devrites 5.10.2 → 5.12.0

package/engine/internal/lib/regression_test.go

@@ -0,0 +1,179 @@
+package lib
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+const regressionTasks = `# Tasks
+
+| Slice | Outcome | Depends on |
+| --- | --- | --- |
+| SLICE-001 | first | none |
+| SLICE-002 | second | SLICE-001 |
+
+## SLICE-001 first
+Goal: one.
+Status: built
+
+## SLICE-002 second
+Goal: two.
+Status: pending
+`
+
+const regressionSpec = `# Spec
+
+## Acceptance criteria
+- [x] AC-001: first thing works
+- [ ] AC-002: second thing works
+`
+
+const regressionGates = `# Gates
+
+- [x] AC-001: first thing works
+  EVIDENCE: attested by reviewer
+- [ ] AC-002: second thing works
+  CHECK: go test ./...
+  EXPECT: ok
+  EVIDENCE: pending
+`
+
+const regressionQuestions = `# Questions
+
+## q-2026-01-01-001 pick a store
+status: answered
+answer: sqlite
+answered_at: 2026-01-02T00:00:00Z
+
+## q-2026-01-01-002 pick a cache
+status: open
+`
+
+func regressionWorkspace(t *testing.T, phase string) (root, featureDir string) {
+	t.Helper()
+	root, featureDir = newWorkspace(t, phase)
+	writeFile(t, filepath.Join(featureDir, "spec.md"), regressionSpec)
+	writeFile(t, filepath.Join(featureDir, "tasks.md"), regressionTasks)
+	writeFile(t, filepath.Join(featureDir, "gates.md"), regressionGates)
+	writeFile(t, filepath.Join(featureDir, "questions.md"), regressionQuestions)
+	return root, featureDir
+}
+
+func checkRegression(t *testing.T, root string, args ...string) (int, string) {
+	t.Helper()
+	stdout, stderr := &bytes.Buffer{}, &bytes.Buffer{}
+	code := RunCheckRegression(root, args, stdout, stderr)
+	return code, stdout.String() + stderr.String()
+}
+
+func TestRegressionUnprovenWithoutBaseline(t *testing.T) {
+	root, _ := regressionWorkspace(t, "build")
+	code, out := checkRegression(t, root, "feat")
+	if code != 0 || !strings.Contains(out, "unproven") {
+		t.Fatalf("code=%d out=%s", code, out)
+	}
+}
+
+func TestRegressionBaselineUpdateThenCleanPass(t *testing.T) {
+	root, _ := regressionWorkspace(t, "build")
+	code, out := checkRegression(t, root, "feat", "--update")
+	if code != 0 || !strings.Contains(out, "baseline updated") {
+		t.Fatalf("update code=%d out=%s", code, out)
+	}
+	code, out = checkRegression(t, root, "feat")
+	if code != 0 || !strings.Contains(out, "PASS") {
+		t.Fatalf("check code=%d out=%s", code, out)
+	}
+}
+
+func TestRegressionDetectsProgressLoss(t *testing.T) {
+	root, dir := regressionWorkspace(t, "prove")
+	if code, out := checkRegression(t, root, "feat", "--update"); code != 0 {
+		t.Fatalf("update code=%d out=%s", code, out)
+	}
+
+	writeFile(t, filepath.Join(dir, "spec.md"), `# Spec
+
+## Acceptance criteria
+- [ ] AC-001: first thing works
+- [ ] AC-002: second thing works
+`)
+	writeFile(t, filepath.Join(dir, "tasks.md"), strings.Replace(regressionTasks, "Status: built", "Status: in-progress", 1))
+	writeFile(t, filepath.Join(dir, "gates.md"), strings.Replace(regressionGates, "- [x] AC-001", "- [ ] AC-001", 1))
+	writeFile(t, filepath.Join(dir, "questions.md"), strings.Replace(regressionQuestions, "status: answered", "status: open", 1))
+	writeFile(t, filepath.Join(dir, "state.md"), "# State\n\n## Cursor\n| Key | Value |\n| --- | --- |\n| phase | build |\n| status | running |\n")
+
+	code, out := checkRegression(t, root, "feat")
+	if code != 3 {
+		t.Fatalf("expected blocked, code=%d out=%s", code, out)
+	}
+	for _, want := range []string{"AC-001", "gate AC-001", "SLICE-001", "q-2026-01-01-001", "phase moved backward"} {
+		if !strings.Contains(out, want) {
+			t.Fatalf("missing %q in:\n%s", want, out)
+		}
+	}
+}
+
+func TestRegressionDetectsRemovedArtifact(t *testing.T) {
+	root, dir := regressionWorkspace(t, "build")
+	if code, _ := checkRegression(t, root, "feat", "--update"); code != 0 {
+		t.Fatalf("update failed")
+	}
+	if err := os.Remove(filepath.Join(dir, "gates.md")); err != nil {
+		t.Fatal(err)
+	}
+	code, out := checkRegression(t, root, "feat")
+	if code != 3 || !strings.Contains(out, "gates.md") {
+		t.Fatalf("code=%d out=%s", code, out)
+	}
+}
+
+func TestRegressionIgnoresFencedDecoys(t *testing.T) {
+	root, dir := regressionWorkspace(t, "build")
+	writeFile(t, filepath.Join(dir, "spec.md"), "# Spec\n\n```\n- [x] AC-099: fenced decoy\n```\n\n## Acceptance criteria\n- [ ] AC-001: real\n")
+	if code, out := checkRegression(t, root, "feat", "--update"); code != 0 {
+		t.Fatalf("update code=%d out=%s", code, out)
+	}
+	writeFile(t, filepath.Join(dir, "spec.md"), "# Spec\n\n## Acceptance criteria\n- [ ] AC-001: real\n")
+	code, out := checkRegression(t, root, "feat")
+	if code != 0 {
+		t.Fatalf("fenced decoy was recorded: code=%d out=%s", code, out)
+	}
+}
+
+func TestRegressionUpdateBlessesAndReports(t *testing.T) {
+	root, dir := regressionWorkspace(t, "build")
+	if code, _ := checkRegression(t, root, "feat", "--update"); code != 0 {
+		t.Fatalf("update failed")
+	}
+	writeFile(t, filepath.Join(dir, "spec.md"), strings.Replace(regressionSpec, "- [x] AC-001", "- [ ] AC-001", 1))
+	code, out := checkRegression(t, root, "feat", "--update")
+	if code != 0 || !strings.Contains(out, "REGRESSION-BLESSED") {
+		t.Fatalf("update code=%d out=%s", code, out)
+	}
+	if code, out := checkRegression(t, root, "feat"); code != 0 {
+		t.Fatalf("post-bless check should pass: code=%d out=%s", code, out)
+	}
+}
+
+func TestRegressionCorruptBaselineBlocks(t *testing.T) {
+	root, dir := regressionWorkspace(t, "build")
+	writeFile(t, filepath.Join(dir, regressionBaselineFile), "{not json")
+	code, out := checkRegression(t, root, "feat")
+	if code != 3 || !strings.Contains(out, "unreadable") {
+		t.Fatalf("code=%d out=%s", code, out)
+	}
+}
+
+func TestRegressionUsageErrors(t *testing.T) {
+	root, _ := regressionWorkspace(t, "build")
+	if code, _ := checkRegression(t, root); code != 2 {
+		t.Fatalf("no args code=%d", code)
+	}
+	if code, _ := checkRegression(t, root, "feat", "--bogus"); code != 2 {
+		t.Fatalf("bad flag code=%d", code)
+	}
+}

package/engine/internal/lib/resolve_remediation_test.go

@@ -55,6 +55,6 @@ func resolveWorkspace(t *testing.T, questions string) string {
 	root := t.TempDir()
 	testutil.WriteFile(t, filepath.Join(root, "ACTIVE"), "feat\n")
 	testutil.WriteFile(t, filepath.Join(root, "work", "feat", "questions.md"), questions)
-	testutil.WriteFile(t, filepath.Join(root, "work", "feat", "state.md"), "- Status: running\n- Next step: continue\n- Schema: 3\n")
+	testutil.WriteFile(t, filepath.Join(root, "work", "feat", "state.md"), "- Status: running\n- Next step: continue\n- Schema: 4\n")
 	return root
 }

package/engine/internal/lib/secretscan_test.go

@@ -348,7 +348,7 @@ func TestSecretScanBlocksHighSeverityTouchedFile(t *testing.T) {
 	root := filepath.Join(project, ".devrites")
 	testutil.WriteFile(t, filepath.Join(root, "ACTIVE"), "leak\n")
 	testutil.WriteFile(t, filepath.Join(root, "work", "leak", "touched-files.md"), candidateTestManifest(candidateTestRow{state: "present", path: "secrets.txt", slice: "S-1", reason: "Credential check."}))
-	testutil.WriteFile(t, filepath.Join(root, "work", "leak", "state.md"), "| schema | 3 |\n")
+	testutil.WriteFile(t, filepath.Join(root, "work", "leak", "state.md"), "| schema | 4 |\n")
 	secret := "ghp_" + strings.Repeat("f", 32)
 	testutil.WriteFile(t, filepath.Join(project, "secrets.txt"), secret+"\n")
 	var out, err bytes.Buffer

package/engine/internal/lib/slicecheck.go

@@ -0,0 +1,179 @@
+package lib
+
+import (
+	"fmt"
+	"io"
+	"regexp"
+	"strings"
+
+	"github.com/devrites/devrites/internal/state"
+)
+
+// slicecheck.go: pre-dispatch lint for one slice's wright contract. A wright
+// dispatch is the most expensive step in a lifecycle; contract defects (missing
+// allowlist, non-exact paths, AC references that do not exist in spec.md, no
+// proof plan) surface only at return inspection — after the tokens are spent.
+// This check fails before dispatch instead.
+//
+//	devrites-engine check slice <slug> <SLICE-ID>
+//
+//	0  contract holds    2  usage error    3  blocked: problems listed
+
+var (
+	sliceFieldRe     = regexp.MustCompile(`(?m)^([A-Za-z][A-Za-z /_-]*):\s*(.*)$`)
+	sliceACRe        = regexp.MustCompile(`\bAC-\d+\b`)
+	pathGlobCharRe   = regexp.MustCompile(`[*?\[\]{}]`)
+	pathTraversalRe  = regexp.MustCompile(`(^|/)\.\.(/|$)`)
+	devritesPathRe   = regexp.MustCompile(`(?i)^\.?devrites(/|$)`)
+	windowsDrivePath = regexp.MustCompile(`^[A-Za-z]:[\\/]`)
+)
+
+// sliceFields extracts the single-line `Field: value` pairs of a slice block.
+func sliceFields(block string) map[string]string {
+	fields := map[string]string{}
+	for _, m := range sliceFieldRe.FindAllStringSubmatch(block, -1) {
+		key := strings.ToLower(strings.TrimSpace(m[1]))
+		if _, seen := fields[key]; !seen {
+			fields[key] = strings.TrimSpace(m[2])
+		}
+	}
+	return fields
+}
+
+// fieldValue returns the first matching field value among aliases.
+func fieldValue(fields map[string]string, aliases ...string) (string, bool) {
+	for _, name := range aliases {
+		if v, ok := fields[name]; ok {
+			return v, true
+		}
+	}
+	return "", false
+}
+
+// parsePathList splits a `;` or `,` separated project-relative path list.
+func parsePathList(raw string) []string {
+	var out []string
+	for _, part := range strings.FieldsFunc(raw, func(r rune) bool { return r == ';' || r == ',' }) {
+		p := strings.Trim(strings.TrimSpace(part), "`'\"")
+		if p != "" && !strings.EqualFold(p, "none") {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+// checkAllowlistPaths validates the exact-path contract: project-relative files
+// only — no directories, globs, traversal, .devrites, or duplicates.
+func checkAllowlistPaths(paths []string) []string {
+	var problems []string
+	seen := map[string]bool{}
+	for _, p := range paths {
+		switch {
+		case strings.HasPrefix(p, "/") || windowsDrivePath.MatchString(p):
+			problems = append(problems, fmt.Sprintf("allowlist path %q is not project-relative", p))
+		case pathTraversalRe.MatchString(p):
+			problems = append(problems, fmt.Sprintf("allowlist path %q escapes the project (..)", p))
+		case pathGlobCharRe.MatchString(p):
+			problems = append(problems, fmt.Sprintf("allowlist path %q uses a glob — exact paths only", p))
+		case strings.HasSuffix(p, "/"):
+			problems = append(problems, fmt.Sprintf("allowlist path %q is a directory — exact files only", p))
+		case devritesPathRe.MatchString(p):
+			problems = append(problems, fmt.Sprintf("allowlist path %q targets .devrites — wrights never write workflow state", p))
+		case seen[p]:
+			problems = append(problems, fmt.Sprintf("allowlist path %q is duplicated", p))
+		}
+		seen[p] = true
+	}
+	return problems
+}
+
+// RunCheckSlice lints one slice's dispatch contract.
+func RunCheckSlice(root string, args []string, stdout, stderr io.Writer) int {
+	if len(args) != 2 {
+		fmt.Fprintln(stderr, "usage: devrites-engine check slice <slug> <SLICE-ID>")
+		return 2
+	}
+	slug, sliceID := args[0], args[1]
+	if !state.ValidSliceID(sliceID) {
+		fmt.Fprintf(stderr, "check slice: %q is not a SLICE-### id\n", sliceID)
+		return 2
+	}
+	tasks, err := readWorkspaceArtifact(root, slug, "tasks.md")
+	if err != nil {
+		fmt.Fprintf(stderr, "check slice: %v\n", err)
+		return 3
+	}
+	block, ok := state.ExtractTaskSlice(tasks, sliceID)
+	if !ok {
+		fmt.Fprintf(stderr, "check slice: %s not found in tasks.md\n", sliceID)
+		return 3
+	}
+
+	var problems []string
+	fields := sliceFields(block)
+
+	if goal, ok := fieldValue(fields, "goal"); !ok || goal == "" {
+		problems = append(problems, "Goal field missing or empty")
+	}
+
+	allowRaw, hasAllow := fieldValue(fields, "writer allowlist")
+	var allowlist []string
+	if !hasAllow || len(parsePathList(allowRaw)) == 0 {
+		problems = append(problems, "Writer allowlist missing or empty — dispatch requires exact project-relative paths")
+	} else {
+		allowlist = parsePathList(allowRaw)
+		problems = append(problems, checkAllowlistPaths(allowlist)...)
+	}
+
+	if touchedRaw, ok := fieldValue(fields, "files likely touched"); ok {
+		allowed := map[string]bool{}
+		for _, p := range allowlist {
+			allowed[p] = true
+		}
+		for _, p := range parsePathList(touchedRaw) {
+			if hasAllow && !allowed[p] {
+				problems = append(problems, fmt.Sprintf("Files likely touched %q is outside the Writer allowlist", p))
+			}
+		}
+	}
+
+	acs := sliceACRe.FindAllString(block, -1)
+	if len(acs) == 0 {
+		problems = append(problems, "no AC-### coverage declared — every slice must satisfy acceptance criteria")
+	} else {
+		spec, specErr := readWorkspaceArtifact(root, slug, "spec.md")
+		if specErr != nil {
+			problems = append(problems, fmt.Sprintf("spec.md unavailable — cannot verify %d AC reference(s)", len(acs)))
+		} else {
+			specText := string(spec)
+			seen := map[string]bool{}
+			var unknown []string
+			for _, ac := range acs {
+				if seen[ac] {
+					continue
+				}
+				seen[ac] = true
+				if !strings.Contains(specText, ac) {
+					unknown = append(unknown, ac)
+				}
+			}
+			for _, ac := range unknown {
+				problems = append(problems, fmt.Sprintf("%s is referenced but not declared in spec.md", ac))
+			}
+		}
+	}
+
+	if proof, ok := fieldValue(fields, "tests/proof", "tests", "proof"); !ok || proof == "" {
+		problems = append(problems, "Tests/proof field missing or empty — no evidence plan for the slice")
+	}
+
+	if len(problems) > 0 {
+		fmt.Fprintf(stdout, "check slice: %s BLOCKED\n", sliceID)
+		for _, p := range problems {
+			fmt.Fprintf(stdout, "  - %s\n", p)
+		}
+		return 3
+	}
+	fmt.Fprintf(stdout, "check slice: %s ok (paths=%d acs=%d)\n", sliceID, len(allowlist), len(acs))
+	return 0
+}

package/engine/internal/lib/slicecheck_test.go

@@ -0,0 +1,111 @@
+package lib
+
+import (
+	"bytes"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func sliceWorkspace(t *testing.T, tasks, spec string) (root string) {
+	t.Helper()
+	root, featureDir := newWorkspace(t, "build")
+	writeFile(t, filepath.Join(featureDir, "tasks.md"), tasks)
+	if spec != "" {
+		writeFile(t, filepath.Join(featureDir, "spec.md"), spec)
+	}
+	return root
+}
+
+const goodSliceTasks = `# Tasks
+
+## SLICE-001 Wire the thing
+Goal: do the thing.
+Satisfies: AC-001, AC-002
+Acceptance criteria: thing works
+Dependencies: none
+depends_on: []
+Writer allowlist: src/a.go; src/a_test.go
+Files likely touched: src/a.go; src/a_test.go
+Tests/proof: run go test ./...
+Status: pending
+`
+
+const sliceSpec = `# Spec
+
+- [ ] AC-001: thing works.
+- [ ] AC-002: thing is verified.
+`
+
+func TestCheckSlicePassesValidContract(t *testing.T) {
+	root := sliceWorkspace(t, goodSliceTasks, sliceSpec)
+	stdout, stderr := &bytes.Buffer{}, &bytes.Buffer{}
+	code := RunCheckSlice(root, []string{"feat", "SLICE-001"}, stdout, stderr)
+	if code != 0 {
+		t.Fatalf("code=%d want 0\n%s%s", code, stdout, stderr)
+	}
+	if !strings.Contains(stdout.String(), "paths=2") || !strings.Contains(stdout.String(), "acs=2") {
+		t.Fatalf("unexpected output:\n%s", stdout)
+	}
+}
+
+func TestCheckSliceBlocksContractDefects(t *testing.T) {
+	tasks := `# Tasks
+
+## SLICE-001 Bad contract
+Satisfies: AC-099
+Writer allowlist: ../escape.go; src/*.go; .devrites/state.md; src/dup.go; src/dup.go
+Files likely touched: src/not-listed.go
+`
+	root := sliceWorkspace(t, tasks, sliceSpec)
+	stdout, stderr := &bytes.Buffer{}, &bytes.Buffer{}
+	code := RunCheckSlice(root, []string{"feat", "SLICE-001"}, stdout, stderr)
+	if code != 3 {
+		t.Fatalf("code=%d want 3\n%s%s", code, stdout, stderr)
+	}
+	out := stdout.String()
+	for _, want := range []string{
+		"Goal field missing",
+		"escapes the project",
+		"glob",
+		".devrites",
+		"duplicated",
+		"outside the Writer allowlist",
+		"AC-099",
+		"Tests/proof field missing",
+	} {
+		if !strings.Contains(out, want) {
+			t.Fatalf("missing problem %q:\n%s", want, out)
+		}
+	}
+}
+
+func TestCheckSliceMissingSliceAndArgs(t *testing.T) {
+	root := sliceWorkspace(t, goodSliceTasks, sliceSpec)
+	stdout, stderr := &bytes.Buffer{}, &bytes.Buffer{}
+	if code := RunCheckSlice(root, []string{"feat", "SLICE-042"}, stdout, stderr); code != 3 {
+		t.Fatalf("unknown slice code=%d want 3", code)
+	}
+	if code := RunCheckSlice(root, []string{"feat", "not-a-slice"}, stdout, stderr); code != 2 {
+		t.Fatalf("bad id code=%d want 2", code)
+	}
+	if code := RunCheckSlice(root, []string{"feat"}, stdout, stderr); code != 2 {
+		t.Fatalf("missing arg code=%d want 2", code)
+	}
+}
+
+func TestCheckSliceRejectsSliceWithNoAC(t *testing.T) {
+	tasks := `# Tasks
+
+## SLICE-001 Chore
+Goal: tidy.
+Writer allowlist: src/a.go
+Tests/proof: none needed
+`
+	root := sliceWorkspace(t, tasks, sliceSpec)
+	stdout, stderr := &bytes.Buffer{}, &bytes.Buffer{}
+	code := RunCheckSlice(root, []string{"feat", "SLICE-001"}, stdout, stderr)
+	if code != 3 || !strings.Contains(stdout.String(), "no AC-### coverage") {
+		t.Fatalf("code=%d out:\n%s%s", code, stdout, stderr)
+	}
+}

package/engine/internal/lib/taskgraph_test.go

@@ -259,7 +259,7 @@ func TestObserveSummaryExposesTaskGraphProblems(t *testing.T) {
 	if err := os.MkdirAll(workspace, 0o755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(workspace, "state.md"), []byte("| phase | define |\n| schema | 3 |\n"), 0o644); err != nil {
+	if err := os.WriteFile(filepath.Join(workspace, "state.md"), []byte("| phase | define |\n| schema | 4 |\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	body := `# Tasks
@@ -308,7 +308,7 @@ func TestObserveSummaryExposesProblemsWhenNoSliceHeaders(t *testing.T) {
 	if err := os.MkdirAll(workspace, 0o755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(workspace, "state.md"), []byte("| phase | define |\n| schema | 3 |\n"), 0o644); err != nil {
+	if err := os.WriteFile(filepath.Join(workspace, "state.md"), []byte("| phase | define |\n| schema | 4 |\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(workspace, "tasks.md"), []byte("# Tasks\n\n- do the work\n"), 0o644); err != nil {

package/engine/internal/lib/triggers.go

@@ -0,0 +1,133 @@
+package lib
+
+import (
+	"os"
+	"path/filepath"
+	"regexp"
+	"slices"
+	"sort"
+	"strings"
+)
+
+// triggers.go: advisory trigger suggestions for `context`. Declared triggers are
+// semantic — only the model may apply them — but the *facts* that make one
+// relevant are deterministic: sentinel files, workspace-artifact keywords, and
+// the dispatch role. Suggesting from facts removes per-invocation guesswork and
+// the two failure modes it causes (over-loading wastes tokens; under-loading
+// skips rules and costs a repair round). Suggestions are additive only: they
+// never veto a caller-selected trigger and are never applied automatically.
+
+// triggerFacts is the evidence base for suggestions.
+type triggerFacts struct {
+	role        string
+	afk         bool
+	afkParallel bool
+	principles  bool
+	corpus      string // lowercased text of spec/plan/tasks/design brief
+}
+
+// triggerEvidenceFiles bounds which workspace artifacts feed keyword matching.
+var triggerEvidenceFiles = []string{"spec.md", "plan.md", "tasks.md", "design-brief.md"}
+
+const triggerEvidenceFileCap = 256 << 10
+
+var (
+	uiSignalRe   = regexp.MustCompile(`\b(frontend|front-end|\bui\b|\bux\b|css|tailwind|stylesheet|component|responsive|layout|browser|viewport|screen reader|landing page|design[- ]brief|react|vue|svelte|next\.?js)\b`)
+	secSignalRe  = regexp.MustCompile(`\b(auth|authentication|authorization|login|password|secret|token|credential|permission|encrypt|crypto|oauth|session|cookie|inject|xss|csrf|ssrf|webhook|untrusted|input validat)`)
+	tddSignalRe  = regexp.MustCompile(`\b(tdd|test[- ]first|test driven)\b`)
+	topoSignalRe = regexp.MustCompile(`(migrat|\bschema\b|\bsql\b|database|postgres|mysql|sqlite|mongo|\bqueue\b|kafka|rabbitmq|redis|\bcache\b|webhook|monorepo|multi[- ]root|multi[- ]service|microservice|\bgrpc\b|graphql|\brest\b|\bapi\b|message broker)`)
+	wfaSignalRe  = regexp.MustCompile(`workflow[- ]artifact`)
+)
+
+// triggerSignals maps declared trigger-name shapes to facts. nameRe is matched
+// case-insensitively against each declared (unselected) trigger name.
+var triggerSignals = []struct {
+	nameRe *regexp.Regexp
+	fires  func(triggerFacts) bool
+}{
+	{regexp.MustCompile(`afk`), func(f triggerFacts) bool { return f.afk }},
+	{regexp.MustCompile(`parallel`), func(f triggerFacts) bool { return f.afkParallel }},
+	{regexp.MustCompile(`frontend|^ui$|ux|design`), func(f triggerFacts) bool { return uiSignalRe.MatchString(f.corpus) }},
+	{regexp.MustCompile(`security|^sec`), func(f triggerFacts) bool { return secSignalRe.MatchString(f.corpus) }},
+	{regexp.MustCompile(`tdd`), func(f triggerFacts) bool { return tddSignalRe.MatchString(f.corpus) }},
+	{regexp.MustCompile(`applicability|topology|data[-_]?integrity|integration|repository`), func(f triggerFacts) bool {
+		return topoSignalRe.MatchString(f.corpus)
+	}},
+	{regexp.MustCompile(`principles`), func(f triggerFacts) bool { return f.principles }},
+	{regexp.MustCompile(`workflow[-_]?artifacts?`), func(f triggerFacts) bool {
+		return wfaSignalRe.MatchString(f.corpus)
+	}},
+	// A writer role authors product source/tests; the craft-rule triggers apply.
+	{regexp.MustCompile(`coding|errors?|patterns?|^dod$|definition|testing`), func(f triggerFacts) bool {
+		return f.role == "slice-wright"
+	}},
+}
+
+// suggestTriggers returns declared, unselected trigger names whose firing facts
+// hold in this workspace. Sorted for stable output.
+func suggestTriggers(manifest loadsManifest, root, featureDir string, opts contextOpts) []string {
+	facts := gatherTriggerFacts(root, featureDir, opts.role)
+	var suggested []string
+	for name := range manifest.Triggers {
+		if slices.Contains(opts.triggers, name) {
+			continue
+		}
+		lower := strings.ToLower(name)
+		for _, signal := range triggerSignals {
+			if signal.nameRe.MatchString(lower) && signal.fires(facts) {
+				suggested = append(suggested, name)
+				break
+			}
+		}
+	}
+	sort.Strings(suggested)
+	return suggested
+}
+
+func gatherTriggerFacts(root, featureDir, role string) triggerFacts {
+	facts := triggerFacts{role: role}
+	if root != "" {
+		afkPath := filepath.Join(root, "AFK")
+		if info, err := os.Stat(afkPath); err == nil && info.Mode().IsRegular() {
+			facts.afk = true
+			if data, err := os.ReadFile(afkPath); err == nil { // #nosec G304 -- .devrites/AFK sentinel
+				facts.afkParallel = afkAllowsParallel(string(data))
+			}
+		}
+		if info, err := os.Stat(filepath.Join(root, "principles.md")); err == nil && info.Mode().IsRegular() {
+			facts.principles = true
+		}
+	}
+	if featureDir != "" {
+		var corpus strings.Builder
+		for _, name := range triggerEvidenceFiles {
+			path := filepath.Join(featureDir, name)
+			info, err := os.Stat(path)
+			if err != nil || !info.Mode().IsRegular() || info.Size() > triggerEvidenceFileCap {
+				continue
+			}
+			// #nosec G304 -- workspace artifact; size cap checked above
+			if data, err := os.ReadFile(path); err == nil {
+				corpus.Write(data)
+				corpus.WriteByte('\n')
+			}
+		}
+		facts.corpus = strings.ToLower(corpus.String())
+	}
+	return facts
+}
+
+var afkParallelRe = regexp.MustCompile(`(?m)^\s*max_parallel\s*:\s*([0-9]+)\s*$`)
+
+// afkAllowsParallel reports whether the AFK sentinel declares max_parallel > 1.
+func afkAllowsParallel(content string) bool {
+	m := afkParallelRe.FindStringSubmatch(content)
+	if len(m) < 2 {
+		return false
+	}
+	n := 0
+	for _, r := range m[1] {
+		n = n*10 + int(r-'0')
+	}
+	return n > 1
+}