devrites 3.0.7 → 3.1.0

package/engine/tests/parity_buildreadiness_test.go

@@ -1,36 +1,125 @@
 package main_test
 
-// TestParityBuildReadiness checks the build-readiness gate's stdout + exit code
+// TestParityBuildReadiness checks the build-readiness gate's stdout and exit code
 // against the golden snapshot for each state.md fixture.
 
-import "testing"
+import (
+	"fmt"
+	"path/filepath"
+	"testing"
+
+	"github.com/devrites/devrites/internal/lib"
+)
 
 func TestParityBuildReadiness(t *testing.T) {
 	work := t.TempDir()
 
-	// Status halts (stderr-only messages; parity is stdout + exit code).
+	// Status halts write only to stderr; parity covers stdout and the exit code.
 	writeFeatureFile(t, work, "await", "state.md", "- Status: awaiting_human\n") // exit 3
 	writeFeatureFile(t, work, "blocked", "state.md", "- Status: blocked\n")      // exit 4
 
-	// Ready: plan approved + status.
-	writeFeatureFile(t, work, "approved", "state.md", "- Plan approved: 2024-01-01\n- Status: running\n") // exit 0
+	writeReadyArtifacts := func(slug string) {
+		t.Helper()
+		writeCoverageArtifacts(t, work, slug)
+		for name, body := range map[string]string{
+			"architecture.md": "# Architecture\n\nExisting layer.\n",
+			"plan.md":         "# Plan\n\nOne slice.\n",
+			"tasks.md":        "# Tasks\n\n## SLICE-001\nBuild.\n",
+			"traceability.md": "# Traceability\n\nAC-001 -> SLICE-001.\n",
+			"test-plan.md": `# Test plan
+
+## Build-entry preflight
+| Gate | Command | Cwd | Expected | Prerequisites | Provenance to recapture |
+| --- | --- | --- | --- | --- | --- |
+| unit | go test ./... | engine | exit 0 | none | go version |
+
+## Per-gap test requirements
+| ID | Path / flow | Test file | Asserts | Kind | Slice | Priority |
+| --- | --- | --- | --- | --- | --- | --- |
+| T1 | flow | flow_test.go | request → success | unit | SLICE-001 | P1 |
+
+## Acceptance → test map
+- AC-001 → T1
+`,
+		} {
+			writeFeatureFile(t, work, slug, name, body)
+		}
+		root := filepath.Join(work, ".devrites")
+		digest, err := lib.ReadinessInputDigest(root, slug, "engineering")
+		if err != nil {
+			t.Fatal(err)
+		}
+		writeFeatureFile(t, work, slug, "eng-review.md", fmt.Sprintf(`# Eng review
+
+Implementation readiness: READY
+Readiness inputs SHA-256: %s
+
+## 2a. Build-entry preflight
+| Gate | Command + cwd | Tool/version | Prerequisite owner | Full provenance inputs | Fixture/smoke | Verdict |
+| --- | --- | --- | --- | --- | --- | --- |
+| unit | go test ./... | go | none | go.mod | focused | pass |
+
+## 2b. Implementation readiness
+| Surface | Requirement/decision | Boundary/wiring | Slice | Proof | Verdict |
+| --- | --- | --- | --- | --- | --- |
+| flow | AC-001 | existing | SLICE-001 | T1 | ready |
+
+## 4. Failure modes
+| New codepath | Realistic failure | Test? | Handling? | Silent? | Verdict |
+| --- | --- | --- | --- | --- | --- |
+| flow | invalid | yes | yes | no | ok |
+
+## 7. Completion summary
+- Ready.
+`, digest))
+	}
+
+	// A ready feature has an approved plan, running status, and current
+	// clarification and vet artifacts.
+	for _, slug := range []string{"approved", "trailpipe", "trailhash", "emptystatus"} {
+		writeReadyArtifacts(slug)
+	}
+	writeFeatureFile(t, work, "approved", "state.md", "- Phase: vet\n- Plan approved: 2024-01-01\n- Status: running\n") // exit 0
 
 	// Plan not approved: missing line, or the literal "none".
+	writeCoverageArtifacts(t, work, "noapprove")
+	writeCoverageArtifacts(t, work, "approvenone")
 	writeFeatureFile(t, work, "noapprove", "state.md", "- Status: running\n")                          // exit 2
 	writeFeatureFile(t, work, "approvenone", "state.md", "- Plan approved: none\n- Status: running\n") // exit 2
 
 	// field() strip: a trailing " | none" / " # note" annotation is trimmed off
 	// Status before the case match, so both stay "running" and reach OK.
-	writeFeatureFile(t, work, "trailpipe", "state.md", "- Plan approved: 2024-01-01\n- Status: running | none\n") // exit 0
-	writeFeatureFile(t, work, "trailhash", "state.md", "- Plan approved: 2024-01-01\n- Status: running # note\n") // exit 0
+	writeFeatureFile(t, work, "trailpipe", "state.md", "- Phase: vet\n- Plan approved: 2024-01-01\n- Status: running | none\n") // exit 0
+	writeFeatureFile(t, work, "trailhash", "state.md", "- Phase: vet\n- Plan approved: 2024-01-01\n- Status: running # note\n") // exit 0
 
-	// Empty Status value + plan approved → status renders as "running".
-	writeFeatureFile(t, work, "emptystatus", "state.md", "- Plan approved: 2024-01-01\n- Status: \n") // exit 0
+	// An empty Status with an approved plan renders as "running".
+	writeFeatureFile(t, work, "emptystatus", "state.md", "- Phase: vet\n- Plan approved: 2024-01-01\n- Status: \n") // exit 0
+
+	// A plan cannot build without an explicit closed clarification scan and a
+	// successful engineering-readiness verdict. These are objective routes, not
+	// human questions.
+	writeFeatureFile(t, work, "noclarify", "state.md", "- Phase: vet\n- Plan approved: 2024-01-01\n- Status: running\n") // exit 6
+
+	writeFeatureFile(t, work, "clarifyopen", "state.md", "- Phase: vet\n- Plan approved: 2024-01-01\n- Status: running\n") // exit 6
+	writeFeatureFile(t, work, "clarifyopen", "brief.md", "# Brief\n\nOutcome.\n")
+	writeFeatureFile(t, work, "clarifyopen", "spec.md", "# Spec\n\nAC-001.\n")
+	writeFeatureFile(t, work, "clarifyopen", "decision-coverage.md", "# Decision coverage\n\n- Decision coverage: NEEDS CLARIFICATION\n")
+
+	writeFeatureFile(t, work, "novet", "state.md", "- Phase: plan\n- Plan approved: 2024-01-01\n- Status: running\n") // exit 7
+	writeCoverageArtifacts(t, work, "novet")
+
+	writeFeatureFile(t, work, "vetnotready", "state.md", "- Phase: vet\n- Plan approved: 2024-01-01\n- Status: running\n") // exit 7
+	writeCoverageArtifacts(t, work, "vetnotready")
+	writeFeatureFile(t, work, "vetnotready", "eng-review.md", "# Engineering review\n\n- Implementation readiness: NEEDS REPLAN\n")
+
+	writeReadyArtifacts("stalevet")
+	writeFeatureFile(t, work, "stalevet", "state.md", "- Phase: plan\n- Plan approved: 2024-01-01\n- Status: running\n") // exit 7
 
 	// "ghost" is intentionally never created → no workspace/state.md (exit 5).
 	for _, arg := range []string{
 		"await", "blocked", "approved", "noapprove", "approvenone",
-		"trailpipe", "trailhash", "emptystatus", "ghost",
+		"trailpipe", "trailhash", "emptystatus", "noclarify", "clarifyopen",
+		"novet", "vetnotready", "stalevet", "ghost",
 	} {
 		c := parityCase{
 			workdir: work,
@@ -40,3 +129,45 @@ func TestParityBuildReadiness(t *testing.T) {
 		t.Run("arg="+arg, func(t *testing.T) { c.assertEqual(t) })
 	}
 }
+
+func writeCoverageArtifacts(t *testing.T, work, slug string) {
+	t.Helper()
+	writeFeatureFile(t, work, slug, "brief.md", "# Brief\n\nOutcome.\n")
+	writeFeatureFile(t, work, slug, "spec.md", "# Spec\n\n## Acceptance criteria\n- AC-001 succeeds.\n")
+	writeFeatureFile(t, work, slug, "decisions.md", "# Decisions\n\nNo open product decisions.\n")
+	writeFeatureFile(t, work, slug, "assumptions.md", "# Assumptions\n\nNo material assumptions.\n")
+	writeFeatureFile(t, work, slug, "questions.md", "# Questions\n\nNone.\n")
+	root := filepath.Join(work, ".devrites")
+	digest, err := lib.ReadinessInputDigest(root, slug, "coverage")
+	if err != nil {
+		t.Fatal(err)
+	}
+	writeFeatureFile(t, work, slug, "decision-coverage.md", fmt.Sprintf(`# Decision coverage
+
+Decision coverage: CLEAR
+Coverage inputs SHA-256: %s
+
+## Topology
+| Surface | Kind | Related IDs | Evidence |
+| --- | --- | --- | --- |
+| flow | behavior | AC-001 | spec.md |
+
+## Coverage matrix
+| Surface | Dimension | Status | Canonical reference | Owner / validation gate | Consequence if wrong |
+| --- | --- | --- | --- | --- | --- |
+| flow | behavior | closed | AC-001 | rite-prove | failure |
+
+## Assumption audit
+| Assumption | Evidence | Confidence | Owner | Validation | Consequence if wrong |
+| --- | --- | --- | --- | --- | --- |
+| none | n/a | high | n/a | n/a | n/a |
+
+## Residual uncertainty
+| Item | Why nonblocking | Owner | Validation gate |
+| --- | --- | --- | --- |
+| none | n/a | n/a | n/a |
+
+## Readiness verdict
+No unresolved decision remains.
+`, digest))
+}

package/engine/tests/parity_learnings_test.go

@@ -1,10 +1,9 @@
 package main_test
 
 // TestParityLearnings checks the learnings command against the golden snapshots.
-// learnings state is ROOT-LEVEL, read from DEVRITES_ROOT=work/.devrites when the
-// case runs in workdir=work with libRootEnv(work). The mine/nudge pipelines are
-// deterministic from fixtures. Fixture counts are DISTINCT (3 vs 2) so ordering
-// never depends on a platform-specific tie-break.
+// Learning state lives at the root selected by DEVRITES_ROOT. The mine and nudge
+// fixtures use counts of 3 and 2 so sorting never depends on a platform-specific
+// tie.
 
 import (
 	"path/filepath"
@@ -14,10 +13,11 @@ import (
 func TestParityLearnings(t *testing.T) {
 	learn := func(a ...string) []string { return append([]string{"learnings"}, a...) }
 
-	// --- add: fresh workspace. bash creates the ledger + a dated entry; Go then
-	// appends a second entry. Only stdout ("learnings: recorded.") + exit 0 are the
-	// contract: the dated file line is a nondeterministic side effect, not stdout.
+	// Add to a fresh workspace. Bash creates the ledger and a dated entry, then Go
+	// appends another. Only stdout ("learnings: recorded.") and exit 0 belong to
+	// the contract because the dated file entry is nondeterministic.
 	addw := t.TempDir()
+	mkdirAllT(t, addw, ".devrites")
 	t.Run("add", func(t *testing.T) {
 		(parityCase{
 			workdir: addw, env: libRootEnv(addw),
@@ -25,7 +25,7 @@ func TestParityLearnings(t *testing.T) {
 		}).assertEqual(t)
 	})
 
-	// --- list: a pre-written ledger; both sides cat the same file verbatim.
+	// List a prepared ledger. Both implementations print the file unchanged.
 	listw := t.TempDir()
 	writeFile(t, listw, filepath.Join(".devrites", "learnings.md"),
 		"# DevRites learnings ledger\n\n"+
@@ -38,10 +38,9 @@ func TestParityLearnings(t *testing.T) {
 		}).assertEqual(t)
 	})
 
-	// --- mine + nudge: two archived features. The shared "recurring finding" bullet
-	// normalizes identically across features despite differing numbers/paths (the sed
-	// id/path/number stripping), giving count 3; the "second dead end" bullet gives
-	// count 2. Distinct counts ⇒ deterministic order on any `sort`.
+	// Mine and nudge use two archived features. Normalization strips IDs, paths,
+	// and numbers, so "recurring finding" has count 3 and "second dead end" has
+	// count 2. The distinct counts keep sort order stable.
 	arch := t.TempDir()
 	writeFile(t, arch, filepath.Join(".devrites", "archive", "feat-a", "decisions.md"),
 		"# decisions for feat-a\n"+
@@ -55,7 +54,7 @@ func TestParityLearnings(t *testing.T) {
 			"- second dead end: retry backoff exceeded 9 attempts\n"+
 			"- a one-off dismiss note about the flaky linter run\n")
 
-	// mine: default archive (bash .devrites/archive, Go <root>/archive: same dir).
+	// Both implementations resolve the default archive to the same directory.
 	t.Run("mine", func(t *testing.T) {
 		(parityCase{
 			workdir: arch, env: libRootEnv(arch),
@@ -63,8 +62,8 @@ func TestParityLearnings(t *testing.T) {
 		}).assertEqual(t)
 	})
 
-	// mine: no archive. An explicit relative path both sides resolve against workdir,
-	// so the path embedded in the message is identical for bash and Go.
+	// Both implementations resolve an explicit relative path against workdir, so
+	// the missing path in the message is identical.
 	t.Run("mine-no-archive", func(t *testing.T) {
 		(parityCase{
 			workdir: arch, env: libRootEnv(arch),
@@ -72,7 +71,7 @@ func TestParityLearnings(t *testing.T) {
 		}).assertEqual(t)
 	})
 
-	// nudge: >=2 features + a class recurring 3x + no review marker ⇒ the nudge line.
+	// Two features, three occurrences, and no review marker produce a nudge.
 	t.Run("nudge", func(t *testing.T) {
 		(parityCase{
 			workdir: arch, env: libRootEnv(arch),
@@ -80,7 +79,7 @@ func TestParityLearnings(t *testing.T) {
 		}).assertEqual(t)
 	})
 
-	// --- unknown cmd: usage to stderr, exit 2 (stdout empty on both sides).
+	// An unknown command writes usage to stderr and exits 2 without stdout.
 	t.Run("unknown", func(t *testing.T) {
 		(parityCase{
 			workdir: arch, env: libRootEnv(arch),

package/engine/tests/parity_reconcile_test.go

@@ -2,14 +2,15 @@ package main_test
 
 import (
 	"fmt"
+	"strings"
 	"testing"
 )
 
 // TestParityReconcile checks reconcile against the golden snapshots: snapshot
-// captures the worktree as a tree object, check diffs it and flags source changes
-// outside the claimed manifest. Runs git in a real repo, so stdout + exit are
-// captured from the live command. The .devrites/ bookkeeping is skipped by the
-// gate, so it never affects the verdict.
+// captures the worktree as a tree object, check diffs it and flags changes
+// outside the orchestrator-authored allowlist, and close ends the retained
+// post-slice baseline. It runs Git in a real repository, so stdout and exit are
+// captured from the live command.
 func TestParityReconcile(t *testing.T) {
 	requireGit(t)
 
@@ -25,7 +26,12 @@ func TestParityReconcile(t *testing.T) {
 	}
 	// snapshot is also a setup step for the check-* cases, so it snapshots under a
 	// distinct key to avoid colliding with check's golden in the same subtest.
-	snapshot := func(t *testing.T, work string) {
+	snapshot := func(t *testing.T, work string, allowed ...string) {
+		body := ""
+		if len(allowed) > 0 {
+			body = strings.Join(allowed, "\n") + "\n"
+		}
+		writeFeatureFile(t, work, "feat", ".wright-allowlist", body)
 		out, code := runArgv(t, work, libRootEnv(work), "", binPath, "reconcile", "snapshot", "feat")
 		assertGoldenKey(t, t.Name()+"/snapshot", fmt.Sprintf("exit %d\n%s", code, out))
 	}
@@ -38,38 +44,35 @@ func TestParityReconcile(t *testing.T) {
 
 	t.Run("check-clean", func(t *testing.T) {
 		work := newRepo(t)
-		snapshot(t, work)
+		snapshot(t, work, "src/a.js")
 		writeFile(t, work, "src/a.js", "console.log(999)\n") // the wright's change
-		writeFeatureFile(t, work, "feat", ".reconcile-claimed", "src/a.js\n")
 		check(t, work)
 	})
 
 	t.Run("check-violation", func(t *testing.T) {
 		work := newRepo(t)
-		snapshot(t, work)
+		snapshot(t, work, "src/a.js")
 		writeFile(t, work, "src/a.js", "console.log(999)\n")
-		writeFile(t, work, "src/b.js", "console.log(888)\n") // NOT claimed -> A1 breach
-		writeFeatureFile(t, work, "feat", ".reconcile-claimed", "src/a.js\n")
+		writeFile(t, work, "src/b.js", "console.log(888)\n") // Outside the allowlist; an A1 breach.
 		check(t, work)
 	})
 
 	t.Run("check-no-base", func(t *testing.T) {
 		work := newRepo(t)
-		writeFeatureFile(t, work, "feat", ".reconcile-claimed", "src/a.js\n")
-		check(t, work) // no snapshot -> exit 6
+		check(t, work) // No snapshot, so exit 6.
 	})
 
-	t.Run("check-no-claimed", func(t *testing.T) {
+	t.Run("snapshot-no-allowlist", func(t *testing.T) {
 		work := newRepo(t)
-		snapshot(t, work)
-		check(t, work) // base present, no claimed -> exit 6
+		out, code := runArgv(t, work, libRootEnv(work), "", binPath, "reconcile", "snapshot", "feat")
+		assertGolden(t, out, code)
 	})
 
 	t.Run("inline-fallback", func(t *testing.T) {
 		work := newRepo(t)
 		snapshot(t, work)
-		writeFeatureFile(t, work, "feat", ".reconcile-inline", "")
-		check(t, work) // gate skipped -> exit 0
+		out, code := runArgv(t, work, libRootEnv(work), "", binPath, "reconcile", "close", "feat")
+		assertGolden(t, out, code)
 	})
 
 	t.Run("not-git", func(t *testing.T) {

package/engine/tests/parity_resolve_test.go

@@ -7,8 +7,8 @@ import (
 	"testing"
 )
 
-// Golden snapshot for resolve: it MUTATES questions.md + state.md. Each case
-// snapshots the command's stdout + exit code and, for the mutating cases, the
+// Golden snapshots for resolve include its changes to questions.md and state.md.
+// Each case records stdout and the exit code. Mutating cases also record the
 // resulting file bytes. The two nondeterministic timestamp fields (answered_at
 // and the Log entry) are masked out before the file content is snapshotted so the
 // golden is deterministic across runs.
@@ -45,8 +45,8 @@ const resolveState = `- Status: awaiting_human
 `
 
 func TestParityResolve(t *testing.T) {
-	// setup writes the fixtures into a Go tree (.devrites/features/feat) and returns
-	// the workspace root.
+	// setup writes fixtures under .devrites/features/feat and returns the
+	// workspace root.
 	setup := func(t *testing.T, questions, state string) (gwork string) {
 		t.Helper()
 		gwork = t.TempDir()
@@ -55,7 +55,7 @@ func TestParityResolve(t *testing.T) {
 		writeFile(t, gwork, filepath.Join(".devrites", "ACTIVE"), "feat\n")
 		return gwork
 	}
-	// run executes resolve in gwork and snapshots its stdout + exit code under the
+	// run executes resolve in gwork and snapshots stdout and the exit code under the
 	// current subtest's golden.
 	run := func(t *testing.T, gwork string, args ...string) {
 		t.Helper()
@@ -124,16 +124,17 @@ answer: prior
 	})
 
 	t.Run("no-workspace", func(t *testing.T) {
-		// Bare tree: no ACTIVE, no questions.md -> exit 2.
+		// A bare tree with no explicit root, ACTIVE, or questions.md exits 2.
+		// Pointing DEVRITES_ROOT at the nonexistent .devrites child would instead
+		// be an explicit unsafe-root refusal, which is a different contract.
 		gwork := t.TempDir()
-		run(t, gwork, "q-1", "x")
+		out, code := runArgv(t, gwork, libEnv, "", binPath, "resolve", "q-1", "x")
+		assertGolden(t, out, code)
 	})
 
 	t.Run("next-qid", func(t *testing.T) {
-		// Read-only: computes the next qid for an explicit questions.md path.
-		// DEVRITES_NOW pins the clock so the golden is stable across day
-		// boundaries: without it the qid tracks the real date and the snapshot
-		// fails every day but the one it was recorded on (ADR-0006, clock seam).
+		// DEVRITES_NOW fixes the date used by next-qid so the snapshot stays stable.
+		// See ADR-0006.
 		dir := t.TempDir()
 		writeFile(t, dir, "questions.md", "## q-2024-01-01-001\nstatus: open\n")
 		qpath := filepath.Join(dir, "questions.md")

package/engine/tests/parity_test.go

@@ -1,12 +1,12 @@
 package main_test
 
 // Golden CLI harness: run `devrites-engine <args>` against a fixture and compare its
-// stdout + exit code to a recorded snapshot under testdata/golden/. The snapshots
+// stdout and exit code to a recorded snapshot under testdata/golden. The snapshots
 // were captured from the commands once they were proven correct, so a later change
 // that alters observable behaviour fails here. Regenerate them deliberately with
 // UPDATE_GOLDEN=1 (e.g. `UPDATE_GOLDEN=1 go test ./...`).
 //
-// stderr is intentionally NOT captured: it is diagnostic, not contract. Only
+// stderr is not captured because it is diagnostic rather than contractual. Only
 // stdout (the output the hook/command consumer reads) and the exit code are.
 
 import (
@@ -28,7 +28,7 @@ type parityCase struct {
 	goArgs  []string // args to the built devrites-engine binary (binPath is prepended)
 }
 
-// assertEqual runs the command and compares its stdout + exit code to the golden
+// assertEqual runs the command and compares its stdout and exit code to the golden
 // snapshot for the current subtest.
 func (c parityCase) assertEqual(t *testing.T) {
 	t.Helper()
@@ -104,8 +104,8 @@ func TestParityReviewerReadonly(t *testing.T) {
 		{"enforce-deny-mutating", []string{"DEVRITES_REVIEWER_RO=enforce"}, `{"tool_name":"Bash","tool_input":{"command":"rm -rf foo"}}`},
 		{"enforce-deny-git-commit", []string{"DEVRITES_REVIEWER_RO=enforce"}, `{"tool_name":"Bash","tool_input":{"command":"git commit -m x"}}`},
 		{"observe-mutating-silent", nil, `{"tool_name":"Bash","tool_input":{"command":"rm -rf foo"}}`},
-		// The agent-required gate reads agent_type ONLY (like the bash node parse),
-		// so a subagent_type-only payload has no identity and is allowed.
+		// The agent-required gate reads only agent_type, matching the Bash hook's
+		// Node parser, so a subagent_type-only payload has no identity and is allowed.
 		{"agent-required-subagent-type-only-allows",
 			[]string{"DEVRITES_REVIEWER_RO=enforce", "DEVRITES_REVIEWER_AGENT_REQUIRED=1"},
 			`{"tool_name":"Bash","tool_input":{"command":"rm -rf foo"},"subagent_type":"devrites-code-reviewer"}`},
@@ -268,7 +268,7 @@ func TestParityRedwatch(t *testing.T) {
 }
 
 // TestParityA1Guard checks `hook a1-guard` against golden snapshots for each
-// payload: it blocks a MAIN-thread source edit only when the build window is open
+// payload. It blocks a main-thread source edit only when the build window is open
 // and enforce is on, and allows subagent edits, .devrites bookkeeping edits, an
 // inline-fallback window, and a closed window.
 func TestParityA1Guard(t *testing.T) {
@@ -308,23 +308,27 @@ func TestParityA1Guard(t *testing.T) {
 }
 
 // TestParityWrightScope checks `hook wright-scope` against golden snapshots for
-// each payload: a path in touched-files.md is allowed, one outside it is denied
-// under enforce, .devrites edits and non-edit tools are allowed, and the
-// agent-required gate skips a non-wright caller.
+// each payload: an exact orchestrator-allowlisted path is allowed, one outside
+// it and every .devrites path are denied for an active wright, read-only tools
+// pass, and the agent-required gate skips a non-DevRites caller.
 func TestParityWrightScope(t *testing.T) {
 	work := t.TempDir()
-	writeFeatureFile(t, work, "ws", "touched-files.md", "# touched\n- `src/app.js`\n")
+	writeFeatureFile(t, work, "ws", ".wright-allowlist", "src/app.js\n")
 
 	enforce := []string{"DEVRITES_WRIGHT_SCOPE=enforce"}
+	activeWright := []string{
+		"DEVRITES_AGENT_RUN=1",
+		"DEVRITES_ACTIVE_AGENT=devrites-slice-wright",
+	}
 	for _, tc := range []struct {
 		name  string
 		env   []string
 		stdin string
 	}{
-		{"in-scope-allowed", enforce, `{"tool_name":"Edit","tool_input":{"file_path":"src/app.js"}}`},
-		{"out-of-scope-enforce-denies", enforce, `{"tool_name":"Edit","tool_input":{"file_path":"src/other.js"}}`},
-		{"devrites-edit-allowed", enforce, `{"tool_name":"Edit","tool_input":{"file_path":".devrites/x/y.md"}}`},
-		{"non-edit-tool", enforce, `{"tool_name":"Bash","tool_input":{"command":"ls"}}`},
+		{"in-scope-allowed", activeWright, `{"tool_name":"Edit","tool_input":{"file_path":"src/app.js"}}`},
+		{"out-of-scope-enforce-denies", activeWright, `{"tool_name":"Edit","tool_input":{"file_path":"src/other.js"}}`},
+		{"devrites-edit-denied", activeWright, `{"tool_name":"Edit","tool_input":{"file_path":".devrites/x/y.md"}}`},
+		{"non-edit-tool", activeWright, `{"tool_name":"Bash","tool_input":{"command":"ls"}}`},
 		{"out-of-scope-observe-silent", nil, `{"tool_name":"Edit","tool_input":{"file_path":"src/other.js"}}`},
 		{"agent-required-non-wright", append([]string{"DEVRITES_WRIGHT_AGENT_REQUIRED=1"}, enforce...),
 			`{"tool_name":"Edit","tool_input":{"file_path":"src/other.js"},"agent_type":"Explore"}`},
@@ -343,7 +347,7 @@ func TestParityWrightScope(t *testing.T) {
 }
 
 // setActiveAFK points .devrites/ACTIVE at slug (or removes it) and toggles the
-// .devrites/AFK sentinel: the two files bash (via CWD) and the migrated Go (via
+// .devrites/AFK sentinel: the two files bash (via CWD) and Go (via
 // <root>) both read from the same shared location.
 func setActiveAFK(t *testing.T, work, slug string, afk bool) {
 	t.Helper()
@@ -371,8 +375,8 @@ func TestParityOrientSilentPath(t *testing.T) {
 
 	c := parityCase{
 		workdir: dir,
-		// Ensure DEVRITES_ROOT does not leak in and make the Go side resolve a
-		// real workspace; it must see "not a DevRites project".
+		// Clear DEVRITES_ROOT so the Go side cannot resolve a real workspace. It
+		// must see "not a DevRites project".
 		env:    []string{"DEVRITES_ROOT="},
 		goArgs: []string{"hook", "orient", "--harness=claude"},
 	}