devrites 4.7.0 → 5.1.0

package/engine/internal/release/release.go

@@ -164,7 +164,7 @@ func fetchJSON(ctx context.Context, rawURL string, out any) error {
 	if err != nil {
 		return err
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode < 200 || resp.StatusCode > 299 {
 		return fmt.Errorf("%s returned %s", resp.Request.URL.Redacted(), resp.Status)
 	}
@@ -192,6 +192,7 @@ func downloadVerified(ctx context.Context, rawURL, destination, filename string,
 	if err := download(ctx, rawURL+".sha256", sumPath, maxChecksumBytes, 0o600); err != nil {
 		return fmt.Errorf("missing checksum for %s: %w", filename, err)
 	}
+	// #nosec G304 -- checksum downloaded into the self-update temp dir
 	sum, err := os.ReadFile(sumPath)
 	if err != nil {
 		return fmt.Errorf("read checksum for %s: %w", filename, err)
@@ -204,6 +205,7 @@ func downloadVerified(ctx context.Context, rawURL, destination, filename string,
 	if err != nil || len(want) != sha256.Size {
 		return fmt.Errorf("invalid SHA-256 for %s", filename)
 	}
+	// #nosec G304 -- downloaded release asset in the self-update temp dir
 	file, err := os.Open(destination)
 	if err != nil {
 		return fmt.Errorf("open %s for checksum: %w", filename, err)
@@ -228,7 +230,7 @@ func download(ctx context.Context, rawURL, destination string, maxBytes int64, m
 	if err != nil {
 		return err
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode < 200 || resp.StatusCode > 299 {
 		return fmt.Errorf("%s returned %s", resp.Request.URL.Redacted(), resp.Status)
 	}
@@ -338,16 +340,17 @@ func extractBundle(archive, destination, tag string) (string, error) {
 }
 
 func extractTarGz(archive, destination string) error {
+	// #nosec G304 -- downloaded release archive in the self-update temp dir
 	file, err := os.Open(archive)
 	if err != nil {
 		return fmt.Errorf("open archive: %w", err)
 	}
-	defer file.Close()
+	defer func() { _ = file.Close() }()
 	gz, err := gzip.NewReader(file)
 	if err != nil {
 		return fmt.Errorf("open gzip stream: %w", err)
 	}
-	defer gz.Close()
+	defer func() { _ = gz.Close() }()
 	reader := tar.NewReader(gz)
 	root, err := filepath.Abs(destination)
 	if err != nil {
@@ -389,6 +392,7 @@ func extractTarGz(archive, destination string) error {
 			if err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil {
 				return fmt.Errorf("create directory for %s: %w", name, err)
 			}
+			// #nosec G304 -- tar member name ValidPath-checked and confined to the extraction root above
 			out, err := os.OpenFile(target, os.O_CREATE|os.O_EXCL|os.O_WRONLY, mode)
 			if err != nil {
 				return fmt.Errorf("create %s: %w", name, err)

package/engine/internal/rootfacts/facts.go

@@ -299,6 +299,7 @@ func inspectWorkspaceState(facts *Facts) {
 		})
 		return
 	}
+	// #nosec G304 -- workspace ACTIVE path; symlink policy enforced by state.ResolveRoot
 	raw, err := os.ReadFile(activePath)
 	if err != nil {
 		return
@@ -349,6 +350,7 @@ func probeGit(dir string) GitFacts {
 func gitPath(dir, flag string) (string, bool) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
+	// #nosec G204 -- git -C <operator repo dir>, fixed args, sanitized env
 	cmd := exec.CommandContext(ctx, "git", "-C", dir, "rev-parse", "--path-format=absolute", flag)
 	cmd.Env = append(gitenv.Sanitize(os.Environ()), "GIT_OPTIONAL_LOCKS=0", "GIT_TERMINAL_PROMPT=0")
 	out, err := cmd.Output()
@@ -441,6 +443,7 @@ func within(candidate, parent string) bool {
 }
 
 func isDir(path string) bool {
+	// #nosec G703 -- existence probe on a safepath-resolved candidate
 	info, err := os.Stat(path)
 	return err == nil && info.IsDir()
 }

package/engine/internal/safepath/safepath_fuzz_test.go

@@ -0,0 +1,21 @@
+package safepath
+
+import "testing"
+
+func FuzzWithinResolved(f *testing.F) {
+	f.Add("child/file.txt", "/tmp/parent")
+	f.Add("..", "/tmp/parent")
+	f.Add("", "")
+	f.Fuzz(func(t *testing.T, candidate, parent string) {
+		_ = WithinResolved(candidate, parent)
+	})
+}
+
+func FuzzResolveExisting(f *testing.F) {
+	f.Add("/tmp/example")
+	f.Add("relative/path")
+	f.Add("")
+	f.Fuzz(func(t *testing.T, filename string) {
+		_, _ = ResolveExisting(filename)
+	})
+}

package/engine/internal/state/acceptance.go

@@ -0,0 +1,87 @@
+package state
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+var (
+	acceptanceHeadingRE = regexp.MustCompile(`(?i)^##\s+Acceptance criteria\s*$`)
+	canonicalACRE       = regexp.MustCompile(`\bAC-\d{3}\b`)
+	h2HeadingRE         = regexp.MustCompile(`^##\s+`)
+)
+
+// AcceptanceMapResult is the deterministic ID-presence check from spec.md
+// onto tasks.md and test-plan.md. It does not judge coverage quality.
+type AcceptanceMapResult struct {
+	SpecIDs  []string
+	Problems []string
+}
+
+// ParseAcceptanceMap extracts canonical AC-### IDs from spec.md's Acceptance
+// criteria section and requires each to appear as a literal substring in the
+// required planning artifacts.
+func ParseAcceptanceMap(spec, tasks, testPlan []byte, requireTasks, requireTestPlan bool) AcceptanceMapResult {
+	ids := uniqueCanonicalACs(acceptanceSection(spec))
+	result := AcceptanceMapResult{SpecIDs: ids}
+	if len(ids) == 0 {
+		return result
+	}
+	if requireTasks {
+		text := string(tasks)
+		for _, id := range ids {
+			if !strings.Contains(text, id) {
+				result.Problems = append(result.Problems, fmt.Sprintf("acceptance %s is not referenced in tasks.md", id))
+			}
+		}
+	}
+	if requireTestPlan {
+		text := string(testPlan)
+		for _, id := range ids {
+			if !strings.Contains(text, id) {
+				result.Problems = append(result.Problems, fmt.Sprintf("acceptance %s is not referenced in test-plan.md", id))
+			}
+		}
+	}
+	return result
+}
+
+func acceptanceSection(spec []byte) string {
+	lines := strings.Split(strings.ReplaceAll(string(spec), "\r\n", "\n"), "\n")
+	start := -1
+	for i, line := range lines {
+		if acceptanceHeadingRE.MatchString(strings.TrimSpace(line)) {
+			start = i + 1
+			break
+		}
+	}
+	if start < 0 {
+		return ""
+	}
+	end := len(lines)
+	for i := start; i < len(lines); i++ {
+		if h2HeadingRE.MatchString(lines[i]) {
+			end = i
+			break
+		}
+	}
+	return strings.Join(lines[start:end], "\n")
+}
+
+func uniqueCanonicalACs(text string) []string {
+	found := canonicalACRE.FindAllString(text, -1)
+	if len(found) == 0 {
+		return nil
+	}
+	seen := make(map[string]bool, len(found))
+	var ids []string
+	for _, id := range found {
+		if seen[id] {
+			continue
+		}
+		seen[id] = true
+		ids = append(ids, id)
+	}
+	return ids
+}

package/engine/internal/state/acceptance_test.go

@@ -0,0 +1,57 @@
+package state
+
+import (
+	"slices"
+	"testing"
+)
+
+func TestParseAcceptanceMapEmptySpecPasses(t *testing.T) {
+	got := ParseAcceptanceMap([]byte("# Spec\n\nReady.\n"), []byte("tasks"), []byte("plan"), true, true)
+	if len(got.SpecIDs) != 0 || len(got.Problems) != 0 {
+		t.Fatalf("ids=%v problems=%v", got.SpecIDs, got.Problems)
+	}
+}
+
+func TestParseAcceptanceMapRequiresTasksAndTestPlan(t *testing.T) {
+	spec := []byte("# Spec\n\n## Acceptance criteria\n- [ ] AC-001: export CSV\n- [ ] AC-002: reject cross-user\n")
+	tasks := []byte("# Tasks\nSatisfies: AC-001\n")
+	plan := []byte("# Test plan\nAC-001 → T1\n")
+	got := ParseAcceptanceMap(spec, tasks, plan, true, true)
+	if !slices.Equal(got.SpecIDs, []string{"AC-001", "AC-002"}) {
+		t.Fatalf("ids=%v", got.SpecIDs)
+	}
+	if !slices.Equal(got.Problems, []string{
+		"acceptance AC-002 is not referenced in tasks.md",
+		"acceptance AC-002 is not referenced in test-plan.md",
+	}) {
+		t.Fatalf("problems=%v", got.Problems)
+	}
+}
+
+func TestParseAcceptanceMapSkipsUnrequiredArtifacts(t *testing.T) {
+	spec := []byte("## Acceptance Criteria\n- AC-001: bind readiness inputs.\n")
+	got := ParseAcceptanceMap(spec, nil, nil, false, false)
+	if !slices.Equal(got.SpecIDs, []string{"AC-001"}) || len(got.Problems) != 0 {
+		t.Fatalf("ids=%v problems=%v", got.SpecIDs, got.Problems)
+	}
+}
+
+func TestParseAcceptanceMapIgnoresNoncanonicalAndDuplicates(t *testing.T) {
+	spec := []byte("## Acceptance criteria\n- AC-001: one\n- AC1: ignored\n- AC-001: again\n")
+	tasks := []byte("Satisfies: AC-001\n")
+	plan := []byte("AC-001\n")
+	got := ParseAcceptanceMap(spec, tasks, plan, true, true)
+	if !slices.Equal(got.SpecIDs, []string{"AC-001"}) || len(got.Problems) != 0 {
+		t.Fatalf("ids=%v problems=%v", got.SpecIDs, got.Problems)
+	}
+}
+
+func TestParseAcceptanceMapStopsAtNextH2(t *testing.T) {
+	spec := []byte("## Acceptance criteria\n- AC-001: in section\n\n## Non-goals\n- AC-999: outside\n")
+	tasks := []byte("AC-001\n")
+	plan := []byte("AC-001\n")
+	got := ParseAcceptanceMap(spec, tasks, plan, true, true)
+	if !slices.Equal(got.SpecIDs, []string{"AC-001"}) || len(got.Problems) != 0 {
+		t.Fatalf("ids=%v problems=%v", got.SpecIDs, got.Problems)
+	}
+}

package/engine/internal/state/cursor.go

@@ -74,13 +74,26 @@ func CursorField(lines []string, key string) (string, bool) {
 }
 
 // SetCursorField replaces an existing state.md field without changing whether
-// the file uses the canonical table or legacy bullet form.
+// the file uses the canonical table or legacy bullet form. A value carrying a
+// raw pipe is declined (false) for table rows, and a value carrying a line
+// break is declined everywhere: neither is representable in a cell. A write
+// the reader cannot read back is declined too.
 func SetCursorField(lines []string, key, value string) ([]string, bool) {
+	if strings.ContainsAny(value, "\r\n") {
+		return append([]string(nil), lines...), false
+	}
 	structural, ok := structuralCursorLines(lines)
 	if !ok {
 		return append([]string(nil), lines...), false
 	}
-	return setCursorField(lines, structural, key, value)
+	out, ok := setCursorField(lines, structural, key, value)
+	if !ok {
+		return out, false
+	}
+	if !cursorReadable(out, key, value) {
+		return append([]string(nil), lines...), false
+	}
+	return out, true
 }
 
 func setCursorField(lines, structural []string, key, value string) ([]string, bool) {
@@ -94,6 +107,9 @@ func setCursorField(lines, structural []string, key, value string) ([]string, bo
 		original := out[i]
 		switch kind {
 		case cursorLineTable:
+			if strings.Contains(value, "|") {
+				return out, false
+			}
 			indent := original[:len(original)-len(strings.TrimLeft(original, " \t"))]
 			out[i] = indent + "| " + strings.TrimSpace(gotKey) + " | " + value + " |"
 		case cursorLineLegacy:
@@ -106,16 +122,41 @@ func setCursorField(lines, structural []string, key, value string) ([]string, bo
 }
 
 // UpsertCursorField replaces key when present or inserts it into the canonical
-// cursor table (falling back to a legacy bullet when no table exists).
+// cursor table (falling back to a legacy bullet when no table exists). A value
+// carrying a raw pipe keeps the legacy bullet form — a cell cannot represent
+// it — and a value carrying a line break is declined with the input returned
+// unchanged. Every write is verified readable before it is returned; an
+// unreadable write (for example, appending after an unclosed fence) leaves the
+// document unchanged.
 func UpsertCursorField(lines []string, key, value string) []string {
+	if strings.ContainsAny(value, "\r\n") {
+		return append([]string(nil), lines...)
+	}
 	structural, ok := structuralCursorLines(lines)
 	if !ok {
 		return append([]string(nil), lines...)
 	}
-	if out, ok := setCursorField(lines, structural, key, value); ok {
-		return out
+	var candidate []string
+	if strings.Contains(value, "|") {
+		candidate = append(DeleteCursorField(lines, key), "- "+key+": "+value)
+	} else if out, ok := setCursorField(lines, structural, key, value); ok {
+		candidate = out
+	} else if lastTable := lastCursorTableRow(structural); lastTable >= 0 {
+		candidate = append(append([]string(nil), lines...), "")
+		copy(candidate[lastTable+2:], candidate[lastTable+1:])
+		candidate[lastTable+1] = "| " + key + " | " + value + " |"
+	} else {
+		candidate = append(append([]string(nil), lines...), "- "+key+": "+value)
 	}
-	out := append([]string(nil), lines...)
+	if cursorReadable(candidate, key, value) {
+		return candidate
+	}
+	return append([]string(nil), lines...)
+}
+
+// lastCursorTableRow returns the index of the final table row inside the
+// Cursor section, or -1 when no table exists.
+func lastCursorTableRow(structural []string) int {
 	lastTable := -1
 	inCursor := false
 	for i, line := range structural {
@@ -140,14 +181,14 @@ func UpsertCursorField(lines []string, key, value string) []string {
 			}
 		}
 	}
-	if lastTable >= 0 {
-		insert := "| " + key + " | " + value + " |"
-		out = append(out, "")
-		copy(out[lastTable+2:], out[lastTable+1:])
-		out[lastTable+1] = insert
-		return out
-	}
-	return append(out, "- "+key+": "+value)
+	return lastTable
+}
+
+// cursorReadable reports whether key reads back as value from a candidate
+// document — the write side of parseCursorLine's cell normalization.
+func cursorReadable(lines []string, key, value string) bool {
+	got, ok := CursorField(lines, key)
+	return ok && got == strings.TrimSpace(value)
 }
 
 // DeleteCursorField removes every presentation of key from canonical or legacy

package/engine/internal/state/cursor_fuzz_test.go

@@ -0,0 +1,80 @@
+package state
+
+import (
+	"bytes"
+	"slices"
+	"strings"
+	"testing"
+	"unicode/utf8"
+)
+
+var cursorFuzzKeys = []string{
+	CursorPhase, CursorStatus, CursorNextAction, CursorQuestionID,
+	CursorActiveSlice, CursorAFKSlicesRemaining, CursorReturnPhase,
+	CursorReturnNextAction, CursorSchema,
+}
+
+func FuzzCursorRoundTrip(f *testing.F) {
+	f.Add(uint8(0), "spec", []byte("# Feature\n\n## Cursor\n\n| phase | init |\n| --- | --- |\n| status | running |"))
+	f.Add(uint8(1), "", []byte("- phase: spec\n- status: running"))
+	f.Add(uint8(8), "5", []byte("## Cursor\n\n| phase | init |"))
+	f.Add(uint8(2), "a|b", []byte("| status | running |"))
+	f.Add(uint8(4), "two\nlines", []byte("| status | running |"))
+	f.Add(uint8(5), "value with spaces", []byte{})
+	f.Fuzz(func(t *testing.T, keyIndex uint8, value string, doc []byte) {
+		// Docs and values with NUL bytes or invalid UTF-8 are outside the
+		// format: the read and write paths refuse them, so round-trip says
+		// nothing there.
+		if !utf8.Valid(doc) || bytes.IndexByte(doc, 0) >= 0 ||
+			!utf8.ValidString(value) || strings.IndexByte(value, 0) >= 0 {
+			return
+		}
+		key := cursorFuzzKeys[int(keyIndex)%len(cursorFuzzKeys)]
+		lines := strings.Split(string(doc), "\n")
+		upserted := UpsertCursorField(lines, key, value)
+		if strings.ContainsAny(value, "\r\n") {
+			// Line breaks are representable in no form: the write must be
+			// declined with the document unchanged.
+			if !slices.Equal(upserted, lines) {
+				t.Fatal("newline value was not declined unchanged")
+			}
+			return
+		}
+		// The upsert contract: either the document is unchanged, or the value
+		// is readable from the result.
+		got, ok := CursorField(upserted, key)
+		if !slices.Equal(upserted, lines) && (!ok || got != strings.TrimSpace(value)) {
+			t.Fatalf("upsert changed the document but %q is not readable (got %q, ok %v)", value, got, ok)
+		}
+		deleted := DeleteCursorField(upserted, key)
+		if _, ok := CursorField(deleted, key); ok {
+			t.Fatalf("deleted key %q still readable", key)
+		}
+		replaced, ok := SetCursorField(upserted, key, value)
+		if ok {
+			got, ok := CursorField(replaced, key)
+			if !ok || got != strings.TrimSpace(value) {
+				t.Fatalf("set %q not readable (got %q, ok %v)", value, got, ok)
+			}
+		}
+	})
+}
+
+func FuzzCursorParsing(f *testing.F) {
+	f.Add([]byte("| phase | spec |"), "phase", "x")
+	f.Add([]byte("```\n| q | a |\n```"), "qid", "y")
+	f.Add([]byte("- nextstep: run"), "next_action", "z")
+	f.Add([]byte("## Cursor\n\n| a | b | extra |"), "", "")
+	f.Fuzz(func(t *testing.T, doc []byte, key, value string) {
+		if !utf8.Valid(doc) || bytes.IndexByte(doc, 0) >= 0 {
+			return
+		}
+		lines := strings.Split(string(doc), "\n")
+		_, _ = CursorField(lines, key)
+		_ = CursorForm(lines)
+		out, _ := SetCursorField(lines, key, value)
+		out = UpsertCursorField(out, key, value)
+		_ = DeleteCursorField(out, key)
+		_, _ = ConvertCursorToTable(lines)
+	})
+}

package/engine/internal/state/lock_unix.go

@@ -14,6 +14,7 @@ import (
 type fileLock struct{ f *os.File }
 
 func acquireLock(path string) (*fileLock, error) {
+	// #nosec G304 -- feature lock file inside the workspace .devrites tree
 	f, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o644)
 	if err != nil {
 		return nil, fmt.Errorf("acquire lock: %w", err)

package/engine/internal/state/observation.go

@@ -253,8 +253,8 @@ func observeWorkspace(root, slug string, callback observationCallback) (*Workspa
 	if err != nil {
 		return nil, ObservationWorkspaceInvalid
 	}
-	defer roots.devrites.Close()
-	defer roots.workspace.Close()
+	defer func() { _ = roots.devrites.Close() }()
+	defer func() { _ = roots.workspace.Close() }()
 
 	inventory := observationInventory()
 	facts := make([]ArtifactFact, 0, len(inventory))
@@ -456,7 +456,7 @@ func observeArtifact(location artifactLocation, callback observationCallback) (A
 	if err != nil {
 		return artifactFailureResult(location.path, snapshot, artifactUnchanged(location, snapshot), err)
 	}
-	defer file.Close()
+	defer func() { _ = file.Close() }()
 
 	openedInfo, err := file.Stat()
 	if err != nil {

package/engine/internal/state/observation_test.go

@@ -336,7 +336,7 @@ func TestWorkspaceObservationSymlinkClassifiesParent(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer root.Close()
+	defer func() { _ = root.Close() }()
 
 	fact, _, err := observeArtifact(artifactLocation{
 		path: ArtifactPath("spec.md"),

package/engine/internal/state/taskgraph_fuzz_test.go

@@ -0,0 +1,38 @@
+package state
+
+import "testing"
+
+func FuzzTaskGraphParsing(f *testing.F) {
+	f.Add([]byte("## SLICE-1\n\nDependencies: none\n"))
+	f.Add([]byte("## SLICE-1\nDependencies: [SLICE-2]\n\n## SLICE-2\nDependencies: [SLICE-1]\n"))
+	f.Add([]byte("## SLICE-1\nDependencies: none\ndepends_on: SLICE-9\n"))
+	f.Add([]byte("## SLICE-1\n## SLICE-1\nDependencies: none\n"))
+	f.Add([]byte("## SLICE-1\nDependencies: [oops, SLICE-2]\n\n## SLICE-2\ndepends_on: [SLICE-1]\n"))
+	f.Add([]byte("## SLICE-42\nDependencies:\n"))
+	f.Add([]byte(""))
+	f.Fuzz(func(t *testing.T, doc []byte) {
+		result := ParseTaskGraph(doc)
+
+		known := make(map[string]bool, len(result.Slices))
+		for _, slice := range result.Slices {
+			if !sliceIDValidRE.MatchString(slice.ID) {
+				t.Fatalf("slice id %q does not satisfy the id grammar", slice.ID)
+			}
+			if known[slice.ID] {
+				t.Fatalf("slice id %q emitted twice", slice.ID)
+			}
+			known[slice.ID] = true
+		}
+		unknown := make(map[string]bool, len(result.Unknown))
+		for _, dep := range result.Unknown {
+			unknown[dep] = true
+		}
+		for _, slice := range result.Slices {
+			for _, dep := range slice.Dependencies {
+				if !known[dep] && !unknown[dep] {
+					t.Fatalf("slice %s depends on %q which is neither defined nor reported unknown", slice.ID, dep)
+				}
+			}
+		}
+	})
+}

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/114b28f68c1fa4db

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\x00')
+string("0")
+[]byte("```")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/378a0f2218e812ea

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\x10')
+string("\r|")
+[]byte("0")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/39eaa26fcb481e3c

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\x05')
+string("\xe4")
+[]byte("")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/776ca1dc0143acf0

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\b')
+string(" ")
+[]byte("0")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/9295930c1ebb81df

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('ñ')
+string("|")
+[]byte("```")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/a60de309dc33be0d

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\b')
+string("\n")
+[]byte("0")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/f04dc7b06ef7c99f

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\x12')
+string("\x00")
+[]byte("0")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/f3000ac510878bd6

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\x05')
+string("0")
+[]byte("\x8e")

package/engine/internal/state/testdata/fuzz/FuzzWorkspaceSchemaRow/a75aabb9f2a847d5

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("sChemA:1")

package/engine/internal/state/workspaceschema_fuzz_test.go

@@ -0,0 +1,27 @@
+package state
+
+import (
+	"strings"
+	"testing"
+)
+
+func FuzzWorkspaceSchemaRow(f *testing.F) {
+	f.Add([]byte("| schema | 5 |"))
+	f.Add([]byte("- schema: 2"))
+	f.Add([]byte("| schema | abc |"))
+	f.Add([]byte("| schema | 0 |"))
+	f.Add([]byte("## Cursor\n\n| key | value |"))
+	f.Add([]byte("```\n| schema | 7 |\n```"))
+	f.Fuzz(func(t *testing.T, doc []byte) {
+		version, err := workspaceSchemaRow(strings.Split(string(doc), "\n"))
+		if err != nil {
+			if version != 0 {
+				t.Fatalf("error result carries version %d", version)
+			}
+			return
+		}
+		if version < 1 {
+			t.Fatalf("success with non-positive version %d", version)
+		}
+	})
+}

package/engine/internal/state/write.go

@@ -29,11 +29,12 @@ func AppendLog(path, record string) error {
 	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 		return fmt.Errorf("append log %s: %w", path, err)
 	}
+	// #nosec G304 -- workspace artifact path inside the .devrites tree
 	f, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o644)
 	if err != nil {
 		return fmt.Errorf("append log %s: %w", path, err)
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 	if _, err := f.WriteString(strings.TrimRight(record, "\n") + "\n"); err != nil {
 		return fmt.Errorf("append log %s: %w", path, err)
 	}
@@ -54,6 +55,6 @@ func WithFeatureLock(root, slug string, fn func() error) error {
 	if err != nil {
 		return fmt.Errorf("lock feature %q: %w", slug, err)
 	}
-	defer l.release()
+	defer func() { _ = l.release() }()
 	return fn()
 }

package/engine/internal/testutil/testutil.go

@@ -8,7 +8,7 @@ import (
 )
 
 // CanonicalTasksMarkdown is a minimal valid slice graph for gate fixtures.
-const CanonicalTasksMarkdown = "# Tasks\n\n## SLICE-001 Ready\nDependencies: none\n"
+const CanonicalTasksMarkdown = "# Tasks\n\n## SLICE-001 Ready\nSatisfies: AC-001\nDependencies: none\n"
 
 // CopyTree recursively copies the directory tree at src into dst, creating dst
 // and any parents. It is used to give each test an isolated, writable copy of a
@@ -48,11 +48,12 @@ func WriteFileMode(t *testing.T, path, data string, perm os.FileMode) {
 // missing or unwritable.
 func AppendFile(t *testing.T, path, data string) {
 	t.Helper()
+	// #nosec G304 -- test fixture path under t.TempDir()
 	f, err := os.OpenFile(path, os.O_APPEND|os.O_WRONLY, 0o644)
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 	if _, err := f.WriteString(data); err != nil {
 		t.Fatal(err)
 	}
@@ -61,6 +62,7 @@ func AppendFile(t *testing.T, path, data string) {
 // ReadFile returns the contents of path, failing the test on any error.
 func ReadFile(t *testing.T, path string) string {
 	t.Helper()
+	// #nosec G304 -- test fixture path under t.TempDir()
 	data, err := os.ReadFile(path)
 	if err != nil {
 		t.Fatal(err)