devrites 4.7.0 → 5.0.0

package/engine/internal/state/acceptance_test.go

@@ -0,0 +1,57 @@
+package state
+
+import (
+	"slices"
+	"testing"
+)
+
+func TestParseAcceptanceMapEmptySpecPasses(t *testing.T) {
+	got := ParseAcceptanceMap([]byte("# Spec\n\nReady.\n"), []byte("tasks"), []byte("plan"), true, true)
+	if len(got.SpecIDs) != 0 || len(got.Problems) != 0 {
+		t.Fatalf("ids=%v problems=%v", got.SpecIDs, got.Problems)
+	}
+}
+
+func TestParseAcceptanceMapRequiresTasksAndTestPlan(t *testing.T) {
+	spec := []byte("# Spec\n\n## Acceptance criteria\n- [ ] AC-001: export CSV\n- [ ] AC-002: reject cross-user\n")
+	tasks := []byte("# Tasks\nSatisfies: AC-001\n")
+	plan := []byte("# Test plan\nAC-001 → T1\n")
+	got := ParseAcceptanceMap(spec, tasks, plan, true, true)
+	if !slices.Equal(got.SpecIDs, []string{"AC-001", "AC-002"}) {
+		t.Fatalf("ids=%v", got.SpecIDs)
+	}
+	if !slices.Equal(got.Problems, []string{
+		"acceptance AC-002 is not referenced in tasks.md",
+		"acceptance AC-002 is not referenced in test-plan.md",
+	}) {
+		t.Fatalf("problems=%v", got.Problems)
+	}
+}
+
+func TestParseAcceptanceMapSkipsUnrequiredArtifacts(t *testing.T) {
+	spec := []byte("## Acceptance Criteria\n- AC-001: bind readiness inputs.\n")
+	got := ParseAcceptanceMap(spec, nil, nil, false, false)
+	if !slices.Equal(got.SpecIDs, []string{"AC-001"}) || len(got.Problems) != 0 {
+		t.Fatalf("ids=%v problems=%v", got.SpecIDs, got.Problems)
+	}
+}
+
+func TestParseAcceptanceMapIgnoresNoncanonicalAndDuplicates(t *testing.T) {
+	spec := []byte("## Acceptance criteria\n- AC-001: one\n- AC1: ignored\n- AC-001: again\n")
+	tasks := []byte("Satisfies: AC-001\n")
+	plan := []byte("AC-001\n")
+	got := ParseAcceptanceMap(spec, tasks, plan, true, true)
+	if !slices.Equal(got.SpecIDs, []string{"AC-001"}) || len(got.Problems) != 0 {
+		t.Fatalf("ids=%v problems=%v", got.SpecIDs, got.Problems)
+	}
+}
+
+func TestParseAcceptanceMapStopsAtNextH2(t *testing.T) {
+	spec := []byte("## Acceptance criteria\n- AC-001: in section\n\n## Non-goals\n- AC-999: outside\n")
+	tasks := []byte("AC-001\n")
+	plan := []byte("AC-001\n")
+	got := ParseAcceptanceMap(spec, tasks, plan, true, true)
+	if !slices.Equal(got.SpecIDs, []string{"AC-001"}) || len(got.Problems) != 0 {
+		t.Fatalf("ids=%v problems=%v", got.SpecIDs, got.Problems)
+	}
+}

package/engine/internal/state/cursor.go

@@ -74,13 +74,26 @@ func CursorField(lines []string, key string) (string, bool) {
 }
 
 // SetCursorField replaces an existing state.md field without changing whether
-// the file uses the canonical table or legacy bullet form.
+// the file uses the canonical table or legacy bullet form. A value carrying a
+// raw pipe is declined (false) for table rows, and a value carrying a line
+// break is declined everywhere: neither is representable in a cell. A write
+// the reader cannot read back is declined too.
 func SetCursorField(lines []string, key, value string) ([]string, bool) {
+	if strings.ContainsAny(value, "\r\n") {
+		return append([]string(nil), lines...), false
+	}
 	structural, ok := structuralCursorLines(lines)
 	if !ok {
 		return append([]string(nil), lines...), false
 	}
-	return setCursorField(lines, structural, key, value)
+	out, ok := setCursorField(lines, structural, key, value)
+	if !ok {
+		return out, false
+	}
+	if !cursorReadable(out, key, value) {
+		return append([]string(nil), lines...), false
+	}
+	return out, true
 }
 
 func setCursorField(lines, structural []string, key, value string) ([]string, bool) {
@@ -94,6 +107,9 @@ func setCursorField(lines, structural []string, key, value string) ([]string, bo
 		original := out[i]
 		switch kind {
 		case cursorLineTable:
+			if strings.Contains(value, "|") {
+				return out, false
+			}
 			indent := original[:len(original)-len(strings.TrimLeft(original, " \t"))]
 			out[i] = indent + "| " + strings.TrimSpace(gotKey) + " | " + value + " |"
 		case cursorLineLegacy:
@@ -106,16 +122,41 @@ func setCursorField(lines, structural []string, key, value string) ([]string, bo
 }
 
 // UpsertCursorField replaces key when present or inserts it into the canonical
-// cursor table (falling back to a legacy bullet when no table exists).
+// cursor table (falling back to a legacy bullet when no table exists). A value
+// carrying a raw pipe keeps the legacy bullet form — a cell cannot represent
+// it — and a value carrying a line break is declined with the input returned
+// unchanged. Every write is verified readable before it is returned; an
+// unreadable write (for example, appending after an unclosed fence) leaves the
+// document unchanged.
 func UpsertCursorField(lines []string, key, value string) []string {
+	if strings.ContainsAny(value, "\r\n") {
+		return append([]string(nil), lines...)
+	}
 	structural, ok := structuralCursorLines(lines)
 	if !ok {
 		return append([]string(nil), lines...)
 	}
-	if out, ok := setCursorField(lines, structural, key, value); ok {
-		return out
+	var candidate []string
+	if strings.Contains(value, "|") {
+		candidate = append(DeleteCursorField(lines, key), "- "+key+": "+value)
+	} else if out, ok := setCursorField(lines, structural, key, value); ok {
+		candidate = out
+	} else if lastTable := lastCursorTableRow(structural); lastTable >= 0 {
+		candidate = append(append([]string(nil), lines...), "")
+		copy(candidate[lastTable+2:], candidate[lastTable+1:])
+		candidate[lastTable+1] = "| " + key + " | " + value + " |"
+	} else {
+		candidate = append(append([]string(nil), lines...), "- "+key+": "+value)
 	}
-	out := append([]string(nil), lines...)
+	if cursorReadable(candidate, key, value) {
+		return candidate
+	}
+	return append([]string(nil), lines...)
+}
+
+// lastCursorTableRow returns the index of the final table row inside the
+// Cursor section, or -1 when no table exists.
+func lastCursorTableRow(structural []string) int {
 	lastTable := -1
 	inCursor := false
 	for i, line := range structural {
@@ -140,14 +181,14 @@ func UpsertCursorField(lines []string, key, value string) []string {
 			}
 		}
 	}
-	if lastTable >= 0 {
-		insert := "| " + key + " | " + value + " |"
-		out = append(out, "")
-		copy(out[lastTable+2:], out[lastTable+1:])
-		out[lastTable+1] = insert
-		return out
-	}
-	return append(out, "- "+key+": "+value)
+	return lastTable
+}
+
+// cursorReadable reports whether key reads back as value from a candidate
+// document — the write side of parseCursorLine's cell normalization.
+func cursorReadable(lines []string, key, value string) bool {
+	got, ok := CursorField(lines, key)
+	return ok && got == strings.TrimSpace(value)
 }
 
 // DeleteCursorField removes every presentation of key from canonical or legacy

package/engine/internal/state/cursor_fuzz_test.go

@@ -0,0 +1,80 @@
+package state
+
+import (
+	"bytes"
+	"slices"
+	"strings"
+	"testing"
+	"unicode/utf8"
+)
+
+var cursorFuzzKeys = []string{
+	CursorPhase, CursorStatus, CursorNextAction, CursorQuestionID,
+	CursorActiveSlice, CursorAFKSlicesRemaining, CursorReturnPhase,
+	CursorReturnNextAction, CursorSchema,
+}
+
+func FuzzCursorRoundTrip(f *testing.F) {
+	f.Add(uint8(0), "spec", []byte("# Feature\n\n## Cursor\n\n| phase | init |\n| --- | --- |\n| status | running |"))
+	f.Add(uint8(1), "", []byte("- phase: spec\n- status: running"))
+	f.Add(uint8(8), "5", []byte("## Cursor\n\n| phase | init |"))
+	f.Add(uint8(2), "a|b", []byte("| status | running |"))
+	f.Add(uint8(4), "two\nlines", []byte("| status | running |"))
+	f.Add(uint8(5), "value with spaces", []byte{})
+	f.Fuzz(func(t *testing.T, keyIndex uint8, value string, doc []byte) {
+		// Docs and values with NUL bytes or invalid UTF-8 are outside the
+		// format: the read and write paths refuse them, so round-trip says
+		// nothing there.
+		if !utf8.Valid(doc) || bytes.IndexByte(doc, 0) >= 0 ||
+			!utf8.ValidString(value) || strings.IndexByte(value, 0) >= 0 {
+			return
+		}
+		key := cursorFuzzKeys[int(keyIndex)%len(cursorFuzzKeys)]
+		lines := strings.Split(string(doc), "\n")
+		upserted := UpsertCursorField(lines, key, value)
+		if strings.ContainsAny(value, "\r\n") {
+			// Line breaks are representable in no form: the write must be
+			// declined with the document unchanged.
+			if !slices.Equal(upserted, lines) {
+				t.Fatal("newline value was not declined unchanged")
+			}
+			return
+		}
+		// The upsert contract: either the document is unchanged, or the value
+		// is readable from the result.
+		got, ok := CursorField(upserted, key)
+		if !slices.Equal(upserted, lines) && (!ok || got != strings.TrimSpace(value)) {
+			t.Fatalf("upsert changed the document but %q is not readable (got %q, ok %v)", value, got, ok)
+		}
+		deleted := DeleteCursorField(upserted, key)
+		if _, ok := CursorField(deleted, key); ok {
+			t.Fatalf("deleted key %q still readable", key)
+		}
+		replaced, ok := SetCursorField(upserted, key, value)
+		if ok {
+			got, ok := CursorField(replaced, key)
+			if !ok || got != strings.TrimSpace(value) {
+				t.Fatalf("set %q not readable (got %q, ok %v)", value, got, ok)
+			}
+		}
+	})
+}
+
+func FuzzCursorParsing(f *testing.F) {
+	f.Add([]byte("| phase | spec |"), "phase", "x")
+	f.Add([]byte("```\n| q | a |\n```"), "qid", "y")
+	f.Add([]byte("- nextstep: run"), "next_action", "z")
+	f.Add([]byte("## Cursor\n\n| a | b | extra |"), "", "")
+	f.Fuzz(func(t *testing.T, doc []byte, key, value string) {
+		if !utf8.Valid(doc) || bytes.IndexByte(doc, 0) >= 0 {
+			return
+		}
+		lines := strings.Split(string(doc), "\n")
+		_, _ = CursorField(lines, key)
+		_ = CursorForm(lines)
+		out, _ := SetCursorField(lines, key, value)
+		out = UpsertCursorField(out, key, value)
+		_ = DeleteCursorField(out, key)
+		_, _ = ConvertCursorToTable(lines)
+	})
+}

package/engine/internal/state/lock_unix.go

@@ -14,6 +14,7 @@ import (
 type fileLock struct{ f *os.File }
 
 func acquireLock(path string) (*fileLock, error) {
+	// #nosec G304 -- feature lock file inside the workspace .devrites tree
 	f, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o644)
 	if err != nil {
 		return nil, fmt.Errorf("acquire lock: %w", err)

package/engine/internal/state/observation.go

@@ -253,8 +253,8 @@ func observeWorkspace(root, slug string, callback observationCallback) (*Workspa
 	if err != nil {
 		return nil, ObservationWorkspaceInvalid
 	}
-	defer roots.devrites.Close()
-	defer roots.workspace.Close()
+	defer func() { _ = roots.devrites.Close() }()
+	defer func() { _ = roots.workspace.Close() }()
 
 	inventory := observationInventory()
 	facts := make([]ArtifactFact, 0, len(inventory))
@@ -456,7 +456,7 @@ func observeArtifact(location artifactLocation, callback observationCallback) (A
 	if err != nil {
 		return artifactFailureResult(location.path, snapshot, artifactUnchanged(location, snapshot), err)
 	}
-	defer file.Close()
+	defer func() { _ = file.Close() }()
 
 	openedInfo, err := file.Stat()
 	if err != nil {

package/engine/internal/state/observation_test.go

@@ -336,7 +336,7 @@ func TestWorkspaceObservationSymlinkClassifiesParent(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer root.Close()
+	defer func() { _ = root.Close() }()
 
 	fact, _, err := observeArtifact(artifactLocation{
 		path: ArtifactPath("spec.md"),

package/engine/internal/state/taskgraph_fuzz_test.go

@@ -0,0 +1,38 @@
+package state
+
+import "testing"
+
+func FuzzTaskGraphParsing(f *testing.F) {
+	f.Add([]byte("## SLICE-1\n\nDependencies: none\n"))
+	f.Add([]byte("## SLICE-1\nDependencies: [SLICE-2]\n\n## SLICE-2\nDependencies: [SLICE-1]\n"))
+	f.Add([]byte("## SLICE-1\nDependencies: none\ndepends_on: SLICE-9\n"))
+	f.Add([]byte("## SLICE-1\n## SLICE-1\nDependencies: none\n"))
+	f.Add([]byte("## SLICE-1\nDependencies: [oops, SLICE-2]\n\n## SLICE-2\ndepends_on: [SLICE-1]\n"))
+	f.Add([]byte("## SLICE-42\nDependencies:\n"))
+	f.Add([]byte(""))
+	f.Fuzz(func(t *testing.T, doc []byte) {
+		result := ParseTaskGraph(doc)
+
+		known := make(map[string]bool, len(result.Slices))
+		for _, slice := range result.Slices {
+			if !sliceIDValidRE.MatchString(slice.ID) {
+				t.Fatalf("slice id %q does not satisfy the id grammar", slice.ID)
+			}
+			if known[slice.ID] {
+				t.Fatalf("slice id %q emitted twice", slice.ID)
+			}
+			known[slice.ID] = true
+		}
+		unknown := make(map[string]bool, len(result.Unknown))
+		for _, dep := range result.Unknown {
+			unknown[dep] = true
+		}
+		for _, slice := range result.Slices {
+			for _, dep := range slice.Dependencies {
+				if !known[dep] && !unknown[dep] {
+					t.Fatalf("slice %s depends on %q which is neither defined nor reported unknown", slice.ID, dep)
+				}
+			}
+		}
+	})
+}

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/114b28f68c1fa4db

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\x00')
+string("0")
+[]byte("```")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/378a0f2218e812ea

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\x10')
+string("\r|")
+[]byte("0")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/39eaa26fcb481e3c

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\x05')
+string("\xe4")
+[]byte("")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/776ca1dc0143acf0

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\b')
+string(" ")
+[]byte("0")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/9295930c1ebb81df

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('ñ')
+string("|")
+[]byte("```")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/a60de309dc33be0d

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\b')
+string("\n")
+[]byte("0")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/f04dc7b06ef7c99f

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\x12')
+string("\x00")
+[]byte("0")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/f3000ac510878bd6

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\x05')
+string("0")
+[]byte("\x8e")

package/engine/internal/state/testdata/fuzz/FuzzWorkspaceSchemaRow/a75aabb9f2a847d5

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("sChemA:1")

package/engine/internal/state/workspaceschema_fuzz_test.go

@@ -0,0 +1,27 @@
+package state
+
+import (
+	"strings"
+	"testing"
+)
+
+func FuzzWorkspaceSchemaRow(f *testing.F) {
+	f.Add([]byte("| schema | 5 |"))
+	f.Add([]byte("- schema: 2"))
+	f.Add([]byte("| schema | abc |"))
+	f.Add([]byte("| schema | 0 |"))
+	f.Add([]byte("## Cursor\n\n| key | value |"))
+	f.Add([]byte("```\n| schema | 7 |\n```"))
+	f.Fuzz(func(t *testing.T, doc []byte) {
+		version, err := workspaceSchemaRow(strings.Split(string(doc), "\n"))
+		if err != nil {
+			if version != 0 {
+				t.Fatalf("error result carries version %d", version)
+			}
+			return
+		}
+		if version < 1 {
+			t.Fatalf("success with non-positive version %d", version)
+		}
+	})
+}

package/engine/internal/state/write.go

@@ -29,11 +29,12 @@ func AppendLog(path, record string) error {
 	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 		return fmt.Errorf("append log %s: %w", path, err)
 	}
+	// #nosec G304 -- workspace artifact path inside the .devrites tree
 	f, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o644)
 	if err != nil {
 		return fmt.Errorf("append log %s: %w", path, err)
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 	if _, err := f.WriteString(strings.TrimRight(record, "\n") + "\n"); err != nil {
 		return fmt.Errorf("append log %s: %w", path, err)
 	}
@@ -54,6 +55,6 @@ func WithFeatureLock(root, slug string, fn func() error) error {
 	if err != nil {
 		return fmt.Errorf("lock feature %q: %w", slug, err)
 	}
-	defer l.release()
+	defer func() { _ = l.release() }()
 	return fn()
 }

package/engine/internal/testutil/testutil.go

@@ -8,7 +8,7 @@ import (
 )
 
 // CanonicalTasksMarkdown is a minimal valid slice graph for gate fixtures.
-const CanonicalTasksMarkdown = "# Tasks\n\n## SLICE-001 Ready\nDependencies: none\n"
+const CanonicalTasksMarkdown = "# Tasks\n\n## SLICE-001 Ready\nSatisfies: AC-001\nDependencies: none\n"
 
 // CopyTree recursively copies the directory tree at src into dst, creating dst
 // and any parents. It is used to give each test an isolated, writable copy of a
@@ -48,11 +48,12 @@ func WriteFileMode(t *testing.T, path, data string, perm os.FileMode) {
 // missing or unwritable.
 func AppendFile(t *testing.T, path, data string) {
 	t.Helper()
+	// #nosec G304 -- test fixture path under t.TempDir()
 	f, err := os.OpenFile(path, os.O_APPEND|os.O_WRONLY, 0o644)
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 	if _, err := f.WriteString(data); err != nil {
 		t.Fatal(err)
 	}
@@ -61,6 +62,7 @@ func AppendFile(t *testing.T, path, data string) {
 // ReadFile returns the contents of path, failing the test on any error.
 func ReadFile(t *testing.T, path string) string {
 	t.Helper()
+	// #nosec G304 -- test fixture path under t.TempDir()
 	data, err := os.ReadFile(path)
 	if err != nil {
 		t.Fatal(err)

package/engine/main.go

@@ -29,6 +29,8 @@ Usage:
   devrites-engine check task-graph <slug>  Validate tasks.md slice dependency graph
   devrites-engine check skill-trust <path> Scan one skill/agent Markdown for trust violations
   devrites-engine observe summary <slug>   Emit sanitized JSON workspace summary
+  devrites-engine orient <slug>            Alias for observe summary
+  devrites-engine check indexes [--root <dir>]  Report manifest and code-index presence as JSON
   devrites-engine parallel <subcommand>   Deterministic parallel worktree lease/create/integrate/cleanup
   devrites-engine state resolve <qid> "<ans>"  Resolve an open question and update state atomically
   devrites-engine state close <slug>       Archive a shipped feature and clear ACTIVE
@@ -85,6 +87,8 @@ func run(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 		return parallel.Run("parallel", args[1:], stdin, stdout, stderr)
 	case "observe":
 		return cmdObserve(root, args[1:], stdout, stderr)
+	case "orient":
+		return cmdOrient(root, args[1:], stdout, stderr)
 	case "state":
 		return cmdState(root, args[1:], stdout, stderr)
 	case "migrate":
@@ -107,7 +111,7 @@ func run(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 
 func cmdCheck(root string, args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 	if len(args) == 0 {
-		fmt.Fprintln(stderr, "usage: devrites-engine check <candidate|readiness|seal|path-disjoint|task-graph|skill-trust> ...")
+		fmt.Fprintln(stderr, "usage: devrites-engine check <candidate|readiness|seal|path-disjoint|task-graph|skill-trust|indexes> ...")
 		return exitUsage
 	}
 	sub, rest := args[0], args[1:]
@@ -122,6 +126,8 @@ func cmdCheck(root string, args []string, stdin io.Reader, stdout, stderr io.Wri
 		return cmdTaskGraph(root, rest, stdout, stderr)
 	case "skill-trust":
 		return cmdSkillTrust(rest, stdout, stderr)
+	case "indexes":
+		return lib.RunEnvironmentCheck(root, rest, stdout, stderr)
 	default:
 		fmt.Fprintf(stderr, "devrites: unknown check %q\n", sub)
 		return exitUsage
@@ -234,3 +240,15 @@ func cmdObserve(root string, args []string, stdout, stderr io.Writer) int {
 	}
 	return lib.RunObserveSummary(root, slug, stdout, stderr)
 }
+
+func cmdOrient(root string, args []string, stdout, stderr io.Writer) int {
+	slug, code, err := lib.ActiveSlug(root, args)
+	if err != nil {
+		fmt.Fprintf(stderr, "orient: %v\n", err)
+		if code == 0 {
+			code = exitUsage
+		}
+		return code
+	}
+	return lib.RunObserveSummary(root, slug, stdout, stderr)
+}