devrites 3.2.28 → 4.0.0

package/engine/internal/lib/gitauthority_test.go

@@ -1,346 +0,0 @@
-package lib
-
-import (
-	"bytes"
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"sync"
-	"testing"
-
-	"github.com/devrites/devrites/internal/reason"
-	"github.com/devrites/devrites/internal/toolpolicy"
-)
-
-func TestGitAuthorityOpensAndReusesOneQuestion(t *testing.T) {
-	root, slug, work := gitAuthorityWorkspace(t)
-	t.Setenv("DEVRITES_NOW", "2026-07-23T10:00:00Z")
-	classified := toolpolicy.ClassifyGitCommand("git reset --hard HEAD")
-
-	first := AuthorizeGitOperation(root, slug, classified.Digest, destructiveGitReasons(classified))
-	second := AuthorizeGitOperation(root, slug, classified.Digest, destructiveGitReasons(classified))
-	if first.Allowed || !first.Opened || first.ReasonID != reason.GitAuthorityPending {
-		t.Fatalf("first decision = %#v", first)
-	}
-	if second.Allowed || second.Opened || second.QuestionID != first.QuestionID ||
-		second.ReasonID != reason.GitAuthorityPending {
-		t.Fatalf("second decision = %#v", second)
-	}
-
-	questions := gitAuthorityRead(t, filepath.Join(work, "questions.md"))
-	if strings.Count(questions, "schema: "+GitAuthoritySchemaV1) != 1 {
-		t.Fatalf("question was not idempotent:\n%s", questions)
-	}
-	for _, forbidden := range []string{"git reset", "--hard", "HEAD"} {
-		if strings.Contains(questions, forbidden) {
-			t.Fatalf("questions.md leaked %q:\n%s", forbidden, questions)
-		}
-	}
-	stateText := gitAuthorityRead(t, filepath.Join(work, "state.md"))
-	for _, want := range []string{"awaiting_human", "## Awaiting human", "- qid: " + first.QuestionID} {
-		if !strings.Contains(stateText, want) {
-			t.Fatalf("state missing %q:\n%s", want, stateText)
-		}
-	}
-}
-
-func TestGitAuthorityResolvedExactGrantIsOneShot(t *testing.T) {
-	root, slug, work := gitAuthorityWorkspace(t)
-	t.Setenv("DEVRITES_NOW", "2026-07-23T10:00:00Z")
-	classified := toolpolicy.ClassifyGitCommand("git clean -fdx")
-	reasons := destructiveGitReasons(classified)
-	pending := AuthorizeGitOperation(root, slug, classified.Digest, reasons)
-
-	t.Setenv("DEVRITES_NOW", "2026-07-23T10:01:00Z")
-	var stdout, stderr bytes.Buffer
-	if code := Resolve(root, []string{pending.QuestionID, GitAuthorityAnswer}, &stdout, &stderr); code != 0 {
-		t.Fatalf("resolve code=%d stderr=%q", code, stderr.String())
-	}
-	granted := AuthorizeGitOperation(root, slug, classified.Digest, reasons)
-	if !granted.Allowed || granted.ReasonID != reason.GitAuthorityGranted ||
-		granted.QuestionID != pending.QuestionID {
-		t.Fatalf("grant = %#v", granted)
-	}
-
-	ledgerPath := filepath.Join(work, GitAuthorityLedgerFile)
-	info, err := os.Stat(ledgerPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if runtime.GOOS != "windows" && info.Mode().Perm() != 0o600 {
-		t.Fatalf("ledger mode = %o, want 600", info.Mode().Perm())
-	}
-	ledgerText := gitAuthorityRead(t, ledgerPath)
-	if strings.Count(ledgerText, GitAuthorityConsumptionSchemaV1) != 1 {
-		t.Fatalf("ledger = %q", ledgerText)
-	}
-	for _, forbidden := range []string{"git clean", "-fdx"} {
-		if strings.Contains(ledgerText, forbidden) {
-			t.Fatalf("ledger leaked %q: %s", forbidden, ledgerText)
-		}
-	}
-
-	replay := AuthorizeGitOperation(root, slug, classified.Digest, reasons)
-	if replay.Allowed || !replay.Opened || replay.ReasonID != reason.GitAuthorityReplayed ||
-		replay.QuestionID == pending.QuestionID {
-		t.Fatalf("replay = %#v", replay)
-	}
-	if got := strings.Count(gitAuthorityRead(t, ledgerPath), GitAuthorityConsumptionSchemaV1); got != 1 {
-		t.Fatalf("replay changed ledger entries: %d", got)
-	}
-}
-
-func TestGitAuthorityWrongDigestNeverGrants(t *testing.T) {
-	root, slug, _ := gitAuthorityWorkspace(t)
-	t.Setenv("DEVRITES_NOW", "2026-07-23T10:00:00Z")
-	first := toolpolicy.ClassifyGitCommand("git reset --hard HEAD")
-	second := toolpolicy.ClassifyGitCommand("git clean -fd")
-	pending := AuthorizeGitOperation(root, slug, first.Digest, destructiveGitReasons(first))
-
-	t.Setenv("DEVRITES_NOW", "2026-07-23T10:01:00Z")
-	var stdout, stderr bytes.Buffer
-	if code := Resolve(root, []string{pending.QuestionID, GitAuthorityAnswer}, &stdout, &stderr); code != 0 {
-		t.Fatalf("resolve code=%d stderr=%q", code, stderr.String())
-	}
-	mismatch := AuthorizeGitOperation(root, slug, second.Digest, destructiveGitReasons(second))
-	if mismatch.Allowed || !mismatch.Opened || mismatch.QuestionID == pending.QuestionID {
-		t.Fatalf("wrong digest decision = %#v", mismatch)
-	}
-}
-
-func TestGitAuthorityResolveEnforcesExactAnswerContract(t *testing.T) {
-	root, slug, work := gitAuthorityWorkspace(t)
-	t.Setenv("DEVRITES_NOW", "2026-07-23T10:00:00Z")
-	classified := toolpolicy.ClassifyGitCommand("git reset --hard HEAD")
-	pending := AuthorizeGitOperation(root, slug, classified.Digest, destructiveGitReasons(classified))
-	before := gitAuthorityRead(t, filepath.Join(work, "questions.md"))
-
-	var stdout, stderr bytes.Buffer
-	if code := Resolve(root, []string{pending.QuestionID, "Approve everything"}, &stdout, &stderr); code != 5 {
-		t.Fatalf("wrong answer code=%d stderr=%q", code, stderr.String())
-	}
-	if after := gitAuthorityRead(t, filepath.Join(work, "questions.md")); after != before {
-		t.Fatalf("wrong answer mutated authority question:\n%s", after)
-	}
-
-	stderr.Reset()
-	if code := Resolve(root, []string{pending.QuestionID, "  " + GitAuthorityAnswer + "  "}, &stdout, &stderr); code != 0 {
-		t.Fatalf("trimmed exact answer code=%d stderr=%q", code, stderr.String())
-	}
-	questions := gitAuthorityRead(t, filepath.Join(work, "questions.md"))
-	if !strings.Contains(questions, "answer: "+GitAuthorityAnswer) ||
-		strings.Contains(questions, "answer:   "+GitAuthorityAnswer) {
-		t.Fatalf("answer was not canonicalized:\n%s", questions)
-	}
-	stderr.Reset()
-	if code := Resolve(root, []string{pending.QuestionID, GitAuthorityAnswer}, &stdout, &stderr); code != 4 {
-		t.Fatalf("re-answer code=%d, want immutable-question code 4 (stderr=%q)", code, stderr.String())
-	}
-}
-
-func TestGitAuthorityExpiryAndRefusal(t *testing.T) {
-	t.Run("expired answer opens fresh question", func(t *testing.T) {
-		root, slug, _ := gitAuthorityWorkspace(t)
-		t.Setenv("DEVRITES_NOW", "2026-07-23T10:00:00Z")
-		classified := toolpolicy.ClassifyGitCommand("git branch -D old")
-		pending := AuthorizeGitOperation(root, slug, classified.Digest, destructiveGitReasons(classified))
-
-		t.Setenv("DEVRITES_NOW", "2026-07-23T10:01:00Z")
-		var stdout, stderr bytes.Buffer
-		if code := Resolve(root, []string{pending.QuestionID, GitAuthorityAnswer}, &stdout, &stderr); code != 0 {
-			t.Fatalf("resolve code=%d stderr=%q", code, stderr.String())
-		}
-		t.Setenv("DEVRITES_NOW", "2026-07-23T10:16:00Z")
-		expired := AuthorizeGitOperation(root, slug, classified.Digest, destructiveGitReasons(classified))
-		if expired.Allowed || !expired.Opened || expired.ReasonID != reason.GitAuthorityExpired ||
-			expired.QuestionID == pending.QuestionID {
-			t.Fatalf("expired = %#v", expired)
-		}
-	})
-
-	t.Run("drop remains refused without question spam", func(t *testing.T) {
-		root, slug, work := gitAuthorityWorkspace(t)
-		t.Setenv("DEVRITES_NOW", "2026-07-23T10:00:00Z")
-		classified := toolpolicy.ClassifyGitCommand("git tag -d v1")
-		pending := AuthorizeGitOperation(root, slug, classified.Digest, destructiveGitReasons(classified))
-		var stdout, stderr bytes.Buffer
-		if code := Resolve(root, []string{"--drop", pending.QuestionID, "No"}, &stdout, &stderr); code != 0 {
-			t.Fatalf("drop code=%d stderr=%q", code, stderr.String())
-		}
-		refused := AuthorizeGitOperation(root, slug, classified.Digest, destructiveGitReasons(classified))
-		if refused.Allowed || refused.Opened || refused.ReasonID != reason.GitAuthorityRefused {
-			t.Fatalf("refused = %#v", refused)
-		}
-		if got := strings.Count(gitAuthorityRead(t, filepath.Join(work, "questions.md")), GitAuthoritySchemaV1); got != 1 {
-			t.Fatalf("refusal created %d questions", got)
-		}
-		questions := gitAuthorityRead(t, filepath.Join(work, "questions.md"))
-		if !strings.Contains(questions, "answer: refused") || strings.Contains(questions, "answer: No") {
-			t.Fatalf("drop reason was not privacy-normalized:\n%s", questions)
-		}
-	})
-}
-
-func TestGitAuthorityCorruptionAndUnavailableStateDeny(t *testing.T) {
-	t.Run("corrupt ledger", func(t *testing.T) {
-		root, slug, work := gitAuthorityWorkspace(t)
-		t.Setenv("DEVRITES_NOW", "2026-07-23T10:00:00Z")
-		if err := os.WriteFile(filepath.Join(work, GitAuthorityLedgerFile), []byte("{bad\n"), 0o600); err != nil {
-			t.Fatal(err)
-		}
-		classified := toolpolicy.ClassifyGitCommand("git reset --hard HEAD")
-		got := AuthorizeGitOperation(root, slug, classified.Digest, destructiveGitReasons(classified))
-		if got.Allowed || got.Opened || got.ReasonID != reason.GitAuthorityCorrupt {
-			t.Fatalf("corrupt ledger decision = %#v", got)
-		}
-	})
-
-	t.Run("corrupt typed question", func(t *testing.T) {
-		root, slug, work := gitAuthorityWorkspace(t)
-		t.Setenv("DEVRITES_NOW", "2026-07-23T10:00:00Z")
-		classified := toolpolicy.ClassifyGitCommand("git reset --hard HEAD")
-		_ = AuthorizeGitOperation(root, slug, classified.Digest, destructiveGitReasons(classified))
-		qpath := filepath.Join(work, "questions.md")
-		data := gitAuthorityRead(t, qpath) + "unexpected: forged\n"
-		if err := os.WriteFile(qpath, []byte(data), 0o644); err != nil {
-			t.Fatal(err)
-		}
-		got := AuthorizeGitOperation(root, slug, classified.Digest, destructiveGitReasons(classified))
-		if got.Allowed || got.Opened || got.ReasonID != reason.GitAuthorityCorrupt {
-			t.Fatalf("corrupt question decision = %#v", got)
-		}
-	})
-
-	t.Run("no workspace", func(t *testing.T) {
-		root := filepath.Join(t.TempDir(), ".devrites")
-		if err := os.MkdirAll(root, 0o755); err != nil {
-			t.Fatal(err)
-		}
-		classified := toolpolicy.ClassifyGitCommand("git reset --hard HEAD")
-		got := AuthorizeGitOperation(root, "missing", classified.Digest, destructiveGitReasons(classified))
-		if got.Allowed || got.ReasonID != reason.GitWorkspaceUnavailable {
-			t.Fatalf("missing workspace decision = %#v", got)
-		}
-	})
-
-	t.Run("lock failure leaves question unchanged", func(t *testing.T) {
-		root, slug, work := gitAuthorityWorkspace(t)
-		before := gitAuthorityRead(t, filepath.Join(work, "questions.md"))
-		if err := os.Mkdir(filepath.Join(work, ".lock"), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		classified := toolpolicy.ClassifyGitCommand("git reset --hard HEAD")
-		got := AuthorizeGitOperation(root, slug, classified.Digest, destructiveGitReasons(classified))
-		if got.Allowed || got.ReasonID != reason.GitAuthorityUnavailable {
-			t.Fatalf("lock failure decision = %#v", got)
-		}
-		if after := gitAuthorityRead(t, filepath.Join(work, "questions.md")); after != before {
-			t.Fatalf("lock failure mutated questions:\n%s", after)
-		}
-	})
-}
-
-func TestGitAuthorityConcurrentGrantAllowsExactlyOnce(t *testing.T) {
-	root, slug, work := gitAuthorityWorkspace(t)
-	t.Setenv("DEVRITES_NOW", "2026-07-23T10:00:00Z")
-	classified := toolpolicy.ClassifyGitCommand("git update-ref -d refs/heads/old")
-	reasons := destructiveGitReasons(classified)
-	pending := AuthorizeGitOperation(root, slug, classified.Digest, reasons)
-	var stdout, stderr bytes.Buffer
-	if code := Resolve(root, []string{pending.QuestionID, GitAuthorityAnswer}, &stdout, &stderr); code != 0 {
-		t.Fatalf("resolve code=%d stderr=%q", code, stderr.String())
-	}
-
-	const workers = 12
-	start := make(chan struct{})
-	results := make(chan GitAuthorityDecision, workers)
-	var wg sync.WaitGroup
-	for i := 0; i < workers; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			<-start
-			results <- AuthorizeGitOperation(root, slug, classified.Digest, reasons)
-		}()
-	}
-	close(start)
-	wg.Wait()
-	close(results)
-
-	allowed := 0
-	for result := range results {
-		if result.Allowed {
-			allowed++
-		}
-	}
-	if allowed != 1 {
-		t.Fatalf("allowed = %d, want exactly 1", allowed)
-	}
-	ledgerData := gitAuthorityRead(t, filepath.Join(work, GitAuthorityLedgerFile))
-	lines := strings.Fields(ledgerData)
-	if len(lines) != 1 {
-		t.Fatalf("ledger entries = %d, want 1: %q", len(lines), ledgerData)
-	}
-	var record gitAuthorityConsumption
-	if err := json.Unmarshal([]byte(lines[0]), &record); err != nil {
-		t.Fatal(err)
-	}
-	if record.QuestionID != pending.QuestionID {
-		t.Fatalf("consumed qid = %q, want %q", record.QuestionID, pending.QuestionID)
-	}
-}
-
-func gitAuthorityWorkspace(t *testing.T) (root, slug, work string) {
-	t.Helper()
-	t.Setenv("DEVRITES_WORKSPACE", "")
-	project := t.TempDir()
-	root = filepath.Join(project, ".devrites")
-	slug = "feature"
-	work = filepath.Join(root, "work", slug)
-	if err := os.MkdirAll(work, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	gitAuthorityWrite(t, filepath.Join(root, "ACTIVE"), slug+"\n", 0o644)
-	gitAuthorityWrite(t, filepath.Join(work, "questions.md"), "# Questions\n\nNone.\n", 0o644)
-	gitAuthorityWrite(t, filepath.Join(work, "state.md"), `# State
-
-- Phase: build
-- Status: running
-- Next step: /rite-build
-
-## Log
-- 2026-07-23T09:00:00Z build: running
-`, 0o644)
-	return root, slug, work
-}
-
-func destructiveGitReasons(result toolpolicy.Result) []toolpolicy.ReasonID {
-	var out []toolpolicy.ReasonID
-	for _, finding := range result.Findings {
-		if finding.Verdict == toolpolicy.VerdictDestructive {
-			out = append(out, finding.ReasonID)
-		}
-	}
-	return out
-}
-
-func gitAuthorityWrite(t *testing.T, path, content string, mode os.FileMode) {
-	t.Helper()
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(path, []byte(content), mode); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func gitAuthorityRead(t *testing.T, path string) string {
-	t.Helper()
-	data, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return string(data)
-}

package/engine/internal/lib/jsonout.go

@@ -1,129 +0,0 @@
-package lib
-
-import (
-	"encoding/json"
-	"io"
-	"regexp"
-	"strconv"
-	"strings"
-
-	"github.com/devrites/devrites/internal/reason"
-)
-
-// A `--json` run wraps a command's normal output in the stable machine-readable
-// agent contract without changing command behavior. The envelope stores stdout
-// in data.text, parses stderr into diagnostics, and includes the exit code. See
-// docs/engine/agent-contract.md.
-
-// Envelope is the top-level JSON result of a `--json` command run.
-type Envelope struct {
-	Schema      string        `json:"schema"`
-	Command     string        `json:"command"`
-	OK          bool          `json:"ok"`
-	ExitCode    int           `json:"exitCode"`
-	ReasonID    reason.ID     `json:"reason_id,omitempty"`
-	Data        *EnvelopeData `json:"data,omitempty"`
-	Diagnostics []Diagnostic  `json:"diagnostics,omitempty"`
-}
-
-const CommandEnvelopeSchemaV1 = "devrites-command/v1"
-
-// EnvelopeData keeps stdout unchanged while structured consumers read ok,
-// exitCode, and diagnostics from the envelope.
-type EnvelopeData struct {
-	Text string `json:"text"`
-}
-
-// Diagnostic is one stderr line, classified. Path and Line are populated when the
-// emitting command used the `ERROR:<path>: <msg> (line N)` shape (spec-validate,
-// ledger validate); otherwise they are empty.
-type Diagnostic struct {
-	Code     string `json:"code"`
-	Severity string `json:"severity"` // error | warning | info
-	Message  string `json:"message"`
-	Path     string `json:"path,omitempty"`
-	Line     int    `json:"line,omitempty"`
-}
-
-var (
-	diagLineRe   = regexp.MustCompile(`\(line[[:space:]]+(\d+)\)`)
-	diagPathRe   = regexp.MustCompile(`^([^:]*(?:/[^:]*)?\.[A-Za-z0-9]+):[[:space:]]+(.*)$`)
-	diagCodeWord = regexp.MustCompile(`[^a-z0-9]+`)
-)
-
-// NewEnvelope builds the result envelope from a captured command run.
-func NewEnvelope(command string, code int, stdout, stderr string) Envelope {
-	env := Envelope{Schema: CommandEnvelopeSchemaV1, Command: command, OK: code == 0, ExitCode: code}
-	if s := strings.TrimRight(stdout, "\n"); s != "" {
-		env.Data = &EnvelopeData{Text: s}
-	}
-	for _, line := range strings.Split(stderr, "\n") {
-		line = strings.TrimRight(line, "\r")
-		if strings.TrimSpace(line) == "" {
-			continue
-		}
-		env.Diagnostics = append(env.Diagnostics, parseDiagnostic(command, line))
-	}
-	return env
-}
-
-// WithReason adds a rule-owned reason without changing the legacy envelope
-// fields. Unknown IDs are ignored rather than written as false provenance.
-func (env Envelope) WithReason(id reason.ID) Envelope {
-	if reason.Known(id) {
-		env.ReasonID = id
-	}
-	return env
-}
-
-// parseDiagnostic classifies one stderr line. It recognizes the ERROR:/WARN:
-// prefixes and the `<path>: <message> (line N)` shape the spec/ledger validators
-// emit; anything else becomes an info-level diagnostic with the raw text.
-func parseDiagnostic(command, line string) Diagnostic {
-	d := Diagnostic{Severity: "info", Message: line}
-	rest := line
-	switch {
-	case strings.HasPrefix(line, "ERROR:"):
-		d.Severity = "error"
-		rest = strings.TrimPrefix(line, "ERROR:")
-	case strings.HasPrefix(line, "WARN:"), strings.HasPrefix(line, "WARNING:"):
-		d.Severity = "warning"
-		rest = strings.TrimPrefix(strings.TrimPrefix(line, "WARNING:"), "WARN:")
-	}
-	rest = strings.TrimSpace(rest)
-	d.Message = rest
-	if m := diagPathRe.FindStringSubmatch(rest); m != nil {
-		d.Path = m[1]
-		d.Message = m[2]
-	}
-	if m := diagLineRe.FindStringSubmatch(rest); m != nil {
-		if n, err := strconv.Atoi(m[1]); err == nil {
-			d.Line = n
-		}
-	}
-	d.Code = diagnosticCode(command, d.Severity, d.Message)
-	return d
-}
-
-// diagnosticCode returns a stable `<command>_<severity>` code. Version 1 keeps
-// codes broad so the catalog can add more specific entries without breaking
-// consumers that match the prefix.
-func diagnosticCode(command, severity, message string) string {
-	base := diagCodeWord.ReplaceAllString(strings.ToLower(command), "_")
-	switch {
-	case strings.Contains(message, "marked ADDED") || strings.Contains(message, "marked MODIFIED") || strings.Contains(message, "marked REMOVED"):
-		return base + "_delta_mismatch"
-	case strings.Contains(message, "SHALL") || strings.Contains(message, "WHEN") || strings.Contains(message, "THEN") || strings.Contains(message, "Scenario"):
-		return base + "_grammar"
-	}
-	return base + "_" + severity
-}
-
-// WriteEnvelope marshals an envelope as indented JSON followed by a newline.
-func WriteEnvelope(w io.Writer, env Envelope) {
-	b, err := json.MarshalIndent(env, "", "  ")
-	if err != nil {
-		return
-	}
-	_, _ = w.Write(append(b, '\n'))
-}

package/engine/internal/lib/jsonout_test.go

@@ -1,73 +0,0 @@
-package lib
-
-import (
-	"bytes"
-	"encoding/json"
-	"testing"
-
-	"github.com/devrites/devrites/internal/reason"
-)
-
-func TestNewEnvelopeOK(t *testing.T) {
-	env := NewEnvelope("preamble", 0, "phase: build\nstatus: running\n", "")
-	if !env.OK || env.ExitCode != 0 {
-		t.Fatalf("want ok/0, got ok=%v code=%d", env.OK, env.ExitCode)
-	}
-	if env.Schema != CommandEnvelopeSchemaV1 {
-		t.Fatalf("schema=%q", env.Schema)
-	}
-	if env.Data == nil || env.Data.Text != "phase: build\nstatus: running" {
-		t.Fatalf("data.text not captured verbatim: %+v", env.Data)
-	}
-	if len(env.Diagnostics) != 0 {
-		t.Fatalf("clean run should have no diagnostics, got %v", env.Diagnostics)
-	}
-}
-
-func TestEnvelopeReasonIsExplicitAndCatalogBound(t *testing.T) {
-	env := NewEnvelope("seal", 3, "", "").WithReason(reason.GateSealMissing)
-	if env.ReasonID != reason.GateSealMissing {
-		t.Fatalf("reason_id=%q", env.ReasonID)
-	}
-	env = env.WithReason("DRV-UNREGISTERED")
-	if env.ReasonID != reason.GateSealMissing {
-		t.Fatalf("unknown reason replaced typed reason: %q", env.ReasonID)
-	}
-}
-
-func TestNewEnvelopeParsesDiagnostics(t *testing.T) {
-	stderr := `ERROR:.devrites/work/feat/spec.md: Requirement "X" (line 2) is marked ADDED but already exists in ledger capability "theming"
-ERROR:.devrites/work/feat/spec.md: Requirement "Y" (line 9) has no THEN line`
-	env := NewEnvelope("spec-validate", 1, "", stderr)
-	if env.OK || env.ExitCode != 1 {
-		t.Fatalf("want not-ok/1, got ok=%v code=%d", env.OK, env.ExitCode)
-	}
-	if len(env.Diagnostics) != 2 {
-		t.Fatalf("want 2 diagnostics, got %d", len(env.Diagnostics))
-	}
-	d0 := env.Diagnostics[0]
-	if d0.Severity != "error" || d0.Path != ".devrites/work/feat/spec.md" || d0.Line != 2 {
-		t.Fatalf("diagnostic 0 misparsed: %+v", d0)
-	}
-	if d0.Code != "spec_validate_delta_mismatch" {
-		t.Fatalf("want delta_mismatch code, got %q", d0.Code)
-	}
-	if env.Diagnostics[1].Code != "spec_validate_grammar" {
-		t.Fatalf("want grammar code for THEN-line finding, got %q", env.Diagnostics[1].Code)
-	}
-}
-
-func TestWriteEnvelopeIsValidJSON(t *testing.T) {
-	var buf bytes.Buffer
-	WriteEnvelope(&buf, NewEnvelope("doctor", 3, "skew", "WARN: pack ahead of binary"))
-	var back Envelope
-	if err := json.Unmarshal(buf.Bytes(), &back); err != nil {
-		t.Fatalf("envelope is not valid JSON: %v", err)
-	}
-	if back.ExitCode != 3 || back.OK {
-		t.Fatalf("round-trip lost fields: %+v", back)
-	}
-	if len(back.Diagnostics) != 1 || back.Diagnostics[0].Severity != "warning" {
-		t.Fatalf("warning diagnostic not classified: %+v", back.Diagnostics)
-	}
-}

package/engine/internal/lib/lanes.go

@@ -1,112 +0,0 @@
-package lib
-
-import (
-	"fmt"
-	"io"
-	"path/filepath"
-	"regexp"
-	"slices"
-	"strings"
-)
-
-var (
-	lanePathRe   = regexp.MustCompile("`([^`]+)`")
-	laneForgeYes = regexp.MustCompile(`(?i)^Forge:[[:space:]]+yes(?:[[:space:]]+(?:—|-)[[:space:]]+.+)?$`)
-)
-
-// Lanes suggests conservative parallel work without changing state. It labels
-// read-only lanes, Forge candidates, and independent slices but does not
-// authorize parallel production writes, preserving the one-verified-slice
-// default.
-func Lanes(root string, args []string, stdout, stderr io.Writer) int {
-	if argAt(args, 0) != "plan" {
-		fmt.Fprintln(stderr, "usage: devrites-engine lanes plan [slug]")
-		return 2
-	}
-	slug := argAt(args, 1)
-	if slug == "" {
-		slug = activeSlug(root)
-	}
-	if slug == "" {
-		fmt.Fprintln(stderr, "lanes: no active feature")
-		return 2
-	}
-	tasks, ok := readFileOK(filepath.Join(featureDir(root, slug), "tasks.md"))
-	if !ok {
-		fmt.Fprintf(stdout, "lanes: no tasks.md for %s: no parallel write lanes.\n", slug)
-		return 0
-	}
-	slices := parseLaneSlices(tasks)
-	fmt.Fprintf(stdout, "# Lane plan: %s\n\n", slug)
-	if len(slices) == 0 {
-		fmt.Fprintln(stdout, "No slice headings found. Keep the default single-slice build loop.")
-		return 0
-	}
-	groups := map[string][]string{}
-	for _, s := range slices {
-		key := "read-only/review"
-		if s.forge {
-			key = "forge-candidate"
-		} else if len(s.paths) > 0 {
-			key = strings.Join(s.paths, ",")
-		}
-		groups[key] = append(groups[key], s.name)
-	}
-	fmt.Fprintln(stdout, "Default: one production write slice at a time. Safe parallelism is advisory only.")
-	fmt.Fprintln(stdout)
-	for _, s := range slices {
-		kind := "serial-write"
-		if s.forge {
-			kind = "forge-candidate"
-		} else if len(s.paths) == 0 {
-			kind = "read-only/spike"
-		}
-		conflict := "unknown write surface"
-		if len(s.paths) > 0 {
-			conflict = strings.Join(s.paths, ", ")
-		}
-		fmt.Fprintf(stdout, "- %s: %s: %s", s.name, kind, conflict)
-		if s.forge {
-			fmt.Fprint(stdout, "; advisory only. `devrites-engine forge plan` must authorize 2 or 3 strategies")
-		}
-		fmt.Fprintln(stdout)
-	}
-	return 0
-}
-
-type laneSlice struct {
-	name  string
-	paths []string
-	forge bool
-}
-
-func parseLaneSlices(md string) []laneSlice {
-	var out []laneSlice
-	var cur *laneSlice
-	flush := func() {
-		if cur != nil {
-			out = append(out, *cur)
-		}
-	}
-	for _, line := range strings.Split(md, "\n") {
-		trim := strings.TrimSpace(line)
-		if sliceHeadRe.MatchString(trim) {
-			flush()
-			cur = &laneSlice{name: strings.TrimPrefix(trim, "## ")}
-			continue
-		}
-		if cur == nil {
-			continue
-		}
-		if laneForgeYes.MatchString(trim) {
-			cur.forge = true
-		}
-		for _, m := range lanePathRe.FindAllStringSubmatch(trim, -1) {
-			if !slices.Contains(cur.paths, m[1]) {
-				cur.paths = append(cur.paths, m[1])
-			}
-		}
-	}
-	flush()
-	return out
-}