devrites 3.2.15 → 3.2.17

package/engine/tests/hook_test.go

@@ -7,6 +7,7 @@ package main_test
 import (
 	"bytes"
 	"encoding/json"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -235,6 +236,18 @@ func parsePermissionDecision(t *testing.T, stdout string) (decision, reason stri
 	return env.HookSpecificOutput.PermissionDecision, env.HookSpecificOutput.PermissionDecisionReason
 }
 
+func parseStopDecision(t *testing.T, stdout string) (decision, reason string) {
+	t.Helper()
+	var env struct {
+		Decision string `json:"decision"`
+		Reason   string `json:"reason"`
+	}
+	if err := json.Unmarshal([]byte(strings.TrimSpace(stdout)), &env); err != nil {
+		t.Fatalf("stdout is not a valid Stop decision: %v\n%s", err, stdout)
+	}
+	return env.Decision, env.Reason
+}
+
 func TestHookReviewerReadonlyEnforceDeniesMutatingBash(t *testing.T) {
 	for _, h := range []string{"claude", "codex"} {
 		h := h
@@ -259,14 +272,22 @@ func TestHookReviewerReadonlyEnforceDeniesMutatingBash(t *testing.T) {
 
 func TestHookReviewerReadonlyAllowsSafeBash(t *testing.T) {
 	root := newWorkspace(t)
-	in := `{"tool_name":"Bash","tool_input":{"command":"grep -rn foo ."}}`
-	out, _, code := runDevritesIO(t, root, in, []string{"DEVRITES_REVIEWER_RO=enforce"},
-		"hook", "reviewer-readonly", "--harness=claude")
-	if code != 0 {
-		t.Fatalf("exit = %d, want 0", code)
-	}
-	if strings.TrimSpace(out) != "" {
-		t.Errorf("stdout = %q, want silent for a read-only command", out)
+	for _, command := range []string{
+		"grep -rn foo .",
+		`cd "` + filepath.Dir(root) + `" && git diff --binary --full-index --no-renames HEAD HEAD --`,
+	} {
+		in := hookPayload(t, map[string]any{
+			"tool_name":  "Bash",
+			"tool_input": map[string]any{"command": command},
+		})
+		out, _, code := runDevritesIO(t, root, in, []string{"DEVRITES_REVIEWER_RO=enforce"},
+			"hook", "reviewer-readonly", "--harness=claude")
+		if code != 0 {
+			t.Fatalf("%q exit = %d, want 0", command, code)
+		}
+		if strings.TrimSpace(out) != "" {
+			t.Errorf("%q stdout = %q, want silent for a read-only command", command, out)
+		}
 	}
 }
 
@@ -379,6 +400,40 @@ func TestCodexGenericCompatibilityDoesNotShadowRoot(t *testing.T) {
 	}
 }
 
+func TestCodexRootRunsArtifactGatesInsideActiveWindow(t *testing.T) {
+	root := newWorkspace(t)
+	writeActive(t, root, "auth-tokens")
+	workspace := filepath.Join(root, "features", "auth-tokens")
+	if err := os.WriteFile(filepath.Join(workspace, ".reconcile-base"), []byte("snapshot\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	env := []string{
+		"DEVRITES_CODEX_GENERIC_AGENT_COMPAT=1",
+		"DEVRITES_HOOK_PROFILE=strict",
+	}
+	for _, command := range []string{
+		"npm run build",
+		"npm run test:e2e -- tests/admin-locations.e2e.spec.ts",
+	} {
+		in := fmt.Sprintf(`{"tool_name":"Bash","tool_input":{"command":%q}}`, command)
+		out, errOut, code := runDevritesIO(t, root, in, env,
+			"hook", "wright-scope", "--harness=codex")
+		if code != 0 || strings.TrimSpace(out) != "" {
+			t.Fatalf("%q should be root-owned: exit=%d out=%q stderr=%q", command, code, out, errOut)
+		}
+	}
+
+	in := `{"tool_name":"Bash","tool_input":{"command":"printf x > src/app.go"}}`
+	out, errOut, code := runDevritesIO(t, root, in, env,
+		"hook", "wright-scope", "--harness=codex")
+	if code != 0 {
+		t.Fatalf("source write guard exit=%d stderr=%q", code, errOut)
+	}
+	if decision, _ := parsePermissionDecision(t, out); decision != "deny" {
+		t.Fatalf("root source mutation was not denied: %q", out)
+	}
+}
+
 func TestHookReviewerReadonlyActiveLeafDeniesEveryMutationSurface(t *testing.T) {
 	root := newWorkspace(t)
 	env := []string{
@@ -405,20 +460,87 @@ func TestHookReviewerReadonlyActiveLeafDeniesEveryMutationSurface(t *testing.T)
 
 func TestHookReviewerReadonlyActiveLeafAllowsBoundedProof(t *testing.T) {
 	root := newWorkspace(t)
-	in := `{"tool_name":"Bash","tool_input":{"command":"go test ./... -count=1"}}`
-	out, _, code := runDevritesIO(t, root, in, []string{
+	env := []string{
 		"DEVRITES_AGENT_RUN=1",
 		"DEVRITES_ACTIVE_AGENT=devrites-proof-runner",
-	}, "hook", "reviewer-readonly", "--harness=claude")
+	}
+	for _, command := range []string{
+		"go test ./... -count=1",
+		"command -v devrites-engine",
+		"devrites-engine conventions orient",
+		"devrites-engine learnings mine",
+	} {
+		in := fmt.Sprintf(`{"tool_name":"Bash","tool_input":{"command":%q}}`, command)
+		out, _, code := runDevritesIO(t, root, in, env,
+			"hook", "reviewer-readonly", "--harness=claude")
+		if code != 0 || strings.TrimSpace(out) != "" {
+			t.Fatalf("%q should be allowed: exit=%d out=%q", command, code, out)
+		}
+	}
+	in := `{"tool_name":"Bash","tool_input":{"command":"go test ./... -count=1"}}`
+	out, _, code := runDevritesIO(t, root, in, env,
+		"hook", "wright-scope", "--harness=claude")
 	if code != 0 || strings.TrimSpace(out) != "" {
-		t.Fatalf("bounded proof should be allowed: exit=%d out=%q", code, out)
+		t.Fatalf("wright hook must not shadow reviewer policy: exit=%d out=%q", code, out)
 	}
-	out, _, code = runDevritesIO(t, root, in, []string{
+}
+
+func TestHookReviewerReadonlyProofRunnerKeepsArtifactProofRootOwned(t *testing.T) {
+	root := newWorkspace(t)
+	env := []string{
 		"DEVRITES_AGENT_RUN=1",
 		"DEVRITES_ACTIVE_AGENT=devrites-proof-runner",
-	}, "hook", "wright-scope", "--harness=claude")
+	}
+	for _, command := range []string{
+		"npm run build",
+		"npm run test:e2e -- tests/admin-locations.e2e.spec.ts",
+		"go build ./...",
+		"bash scripts/mutate-repository.sh",
+		"npm run deploy",
+		"make deploy",
+		"docker compose up -d",
+		"printf x > src/app.go",
+		"npm install left-pad",
+		"python -c 'open(\"src/app.go\", \"w\").write(\"x\")'",
+	} {
+		in := fmt.Sprintf(`{"tool_name":"Bash","tool_input":{"command":%q}}`, command)
+		out, errOut, code := runDevritesIO(t, root, in, env,
+			"hook", "reviewer-readonly", "--harness=claude")
+		if code != 0 {
+			t.Fatalf("root-owned proof command guard exit=%d stderr=%q", code, errOut)
+		}
+		if decision, _ := parsePermissionDecision(t, out); decision != "deny" {
+			t.Fatalf("proof leaf command was not denied: command=%q out=%q", command, out)
+		}
+	}
+}
+
+func TestHookRedwatchRecognizesCodexShellAliases(t *testing.T) {
+	root := newWorkspace(t)
+	writeActive(t, root, "auth-tokens")
+	red := filepath.Join(root, "features", "auth-tokens", ".red")
+
+	fail := `{"tool_name":"functions.exec_command","tool_input":{"cmd":"npm test"},"tool_response":"Tests: 1 failed, 3 passed"}`
+	out, errOut, code := runDevritesIO(t, root, fail, nil,
+		"hook", "redwatch", "--harness=codex")
+	if code != 0 {
+		t.Fatalf("failing exec_command exit=%d stderr=%q", code, errOut)
+	}
+	if !strings.Contains(out, "tests/build are RED") {
+		t.Fatalf("failing exec_command omitted RED context: %q", out)
+	}
+	if _, err := os.Stat(red); err != nil {
+		t.Fatalf("failing exec_command did not create .red: %v", err)
+	}
+
+	pass := `{"tool_name":"exec_command","tool_input":{"cmd":"npm test"},"tool_response":"PASS: all tests passed"}`
+	out, errOut, code = runDevritesIO(t, root, pass, nil,
+		"hook", "redwatch", "--harness=codex")
 	if code != 0 || strings.TrimSpace(out) != "" {
-		t.Fatalf("wright hook must not shadow reviewer policy: exit=%d out=%q", code, out)
+		t.Fatalf("passing exec_command exit=%d out=%q stderr=%q", code, out, errOut)
+	}
+	if _, err := os.Stat(red); !os.IsNotExist(err) {
+		t.Fatalf("passing exec_command retained .red: %v", err)
 	}
 }
 
@@ -467,7 +589,7 @@ func TestHookWrightScopeUsesExactOrchestratorAllowlist(t *testing.T) {
 	}
 }
 
-func TestHookWrightScopeBindsCodexWorkerDuringReconcileWindow(t *testing.T) {
+func TestHookWrightScopeRequiresBoundCodexWorkerDuringReconcileWindow(t *testing.T) {
 	root := newWorkspace(t)
 	writeActive(t, root, "auth-tokens")
 	workspace := filepath.Join(root, "features", "auth-tokens")
@@ -484,7 +606,7 @@ func TestHookWrightScopeBindsCodexWorkerDuringReconcileWindow(t *testing.T) {
 		input string
 		deny  bool
 	}{
-		{"listed edit", `{"tool_name":"Edit","tool_input":{"file_path":"src/app.go"},"agent_type":"worker"}`, false},
+		{"unbound listed edit", `{"tool_name":"Edit","tool_input":{"file_path":"src/app.go"},"agent_type":"worker"}`, true},
 		{"unlisted edit", `{"tool_name":"Edit","tool_input":{"file_path":"src/other.go"},"agent_type":"worker"}`, true},
 	} {
 		t.Run(test.name, func(t *testing.T) {
@@ -514,6 +636,90 @@ func TestHookWrightScopeBindsCodexWorkerDuringReconcileWindow(t *testing.T) {
 	}
 }
 
+func TestHookWrightScopeAllowsOnlyBoundCodexV1WorkerPaths(t *testing.T) {
+	root := newWorkspace(t)
+	writeActive(t, root, "auth-tokens")
+	workspace := filepath.Join(root, "features", "auth-tokens")
+	for name, body := range map[string]string{
+		".wright-allowlist":    "src/app.go\n",
+		".reconcile-base":      "snapshot\n",
+		".reconcile-allowlist": "src/app.go\n",
+		".reconcile-devrites":  "[]\n",
+	} {
+		if err := os.WriteFile(filepath.Join(workspace, name), []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := os.MkdirAll(filepath.Join(workspace, ".reconcile-objects"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	sessionID, turnID := "session-bound-worker", "turn-bound-worker"
+	writeCodexAgentContract(t, root, "devrites-slice-wright")
+	writeCodexSkillContract(t, root, "rite-build", "devrites-slice-wright")
+	runDevritesIO(t, root, hookPayload(t, map[string]any{
+		"hook_event_name": "UserPromptSubmit",
+		"session_id":      sessionID,
+		"turn_id":         turnID,
+		"prompt":          "$rite-build",
+	}), nil, "hook", "agent-dispatch", "--harness=codex")
+	if out, stderr, code := runDevritesIO(t, root, hookPayload(t, map[string]any{
+		"hook_event_name": "PreToolUse",
+		"session_id":      sessionID,
+		"turn_id":         turnID,
+		"tool_name":       "spawn_agent",
+		"tool_use_id":     "spawn-bound-worker",
+		"tool_input": map[string]any{
+			"agent_type": "worker",
+			"fork_turns": "none",
+			"message":    "Read .codex/agents/devrites-slice-wright.toml.",
+		},
+	}), nil, "hook", "agent-dispatch", "--harness=codex"); code != 0 {
+		t.Fatalf("spawn exit=%d out=%s stderr=%s", code, out, stderr)
+	} else if decision, reason := parsePermissionDecision(t, out); decision != "allow" {
+		t.Fatalf("spawn denied: %s (%s)", decision, reason)
+	}
+	if out, stderr, code := runDevritesIO(t, root, hookPayload(t, map[string]any{
+		"hook_event_name": "SubagentStart",
+		"session_id":      sessionID,
+		"turn_id":         "child-turn",
+		"agent_id":        "bound-worker",
+		"agent_type":      "worker",
+	}), nil, "hook", "subagent-orient", "--harness=codex"); code != 0 ||
+		!strings.Contains(out, "Confirmed role") {
+		t.Fatalf("start exit=%d out=%s stderr=%s", code, out, stderr)
+	}
+
+	env := []string{"DEVRITES_CODEX_GENERIC_AGENT_COMPAT=1", "DEVRITES_HOOK_PROFILE=strict"}
+	for _, test := range []struct {
+		path string
+		deny bool
+	}{
+		{"src/app.go", false},
+		{"src/other.go", true},
+	} {
+		input := hookPayload(t, map[string]any{
+			"hook_event_name": "PreToolUse",
+			"session_id":      sessionID,
+			"agent_id":        "bound-worker",
+			"agent_type":      "worker",
+			"tool_name":       "Edit",
+			"tool_input":      map[string]any{"file_path": test.path},
+		})
+		out, stderr, code := runDevritesIO(t, root, input, env,
+			"hook", "wright-scope", "--harness=codex")
+		if code != 0 {
+			t.Fatalf("%s exit=%d stderr=%s", test.path, code, stderr)
+		}
+		if test.deny {
+			if decision, _ := parsePermissionDecision(t, out); decision != "deny" {
+				t.Fatalf("%s should be denied: %s", test.path, out)
+			}
+		} else if strings.TrimSpace(out) != "" {
+			t.Fatalf("%s should be allowed: %s", test.path, out)
+		}
+	}
+}
+
 func TestHookWrightScopeAcceptsCodexV2NamedRole(t *testing.T) {
 	root := newWorkspace(t)
 	writeActive(t, root, "auth-tokens")
@@ -594,6 +800,8 @@ func TestHookWrightScopeRequiresSpawnedCodexWorkerForSourceWrites(t *testing.T)
 	runGuard(`{"tool_name":"Write","tool_input":{"file_path":"src/app.go"}}`, true)
 	runGuard(`{"tool_name":"Bash","tool_input":{"command":"printf x > src/app.go"}}`, true)
 	runGuard(`{"tool_name":"js","tool_input":{"code":"writeFile()"}}`, true)
+	runGuard(`{"tool_name":"Bash","tool_input":{"command":"devrites-engine reconcile restore-check auth-tokens"}}`, false)
+	runGuard(`{"tool_name":"Bash","tool_input":{"command":"devrites-engine reconcile restore-check auth-tokens && printf x > src/app.go"}}`, true)
 	out, errOut, code := runDevritesIO(t, root,
 		`{"tool_name":"Bash","tool_input":{"command":"printf x > src/app.go"}}`,
 		nil, "hook", "wright-scope", "--harness=claude")
@@ -1509,6 +1717,74 @@ func TestCodexAgentDispatchBlocksFalseWaitAndStop(t *testing.T) {
 	}
 }
 
+func TestCodexAgentDispatchRequiresSuccessfulReasonBoundWaiver(t *testing.T) {
+	root := newWorkspace(t)
+	role := "devrites-plan-reviewer"
+	writeCodexAgentContract(t, root, role)
+	writeCodexSkillContract(t, root, "rite-vet", role)
+	sessionID, turnID := "session-waiver", "turn-waiver"
+	runDevritesIO(t, root, hookPayload(t, map[string]any{
+		"hook_event_name": "UserPromptSubmit",
+		"session_id":      sessionID,
+		"turn_id":         turnID,
+		"prompt":          "$rite-vet",
+	}), nil, "hook", "agent-dispatch", "--harness=codex")
+
+	invalid := hookPayload(t, map[string]any{
+		"hook_event_name": "PreToolUse",
+		"session_id":      sessionID,
+		"turn_id":         turnID,
+		"tool_name":       "functions.exec_command",
+		"tool_input":      map[string]any{"cmd": "devrites-engine dispatch-waive wrong-phase && true"},
+	})
+	out, _, _ := runDevritesIO(t, root, invalid, nil,
+		"hook", "agent-dispatch", "--harness=codex")
+	if decision, _ := parsePermissionDecision(t, out); decision != "deny" {
+		t.Fatalf("chained waiver was not denied: %s", out)
+	}
+
+	command := "devrites-engine dispatch-waive wrong-phase"
+	pre := hookPayload(t, map[string]any{
+		"hook_event_name": "PreToolUse",
+		"session_id":      sessionID,
+		"turn_id":         turnID,
+		"tool_name":       "functions.exec_command",
+		"tool_input":      map[string]any{"cmd": command},
+	})
+	if out, stderr, code := runDevritesIO(t, root, pre, nil,
+		"hook", "agent-dispatch", "--harness=codex"); code != 0 || strings.TrimSpace(out) != "" {
+		t.Fatalf("waiver pre exit=%d out=%s stderr=%s", code, out, stderr)
+	}
+
+	stop := hookPayload(t, map[string]any{
+		"hook_event_name": "Stop",
+		"session_id":      sessionID,
+		"turn_id":         turnID,
+	})
+	out, _, _ = runDevritesIO(t, root, stop, nil,
+		"hook", "agent-dispatch", "--harness=codex")
+	if decision, _ := parseStopDecision(t, out); decision != "block" {
+		t.Fatalf("PreToolUse waiver falsely satisfied dispatch: %s", out)
+	}
+
+	post := hookPayload(t, map[string]any{
+		"hook_event_name": "PostToolUse",
+		"session_id":      sessionID,
+		"turn_id":         turnID,
+		"tool_name":       "functions.exec_command",
+		"tool_input":      map[string]any{"cmd": command},
+		"tool_response":   "dispatch-waive: accepted wrong-phase",
+	})
+	if out, stderr, code := runDevritesIO(t, root, post, nil,
+		"hook", "agent-dispatch", "--harness=codex"); code != 0 || strings.TrimSpace(out) != "" {
+		t.Fatalf("waiver post exit=%d out=%s stderr=%s", code, out, stderr)
+	}
+	if out, stderr, code := runDevritesIO(t, root, stop, nil,
+		"hook", "agent-dispatch", "--harness=codex"); code != 0 || strings.TrimSpace(out) != "" {
+		t.Fatalf("waived stop exit=%d out=%s stderr=%s", code, out, stderr)
+	}
+}
+
 func TestCodexAgentDispatchConfirmsGenericRoleAndResult(t *testing.T) {
 	root := newWorkspace(t)
 	sessionID, turnID := "session-complete", "turn-complete"
@@ -1629,12 +1905,99 @@ func TestCodexAgentDispatchConfirmsGenericRoleAndResult(t *testing.T) {
 		t.Fatalf("wait exit=%d out=%s stderr=%s", code, out, stderr)
 	}
 
+	if out, stderr, code := runDevritesIO(t, root, stop, nil,
+		"hook", "agent-dispatch", "--harness=codex"); code != 0 {
+		t.Fatalf("pre-wait stop exit=%d out=%s stderr=%s", code, out, stderr)
+	} else if decision, _ := parseStopDecision(t, out); decision != "block" {
+		t.Fatalf("PreToolUse wait falsely satisfied dispatch: %s", out)
+	}
+
+	waitTimeout := hookPayload(t, map[string]any{
+		"hook_event_name": "PostToolUse",
+		"session_id":      sessionID,
+		"turn_id":         turnID,
+		"tool_name":       "wait",
+		"tool_input":      map[string]any{"ids": []string{"agent-1"}},
+		"tool_response":   map[string]any{"timed_out": true},
+	})
+	if out, stderr, code := runDevritesIO(t, root, waitTimeout, nil,
+		"hook", "agent-dispatch", "--harness=codex"); code != 0 || strings.TrimSpace(out) != "" {
+		t.Fatalf("timed-out wait post exit=%d out=%s stderr=%s", code, out, stderr)
+	}
+	if out, stderr, code := runDevritesIO(t, root, stop, nil,
+		"hook", "agent-dispatch", "--harness=codex"); code != 0 {
+		t.Fatalf("post-timeout stop exit=%d out=%s stderr=%s", code, out, stderr)
+	} else if decision, _ := parseStopDecision(t, out); decision != "block" {
+		t.Fatalf("timed-out wait falsely satisfied dispatch: %s", out)
+	}
+
+	waitDone := hookPayload(t, map[string]any{
+		"hook_event_name": "PostToolUse",
+		"session_id":      sessionID,
+		"turn_id":         turnID,
+		"tool_name":       "wait",
+		"tool_input":      map[string]any{"ids": []string{"agent-1"}},
+		"tool_response":   map[string]any{"status": "completed"},
+	})
+	if out, stderr, code := runDevritesIO(t, root, waitDone, nil,
+		"hook", "agent-dispatch", "--harness=codex"); code != 0 || strings.TrimSpace(out) != "" {
+		t.Fatalf("wait post exit=%d out=%s stderr=%s", code, out, stderr)
+	}
+
 	if out, stderr, code := runDevritesIO(t, root, stop, nil,
 		"hook", "agent-dispatch", "--harness=codex"); code != 0 || strings.TrimSpace(out) != "" {
 		t.Fatalf("resolved stop exit=%d out=%s stderr=%s", code, out, stderr)
 	}
 }
 
+func TestCodexAgentDispatchRefusesAmbiguousGenericStart(t *testing.T) {
+	root := newWorkspace(t)
+	sessionID, turnID := "session-ambiguous-start", "turn-ambiguous-start"
+	roles := []string{"devrites-security-auditor", "devrites-plan-reviewer"}
+	for _, role := range roles {
+		writeCodexAgentContract(t, root, role)
+	}
+	writeCodexSkillContract(t, root, "devrites-audit", strings.Join(roles, ","))
+	runDevritesIO(t, root, hookPayload(t, map[string]any{
+		"hook_event_name": "UserPromptSubmit",
+		"session_id":      sessionID,
+		"turn_id":         turnID,
+		"prompt":          "$devrites-audit",
+	}), nil, "hook", "agent-dispatch", "--harness=codex")
+
+	for i, role := range roles {
+		out, stderr, code := runDevritesIO(t, root, hookPayload(t, map[string]any{
+			"hook_event_name": "PreToolUse",
+			"session_id":      sessionID,
+			"turn_id":         turnID,
+			"tool_name":       "spawn_agent",
+			"tool_use_id":     fmt.Sprintf("spawn-%d", i),
+			"tool_input": map[string]any{
+				"agent_type": "explorer",
+				"fork_turns": "none",
+				"message":    "Read .codex/agents/" + role + ".toml.",
+			},
+		}), nil, "hook", "agent-dispatch", "--harness=codex")
+		if code != 0 {
+			t.Fatalf("spawn %s exit=%d out=%s stderr=%s", role, code, out, stderr)
+		}
+	}
+
+	out, stderr, code := runDevritesIO(t, root, hookPayload(t, map[string]any{
+		"hook_event_name": "SubagentStart",
+		"session_id":      sessionID,
+		"turn_id":         "child-turn",
+		"agent_id":        "ambiguous-agent",
+		"agent_type":      "explorer",
+	}), nil, "hook", "subagent-orient", "--harness=codex")
+	if code != 0 {
+		t.Fatalf("start exit=%d stderr=%s", code, stderr)
+	}
+	if !strings.Contains(out, "Dispatch binding failed") {
+		t.Fatalf("ambiguous generic start was bound to an arbitrary role: %s", out)
+	}
+}
+
 func TestCodexAgentDispatchConfirmsDurableV2NamedRole(t *testing.T) {
 	root := newWorkspace(t)
 	codeHome := t.TempDir()
@@ -1925,6 +2288,14 @@ func TestCodexAgentDispatchGatesReconcileCloseOnBoundWrightResult(t *testing.T)
 			"tool_name":       "wait",
 			"tool_input":      map[string]any{"ids": []string{"agent-wright"}},
 		},
+		{
+			"hook_event_name": "PostToolUse",
+			"session_id":      sessionID,
+			"turn_id":         turnID,
+			"tool_name":       "wait",
+			"tool_input":      map[string]any{"ids": []string{"agent-wright"}},
+			"tool_response":   map[string]any{"status": "completed"},
+		},
 	} {
 		hook := "agent-dispatch"
 		if payload["hook_event_name"] == "SubagentStart" {

package/engine/tests/parity_reconcile_test.go

@@ -71,6 +71,9 @@ func TestParityReconcile(t *testing.T) {
 	t.Run("close-window", func(t *testing.T) {
 		work := newRepo(t)
 		snapshot(t, work)
+		if out, code := runArgv(t, work, libRootEnv(work), "", binPath, "reconcile", "check", "feat"); code != 0 {
+			t.Fatalf("pre-close reconcile check = %d, want 0\n%s", code, out)
+		}
 		out, code := runArgv(t, work, libRootEnv(work), "", binPath, "reconcile", "close", "feat")
 		assertGolden(t, out, code)
 	})
@@ -78,7 +81,7 @@ func TestParityReconcile(t *testing.T) {
 	t.Run("not-git", func(t *testing.T) {
 		work := t.TempDir()
 		makeFeatureDir(t, work, "feat")
-		check(t, work) // exit 0
+		check(t, work) // fail closed outside Git
 	})
 
 	t.Run("bad-mode", func(t *testing.T) {

package/engine/tests/parity_testintegrity_test.go

@@ -58,7 +58,7 @@ func TestParityTestIntegrity(t *testing.T) {
 		runCase(t, newRepo(t), "ghost")
 	})
 	t.Run("not-git", func(t *testing.T) {
-		work := t.TempDir() // no initGitRepo -> gate skipped
+		work := t.TempDir() // no initGitRepo -> gate fails closed
 		makeFeatureDir(t, work, "feat")
 		runCase(t, work, "feat")
 	})

package/pack/.claude/agents/devrites-code-reviewer.md

@@ -98,6 +98,9 @@ not as a blocker on this diff.
 - If you can't verify something, say so explicitly rather than assuming it's fine.
 
 ## Output
+
+Wrap the report in the standards `agent-result/v1` envelope with
+`payload.type: review-findings`; never return raw prose.
 ```
 Code review (<slug>) — independent
 [Critical] file:line — problem. fix.

package/pack/.claude/agents/devrites-devex-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-devex-reviewer
 description: Reviews the developer experience of one DevRites feature with fresh context. At /rite-vet it predicts the experience; at /rite-seal it measures and reconciles it. Use for public APIs, CLIs, SDKs, libraries, webhooks, config or environment contracts, error messages, and getting-started flows. Finds where the next developer gets stuck instead of rubber-stamping the surface.
-tools: Read, Grep, Glob, Bash
+tools: Read, Grep, Glob
 hooks:
   PreToolUse:
     - matcher: Edit|Write|MultiEdit|NotebookEdit|Bash|Agent|Task
@@ -48,10 +48,10 @@ You receive a feature slug or workspace path (`.devrites/work/<slug>/`) and the
 diff scope. Read `spec.md`, `plan.md`, `decisions.md`, `touched-files.md`, and
 `.devrites/principles.md` if present. Public API invariants in the principles file
 are binding. Read `devex.md` if present for predicted or measured scores, plus
-`evidence.md` and `browser-evidence.md` for the measured run. Run `git diff` for
-the feature scope and inspect the developer-facing files it touches, including
-route handlers, CLI entry points, exported signatures, README or quickstart
-instructions, and error or exit paths.
+`evidence.md`, `browser-evidence.md`, and the root-supplied immutable diff and
+quickstart log for the measured run. Inspect the developer-facing files it
+touches, including route handlers, CLI entry points, exported signatures, README
+or quickstart instructions, and error or exit paths.
 
 ## Review (developer-facing surface, feature scope only)
 
@@ -62,9 +62,10 @@ consistently:
 - **Time-to-hello-world:** in measure mode, record the wall-clock time to one
   successful call or response. In predict mode, estimate it. This is the headline
   number.
-- **Getting-started friction:** run the quickstart exactly as written on a clean
-  checkout. An undocumented prerequisite, wrong command, or missing step is a
-  finding.
+- **Getting-started friction:** validate the root-owned clean-checkout quickstart
+  transcript, exact commands, timings, and candidate identity. An undocumented
+  prerequisite, wrong command, missing step, or stale/mismatched transcript is a
+  finding. Never execute the quickstart yourself.
 - **Error-message quality:** a failure must say what failed, why, and how to
   recover, include the relevant IDs, and expose **no secrets** under `security.md`.
   A bare trace, silent exit, or "an error occurred" on a developer-facing path is a
@@ -96,6 +97,9 @@ consistently:
   invent a DX problem to justify the pass.
 
 ## Output
+
+Wrap the report in the standards `agent-result/v1` envelope with
+`payload.type: review-findings`; never return raw prose.
 ```
 DevEx review (<slug>) — independent · mode: predict | measure
 Scorecard:

package/pack/.claude/agents/devrites-doubt-reviewer.md

@@ -54,6 +54,9 @@ Critical. Treat overrides as review input, not permission.
 - Be concrete: the exact scenario that breaks it, with `file:line` where relevant.
 
 ## Output
+
+Wrap the report in the standards `agent-result/v1` envelope with
+`payload.type: review-findings`; never return raw prose.
 ```
 Doubt review
 Claim: <restated>

package/pack/.claude/agents/devrites-forge-judge.md

@@ -36,7 +36,7 @@ Read the review bar once: `spec.md` and the slice acceptance criteria;
 For each candidate, read only the immutable extracted delta:
 
 ```bash
-git -C "<manifest primary_root>" diff --binary --full-index --no-renames \
+cd "<validated manifest primary_root>" && git diff --binary --full-index --no-renames \
   "<candidate initial_base>" "<candidate commit>" --
 ```
 
@@ -94,6 +94,9 @@ Cite the diff line before the mark, and never rank candidates by general impress
 - The strategy a candidate was assigned is context, not credit: score the code it produced.
 
 ## Output
+
+Wrap the report in the standards `agent-result/v1` envelope with
+`payload.type: review-findings`; never return raw prose.
 ```
 Forge verdict (<slug> / <slice id>) — independent, comparative
 Candidates scored (each, evidence → mark):

package/pack/.claude/agents/devrites-frontend-reviewer.md

@@ -72,6 +72,9 @@ project's tokens, shared components, and neighboring screens.
   with `file:line` and a concrete fix. Feature scope only.
 
 ## Output
+
+Wrap the report in the standards `agent-result/v1` envelope with
+`payload.type: review-findings`; never return raw prose.
 ```
 Frontend review (<slug>) — independent
 System alignment: <drift by root cause>

package/pack/.claude/agents/devrites-performance-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-performance-reviewer
 description: Reviews one DevRites feature for /rite-seal from a fresh context, starting with measurement. Checks N+1 queries, hot-path work, payload and bundle size, and Core Web Vitals risks. Source mode reports potential findings from a static scan; Measured mode grades real Lighthouse, PSI, CrUX, or trace results with a source-labeled scorecard. Never claims a slowdown without a number or a concrete measurement, and never presents lab data as field data.
-tools: Read, Grep, Glob, Bash
+tools: Read, Grep, Glob
 hooks:
   PreToolUse:
     - matcher: Edit|Write|MultiEdit|NotebookEdit|Bash|Agent|Task
@@ -29,16 +29,14 @@ remains a Critical. Treat overrides as review input, not permission.
 
 ## Inputs
 In workspace `.devrites/work/<slug>/`, read `spec.md` for any performance budget,
-then `evidence.md` and `touched-files.md`. Run `git diff` and inspect the touched
-files. Look for Core Web Vitals evidence in `evidence.md`, a saved Lighthouse,
+then `evidence.md`, `touched-files.md`, and the immutable diff supplied by the root.
+Look for Core Web Vitals evidence in `evidence.md`, a saved Lighthouse,
 PageSpeed Insights, or CrUX JSON artifact, and `browser-evidence.md`.
 
-Read the baseline checklist on demand (resolve the path like the readonly hook):
-```
-C=.claude/skills/rite-review/reference/performance-checklist.md
-[ -f "$C" ] || C="$CLAUDE_PLUGIN_ROOT/pack/.claude/skills/rite-review/reference/performance-checklist.md"
-[ -f "$C" ] || C=pack/.claude/skills/rite-review/reference/performance-checklist.md
-```
+Read the first existing baseline checklist in this order with `Read`:
+`.claude/skills/rite-review/reference/performance-checklist.md`,
+the packet-provided plugin-root copy, then
+`pack/.claude/skills/rite-review/reference/performance-checklist.md`.
 
 ## Two modes (the inputs set the mode, not a flag)
 - **Source mode:** use this default when there are no performance artifacts. Scan
@@ -87,6 +85,9 @@ when a scorecard is allowed.
 
 ## Output
 
+Wrap the report in the standards `agent-result/v1` envelope with
+`payload.type: review-findings`; never return raw prose.
+
 **Measured mode**: lead with a compact scorecard, then the line findings:
 ```
 Performance review (<slug>) — independent