devrites 4.2.0 → 4.4.0

package/engine/internal/parallel/parallel_test.go

@@ -0,0 +1,242 @@
+package parallel
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func gitOk(t *testing.T, dir string, args ...string) string {
+	t.Helper()
+	cmd := exec.Command("git", append([]string{"-C", dir}, args...)...)
+	cmd.Env = append(os.Environ(),
+		"GIT_CONFIG_NOSYSTEM=1",
+		"GIT_TERMINAL_PROMPT=0",
+		"GIT_AUTHOR_NAME=DevRites Test",
+		"GIT_AUTHOR_EMAIL=devrites@example.invalid",
+		"GIT_COMMITTER_NAME=DevRites Test",
+		"GIT_COMMITTER_EMAIL=devrites@example.invalid",
+	)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("git %v: %v\n%s", args, err, out)
+	}
+	return strings.TrimSpace(string(out))
+}
+
+func setupRepo(t *testing.T) (repo, base string) {
+	t.Helper()
+	repo = t.TempDir()
+	gitOk(t, repo, "init")
+	gitOk(t, repo, "checkout", "-b", "main")
+	if err := os.MkdirAll(filepath.Join(repo, "src"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(repo, "src", "a.go"), []byte("package main\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(repo, "src", "b.go"), []byte("package main\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(repo, "README.md"), []byte("base\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	gitOk(t, repo, "add", ".")
+	gitOk(t, repo, "commit", "-m", "base")
+	base = gitOk(t, repo, "rev-parse", "HEAD")
+	return repo, base
+}
+
+func TestLeaseRoundTrip(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	path := filepath.Join(dir, "parallel-lease.md")
+	lease := &Lease{
+		BatchID:             "batch1",
+		CreatedAt:           "2026-08-23T00:00:00Z",
+		BaseSHA:             "abcdef1",
+		N:                   2,
+		Status:              StatusRunning,
+		ControlPIDOrSession: "test",
+		Slices: []LeaseSlice{
+			{ID: "slice-a", Paths: []string{"src/a.go"}, WorktreePath: "/tmp/a", Branch: "devrites/parallel/x/batch1/slice-a", WrightStatus: WrightPending},
+			{ID: "slice-b", Paths: []string{"src/b.go"}, WorktreePath: "/tmp/b", Branch: "devrites/parallel/x/batch1/slice-b", WrightStatus: WrightPending},
+		},
+	}
+	if err := WriteLease(path, lease); err != nil {
+		t.Fatal(err)
+	}
+	got, err := ReadLease(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.BatchID != "batch1" || got.Status != StatusRunning || len(got.Slices) != 2 {
+		t.Fatalf("unexpected lease: %#v", got)
+	}
+}
+
+func TestCreateAbortCleanup(t *testing.T) {
+	repo, base := setupRepo(t)
+	slug := "demo-feature"
+	batch := "batch1"
+	lease, err := Create(CreateOpts{
+		Root:    repo,
+		Slug:    slug,
+		BatchID: batch,
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src/a.go"}},
+			{ID: "slice-b", Paths: []string{"src/b.go"}},
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if lease.Status != StatusRunning || lease.N != 2 {
+		t.Fatalf("lease=%#v", lease)
+	}
+	wtA := lease.Slices[0].WorktreePath
+	wtB := lease.Slices[1].WorktreePath
+	for _, wt := range []string{wtA, wtB} {
+		if _, err := os.Stat(wt); err != nil {
+			t.Fatalf("missing worktree %s: %v", wt, err)
+		}
+		if head := gitOk(t, wt, "rev-parse", "HEAD"); head != base {
+			t.Fatalf("worktree head %s want %s", head, base)
+		}
+	}
+	if head := gitOk(t, repo, "rev-parse", "HEAD"); head != base {
+		t.Fatalf("control moved after create: %s", head)
+	}
+
+	// Drift control tip, then abort should restore base.
+	if err := os.WriteFile(filepath.Join(repo, "README.md"), []byte("drift\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	gitOk(t, repo, "add", "README.md")
+	gitOk(t, repo, "commit", "-m", "drift")
+	if _, err := Abort(repo, slug, true); err != nil {
+		t.Fatal(err)
+	}
+	if head := gitOk(t, repo, "rev-parse", "HEAD"); head != base {
+		t.Fatalf("abort left control at %s want %s", head, base)
+	}
+	leasePath, _ := LeasePath(repo, slug)
+	lease, err = ReadLease(leasePath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if lease.Status != StatusAborted {
+		t.Fatalf("status=%s", lease.Status)
+	}
+	if _, err := os.Stat(wtA); err != nil {
+		t.Fatalf("abort should preserve worktree: %v", err)
+	}
+
+	if err := Cleanup(repo, slug, true); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(wtA); !os.IsNotExist(err) {
+		t.Fatalf("cleanup should remove worktree A")
+	}
+	if _, err := os.Stat(leasePath); !os.IsNotExist(err) {
+		t.Fatalf("cleanup should clear lease")
+	}
+}
+
+func TestCreateRefusesOverlap(t *testing.T) {
+	repo, base := setupRepo(t)
+	_, err := Create(CreateOpts{
+		Root:    repo,
+		Slug:    "demo",
+		BatchID: "batch1",
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src/a.go"}},
+			{ID: "slice-b", Paths: []string{"src/a.go"}},
+		},
+	})
+	if err == nil || !strings.Contains(err.Error(), "overlap") {
+		t.Fatalf("expected overlap refusal, got %v", err)
+	}
+}
+
+func TestIntegrateDivergentSiblings(t *testing.T) {
+	repo, base := setupRepo(t)
+	slug := "demo-feature"
+	batch := "batch1"
+	lease, err := Create(CreateOpts{
+		Root:    repo,
+		Slug:    slug,
+		BatchID: batch,
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src/a.go"}},
+			{ID: "slice-b", Paths: []string{"src/b.go"}},
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	wtA := lease.Slices[0].WorktreePath
+	wtB := lease.Slices[1].WorktreePath
+
+	if err := os.WriteFile(filepath.Join(wtA, "src", "a.go"), []byte("package main\n\nfunc A() {}\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	gitOk(t, wtA, "add", "src/a.go")
+	gitOk(t, wtA, "commit", "-m", "slice-a green")
+	tcA := gitOk(t, wtA, "rev-parse", "HEAD")
+
+	if err := os.WriteFile(filepath.Join(wtB, "src", "b.go"), []byte("package main\n\nfunc B() {}\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	gitOk(t, wtB, "add", "src/b.go")
+	gitOk(t, wtB, "commit", "-m", "slice-b green")
+	tcB := gitOk(t, wtB, "rev-parse", "HEAD")
+
+	if _, err := RecordGreen(repo, slug, "slice-a", tcA); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := RecordGreen(repo, slug, "slice-b", tcB); err != nil {
+		t.Fatal(err)
+	}
+
+	tip, lease, err := Integrate(IntegrateOpts{Root: repo, Slug: slug, ApplyToControl: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if lease.Status != StatusComplete {
+		t.Fatalf("status=%s", lease.Status)
+	}
+	if tip == "" || tip == base {
+		t.Fatalf("expected advanced tip, got %s", tip)
+	}
+	head := gitOk(t, repo, "rev-parse", "HEAD")
+	if head != tip {
+		t.Fatalf("control head %s want tip %s", head, tip)
+	}
+	a := mustRead(t, filepath.Join(repo, "src", "a.go"))
+	b := mustRead(t, filepath.Join(repo, "src", "b.go"))
+	if !strings.Contains(a, "func A") || !strings.Contains(b, "func B") {
+		t.Fatalf("integrated contents missing: a=%q b=%q", a, b)
+	}
+
+	if err := Cleanup(repo, slug, false); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(wtA); !os.IsNotExist(err) {
+		t.Fatalf("cleanup should remove workers")
+	}
+}
+
+func mustRead(t *testing.T, path string) string {
+	t.Helper()
+	b, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(b)
+}

package/engine/internal/parallel/pathdisjoint.go

@@ -0,0 +1,129 @@
+// Package parallel implements deterministic parallel-worktree control ops:
+// path-disjoint checks, advisory leases, and git worktree create/integrate/cleanup.
+package parallel
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strings"
+)
+
+var winAbsRE = regexp.MustCompile(`(?i)^[A-Za-z]:[/\\]`)
+
+// SlicePaths is one path-disjoint eligibility unit.
+type SlicePaths struct {
+	ID    string   `json:"id"`
+	Paths []string `json:"paths"`
+}
+
+// NormalizePath mirrors scripts/check-path-disjoint.py: slash-normalize, reject
+// empty/absolute/.. paths, and drop empty/"." segments.
+func NormalizePath(raw string) (string, error) {
+	path := strings.TrimSpace(strings.ReplaceAll(raw, `\`, "/"))
+	if path == "" {
+		return "", fmt.Errorf("empty path is not allowed")
+	}
+	if strings.HasPrefix(path, "/") || winAbsRE.MatchString(path) {
+		return "", fmt.Errorf("path must be project-relative, not absolute: %q", raw)
+	}
+	parts := make([]string, 0, strings.Count(path, "/")+1)
+	for part := range strings.SplitSeq(path, "/") {
+		if part == "" || part == "." {
+			continue
+		}
+		if part == ".." {
+			return "", fmt.Errorf("path must not contain '..': %q", raw)
+		}
+		parts = append(parts, part)
+	}
+	if len(parts) == 0 {
+		return "", fmt.Errorf("empty path is not allowed")
+	}
+	return strings.Join(parts, "/"), nil
+}
+
+func validateSlicePaths(paths []string, label, root string) ([]string, error) {
+	if paths == nil {
+		return nil, fmt.Errorf("%s: paths must be a list", label)
+	}
+	normalized := make([]string, 0, len(paths))
+	seen := make(map[string]struct{}, len(paths))
+	for _, raw := range paths {
+		path, err := NormalizePath(raw)
+		if err != nil {
+			return nil, fmt.Errorf("%s: %w", label, err)
+		}
+		// Parallel eligibility must reject workspace control metadata so slices
+		// cannot claim control-tree / SSOT files (docs: ".devrites/**").
+		if path == ".devrites" || strings.HasPrefix(path, ".devrites/") {
+			return nil, fmt.Errorf("%s: path must not include .devrites: %q", label, path)
+		}
+		if _, ok := seen[path]; ok {
+			return nil, fmt.Errorf("%s: duplicate path %q", label, path)
+		}
+		seen[path] = struct{}{}
+		normalized = append(normalized, path)
+		if root != "" {
+			full := filepath.Join(root, filepath.FromSlash(path))
+			if info, err := os.Lstat(full); err == nil && info.Mode()&os.ModeSymlink != 0 {
+				return nil, fmt.Errorf("%s: symlink path is not allowed: %q", label, path)
+			}
+		}
+	}
+	return normalized, nil
+}
+
+// CheckPathDisjoint returns slice ids when every pair of path sets is disjoint.
+func CheckPathDisjoint(slices []SlicePaths, root string) ([]string, error) {
+	if len(slices) < 2 {
+		return nil, fmt.Errorf("need at least two slices to check path-disjoint eligibility")
+	}
+	owners := make(map[string][]string)
+	ids := make([]string, 0, len(slices))
+	for index, item := range slices {
+		label := fmt.Sprintf("slice %d", index)
+		if item.ID != "" {
+			label = fmt.Sprintf("slice %q", item.ID)
+			ids = append(ids, item.ID)
+		} else {
+			ids = append(ids, fmt.Sprintf("%d", index))
+		}
+		paths, err := validateSlicePaths(item.Paths, label, root)
+		if err != nil {
+			return nil, err
+		}
+		for _, path := range paths {
+			owners[path] = append(owners[path], label)
+		}
+	}
+	var overlaps []string
+	for path, labels := range owners {
+		if len(labels) > 1 {
+			overlaps = append(overlaps, fmt.Sprintf("%q shared by %s", path, strings.Join(labels, ", ")))
+		}
+	}
+	if len(overlaps) > 0 {
+		sort.Strings(overlaps)
+		return nil, fmt.Errorf("path sets overlap: %s", strings.Join(overlaps, "; "))
+	}
+	return ids, nil
+}
+
+// ParseSlicesJSON accepts {"slices":[...]} or a top-level slices array.
+func ParseSlicesJSON(data []byte) ([]SlicePaths, error) {
+	var asObject struct {
+		Slices []SlicePaths `json:"slices"`
+	}
+	if err := json.Unmarshal(data, &asObject); err == nil && asObject.Slices != nil {
+		return asObject.Slices, nil
+	}
+	var asList []SlicePaths
+	if err := json.Unmarshal(data, &asList); err == nil {
+		return asList, nil
+	}
+	return nil, fmt.Errorf(`input must be {"slices": [...]} or a top-level slices array`)
+}

package/engine/internal/parallel/pathdisjoint_test.go

@@ -0,0 +1,97 @@
+package parallel
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestNormalizePathRejectsDirty(t *testing.T) {
+	t.Parallel()
+	cases := []string{"", " ", "/", "/abs", `C:\windows`, `..`, "a/../b", "../x"}
+	for _, raw := range cases {
+		if _, err := NormalizePath(raw); err == nil {
+			t.Fatalf("NormalizePath(%q) should fail", raw)
+		}
+	}
+}
+
+func TestNormalizePathAcceptsRelative(t *testing.T) {
+	t.Parallel()
+	got, err := NormalizePath(`src\foo.go`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "src/foo.go" {
+		t.Fatalf("got %q", got)
+	}
+}
+
+func TestCheckPathDisjointOverlap(t *testing.T) {
+	t.Parallel()
+	_, err := CheckPathDisjoint([]SlicePaths{
+		{ID: "a", Paths: []string{"src/a.go"}},
+		{ID: "b", Paths: []string{"src/a.go"}},
+	}, "")
+	if err == nil || !strings.Contains(err.Error(), "overlap") {
+		t.Fatalf("expected overlap error, got %v", err)
+	}
+}
+
+func TestCheckPathDisjointOK(t *testing.T) {
+	t.Parallel()
+	ids, err := CheckPathDisjoint([]SlicePaths{
+		{ID: "a", Paths: []string{"src/a.go"}},
+		{ID: "b", Paths: []string{"src/b.go"}},
+	}, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(ids) != 2 {
+		t.Fatalf("ids=%v", ids)
+	}
+}
+
+func TestCheckPathDisjointRejectsDevritesPaths(t *testing.T) {
+	t.Parallel()
+	_, err := CheckPathDisjoint([]SlicePaths{
+		{ID: "a", Paths: []string{".devrites/work/state.md"}},
+		{ID: "b", Paths: []string{"src/b.go"}},
+	}, "")
+	if err == nil || !strings.Contains(err.Error(), ".devrites") {
+		t.Fatalf("expected .devrites rejection error, got %v", err)
+	}
+}
+
+func TestCheckPathDisjointSymlinkRoot(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	target := filepath.Join(dir, "real.go")
+	if err := os.WriteFile(target, []byte("x"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	link := filepath.Join(dir, "link.go")
+	if err := os.Symlink(target, link); err != nil {
+		t.Skip("symlinks unavailable")
+	}
+	_, err := CheckPathDisjoint([]SlicePaths{
+		{ID: "a", Paths: []string{"link.go"}},
+		{ID: "b", Paths: []string{"other.go"}},
+	}, dir)
+	if err == nil || !strings.Contains(err.Error(), "symlink") {
+		t.Fatalf("expected symlink error, got %v", err)
+	}
+}
+
+func TestParseSlicesJSONShapes(t *testing.T) {
+	t.Parallel()
+	a, err := ParseSlicesJSON([]byte(`{"slices":[{"id":"a","paths":["x.go"]},{"id":"b","paths":["y.go"]}]}`))
+	if err != nil || len(a) != 2 {
+		t.Fatalf("object shape: %v %#v", err, a)
+	}
+	b, err := ParseSlicesJSON([]byte(`[{"id":"a","paths":["x.go"]},{"id":"b","paths":["y.go"]}]`))
+	if err != nil || len(b) != 2 {
+		t.Fatalf("array shape: %v %#v", err, b)
+	}
+}

package/engine/internal/state/status.go

@@ -7,14 +7,17 @@ import (
 
 // Report is the computed completeness status of a feature at its current phase.
 type Report struct {
-	Slug          string
-	Phase         Phase
-	Required      map[Section]bool
-	Missing       []Section // required-but-empty sections, in policy order
-	RequiredFiles map[string]bool
-	MissingFiles  []string // required-but-empty workspace files, in lifecycle order
-	present       map[Section]bool
-	diagnostics   []ArtifactDiagnostic
+	Slug              string
+	Phase             Phase
+	Status            string
+	NextAction        string
+	PrinciplesPresent bool
+	Required          map[Section]bool
+	Missing           []Section // required-but-empty sections, in policy order
+	RequiredFiles     map[string]bool
+	MissingFiles      []string // required-but-empty workspace files, in lifecycle order
+	present           map[Section]bool
+	diagnostics       []ArtifactDiagnostic
 }
 
 // Status computes phase-relative completeness from one retained workspace observation.
@@ -35,6 +38,24 @@ func statusWithCallback(root, slug string, callback observationCallback) (*Repor
 	return newObservationReport(observation, phase, policy), nil
 }
 
+func observationCursorFields(observation *WorkspaceObservation) (status, nextAction string, principlesPresent bool) {
+	if fact, ok := observation.Fact(".devrites/principles.md"); ok && fact.State() == ArtifactPresent {
+		principlesPresent = true
+	}
+	fact, ok := observation.Fact(LedgerFile)
+	if !ok || fact.State() != ArtifactPresent {
+		return "", "", principlesPresent
+	}
+	lines := strings.Split(string(fact.Bytes()), "\n")
+	if value, ok := CursorField(lines, CursorStatus); ok {
+		status = value
+	}
+	if value, ok := CursorField(lines, CursorNextAction); ok {
+		nextAction = value
+	}
+	return status, nextAction, principlesPresent
+}
+
 func newObservationReport(observation *WorkspaceObservation, phase Phase, policy PhasePolicy) *Report {
 	present := observationSectionPresence(observation)
 	required := requiredSections(policy)
@@ -44,15 +65,19 @@ func newObservationReport(observation *WorkspaceObservation, phase Phase, policy
 	for i, artifact := range missingArtifacts {
 		missingFiles[i] = string(artifact)
 	}
+	status, nextAction, principlesPresent := observationCursorFields(observation)
 	return &Report{
-		Slug:          observation.Slug(),
-		Phase:         phase,
-		Required:      required,
-		Missing:       missingObservationSections(present, policy.RequiredSections),
-		RequiredFiles: requiredFiles,
-		MissingFiles:  missingFiles,
-		present:       present,
-		diagnostics:   diagnostics,
+		Slug:              observation.Slug(),
+		Phase:             phase,
+		Status:            status,
+		NextAction:        nextAction,
+		PrinciplesPresent: principlesPresent,
+		Required:          required,
+		Missing:           missingObservationSections(present, policy.RequiredSections),
+		RequiredFiles:     requiredFiles,
+		MissingFiles:      missingFiles,
+		present:           present,
+		diagnostics:       diagnostics,
 	}
 }
 

package/engine/main.go

@@ -10,6 +10,7 @@ import (
 	"github.com/devrites/devrites/internal/gate"
 	"github.com/devrites/devrites/internal/install"
 	"github.com/devrites/devrites/internal/lib"
+	"github.com/devrites/devrites/internal/parallel"
 	"github.com/devrites/devrites/internal/state"
 	"github.com/devrites/devrites/internal/version"
 )
@@ -24,9 +25,17 @@ Usage:
   devrites-engine check readiness <slug>   Check required files and the stable Build-input binding
   devrites-engine check readiness --emit-binding <slug>  Emit the stable Build-input binding for Vet
   devrites-engine check seal <slug>        Recheck the Build-input binding, final files, and evidence freshness
+  devrites-engine check path-disjoint [--root <dir>] [<json-file>|-]
+                                         Verify slice path sets are pairwise disjoint
+  devrites-engine check task-graph <slug>  Validate tasks.md slice dependency graph
+  devrites-engine check skill-trust <path> Scan one skill/agent Markdown for trust violations
+  devrites-engine observe summary <slug>   Emit sanitized JSON workspace summary
+  devrites-engine parallel <subcommand>   Deterministic parallel worktree lease/create/integrate/cleanup
   devrites-engine state resolve <qid> "<ans>"  Resolve an open question and update state atomically
   devrites-engine state close <slug>       Archive a shipped feature and clear ACTIVE
   devrites-engine secret-scan [--staged] [--stdin] [slug]  Scan exact staged blobs, stdin, or touched files; HIGH blocks
+  devrites-engine open-visual <path-or-name> [--slug <slug>] [--no-open]
+                                         Resolve a visual HTML file, optionally open it locally, print agent paths
   devrites-engine version                  Print the engine binary's version
 Exit codes:
   0  ok / gate passed
@@ -71,11 +80,17 @@ func run(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 	case "uninstall":
 		return install.Run(args[1:], stdout, stderr, install.ModeUninstall)
 	case "check":
-		return cmdCheck(args[1:], stdout, stderr)
+		return cmdCheck(root, args[1:], stdin, stdout, stderr)
+	case "parallel":
+		return parallel.Run("parallel", args[1:], stdin, stdout, stderr)
+	case "observe":
+		return cmdObserve(root, args[1:], stdout, stderr)
 	case "state":
 		return cmdState(root, args[1:], stdout, stderr)
 	case "secret-scan":
 		return lib.SecretScan(root, args[1:], stdin, stdout, stderr)
+	case "open-visual":
+		return lib.OpenVisual(root, args[1:], stdout, stderr)
 	case "version", "--version":
 		fmt.Fprintln(stdout, version.Version)
 		return exitOK
@@ -88,9 +103,9 @@ func run(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 	}
 }
 
-func cmdCheck(args []string, stdout, stderr io.Writer) int {
+func cmdCheck(root string, args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 	if len(args) == 0 {
-		fmt.Fprintln(stderr, "usage: devrites-engine check <candidate|readiness|seal> ...")
+		fmt.Fprintln(stderr, "usage: devrites-engine check <candidate|readiness|seal|path-disjoint|task-graph|skill-trust> ...")
 		return exitUsage
 	}
 	sub, rest := args[0], args[1:]
@@ -99,6 +114,12 @@ func cmdCheck(args []string, stdout, stderr io.Writer) int {
 		return cmdCandidate(rest, stdout, stderr)
 	case "readiness", "seal":
 		return cmdGate(gate.Kind(sub), rest, stdout, stderr)
+	case "path-disjoint":
+		return parallel.Run("path-disjoint", rest, stdin, stdout, stderr)
+	case "task-graph":
+		return cmdTaskGraph(root, rest, stdout, stderr)
+	case "skill-trust":
+		return cmdSkillTrust(rest, stdout, stderr)
 	default:
 		fmt.Fprintf(stderr, "devrites: unknown check %q\n", sub)
 		return exitUsage
@@ -185,3 +206,55 @@ func cmdGate(kind gate.Kind, args []string, stdout, stderr io.Writer) int {
 	fmt.Fprint(stdout, result.Render())
 	return exitOK
 }
+
+func cmdTaskGraph(root string, args []string, stdout, stderr io.Writer) int {
+	if len(args) != 1 {
+		fmt.Fprintln(stderr, "usage: devrites-engine check task-graph <slug>")
+		return exitUsage
+	}
+	if root == "" {
+		var err error
+		root, err = state.ResolveRoot(os.Getenv("DEVRITES_ROOT"))
+		if err != nil {
+			fmt.Fprintf(stderr, "devrites: %v\n", err)
+			return exitUsage
+		}
+	}
+	return lib.RunTaskGraphCheck(root, args[0], stdout, stderr)
+}
+
+func cmdSkillTrust(args []string, stdout, stderr io.Writer) int {
+	if len(args) != 1 {
+		fmt.Fprintln(stderr, "usage: devrites-engine check skill-trust <path>")
+		return exitUsage
+	}
+	return lib.RunSkillTrustCheck(args[0], stdout, stderr)
+}
+
+func cmdObserve(root string, args []string, stdout, stderr io.Writer) int {
+	if len(args) == 0 {
+		fmt.Fprintln(stderr, "usage: devrites-engine observe summary <slug>")
+		return exitUsage
+	}
+	if args[0] != "summary" {
+		fmt.Fprintf(stderr, "devrites: unknown observe command %q\n", args[0])
+		return exitUsage
+	}
+	if root == "" {
+		var err error
+		root, err = state.ResolveRoot(os.Getenv("DEVRITES_ROOT"))
+		if err != nil {
+			fmt.Fprintf(stderr, "devrites: %v\n", err)
+			return exitUsage
+		}
+	}
+	slug, code, err := lib.ActiveSlug(root, args[1:])
+	if err != nil {
+		fmt.Fprintf(stderr, "observe: %v\n", err)
+		if code == 0 {
+			code = exitUsage
+		}
+		return code
+	}
+	return lib.RunObserveSummary(root, slug, stdout, stderr)
+}