.Command("git", "-C", gitRoot, "diff", "--name-only", baseTree, nowTree)
+		diff.Env, err = reconcileGitEnv(gitRoot, objects)
+		if err != nil {
+			fmt.Fprintf(stderr, "reconcile: cannot compare worktree: %v\n", err)
+			return 6
+		}
+		diffOut, err := diff.CombinedOutput()
+		if err != nil {
+			fmt.Fprintf(stderr, "reconcile: cannot compare worktree: git diff --name-only: %v: %s\n", err, strings.TrimSpace(string(diffOut)))
+			return 6
+		}
 
 		claimedSet := claimedPaths(claimed)
 		viol := 0
 		var violist strings.Builder
-		for _, f := range gitDiffNames(gitRoot, baseTree, nowTree) {
+		for _, f := range splitLinesNoTrailing(diffOut) {
 			if f == "" || strings.HasPrefix(f, ".devrites/") {
 				continue
 			}
@@ -108,13 +132,13 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 			}
 		}
 		if viol > 0 {
-			fmt.Fprintf(stderr, "reconcile: STOP — %d source file(s) changed OUTSIDE the wright (A1 breach):\n", viol)
+			fmt.Fprintf(stderr, "reconcile: STOP: %d source file(s) changed OUTSIDE the wright (A1 breach):\n", viol)
 			fmt.Fprint(stderr, violist.String())
 			fmt.Fprintln(stderr, "The orchestrator must NOT edit source. Re-dispatch the wright (continue it once) or revert these.")
 			return 5
 		}
 		closeWindow()
-		fmt.Fprintln(stdout, "reconcile: OK — every source change is the wright's; orchestrator touched only bookkeeping.")
+		fmt.Fprintln(stdout, "reconcile: OK: every source change is the wright's; orchestrator touched only bookkeeping.")
 		return 0
 
 	default:
@@ -132,23 +156,36 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 // snapshot and the check would then record that same sha, the diff would come
 // back empty, and the gate would report OK on precisely the A1 breach it exists
 // to catch. Surface the error and let the caller fail closed.
-func worktreeTree(gitRoot string) (string, error) {
+func worktreeTree(gitRoot, objectDir string) (string, error) {
 	idx := filepath.Join(os.TempDir(), fmt.Sprintf("devrites-reconcile-%d.idx", os.Getpid()))
 	_ = os.Remove(idx)
 	defer func() { _ = os.Remove(idx) }()
-	env := append(os.Environ(), "GIT_INDEX_FILE="+idx)
+	if err := os.MkdirAll(objectDir, 0o700); err != nil {
+		return "", fmt.Errorf("create object directory: %w", err)
+	}
+	env, err := reconcileGitEnv(gitRoot, objectDir)
+	if err != nil {
+		return "", err
+	}
+	env = append(env, "GIT_INDEX_FILE="+idx)
 
 	add := exec.Command("git", "-C", gitRoot, "add", "-A")
 	add.Env = env
-	add.Stdout, add.Stderr = io.Discard, io.Discard
-	if err := add.Run(); err != nil {
+	addOut, err := add.CombinedOutput()
+	if err != nil {
+		if detail := strings.TrimSpace(string(addOut)); detail != "" {
+			return "", fmt.Errorf("git add -A: %w: %s", err, detail)
+		}
 		return "", fmt.Errorf("git add -A: %w", err)
 	}
 
 	write := exec.Command("git", "-C", gitRoot, "write-tree")
 	write.Env = env
-	out, err := write.Output()
+	out, err := write.CombinedOutput()
 	if err != nil {
+		if detail := strings.TrimSpace(string(out)); detail != "" {
+			return "", fmt.Errorf("git write-tree: %w: %s", err, detail)
+		}
 		return "", fmt.Errorf("git write-tree: %w", err)
 	}
 	tree := strings.TrimSpace(string(out))
@@ -158,6 +195,29 @@ func worktreeTree(gitRoot string) (string, error) {
 	return tree, nil
 }
 
+func reconcileGitEnv(gitRoot, objectDir string) ([]string, error) {
+	common := exec.Command("git", "-C", gitRoot, "rev-parse", "--git-common-dir")
+	out, err := common.CombinedOutput()
+	if err != nil {
+		return nil, fmt.Errorf("git rev-parse --git-common-dir: %w: %s", err, strings.TrimSpace(string(out)))
+	}
+	commonDir := strings.TrimSpace(string(out))
+	if !filepath.IsAbs(commonDir) {
+		commonDir = filepath.Join(gitRoot, commonDir)
+	}
+	alternates := []string{filepath.Join(commonDir, "objects")}
+	if inherited := os.Getenv("GIT_OBJECT_DIRECTORY"); inherited != "" {
+		alternates = append(alternates, inherited)
+	}
+	if inherited := os.Getenv("GIT_ALTERNATE_OBJECT_DIRECTORIES"); inherited != "" {
+		alternates = append(alternates, inherited)
+	}
+	return append(os.Environ(),
+		"GIT_OBJECT_DIRECTORY="+objectDir,
+		"GIT_ALTERNATE_OBJECT_DIRECTORIES="+strings.Join(alternates, string(os.PathListSeparator)),
+	), nil
+}
+
 // claimedPaths reads the .reconcile-claimed manifest into a set of the exact
 // paths the wright reported changing.
 func claimedPaths(path string) map[string]struct{} {