devrites 3.2.27 → 4.0.0

package/engine/tests/gate_test.go

@@ -1,77 +1,35 @@
 package main_test
 
-// CLI coverage for Issue 04: completeness gates and the stop-gate rest-point
-// invariant against fixture workspaces.
+// CLI coverage for deterministic completeness and state-invariant gates.
 
 import (
-	"bytes"
-	"errors"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
+	"time"
 
+	"github.com/devrites/devrites/internal/lib"
 	"github.com/devrites/devrites/internal/testutil"
 )
 
-// runDevritesIO is runDevrites with control over stdin and extra environment,
-// for the hooks that read a payload (stop-gate) or a mode env var.
-func runDevritesIO(t *testing.T, root, stdin string, extraEnv []string, args ...string) (stdout, stderr string, code int) {
-	t.Helper()
-	cmd := exec.Command(binPath, args...)
-	cmd.Env = append(append(os.Environ(), "DEVRITES_ROOT="+root), extraEnv...)
-	cmd.Stdin = strings.NewReader(stdin)
-	var outBuf, errBuf bytes.Buffer
-	cmd.Stdout = &outBuf
-	cmd.Stderr = &errBuf
-	err := cmd.Run()
-	if err != nil {
-		var ee *exec.ExitError
-		if !errors.As(err, &ee) {
-			t.Fatalf("running %v: %v", args, err)
-		}
-		code = ee.ExitCode()
-	}
-	return outBuf.String(), errBuf.String(), code
-}
-
-// setPhase rewrites the phase in a feature's feature.md frontmatter.
-func setPhase(t *testing.T, root, slug, phase string) {
-	t.Helper()
-	path := filepath.Join(root, "features", slug, "feature.md")
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	lines := strings.Split(string(raw), "\n")
-	for i, l := range lines {
-		if strings.HasPrefix(strings.TrimSpace(l), "phase:") {
-			lines[i] = "phase: " + phase
-		}
-	}
-	if err := os.WriteFile(path, []byte(strings.Join(lines, "\n")), 0o644); err != nil {
-		t.Fatal(err)
-	}
-}
-
 func TestReadinessBlocksIncompletePhase(t *testing.T) {
 	root := newWorkspace(t)
-	out, _, code := runDevrites(t, root, "readiness", "auth-tokens") // build phase, tasks empty
+	out, _, code := runDevrites(t, root, "check", "readiness", "auth-tokens") // build phase, tasks empty
 	if code != 3 {
 		t.Fatalf("exit = %d, want 3 (blocked)", code)
 	}
-	if !strings.Contains(out, `result: blocked (missing to leave "build": tasks)`) {
+	if !strings.Contains(out, `result: blocked (missing to leave "build": tasks.md)`) {
 		t.Errorf("stdout missing the block line\n%s", out)
 	}
-	if !strings.Contains(out, "devrites-engine readiness auth-tokens") {
+	if !strings.Contains(out, "devrites-engine check readiness auth-tokens") {
 		t.Errorf("stdout missing the actionable retry step\n%s", out)
 	}
 }
 
 func TestReadinessPassesCompletePhase(t *testing.T) {
 	root := newWorkspace(t)
-	out, _, code := runDevrites(t, root, "readiness", "search-ranking") // spec phase, spec present
+	out, _, code := runDevrites(t, root, "check", "readiness", "search-ranking") // spec phase, spec present
 	if code != 0 {
 		t.Fatalf("exit = %d, want 0 (pass)", code)
 	}
@@ -85,7 +43,7 @@ func TestReadinessPassesCompletePhase(t *testing.T) {
 	}
 }
 
-func TestReadinessAcceptsCanonicalTemperCursor(t *testing.T) {
+func TestReadinessUsesStructuralArtifactsOnly(t *testing.T) {
 	root := filepath.Join(t.TempDir(), ".devrites")
 	testutil.WriteFile(t, filepath.Join(root, "work", "tempered", "state.md"), `# State
 
@@ -102,12 +60,12 @@ func TestReadinessAcceptsCanonicalTemperCursor(t *testing.T) {
 		"decisions.md":         "# Decisions\n\nNone open.\n",
 		"assumptions.md":       "# Assumptions\n\nNone.\n",
 		"questions.md":         "# Questions\n\nNone.\n",
-		"decision-coverage.md": "# Decision coverage\n\nCLEAR.\n",
+		"decision-coverage.md": "# Decision coverage\n\nNOT CLEAR: native agents own this judgment.\n",
 	} {
 		testutil.WriteFile(t, filepath.Join(root, "work", "tempered", name), body)
 	}
 
-	out, errOut, code := runDevrites(t, root, "readiness", "tempered")
+	out, errOut, code := runDevrites(t, root, "check", "readiness", "tempered")
 	if code != 0 {
 		t.Fatalf("exit = %d, want 0; stderr:\n%s", code, errOut)
 	}
@@ -118,195 +76,214 @@ func TestReadinessAcceptsCanonicalTemperCursor(t *testing.T) {
 
 func TestSealBlocksWhenSealSectionsMissing(t *testing.T) {
 	root := newWorkspace(t)
-	out, _, code := runDevrites(t, root, "seal", "auth-tokens")
+	out, _, code := runDevrites(t, root, "check", "seal", "auth-tokens")
 	if code != 3 {
 		t.Fatalf("exit = %d, want 3 (blocked)", code)
 	}
-	// auth-tokens: tasks + proof empty; seal requires the full set.
-	if !strings.Contains(out, "result: blocked (missing to seal: tasks, proof)") {
+	if !strings.Contains(out, "result: blocked (missing to seal:") || !strings.Contains(out, "tasks.md") || !strings.Contains(out, "evidence.md") {
 		t.Errorf("unexpected seal block line\n%s", out)
 	}
 }
 
 func TestSealPassesWhenComplete(t *testing.T) {
-	root := newWorkspace(t)
-	// Fill the two empty sections auth-tokens is missing for a seal. tasks.md is
-	// a heading-only stub in the fixture; proof.md is absent (empty), so write it.
-	testutil.AppendFile(t, filepath.Join(root, "features", "auth-tokens", "tasks.md"), "\n- [x] mint\n")
-	if err := os.WriteFile(filepath.Join(root, "features", "auth-tokens", "proof.md"),
-		[]byte("# Proof\n\nAll acceptance tests pass.\n"), 0o644); err != nil {
+	project, root := newFinalSealRepo(t)
+	source := filepath.Join(project, "source.go")
+	if err := os.Chtimes(source, time.Unix(2_000_000_000, 0), time.Unix(2_000_000_000, 0)); err != nil {
 		t.Fatal(err)
 	}
-	out, _, code := runDevrites(t, root, "seal", "auth-tokens")
-	if code != 0 {
-		t.Fatalf("exit = %d, want 0 (pass)\n%s", code, out)
-	}
-	if !strings.Contains(out, "result: pass") {
-		t.Errorf("stdout not a pass\n%s", out)
-	}
-}
+	chdirForSeal(t, project)
 
-func TestStopGateEnforceBlocksClaimedDoneButUnproven(t *testing.T) {
-	root := newWorkspace(t)
-	setPhase(t, root, "auth-tokens", "seal") // claims completion
-	writeActive(t, root, "auth-tokens")      // proof.md is empty
-	out, _, code := runDevritesIO(t, root, `{"stop_hook_active":false}`, []string{"DEVRITES_STOP_GATE=enforce"}, "hook", "stop-gate", "--harness=claude")
+	out, errOut, code := runDevrites(t, root, "check", "seal", "final")
 	if code != 0 {
-		t.Fatalf("exit = %d, want 0 (a block is a decision, not a crash)", code)
+		t.Fatalf("exit = %d, want 0\nstdout:\n%s\nstderr:\n%s", code, out, errOut)
 	}
-	if !strings.Contains(out, `"decision":"block"`) {
-		t.Errorf("stop-gate did not block a claimed-done-but-unproven rest point\n%s", out)
-	}
-	if !strings.Contains(out, "proof.md is empty") {
-		t.Errorf("block reason not actionable\n%s", out)
-	}
-}
-
-func TestStopGateDoesNotBlockNormalInProgress(t *testing.T) {
-	root := newWorkspace(t)
-	writeActive(t, root, "auth-tokens") // phase build: in progress, not claiming done
-	out, _, code := runDevritesIO(t, root, `{"stop_hook_active":false}`, []string{"DEVRITES_STOP_GATE=enforce"}, "hook", "stop-gate", "--harness=claude")
-	if code != 0 {
-		t.Fatalf("exit = %d, want 0", code)
-	}
-	if strings.TrimSpace(out) != "" {
-		t.Errorf("stop-gate blocked normal in-progress work\n%s", out)
+	for _, want := range []string{
+		"result: pass",
+		"evidence-fresh: OK",
+	} {
+		if !strings.Contains(out, want) {
+			t.Fatalf("stdout missing %q:\n%s", want, out)
+		}
 	}
 }
 
-func TestStopGateBlocksUnsurfacedBlockingQuestion(t *testing.T) {
-	root := newWorkspace(t)
-	writeActive(t, root, "auth-tokens")
-	featureDir := filepath.Join(root, "features", "auth-tokens")
-	if err := os.WriteFile(filepath.Join(featureDir, "state.md"), []byte("- Status: running\n"), 0o644); err != nil {
+func TestSealBlocksContentChangeWithRestoredMtime(t *testing.T) {
+	project, root := newFinalSealRepo(t)
+	codePath := filepath.Join(project, "source.go")
+	info, err := os.Stat(codePath)
+	if err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(featureDir, "questions.md"), []byte(`## q-2026-07-07-001
-status: open
-gate: blocking
-
-Need a human answer.
-`), 0o644); err != nil {
+	testutil.WriteFile(t, codePath, "package changed\n")
+	if err := os.Chtimes(codePath, info.ModTime(), info.ModTime()); err != nil {
 		t.Fatal(err)
 	}
-	out, _, code := runDevritesIO(t, root, `{"stop_hook_active":false}`, []string{"DEVRITES_STOP_GATE=enforce"}, "hook", "stop-gate", "--harness=claude")
-	if code != 0 {
-		t.Fatalf("exit = %d, want 0 (a block is a decision, not a crash)", code)
+	chdirForSeal(t, project)
+
+	out, errOut, code := runDevrites(t, root, "check", "seal", "final")
+	if code != 3 {
+		t.Fatalf("exit = %d, want 3\nstdout:\n%s\nstderr:\n%s", code, out, errOut)
 	}
-	if !strings.Contains(out, `"decision":"block"`) {
-		t.Errorf("stop-gate did not block an unsurfaced blocking question\n%s", out)
+	if !strings.Contains(errOut, "candidate digest line does not match") {
+		t.Fatalf("stderr missing freshness block:\n%s", errOut)
 	}
-	if !strings.Contains(out, "questions.md") || !strings.Contains(out, "awaiting_human") {
-		t.Errorf("block reason not actionable\n%s", out)
+	if !strings.Contains(out, "reason: DRV-GATE-SEAL-MISSING") {
+		t.Fatalf("stdout missing stable blocked reason:\n%s", out)
 	}
 }
 
-func TestStopGateAllowsSurfacedBlockingQuestion(t *testing.T) {
-	root := newWorkspace(t)
-	writeActive(t, root, "auth-tokens")
-	featureDir := filepath.Join(root, "features", "auth-tokens")
-	if err := os.WriteFile(filepath.Join(featureDir, "state.md"), []byte("- Status: awaiting_human\n"), 0o644); err != nil {
-		t.Fatal(err)
+func TestSealBlocksInvalidCandidateBindings(t *testing.T) {
+	for _, test := range []struct {
+		name   string
+		mutate func(*testing.T, string)
+	}{
+		{name: "duplicate evidence digest", mutate: func(t *testing.T, dir string) {
+			path := filepath.Join(dir, "evidence.md")
+			body, err := os.ReadFile(path)
+			if err != nil {
+				t.Fatal(err)
+			}
+			line := body[strings.LastIndex(string(body), "Candidate SHA-256:"):]
+			testutil.WriteFile(t, path, string(body)+string(line))
+		}},
+		{name: "missing review digest", mutate: func(t *testing.T, dir string) {
+			path := filepath.Join(dir, "review.md")
+			body, err := os.ReadFile(path)
+			if err != nil {
+				t.Fatal(err)
+			}
+			start := strings.LastIndex(string(body), "Candidate SHA-256:")
+			testutil.WriteFile(t, path, string(body[:start]))
+		}},
+		{name: "optional browser missing digest", mutate: func(t *testing.T, dir string) {
+			testutil.WriteFile(t, filepath.Join(dir, "browser-evidence.md"), "# Browser evidence\n\nCapture present without binding.\n")
+		}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			project, root := newFinalSealRepo(t)
+			test.mutate(t, filepath.Join(root, "work", "final"))
+			chdirForSeal(t, project)
+			out, errOut, code := runDevrites(t, root, "check", "seal", "final")
+			if code != 3 || !strings.Contains(out, "reason: DRV-GATE-SEAL-MISSING") || !strings.Contains(errOut, "evidence-fresh: BLOCKED") {
+				t.Fatalf("code=%d stdout=%q stderr=%q", code, out, errOut)
+			}
+		})
 	}
-	if err := os.WriteFile(filepath.Join(featureDir, "questions.md"), []byte(`## q-2026-07-07-001
-status: open
-gate: validating
+}
 
-Need validation.
-`), 0o644); err != nil {
-		t.Fatal(err)
+func TestSealTracksCanonicalQuestionTableStatus(t *testing.T) {
+	project, root := newFinalSealRepo(t)
+	questions := filepath.Join(root, "work", "final", "questions.md")
+	table := `# Questions
+
+## Question register
+| Question ID | Status | Gate | Question | Answer | Impact |
+| --- | --- | --- | --- | --- | --- |
+| Q-001 | answered | validating | Include a header? | Yes. | AC-001 |
+`
+	testutil.WriteFile(t, questions, table)
+	chdirForSeal(t, project)
+
+	if out, errOut, code := runDevrites(t, root, "check", "seal", "final"); code != 0 {
+		t.Fatalf("answered table row blocked seal: exit=%d\nstdout:\n%s\nstderr:\n%s", code, out, errOut)
 	}
-	out, _, code := runDevritesIO(t, root, `{"stop_hook_active":false}`, []string{"DEVRITES_STOP_GATE=enforce"}, "hook", "stop-gate", "--harness=claude")
-	if code != 0 {
-		t.Fatalf("exit = %d, want 0", code)
+
+	testutil.WriteFile(t, questions, strings.Replace(table, "| answered |", "| open |", 1))
+	out, errOut, code := runDevrites(t, root, "check", "seal", "final")
+	if code != 3 {
+		t.Fatalf("open table row exit=%d, want 3\nstdout:\n%s\nstderr:\n%s", code, out, errOut)
 	}
-	if out != "" {
-		t.Errorf("stop-gate stdout = %q, want empty", out)
+	if !strings.Contains(out, "open validating human question(s) remain") {
+		t.Fatalf("seal did not report the canonical open table row:\n%s", out)
 	}
 }
 
-// A .red sentinel (written by redwatch) is a rest-point violation on its own:
-// even in an otherwise in-progress build phase.
-func TestStopGateEnforceBlocksOnRed(t *testing.T) {
-	root := newWorkspace(t)
-	writeActive(t, root, "auth-tokens") // phase build: normally NOT blocked
-	if err := os.WriteFile(filepath.Join(root, "features", "auth-tokens", ".red"), []byte("npm test\n"), 0o644); err != nil {
-		t.Fatal(err)
+func newFinalSealRepo(t *testing.T) (string, string) {
+	t.Helper()
+	requireGit(t)
+	project := t.TempDir()
+	root := filepath.Join(project, ".devrites")
+	dir := filepath.Join(root, "work", "final")
+	initGitRepo(t, project)
+	for name, body := range map[string]string{
+		"state.md":             "| phase | seal |\n| status | running |\n",
+		"brief.md":             "# Brief\n\nFinal seal aggregate.\n",
+		"spec.md":              "# Spec\n\n## Acceptance Criteria\n- AC-001: final seal passes every deterministic gate.\n",
+		"decisions.md":         "# Decisions\n\n## Decisions stood\n- none\n",
+		"assumptions.md":       "# Assumptions\n\n- none\n",
+		"questions.md":         "# Questions\n\n- none\n",
+		"decision-coverage.md": "# Decision coverage\n\nCLEAR\n",
+		"architecture.md":      "# Architecture\n\nUse existing gates.\n",
+		"plan.md":              "# Plan\n\nCompose the final checks.\n",
+		"tasks.md":             "# Tasks\n\n- [x] Build final seal.\n",
+		"traceability.md":      "# Traceability\n\nAC-001 -> final seal.\n",
+		"eng-review.md":        "# Engineering review\n\nPASS\n",
+		"test-plan.md":         "# Test plan\n\nRun focused Go tests.\n",
+		"evidence.md":          "# Evidence\n\nFocused Go tests passed.\n",
+		"touched-files.md":     "# Touched files\n\n## Touched files\nCandidate paths are declared only in the manifest below.\n\n## Candidate manifest\n| State | File | Slice | Reason |\n| --- | --- | --- | --- |\n| present | `source.go` | S-1 | Final Seal fixture. |\n",
+		"review.md": `# Review
+
+## Spec
+No-findings: checked AC-001 against the final candidate.
+
+## Code review
+No-findings: checked the aggregate order and exit mapping.
+`,
+		"seal.md": finalSeal(true),
+	} {
+		testutil.WriteFile(t, filepath.Join(dir, name), body)
 	}
-	out, _, code := runDevritesIO(t, root, `{"stop_hook_active":false}`, []string{"DEVRITES_STOP_GATE=enforce"}, "hook", "stop-gate", "--harness=claude")
-	if code != 0 {
-		t.Fatalf("exit = %d, want 0", code)
+	testutil.WriteFile(t, filepath.Join(project, "source.go"), "package source\n")
+	bindingOut, bindingErr, bindingCode := runDevrites(t, root, "check", "readiness", "--emit-binding", "final")
+	if bindingCode != 0 {
+		t.Fatalf("emit readiness binding exit=%d\nstdout:\n%s\nstderr:\n%s", bindingCode, bindingOut, bindingErr)
 	}
-	if !strings.Contains(out, `"decision":"block"`) || !strings.Contains(out, "RED") {
-		t.Errorf("stop-gate did not block on a .red sentinel\n%s", out)
+	testutil.AppendFile(t, filepath.Join(dir, "eng-review.md"), "\n"+strings.TrimSuffix(bindingOut, "\n")+"\n")
+	digest, _, err := lib.CandidateIdentity(root, "final")
+	if err != nil {
+		t.Fatal(err)
 	}
-}
-
-func TestStopGateObserveModeNeverBlocks(t *testing.T) {
-	root := newWorkspace(t)
-	setPhase(t, root, "auth-tokens", "seal")
-	writeActive(t, root, "auth-tokens")
-	// Default mode (observe): even a violated invariant must not emit a block.
-	out, _, code := runDevritesIO(t, root, `{"stop_hook_active":false}`, nil, "hook", "stop-gate", "--harness=claude")
-	if code != 0 || strings.TrimSpace(out) != "" {
-		t.Errorf("observe mode emitted a block: exit=%d out=%q", code, out)
+	for _, name := range []string{"evidence.md", "review.md", "seal.md"} {
+		path := filepath.Join(dir, name)
+		body, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		testutil.WriteFile(t, path, string(body)+"\nCandidate SHA-256: "+digest+"\n")
 	}
+	gitCommitAll(t, project, "test: final seal fixture")
+	return project, root
 }
 
-func TestStopGateLoopGuardLetsStop(t *testing.T) {
-	root := newWorkspace(t)
-	setPhase(t, root, "auth-tokens", "seal")
-	writeActive(t, root, "auth-tokens")
-	// stop_hook_active=true: we already blocked once this cycle; must let it stop.
-	out, _, code := runDevritesIO(t, root, `{"stop_hook_active":true}`,
-		[]string{"DEVRITES_STOP_GATE=enforce"}, "hook", "stop-gate", "--harness=claude")
-	if code != 0 || strings.TrimSpace(out) != "" {
-		t.Errorf("loop guard failed: exit=%d out=%q", code, out)
+func finalSeal(proven bool) string {
+	checkbox := " "
+	if proven {
+		checkbox = "x"
 	}
-}
+	return `# Seal
 
-func TestStopGateInvalidInputFailsOpen(t *testing.T) {
-	root := newWorkspace(t)
-	setPhase(t, root, "auth-tokens", "seal")
-	writeActive(t, root, "auth-tokens")
-	for _, test := range []struct {
-		name    string
-		payload string
-	}{
-		{"empty", ""},
-		{"malformed", "not-json"},
-		{"missing", `{}`},
-		{"wrong type", `{"stop_hook_active":"false"}`},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			for attempt := 1; attempt <= 2; attempt++ {
-				out, _, code := runDevritesIO(t, root, test.payload,
-					[]string{"DEVRITES_STOP_GATE=enforce"}, "hook", "stop-gate", "--harness=claude")
-				if code != 0 || strings.TrimSpace(out) != "" {
-					t.Errorf("attempt %d: invalid Stop input must fail open: exit=%d out=%q", attempt, code, out)
-				}
-			}
-		})
-	}
+## Acceptance Criteria
+- [` + checkbox + `] AC-001: final seal passes every deterministic gate.
+
+## Reviewer Accounts
+- devrites-spec-reviewer: review.md ` + "`## Spec`" + `
+- devrites-code-reviewer: review.md ` + "`## Code review`" + `
+- devrites-test-analyst: No-findings: focused and full test gates passed; no assertion gaps found.
+- devrites-frontend-reviewer: Not-applicable: no UI changes.
+- devrites-security-auditor: No-findings: checked CLI boundary and fail-closed exits.
+- devrites-performance-reviewer: Not-applicable: no hot path changed.
+- devrites-devex-reviewer: No-findings: checked command output and documentation.
+`
 }
 
-func TestStopGateControlPlaneKillPathsAllow(t *testing.T) {
-	root := newWorkspace(t)
-	setPhase(t, root, "auth-tokens", "seal")
-	writeActive(t, root, "auth-tokens")
-	for _, test := range []struct {
-		name string
-		env  []string
-	}{
-		{"disabled id", []string{"DEVRITES_STOP_GATE=enforce", "DEVRITES_DISABLED_HOOKS=stop-gate"}},
-		{"minimal profile", []string{"DEVRITES_STOP_GATE=enforce", "DEVRITES_HOOK_PROFILE=minimal"}},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			out, _, code := runDevritesIO(t, root, `{"stop_hook_active":false}`, test.env,
-				"hook", "stop-gate", "--harness=claude")
-			if code != 0 || strings.TrimSpace(out) != "" {
-				t.Errorf("control-plane kill must allow: exit=%d out=%q", code, out)
-			}
-		})
+func chdirForSeal(t *testing.T, dir string) {
+	t.Helper()
+	old, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chdir(dir); err != nil {
+		t.Fatal(err)
 	}
+	t.Cleanup(func() { _ = os.Chdir(old) })
 }

package/engine/tests/meta_test.go

@@ -1,22 +1,16 @@
 package main_test
 
-// Cross-cutting assertions: network I/O stays inside the one sanctioned package,
-// and the inline fail-open guard no-ops when the binary is absent.
+// Cross-cutting assertion: first-party packages do not import forbidden network packages.
 
 import (
-	"bytes"
 	"os/exec"
 	"strings"
 	"testing"
 )
 
-// TestFirstPartyMakesNoNetworkCalls asserts that no first-party package imports a
-// network client EXCEPT internal/iohooks: the one sanctioned network surface,
-// where the source-citation cache does conditional-HEAD revalidation. Confining
-// network to that single, auditable package keeps the rest of the engine a
-// network-free control plane that makes zero model calls (PRD: "zero API"). The
-// engine still makes zero MODEL/API calls anywhere; this is the executable form of
-// both guarantees, narrowed to permit exactly the sanctioned cache.
+// TestFirstPartyMakesNoNetworkCalls asserts that no first-party Go package imports
+// a forbidden network package. This keeps the engine a network-free control plane
+// that makes zero model/API calls (PRD: "zero API").
 func TestFirstPartyMakesNoNetworkCalls(t *testing.T) {
 	if _, err := exec.LookPath("go"); err != nil {
 		t.Skip("go toolchain unavailable")
@@ -28,40 +22,16 @@ func TestFirstPartyMakesNoNetworkCalls(t *testing.T) {
 		t.Fatalf("go list: %v", err)
 	}
 	forbidden := map[string]bool{"net": true, "net/http": true, "net/rpc": true, "net/smtp": true}
-	const sanctioned = "github.com/devrites/devrites/internal/iohooks"
 	for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
 		fields := strings.Fields(line)
 		if len(fields) == 0 {
 			continue
 		}
 		pkg, imports := fields[0], fields[1:]
-		if pkg == sanctioned {
-			continue // the one package allowed to touch the network
-		}
 		for _, imp := range imports {
 			if forbidden[imp] {
-				t.Errorf("first-party package %s imports network package %q: only %s may make network calls", pkg, imp, sanctioned)
+				t.Errorf("first-party package %s imports forbidden network package %q", pkg, imp)
 			}
 		}
 	}
 }
-
-// TestFailOpenGuardNoOpsWhenBinaryMissing exercises the inline POSIX guard the
-// hooks.json entries wrap every devrites-engine hook in. With no devrites-engine on PATH the
-// guard must be a silent no-op (exit 0), so a teammate without the binary
-// installed is never wedged.
-func TestFailOpenGuardNoOpsWhenBinaryMissing(t *testing.T) {
-	if _, err := exec.LookPath("sh"); err != nil {
-		t.Skip("sh unavailable")
-	}
-	const guard = `command -v devrites-engine >/dev/null 2>&1 && devrites-engine hook orient --harness=claude || exit 0`
-	cmd := exec.Command("sh", "-c", guard)
-	cmd.Env = []string{"PATH="} // empty PATH -> devrites-engine is not found
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		t.Fatalf("guard did not exit 0 with the binary absent: %v\n%s", err, out)
-	}
-	if len(bytes.TrimSpace(out)) != 0 {
-		t.Errorf("guard produced output with the binary absent: %q", out)
-	}
-}

package/engine/tests/parity_closeout_test.go

@@ -2,7 +2,7 @@ package main_test
 
 // Golden snapshot for the ported close-out command (lib.CloseOut).
 //
-// close-out MUTATES the tree: it moves .devrites/features/<slug> to
+// close-out MUTATES the tree: it moves .devrites/work/<slug> to
 // .devrites/archive/<slug> and, when it is the active slug, clears
 // .devrites/ACTIVE. Each case snapshots the command's stdout + exit code (stderr
 // is diagnostic, not contract) and then asserts the post-move filesystem shape
@@ -28,23 +28,23 @@ func TestParityCloseOut(t *testing.T) {
 	// current subtest's golden.
 	run := func(t *testing.T, gw string, args ...string) {
 		t.Helper()
-		out, code := runArgv(t, gw, libEnv, "", binPath, append([]string{"close-out"}, args...)...)
+		out, code := runArgv(t, gw, libEnv, "", binPath, append([]string{"state", "close"}, args...)...)
 		assertGolden(t, out, code)
 	}
 
 	t.Run("active_slug_cleared", func(t *testing.T) {
 		slug := "feat-x"
 		gw := t.TempDir()
-		writeFile(t, gw, filepath.Join(".devrites/features", slug, "spec.md"), "# spec\n")
+		writeFile(t, gw, filepath.Join(".devrites/work", slug, "spec.md"), "# spec\n")
 		writeFile(t, gw, ".devrites/ACTIVE", slug+"\n")
 
-		run(t, gw, slug, ".devrites")
+		run(t, gw, slug)
 
-		// archive created, features/ source gone, ACTIVE truncated.
+		// archive created, work/ source gone, ACTIVE truncated.
 		if !dirExists(filepath.Join(gw, ".devrites/archive", slug)) {
 			t.Error("archive dir not created")
 		}
-		if !gone(filepath.Join(gw, ".devrites/features", slug)) {
+		if !gone(filepath.Join(gw, ".devrites/work", slug)) {
 			t.Error("source workspace not moved")
 		}
 		if b, err := os.ReadFile(filepath.Join(gw, ".devrites/ACTIVE")); err != nil {
@@ -58,10 +58,10 @@ func TestParityCloseOut(t *testing.T) {
 		slug := "feat-y"
 		other := "someone-else\n"
 		gw := t.TempDir()
-		writeFile(t, gw, filepath.Join(".devrites/features", slug, "spec.md"), "# spec\n")
+		writeFile(t, gw, filepath.Join(".devrites/work", slug, "spec.md"), "# spec\n")
 		writeFile(t, gw, ".devrites/ACTIVE", other)
 
-		run(t, gw, slug, ".devrites")
+		run(t, gw, slug)
 
 		// The archive moved, but ACTIVE (pointed elsewhere) is left untouched.
 		if !dirExists(filepath.Join(gw, ".devrites/archive", slug)) {
@@ -77,19 +77,19 @@ func TestParityCloseOut(t *testing.T) {
 	t.Run("missing_workspace", func(t *testing.T) {
 		// No workspace seeded -> non-zero exit, empty stdout.
 		gw := t.TempDir()
-		run(t, gw, "ghost", ".devrites")
+		run(t, gw, "ghost")
 	})
 
 	t.Run("archive_clobber", func(t *testing.T) {
 		slug := "feat-z"
 		gw := t.TempDir()
-		writeFile(t, gw, filepath.Join(".devrites/features", slug, "spec.md"), "# spec\n")
+		writeFile(t, gw, filepath.Join(".devrites/work", slug, "spec.md"), "# spec\n")
 		writeFile(t, gw, filepath.Join(".devrites/archive", slug, "old.md"), "old\n")
 
-		run(t, gw, slug, ".devrites")
+		run(t, gw, slug)
 
 		// Refused: source stays in place, the pre-existing archive is not clobbered.
-		if !dirExists(filepath.Join(gw, ".devrites/features", slug)) {
+		if !dirExists(filepath.Join(gw, ".devrites/work", slug)) {
 			t.Error("source workspace was moved despite clobber refusal")
 		}
 	})