devrites 3.2.27 → 4.0.0

package/engine/root_routing_test.go

@@ -3,10 +3,7 @@ package main
 import (
 	"bytes"
 	"os"
-	"os/exec"
 	"path/filepath"
-	"reflect"
-	"sort"
 	"strings"
 	"testing"
 )
@@ -18,89 +15,12 @@ func TestRootModeForCoversReadAndWriteSurfaces(t *testing.T) {
 		args    []string
 		want    rootMode
 	}{
-		{name: "unrelated command", command: "doctor", want: rootUnused},
-		{name: "first task", command: "first-task", want: rootLenient},
-		{name: "spec dedupe", command: "spec-dedupe", want: rootLenient},
-		{name: "footprint render", command: "footprint", args: []string{"render"}, want: rootLenient},
-		{name: "footprint roster", command: "footprint", args: []string{"roster"}, want: rootLenient},
-		{name: "footprint log", command: "footprint", args: []string{"log"}, want: rootStrict},
-		{name: "evidence fresh", command: "evidence-fresh", want: rootLenient},
-		{name: "coverage", command: "coverage", want: rootLenient},
-		{name: "doubt coverage", command: "doubt-coverage", want: rootLenient},
-		{name: "budget", command: "budget", want: rootLenient},
-		{name: "preamble", command: "preamble", want: rootLenient},
-		{name: "progress", command: "progress", want: rootLenient},
-		{name: "stuck check", command: "stuck", args: []string{"check"}, want: rootLenient},
-		{name: "stuck log", command: "stuck", args: []string{"log"}, want: rootStrict},
-		{name: "recovery route", command: "recovery", args: []string{"route"}, want: rootLenient},
-		{name: "recovery check", command: "recovery", args: []string{"check"}, want: rootLenient},
-		{name: "recovery fingerprint", command: "recovery", args: []string{"fingerprint"}, want: rootLenient},
-		{name: "recovery record", command: "recovery", args: []string{"record"}, want: rootStrict},
-		{name: "recovery clear", command: "recovery", args: []string{"clear"}, want: rootStrict},
-		{name: "build readiness", command: "build-readiness", want: rootLenient},
-		{name: "readiness digest", command: "readiness-digest", want: rootLenient},
-		{name: "clarify enter", command: "clarify-return", args: []string{"enter"}, want: rootStrict},
-		{name: "clarify restore", command: "clarify-return", args: []string{"restore"}, want: rootStrict},
-		{name: "analyze", command: "analyze", want: rootLenient},
-		{name: "mutation gate", command: "mutation-gate", want: rootLenient},
-		{name: "test integrity", command: "test-integrity", want: rootLenient},
-		{name: "review integrity", command: "review-integrity", want: rootLenient},
-		{name: "reconcile snapshot", command: "reconcile", args: []string{"snapshot"}, want: rootStrict},
-		{name: "reconcile check", command: "reconcile", args: []string{"check"}, want: rootStrict},
-		{name: "reconcile close", command: "reconcile", args: []string{"close"}, want: rootStrict},
-		{name: "resolve", command: "resolve", want: rootStrict},
-		{name: "resolve next qid", command: "resolve", args: []string{"next-qid"}, want: rootLenient},
-		{name: "close out", command: "close-out", want: rootStrict},
-		{name: "archive search", command: "archive-search", want: rootLenient},
-		{name: "decisions search", command: "decisions", args: []string{"search"}, want: rootLenient},
-		{name: "decisions index", command: "decisions", args: []string{"index"}, want: rootStrict},
-		{name: "ledger diff", command: "ledger", args: []string{"diff"}, want: rootLenient},
-		{name: "ledger validate", command: "ledger", args: []string{"validate"}, want: rootLenient},
-		{name: "ledger list", command: "ledger", args: []string{"list"}, want: rootLenient},
-		{name: "ledger show", command: "ledger", args: []string{"show"}, want: rootLenient},
-		{name: "ledger sync", command: "ledger", args: []string{"sync"}, want: rootStrict},
-		{name: "ledger json before sync", command: "ledger", args: []string{"--json", "sync"}, want: rootStrict},
-		{name: "learnings list", command: "learnings", args: []string{"list"}, want: rootLenient},
-		{name: "learnings top", command: "learnings", args: []string{"top"}, want: rootLenient},
-		{name: "learnings mine", command: "learnings", args: []string{"mine"}, want: rootLenient},
-		{name: "learnings nudge", command: "learnings", args: []string{"nudge"}, want: rootLenient},
-		{name: "learnings add", command: "learnings", args: []string{"add"}, want: rootStrict},
-		{name: "timeline list", command: "timeline", args: []string{"list"}, want: rootLenient},
-		{name: "timeline report", command: "timeline", args: []string{"report"}, want: rootLenient},
-		{name: "timeline log", command: "timeline", args: []string{"log"}, want: rootStrict},
-		{name: "timeline purge", command: "timeline", args: []string{"purge"}, want: rootStrict},
-		{name: "health list", command: "health", args: []string{"list"}, want: rootLenient},
-		{name: "health default", command: "health", want: rootStrict},
-		{name: "health run", command: "health", args: []string{"run"}, want: rootStrict},
-		{name: "health check", command: "health", args: []string{"check"}, want: rootStrict},
-		{name: "health record", command: "health", args: []string{"record"}, want: rootStrict},
-		{name: "config", command: "config", args: []string{"get"}, want: rootLenient},
-		{name: "reviewers", command: "reviewers", args: []string{"list"}, want: rootLenient},
-		{name: "outside voice", command: "outside-voice", want: rootLenient},
-		{name: "docs stale", command: "docs-stale", want: rootLenient},
+		{name: "unrelated command", command: "unknown", want: rootUnused},
+		{name: "check family", command: "check", args: []string{"readiness"}, want: rootUnused},
+		{name: "resolve", command: "state", args: []string{"resolve"}, want: rootStrict},
+		{name: "close", command: "state", args: []string{"close"}, want: rootStrict},
+		{name: "unknown state command", command: "state", args: []string{"unknown"}, want: rootUnused},
 		{name: "secret scan", command: "secret-scan", want: rootLenient},
-		{name: "review fingerprints read", command: "review-fingerprints", want: rootLenient},
-		{name: "review fingerprints write", command: "review-fingerprints", args: []string{"demo", "--write"}, want: rootStrict},
-		{name: "reviewer stats report", command: "reviewer-stats", args: []string{"report"}, want: rootLenient},
-		{name: "reviewer stats record", command: "reviewer-stats", args: []string{"record"}, want: rootStrict},
-		{name: "lanes", command: "lanes", args: []string{"plan"}, want: rootLenient},
-		{name: "forge missing verb", command: "forge", want: rootStrict},
-		{name: "forge plan", command: "forge", args: []string{"plan"}, want: rootStrict},
-		{name: "forge record", command: "forge", args: []string{"record"}, want: rootStrict},
-		{name: "forge extract", command: "forge", args: []string{"extract"}, want: rootStrict},
-		{name: "forge merge", command: "forge", args: []string{"merge"}, want: rootStrict},
-		{name: "forge cleanup", command: "forge", args: []string{"cleanup"}, want: rootStrict},
-		{name: "forge reap", command: "forge", args: []string{"reap"}, want: rootStrict},
-		{name: "extensions list", command: "extensions", args: []string{"list"}, want: rootLenient},
-		{name: "extensions validate", command: "extensions", args: []string{"validate"}, want: rootLenient},
-		{name: "extensions sync", command: "extensions", args: []string{"sync"}, want: rootStrict},
-		{name: "overrides", command: "overrides", args: []string{"validate"}, want: rootLenient},
-		{name: "context show", command: "context", args: []string{"show"}, want: rootLenient},
-		{name: "context sync", command: "context", args: []string{"sync"}, want: rootStrict},
-		{name: "runbook list", command: "runbook", args: []string{"list"}, want: rootLenient},
-		{name: "runbook validate", command: "runbook", args: []string{"validate"}, want: rootLenient},
-		{name: "runbook run", command: "runbook", args: []string{"run"}, want: rootStrict},
-		{name: "runbook resume", command: "runbook", args: []string{"resume"}, want: rootStrict},
 	}
 
 	for _, test := range tests {
@@ -112,165 +32,216 @@ func TestRootModeForCoversReadAndWriteSurfaces(t *testing.T) {
 	}
 }
 
-func TestStrictForgeRefusesParentWorkspaceAcrossNestedRepository(t *testing.T) {
-	parent := t.TempDir()
-	if err := os.Mkdir(filepath.Join(parent, ".devrites"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	child := filepath.Join(parent, "nested")
-	if err := os.Mkdir(child, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	initRootRoutingGitRepo(t, child)
-	withRootRoutingCWD(t, child)
-	t.Setenv("DEVRITES_ROOT", "")
-	t.Setenv("DEVRITES_WORKSPACE", "")
-
-	var stdout, stderr bytes.Buffer
-	code := run([]string{"forge", "plan"}, strings.NewReader(""), &stdout, &stderr)
-	if code != exitBlocked {
-		t.Fatalf("forge plan exit = %d, want %d; stdout=%q stderr=%q", code, exitBlocked, stdout.String(), stderr.String())
-	}
-	if !strings.Contains(stderr.String(), "unsafe DevRites root") {
-		t.Fatalf("stderr = %q, want unsafe-root refusal", stderr.String())
-	}
-	if _, err := os.Stat(filepath.Join(child, ".devrites")); !os.IsNotExist(err) {
-		t.Fatalf("strict refusal must not create nested workspace; stat err=%v", err)
+func TestRemovedCommandsAreUnknown(t *testing.T) {
+	for _, command := range []string{"snapshot", "readiness", "seal", "spec-validate", "check-acceptance", "evidence-fresh", "coverage", "doubt-coverage", "test-integrity", "review-integrity", "build-readiness", "readiness-digest", "analyze", "ledger", "resolve", "clarify-return", "tick-afk", "recovery", "close-out", "migrate", "status", "budget", "mutation-gate", "validate-pack", "doctor"} {
+		for _, args := range [][]string{{command}, {command, "--json"}} {
+			t.Run(strings.Join(args, "-"), func(t *testing.T) {
+				var stdout, stderr bytes.Buffer
+				if code := run(args, strings.NewReader(""), &stdout, &stderr); code != exitUsage {
+					t.Fatalf("run(%q) = %d, want %d", args, code, exitUsage)
+				}
+				if !strings.Contains(stderr.String(), `unknown command "`+command+`"`) {
+					t.Fatalf("stderr = %q, want unknown-command diagnostic", stderr.String())
+				}
+				if strings.Contains(usage, "devrites-engine "+command) {
+					t.Fatalf("usage still advertises %q", command)
+				}
+			})
+		}
 	}
+}
 
-	stdout.Reset()
-	stderr.Reset()
-	code = run([]string{"context", "show"}, strings.NewReader(""), &stdout, &stderr)
-	if code != exitOK {
-		t.Fatalf("context show exit = %d, want %d; stderr=%q", code, exitOK, stderr.String())
+func TestRemovedNestedCommandsAreRejected(t *testing.T) {
+	root := filepath.Join(t.TempDir(), ".devrites")
+	if err := os.Mkdir(root, 0o755); err != nil {
+		t.Fatal(err)
 	}
-	if !strings.Contains(stdout.String(), "DRV-ROOT-OUTSIDE-GIT") {
-		t.Fatalf("context show should diagnose the unsafe parent root; stdout=%q", stdout.String())
+	t.Setenv("DEVRITES_ROOT", root)
+	for _, test := range []struct {
+		args []string
+		want string
+	}{
+		{args: []string{"check", "spec"}, want: `unknown check "spec"`},
+		{args: []string{"state", "clarify"}, want: `unknown state command "clarify"`},
+		{args: []string{"state", "tick-afk"}, want: `unknown state command "tick-afk"`},
+		{args: []string{"state", "recovery"}, want: `unknown state command "recovery"`},
+		{args: []string{"state", "resolve", "next-qid", "questions.md"}, want: "No active workspace"},
+	} {
+		t.Run(strings.Join(test.args, "-"), func(t *testing.T) {
+			var stdout, stderr bytes.Buffer
+			if code := run(test.args, strings.NewReader(""), &stdout, &stderr); code != exitUsage {
+				t.Fatalf("run(%q) = %d, want %d", test.args, code, exitUsage)
+			}
+			if !strings.Contains(stderr.String(), test.want) {
+				t.Fatalf("stderr = %q, want %q", stderr.String(), test.want)
+			}
+		})
 	}
 }
 
-func TestStrictWriterRefusesExternalWorkspaceBeforeMutation(t *testing.T) {
-	project := t.TempDir()
-	root := filepath.Join(project, ".devrites")
-	if err := os.MkdirAll(filepath.Join(root, "work", "demo"), 0o755); err != nil {
-		t.Fatal(err)
+func TestRemovedOutputFlagsAreRejected(t *testing.T) {
+	t.Setenv("DEVRITES_ROOT", t.TempDir())
+	for _, args := range [][]string{
+		{"check", "readiness", "feature", "--json"},
+		{"check", "seal", "feature", "--json"},
+	} {
+		t.Run(strings.Join(args, "-"), func(t *testing.T) {
+			var stdout, stderr bytes.Buffer
+			if code := run(args, strings.NewReader(""), &stdout, &stderr); code != exitUsage {
+				t.Fatalf("run(%q)=%d, want %d", args, code, exitUsage)
+			}
+			if stderr.Len() == 0 {
+				t.Fatalf("run(%q) returned no usage diagnostic", args)
+			}
+		})
 	}
-	initRootRoutingGitRepo(t, project)
-	withRootRoutingCWD(t, project)
-	t.Setenv("DEVRITES_ROOT", "")
-	t.Setenv("DEVRITES_WORKSPACE", t.TempDir())
-	before := rootRoutingTree(t, root)
+}
 
-	var stdout, stderr bytes.Buffer
-	code := run([]string{"timeline", "log", "rite-build"}, strings.NewReader(""), &stdout, &stderr)
-	if code != exitBlocked {
-		t.Fatalf("timeline log exit = %d, want %d; stdout=%q stderr=%q", code, exitBlocked, stdout.String(), stderr.String())
+func TestNestedCommandFamiliesAreRoutedAndAdvertised(t *testing.T) {
+	t.Setenv("DEVRITES_ROOT", t.TempDir())
+	for _, args := range [][]string{{"check", "candidate"}, {"check", "readiness"}, {"check", "seal"}, {"state", "resolve"}, {"state", "close"}} {
+		t.Run(strings.Join(args, "-"), func(t *testing.T) {
+			var stdout, stderr bytes.Buffer
+			_ = run(args, strings.NewReader(""), &stdout, &stderr)
+			if strings.Contains(stderr.String(), "unknown command") || strings.Contains(stderr.String(), "unknown check") || strings.Contains(stderr.String(), "unknown state") {
+				t.Fatalf("%q was not routed: %s", args, stderr.String())
+			}
+		})
 	}
-	if !strings.Contains(stderr.String(), "unsafe DevRites root") {
-		t.Fatalf("stderr = %q, want unsafe-root refusal", stderr.String())
+	for _, want := range []string{"devrites-engine check candidate", "devrites-engine check readiness", "devrites-engine check seal", "devrites-engine state resolve", "devrites-engine state close"} {
+		if !strings.Contains(usage, want) {
+			t.Fatalf("usage does not advertise %q", want)
+		}
 	}
-	if after := rootRoutingTree(t, root); !reflect.DeepEqual(after, before) {
-		t.Fatalf("strict refusal mutated workspace tree: before=%q after=%q", before, after)
+	for _, removed := range []string{"check spec", "state clarify", "state tick-afk", "state recovery", "doctor"} {
+		if strings.Contains(usage, removed) {
+			t.Fatalf("usage still advertises %q", removed)
+		}
 	}
+}
 
-	stdout.Reset()
-	stderr.Reset()
-	code = run(
-		[]string{"timeline", "purge", "--run", "drv-run-v1:0123456789abcdef0123456789abcdef"},
-		strings.NewReader(""),
-		&stdout,
-		&stderr,
-	)
-	if code != exitBlocked {
-		t.Fatalf("timeline purge exit = %d, want %d; stdout=%q stderr=%q", code, exitBlocked, stdout.String(), stderr.String())
-	}
-	if after := rootRoutingTree(t, root); !reflect.DeepEqual(after, before) {
-		t.Fatalf("unsafe timeline purge mutated workspace tree: before=%q after=%q", before, after)
+func TestNestedCommandFamilyUsageListsOnlyRetainedCommands(t *testing.T) {
+	for _, test := range []struct {
+		args    []string
+		want    string
+		removed []string
+	}{
+		{args: []string{"check"}, want: "check <candidate|readiness|seal>", removed: []string{"spec"}},
+		{args: []string{"state"}, want: "state <resolve|close>", removed: []string{"clarify", "tick-afk", "recovery"}},
+	} {
+		t.Run(test.args[0], func(t *testing.T) {
+			var stdout, stderr bytes.Buffer
+			if code := run(test.args, strings.NewReader(""), &stdout, &stderr); code != exitUsage {
+				t.Fatalf("run(%q) = %d, want %d", test.args, code, exitUsage)
+			}
+			if !strings.Contains(stderr.String(), test.want) {
+				t.Fatalf("stderr = %q, want %q", stderr.String(), test.want)
+			}
+			for _, removed := range test.removed {
+				if strings.Contains(stderr.String(), removed) {
+					t.Fatalf("stderr still advertises %q: %q", removed, stderr.String())
+				}
+			}
+		})
 	}
 }
 
-func TestStrictWriterRefusesWorkspaceOverrideWithoutRoot(t *testing.T) {
+func TestCheckCandidateRoutesAndPrintsIdentity(t *testing.T) {
 	project := t.TempDir()
-	initRootRoutingGitRepo(t, project)
-	withRootRoutingCWD(t, project)
-	t.Setenv("DEVRITES_ROOT", "")
-	t.Setenv("DEVRITES_WORKSPACE", t.TempDir())
-
-	var stdout, stderr bytes.Buffer
-	code := run([]string{"learnings", "add", "demo", "must not escape"}, strings.NewReader(""), &stdout, &stderr)
-	if code != exitBlocked {
-		t.Fatalf("learnings add exit = %d, want %d; stdout=%q stderr=%q", code, exitBlocked, stdout.String(), stderr.String())
+	root := filepath.Join(project, ".devrites")
+	workspace := filepath.Join(root, "work", "feature")
+	if err := os.MkdirAll(workspace, 0o755); err != nil {
+		t.Fatal(err)
 	}
-	if !strings.Contains(stderr.String(), "DEVRITES_WORKSPACE requires a selected DevRites root") {
-		t.Fatalf("stderr = %q, want workspace-without-root refusal", stderr.String())
+	if err := os.WriteFile(filepath.Join(project, "source.go"), []byte("package source\n"), 0o644); err != nil {
+		t.Fatal(err)
 	}
-	if _, err := os.Stat(filepath.Join(project, ".devrites")); !os.IsNotExist(err) {
-		t.Fatalf("strict refusal must not create a root; stat err=%v", err)
+	manifest := "# Touched files\n\n## Touched files\nCandidate paths are declared below.\n\n## Candidate manifest\n| State | File | Slice | Reason |\n| --- | --- | --- | --- |\n| present | `source.go` | S-1 | Implementation. |\n"
+	if err := os.WriteFile(filepath.Join(workspace, "touched-files.md"), []byte(manifest), 0o644); err != nil {
+		t.Fatal(err)
 	}
-}
-
-func TestStrictWriterRefusesMissingExplicitRoot(t *testing.T) {
-	project := t.TempDir()
-	initRootRoutingGitRepo(t, project)
-	withRootRoutingCWD(t, project)
-	root := filepath.Join(project, ".devrites")
 	t.Setenv("DEVRITES_ROOT", root)
-	t.Setenv("DEVRITES_WORKSPACE", "")
-
 	var stdout, stderr bytes.Buffer
-	code := run([]string{"learnings", "add", "demo", "must not bootstrap"}, strings.NewReader(""), &stdout, &stderr)
-	if code != exitBlocked {
-		t.Fatalf("learnings add exit = %d, want %d; stdout=%q stderr=%q", code, exitBlocked, stdout.String(), stderr.String())
-	}
-	if !strings.Contains(stderr.String(), "unsafe DevRites root") {
-		t.Fatalf("stderr = %q, want invalid explicit-root refusal", stderr.String())
+	if code := run([]string{"check", "candidate", "feature"}, strings.NewReader(""), &stdout, &stderr); code != exitOK {
+		t.Fatalf("code=%d stdout=%q stderr=%q", code, stdout.String(), stderr.String())
 	}
-	if _, err := os.Stat(root); !os.IsNotExist(err) {
-		t.Fatalf("strict refusal must not create explicit missing root; stat err=%v", err)
+	lines := strings.Split(strings.TrimSpace(stdout.String()), "\n")
+	if len(lines) != 2 || !strings.HasPrefix(lines[0], "candidate-sha256: ") || len(strings.TrimPrefix(lines[0], "candidate-sha256: ")) != 64 || lines[1] != "candidate-files: 1" {
+		t.Fatalf("stdout=%q", stdout.String())
 	}
 }
 
-func initRootRoutingGitRepo(t *testing.T, dir string) {
-	t.Helper()
-	cmd := exec.Command("git", "init", "-q", dir)
-	if output, err := cmd.CombinedOutput(); err != nil {
-		t.Fatalf("git init %s: %v\n%s", dir, err, output)
+func TestCheckReadinessEmitBindingRoutesOnlyExactShape(t *testing.T) {
+	root := filepath.Join(t.TempDir(), ".devrites")
+	workspace := filepath.Join(root, "work", "feature")
+	for name, body := range map[string]string{
+		"spec.md":              "# Spec\n\nReady.\n",
+		"decision-coverage.md": "# Decision coverage\n\nCLEAR\n",
+		"architecture.md":      "# Architecture\n\nReady.\n",
+		"plan.md":              "# Plan\n\nReady.\n",
+		"tasks.md":             "# Tasks\n\nReady.\n",
+		"traceability.md":      "# Traceability\n\nReady.\n",
+		"test-plan.md":         "# Test plan\n\nReady.\n",
+	} {
+		if err := os.MkdirAll(workspace, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(workspace, name), []byte(body), 0o644); err != nil {
+			t.Fatal(err)
+		}
 	}
-}
+	t.Setenv("DEVRITES_ROOT", root)
 
-func withRootRoutingCWD(t *testing.T, dir string) {
-	t.Helper()
-	before, err := os.Getwd()
-	if err != nil {
-		t.Fatal(err)
+	var stdout, stderr bytes.Buffer
+	if code := run([]string{"check", "readiness", "--emit-binding", "feature"}, strings.NewReader(""), &stdout, &stderr); code != exitOK {
+		t.Fatalf("emit binding code=%d stdout=%q stderr=%q", code, stdout.String(), stderr.String())
+	}
+	line := strings.TrimSuffix(stdout.String(), "\n")
+	const prefix = "Readiness inputs SHA-256: "
+	digest := strings.TrimPrefix(line, prefix)
+	if digest == line || len(digest) != 64 || strings.Trim(digest, "0123456789abcdef") != "" || strings.Count(stdout.String(), "\n") != 1 {
+		t.Fatalf("emit binding stdout=%q", stdout.String())
+	}
+
+	for _, args := range [][]string{
+		{"check", "readiness", "--emit-binding"},
+		{"check", "readiness", "feature", "--emit-binding"},
+		{"check", "readiness", "--emit-binding", "feature", "extra"},
+		{"check", "seal", "--emit-binding", "feature"},
+		{"check", "readiness", "--json", "feature"},
+	} {
+		stdout.Reset()
+		stderr.Reset()
+		if code := run(args, strings.NewReader(""), &stdout, &stderr); code != exitUsage {
+			t.Fatalf("run(%q)=%d, want %d; stdout=%q stderr=%q", args, code, exitUsage, stdout.String(), stderr.String())
+		}
 	}
-	if err := os.Chdir(dir); err != nil {
+
+	if err := os.Remove(filepath.Join(workspace, "plan.md")); err != nil {
 		t.Fatal(err)
 	}
-	t.Cleanup(func() {
-		if err := os.Chdir(before); err != nil {
-			t.Errorf("restore cwd: %v", err)
-		}
-	})
+	stdout.Reset()
+	stderr.Reset()
+	if code := run([]string{"check", "readiness", "--emit-binding", "feature"}, strings.NewReader(""), &stdout, &stderr); code != exitBlocked || stdout.Len() != 0 || !strings.Contains(stderr.String(), "readiness-binding: BLOCKED") {
+		t.Fatalf("unsafe emit code=%d stdout=%q stderr=%q", code, stdout.String(), stderr.String())
+	}
 }
 
-func rootRoutingTree(t *testing.T, root string) []string {
-	t.Helper()
-	var paths []string
-	err := filepath.WalkDir(root, func(path string, entry os.DirEntry, err error) error {
-		if err != nil {
-			return err
-		}
-		rel, err := filepath.Rel(root, path)
-		if err != nil {
-			return err
-		}
-		paths = append(paths, rel)
-		return nil
-	})
-	if err != nil {
+func TestSecretScanRoutesPRBodyThroughStdin(t *testing.T) {
+	root := filepath.Join(t.TempDir(), ".devrites")
+	if err := os.MkdirAll(root, 0o755); err != nil {
 		t.Fatal(err)
 	}
-	sort.Strings(paths)
-	return paths
+	t.Setenv("DEVRITES_ROOT", root)
+	secret := "ghp_" + strings.Repeat("e", 32)
+	var stdout, stderr bytes.Buffer
+	if code := run([]string{"secret-scan", "--stdin"}, strings.NewReader(secret), &stdout, &stderr); code != exitBlocked {
+		t.Fatalf("run(secret-scan --stdin) = %d, want %d", code, exitBlocked)
+	}
+	if !strings.Contains(stdout.String(), `source="<stdin>" kind=github-token`) {
+		t.Fatal("stdout lacks safe stdin finding metadata")
+	}
+	if strings.Contains(stdout.String()+stderr.String(), secret) {
+		t.Fatal("secret material disclosed")
+	}
 }

package/engine/testdata/fixtures/basic/devrites-root/{features/auth-tokens/feature.md → work/auth-tokens/README.md}

@@ -2,7 +2,6 @@
 slug: auth-tokens
 title: Signed auth tokens
 phase: build
-schemaVersion: 1
 ---
 
 Rotate to signed, short-lived auth tokens with refresh rotation.

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/architecture.md

@@ -0,0 +1,3 @@
+# Architecture
+
+Use signed tokens.

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/assumptions.md

@@ -0,0 +1,3 @@
+# Assumptions
+
+None.

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/brief.md

@@ -0,0 +1,3 @@
+# Brief
+
+Signed auth tokens.

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/decision-coverage.md

@@ -0,0 +1,3 @@
+# Decision coverage
+
+CLEAR.

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/eng-review.md

@@ -0,0 +1,3 @@
+# Engineering review
+
+READY.

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/questions.md

@@ -0,0 +1,3 @@
+# Questions
+
+None.

package/engine/testdata/fixtures/basic/devrites-root/{features/auth-tokens/status.md → work/auth-tokens/state.md}

@@ -1,3 +1,6 @@
+- Phase: build
+- Status: running
+
 # Status
 
 Minting and verification middleware have landed. Refresh rotation is in

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/test-plan.md

@@ -0,0 +1,3 @@
+# Test plan
+
+Run token tests.

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/traceability.md

@@ -0,0 +1,3 @@
+# Traceability
+
+Requirements map to tasks.

package/engine/testdata/fixtures/basic/devrites-root/{features/search-ranking/feature.md → work/search-ranking/README.md}

@@ -2,7 +2,6 @@
 slug: search-ranking
 title: Search ranking tweaks
 phase: spec
-schemaVersion: 1
 ---
 
 Blend recency and relevance in the search ranking function.

package/engine/testdata/fixtures/basic/devrites-root/work/search-ranking/assumptions.md

@@ -0,0 +1,3 @@
+# Assumptions
+
+None.

package/engine/testdata/fixtures/basic/devrites-root/work/search-ranking/brief.md

@@ -0,0 +1,3 @@
+# Brief
+
+Search ranking.

package/engine/testdata/fixtures/basic/devrites-root/work/search-ranking/decisions.md

@@ -0,0 +1,3 @@
+# Decisions
+
+None.

package/engine/testdata/fixtures/basic/devrites-root/work/search-ranking/questions.md

@@ -0,0 +1,3 @@
+# Questions
+
+None.

package/engine/testdata/fixtures/basic/devrites-root/work/search-ranking/state.md

@@ -0,0 +1,2 @@
+- Phase: spec
+- Status: running

package/engine/testdata/golden/TestParityCloseOut/active_pointed_elsewhere.golden

@@ -1,2 +1,2 @@
 exit 0
-close-out: archived feat-y -> .devrites/archive/feat-y (ACTIVE pointed elsewhere: left as-is)
+state close: archived feat-y -> archive/feat-y (ACTIVE pointed elsewhere: left as-is)

package/engine/testdata/golden/TestParityCloseOut/active_slug_cleared.golden

@@ -1,2 +1,2 @@
 exit 0
-close-out: archived feat-x -> .devrites/archive/feat-x and cleared ACTIVE
+state close: archived feat-x -> archive/feat-x and cleared ACTIVE

package/engine/tests/adr_0003_gate_exit_code_test.go

@@ -16,7 +16,7 @@ func TestADR0003BlockedGateExitsThreeNotCrash(t *testing.T) {
 	root := newWorkspace(t)
 
 	// auth-tokens is in the build phase with tasks empty -> readiness blocks.
-	out, _, code := runDevrites(t, root, "readiness", "auth-tokens")
+	out, _, code := runDevrites(t, root, "check", "readiness", "auth-tokens")
 	if code != 3 {
 		t.Fatalf("blocked readiness exit = %d, want the reserved 3 (HITL pause)", code)
 	}
@@ -25,7 +25,7 @@ func TestADR0003BlockedGateExitsThreeNotCrash(t *testing.T) {
 	}
 
 	// A satisfied gate is a clean pass, never a spurious non-zero.
-	_, _, ok := runDevrites(t, root, "readiness", "search-ranking") // spec phase, spec present
+	_, _, ok := runDevrites(t, root, "check", "readiness", "search-ranking") // spec phase, spec present
 	if ok != 0 {
 		t.Fatalf("satisfied readiness exit = %d, want 0", ok)
 	}

package/engine/tests/adr_0011_define_plan_test.go

@@ -13,8 +13,8 @@ func TestADR0011DefineAndPlanHaveDistinctTransitionRights(t *testing.T) {
 	if got := state.ResumeVerb(state.PhasePlan); got != "vet" {
 		t.Fatalf("plan resumes %q, want vet", got)
 	}
-	if got, ok := state.PhaseForName("planning"); !ok || got != state.PhasePlan {
-		t.Fatalf("planning alias=(%q,%v), want plan compatibility", got, ok)
+	if got, ok := state.PhaseForName("planning"); ok || got != "" {
+		t.Fatalf("planning alias=(%q,%v), want speculative alias rejected", got, ok)
 	}
 
 	rights := map[string]state.Phase{}