devrites 5.11.0 → 5.13.0

package/engine/internal/overhaul/snapshot/run_test.go

@@ -0,0 +1,360 @@
+package snapshot
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/devrites/devrites/internal/gitenv"
+)
+
+const (
+	envSecret = "hunter2-env-value"
+	keySecret = "secretkeybody-xyz"
+)
+
+func gitRun(dir string, args ...string) ([]byte, error) {
+	cmd := exec.Command("git", append([]string{"-C", dir}, args...)...)
+	cmd.Env = append(gitenv.Sanitize(os.Environ()), "GIT_CONFIG_GLOBAL=/dev/null", "GIT_CONFIG_NOSYSTEM=1",
+		"GIT_AUTHOR_NAME=t", "GIT_AUTHOR_EMAIL=t@example.com", "GIT_COMMITTER_NAME=t", "GIT_COMMITTER_EMAIL=t@example.com")
+	return cmd.CombinedOutput()
+}
+
+func gitT(t *testing.T, dir string, args ...string) {
+	t.Helper()
+	if out, err := gitRun(dir, args...); err != nil {
+		t.Fatalf("git %v: %v\n%s", args, err, out)
+	}
+}
+
+func write(t *testing.T, root, rel, content string) {
+	t.Helper()
+	p := filepath.Join(root, rel)
+	if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(p, []byte(content), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func read(t *testing.T, p string) string {
+	t.Helper()
+	b, err := os.ReadFile(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(b)
+}
+
+func lines(first, last string) string {
+	l := []string{first, "two", "three", "four", "five", "six", "seven", "eight", "nine", last}
+	return strings.Join(l, "\n") + "\n"
+}
+
+// newRepo commits src/a.py, src/b.py and gone.txt.
+func newRepo(t *testing.T) string {
+	t.Helper()
+	root := t.TempDir()
+	gitT(t, root, "init", "-q", "-b", "main")
+	write(t, root, "src/a.py", lines("one", "ten"))
+	write(t, root, "src/b.py", "b\n")
+	write(t, root, "gone.txt", "gone\n")
+	gitT(t, root, "add", "-A")
+	gitT(t, root, "commit", "-q", "-m", "init")
+	return root
+}
+
+// dirtyRepo adds a staged edit, an unstaged edit on top, an unstaged edit
+// elsewhere, a deleted tracked file, an untracked note and two secrets.
+func dirtyRepo(t *testing.T) string {
+	t.Helper()
+	root := newRepo(t)
+	write(t, root, "src/a.py", lines("ONE-staged", "ten"))
+	gitT(t, root, "add", "src/a.py")
+	write(t, root, "src/a.py", lines("ONE-staged", "TEN-unstaged"))
+	write(t, root, "src/b.py", "B-unstaged\n")
+	if err := os.Remove(filepath.Join(root, "gone.txt")); err != nil {
+		t.Fatal(err)
+	}
+	write(t, root, "note.txt", "note\n")
+	write(t, root, ".env", "TOKEN="+envSecret+"\n")
+	write(t, root, "id_material.txt", "-----BEGIN OPENSSH PRIVATE KEY-----\n"+keySecret+"\n-----END OPENSSH PRIVATE KEY-----\n")
+	write(t, root, "deploy.tfvars", "token = \"staged-"+envSecret+"\"\n")
+	gitT(t, root, "add", "deploy.tfvars")
+	write(t, root, "deploy.tfvars", "token = \"unstaged-"+keySecret+"\"\n")
+	return root
+}
+
+func run(args ...string) (int, string, string) {
+	var out, errb bytes.Buffer
+	code := Run(args, &out, &errb)
+	return code, out.String(), errb.String()
+}
+
+func indexState(t *testing.T, root string) (string, time.Time) {
+	t.Helper()
+	p := filepath.Join(root, ".git", "index")
+	fi, err := os.Stat(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return read(t, p), fi.ModTime()
+}
+
+func loadManifest(t *testing.T, out string) manifest {
+	t.Helper()
+	var m manifest
+	if err := json.Unmarshal([]byte(read(t, filepath.Join(out, "manifest.json"))), &m); err != nil {
+		t.Fatal(err)
+	}
+	return m
+}
+
+func captureOK(t *testing.T, root string) string {
+	t.Helper()
+	out := filepath.Join(t.TempDir(), "snap")
+	if code, _, stderr := run("capture", root, out); code != 0 {
+		t.Fatalf("capture exit %d: %s", code, stderr)
+	}
+	return out
+}
+
+func TestCaptureDirtyRepo(t *testing.T) {
+	root := dirtyRepo(t)
+	idxBefore, mtimeBefore := indexState(t, root)
+	out := filepath.Join(t.TempDir(), "snap")
+	code, stdout, stderr := run("capture", root, out)
+	if code != 0 {
+		t.Fatalf("capture exit %d: %s", code, stderr)
+	}
+	if idx, mtime := indexState(t, root); idx != idxBefore || !mtime.Equal(mtimeBefore) {
+		t.Fatal(".git/index bytes or mtime changed during capture")
+	}
+
+	m := loadManifest(t, out)
+	if m.Schema != "overhaul.snapshot/1" || m.Head == nil || m.IndexSHA256 == "" || m.Fingerprint == "" {
+		t.Fatalf("manifest header: %+v", m)
+	}
+	want := map[string]entry{
+		"src/a.py":        {Source: "tracked", Copied: true},
+		"src/b.py":        {Source: "tracked", Copied: true},
+		"gone.txt":        {Source: "tracked", SHA256: "deleted"},
+		"note.txt":        {Source: "untracked", Copied: true},
+		".env":            {Source: "untracked", Sensitive: true},
+		"id_material.txt": {Source: "untracked", Sensitive: true},
+	}
+	for p, w := range want {
+		g := m.Files[p]
+		if g == nil || g.Source != w.Source || g.Copied != w.Copied || g.Sensitive != w.Sensitive ||
+			(w.SHA256 != "" && g.SHA256 != w.SHA256) {
+			t.Errorf("%s: got %+v want %+v", p, g, w)
+		}
+		_, err := os.Lstat(filepath.Join(out, "tree", p))
+		if copied := err == nil; copied != w.Copied {
+			t.Errorf("%s: copied on disk = %v, want %v", p, copied, w.Copied)
+		}
+	}
+	if got := read(t, filepath.Join(out, "tree", "src/a.py")); got != lines("ONE-staged", "TEN-unstaged") {
+		t.Errorf("tree copy of src/a.py = %q", got)
+	}
+
+	staged := read(t, filepath.Join(out, "staged.patch"))
+	unstaged := read(t, filepath.Join(out, "unstaged.patch"))
+	if !strings.Contains(staged, "+ONE-staged") || strings.Contains(staged, "TEN-unstaged") ||
+		strings.Contains(staged, "B-unstaged") || strings.Contains(staged, "gone.txt") {
+		t.Errorf("staged.patch:\n%s", staged)
+	}
+	if strings.Contains(unstaged, "+ONE-staged") || !strings.Contains(unstaged, "+TEN-unstaged") ||
+		!strings.Contains(unstaged, "+B-unstaged") || !strings.Contains(unstaged, "deleted file mode") {
+		t.Errorf("unstaged.patch:\n%s", unstaged)
+	}
+	for _, name := range []string{"status.bin", "index.bin"} {
+		if _, err := os.Stat(filepath.Join(out, name)); err != nil {
+			t.Error(err)
+		}
+	}
+
+	var summary struct {
+		Withheld []string `json:"sensitive_not_copied"`
+	}
+	if err := json.Unmarshal([]byte(stdout), &summary); err != nil ||
+		!slices.Equal(summary.Withheld, []string{".env", "deploy.tfvars", "id_material.txt"}) {
+		t.Errorf("summary %q: %v", stdout, err)
+	}
+	leaks := stdout + stderr
+	if err := filepath.WalkDir(out, func(p string, d os.DirEntry, err error) error {
+		if err == nil && d.Type().IsRegular() {
+			leaks += read(t, p)
+		}
+		return nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	for _, s := range []string{envSecret, keySecret} {
+		if strings.Contains(leaks, s) {
+			t.Errorf("secret %q leaked into output or snapshot", s)
+		}
+	}
+
+	fi, err := os.Stat(out)
+	if err != nil || (runtime.GOOS != "windows" && fi.Mode().Perm() != 0o700) {
+		t.Errorf("snapshot dir mode: %v %v", fi.Mode(), err)
+	}
+}
+
+func TestCaptureRefusals(t *testing.T) {
+	root := newRepo(t)
+
+	inside := filepath.Join(root, "snap")
+	code, _, stderr := run("capture", root, inside)
+	if code != 2 || !strings.Contains(stderr, "snapshot must live outside the target repository") {
+		t.Errorf("inside target: exit %d %q", code, stderr)
+	}
+	if _, err := os.Lstat(inside); err == nil {
+		t.Error("snapshot created inside the target")
+	}
+
+	existing := t.TempDir()
+	write(t, existing, "keep.txt", "keep")
+	code, _, stderr = run("capture", root, existing)
+	if code != 2 || !strings.Contains(stderr, "refusing to overwrite existing snapshot") {
+		t.Errorf("overwrite: exit %d %q", code, stderr)
+	}
+	if entries, _ := os.ReadDir(existing); len(entries) != 1 {
+		t.Errorf("existing snapshot dir was modified: %v", entries)
+	}
+}
+
+func TestCaptureRefusesUnmergedIndex(t *testing.T) {
+	root := newRepo(t)
+	gitT(t, root, "checkout", "-q", "-b", "other")
+	write(t, root, "src/b.py", "other\n")
+	gitT(t, root, "commit", "-q", "-am", "other")
+	gitT(t, root, "checkout", "-q", "main")
+	write(t, root, "src/b.py", "main\n")
+	gitT(t, root, "commit", "-q", "-am", "main")
+	if out, err := gitRun(root, "merge", "other"); err == nil {
+		t.Fatalf("expected a merge conflict: %s", out)
+	}
+	out := filepath.Join(t.TempDir(), "snap")
+	code, _, stderr := run("capture", root, out)
+	if code != 2 || !strings.Contains(stderr, "index has unmerged entries") {
+		t.Fatalf("exit %d %q", code, stderr)
+	}
+	if _, err := os.Lstat(out); err == nil {
+		t.Error("snapshot dir created despite refusal")
+	}
+}
+
+type report struct {
+	IndexUnchanged bool     `json:"index_unchanged"`
+	Agent          []string `json:"agent_owned_changes"`
+	User           []string `json:"changes_outside_agent_paths"`
+}
+
+func verifyRun(t *testing.T, root, out string) (int, report) {
+	t.Helper()
+	agentFile := filepath.Join(t.TempDir(), "agent.txt")
+	write(t, filepath.Dir(agentFile), "agent.txt", "src/a.py\n\n")
+	code, stdout, stderr := run("verify", root, out, "--agent-paths", agentFile)
+	var r report
+	if err := json.Unmarshal([]byte(stdout), &r); err != nil {
+		t.Fatalf("verify exit %d output %q %s: %v", code, stdout, stderr, err)
+	}
+	return code, r
+}
+
+func TestVerifySeparatesAgentAndUserChanges(t *testing.T) {
+	root := dirtyRepo(t)
+	out := captureOK(t, root)
+
+	write(t, root, "src/a.py", "agent edit\n")
+	code, r := verifyRun(t, root, out)
+	if code != 0 || !r.IndexUnchanged || !slices.Equal(r.Agent, []string{"src/a.py"}) || len(r.User) != 0 {
+		t.Fatalf("agent-only change: exit %d %+v", code, r)
+	}
+
+	write(t, root, "note.txt", "user edit\n")
+	code, r = verifyRun(t, root, out)
+	if code != 1 || !slices.Equal(r.User, []string{"note.txt"}) || !slices.Equal(r.Agent, []string{"src/a.py"}) {
+		t.Fatalf("user change: exit %d %+v", code, r)
+	}
+}
+
+func TestVerifyDetectsIndexChange(t *testing.T) {
+	root := dirtyRepo(t)
+	out := captureOK(t, root)
+	gitT(t, root, "add", "src/b.py")
+	code, r := verifyRun(t, root, out)
+	if code != 1 || r.IndexUnchanged || len(r.User) != 0 {
+		t.Fatalf("exit %d %+v", code, r)
+	}
+}
+
+func TestCaptureStaysReadOnlyAtBoundaries(t *testing.T) {
+	root := newRepo(t)
+	gitT(t, root, "config", "diff.noprefix", "true")
+	gitT(t, root, "config", "diff.external", "false")
+
+	inner := filepath.Join(root, "vendor", "inner")
+	if err := os.MkdirAll(inner, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	gitT(t, inner, "init", "-q", "-b", "main")
+	write(t, inner, "lib.txt", "inner\n")
+	gitT(t, inner, "add", "-A")
+	gitT(t, inner, "commit", "-q", "-m", "inner")
+	gitT(t, root, "add", "vendor/inner")
+
+	write(t, root, "src/a.py", lines("ONE-staged", "ten"))
+	gitT(t, root, "add", "src/a.py")
+	write(t, root, "src/a.py", lines("ONE-staged", "TEN-unstaged"))
+	// Stale stat info: content matches the index but the timestamp does not.
+	old := time.Now().Add(-48 * time.Hour)
+	if err := os.Chtimes(filepath.Join(root, "src/b.py"), old, old); err != nil {
+		t.Fatal(err)
+	}
+
+	idxBefore, mtimeBefore := indexState(t, root)
+	out := captureOK(t, root)
+	if idx, mtime := indexState(t, root); idx != idxBefore || !mtime.Equal(mtimeBefore) {
+		t.Fatal(".git/index changed during capture")
+	}
+
+	m := loadManifest(t, out)
+	if !slices.Contains(m.Submodules, "vendor/inner") {
+		t.Errorf("submodules_not_captured = %v", m.Submodules)
+	}
+	if e := m.Files["vendor/inner"]; e == nil || e.SHA256 != "directory" || e.Copied {
+		t.Errorf("gitlink entry = %+v", e)
+	}
+	if _, err := os.Lstat(filepath.Join(out, "tree", "vendor", "inner", "lib.txt")); err == nil {
+		t.Error("nested repository content was copied")
+	}
+	for _, name := range []string{"staged.patch", "unstaged.patch"} {
+		if p := read(t, filepath.Join(out, name)); !strings.Contains(p, "diff --git a/src/a.py b/src/a.py") {
+			t.Errorf("%s lacks prefixed header:\n%s", name, p)
+		}
+	}
+}
+
+func TestDeltaReportsOnlyAttemptChanges(t *testing.T) {
+	root := dirtyRepo(t)
+	before := filepath.Join(t.TempDir(), "before.json")
+	if code, _, stderr := run("state", root, before); code != 0 {
+		t.Fatalf("state exit %d: %s", code, stderr)
+	}
+	write(t, root, "src/b.py", "changed during the attempt\n")
+	code, stdout, stderr := run("delta", before, root)
+	if code != 0 || stdout != "src/b.py\n" {
+		t.Fatalf("delta exit %d stdout %q stderr %q", code, stdout, stderr)
+	}
+}

package/engine/internal/parallel/lease.go

@@ -8,6 +8,8 @@ import (
 	"regexp"
 	"strings"
 	"time"
+
+	"github.com/devrites/devrites/internal/fsutil"
 )
 
 const (
@@ -219,14 +221,7 @@ func WriteLease(path string, lease *Lease) error {
 	if err != nil {
 		return err
 	}
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-		return err
-	}
-	tmp := path + ".tmp"
-	if err := os.WriteFile(tmp, []byte(text), 0o644); err != nil {
-		return err
-	}
-	return os.Rename(tmp, path)
+	return fsutil.WriteFileAtomic(path, []byte(text), 0o644)
 }
 
 func ReadLease(path string) (*Lease, error) {

package/engine/internal/parallel/parallel_test.go

@@ -78,6 +78,40 @@ func TestLeaseRoundTrip(t *testing.T) {
 	}
 }
 
+func TestWriteLeasePreservesFixedTemp(t *testing.T) {
+	for _, directory := range []bool{false, true} {
+		t.Run(fmt.Sprint(directory), func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "lease.md")
+			sentinel := path + ".tmp"
+			if directory {
+				if err := os.Mkdir(sentinel, 0755); err != nil {
+					t.Fatal(err)
+				}
+			} else if err := os.WriteFile(sentinel, []byte("owned elsewhere"), 0644); err != nil {
+				t.Fatal(err)
+			}
+			lease := &Lease{BatchID: "batch", CreatedAt: "now", BaseSHA: "abcdef1", N: 2, Status: StatusRunning, Slices: []LeaseSlice{{ID: "a", Paths: []string{"a.go"}}, {ID: "b", Paths: []string{"b.go"}}}}
+			if err := WriteLease(path, lease); err != nil {
+				t.Fatal(err)
+			}
+			if _, err := ReadLease(path); err != nil {
+				t.Fatal(err)
+			}
+			if directory {
+				info, err := os.Stat(sentinel)
+				if err != nil || !info.IsDir() {
+					t.Fatalf("sentinel changed: %v", err)
+				}
+			} else {
+				raw, err := os.ReadFile(sentinel)
+				if err != nil || string(raw) != "owned elsewhere" {
+					t.Fatalf("sentinel changed: %q %v", raw, err)
+				}
+			}
+		})
+	}
+}
+
 func TestCreateAbortCleanup(t *testing.T) {
 	repo, base := setupRepo(t)
 	slug := "demo-feature"

package/engine/internal/state/budgets.go

@@ -41,6 +41,7 @@ var artifactLineBudgets = map[string]int{
 	"traceability.md":      220,
 	"eng-review.md":        240,
 	"test-plan.md":         260,
+	"gates.md":             200,
 	"state.md":             120,
 	"evidence.md":          280,
 	"browser-evidence.md":  220,
@@ -53,6 +54,8 @@ var artifactLineBudgets = map[string]int{
 	"review.md":            240,
 	"seal.md":              200,
 	"ai-spec.md":           160,
+	"windows.md":           120,
+	"notes.md":             160,
 }
 
 // advisoryOnlyArtifacts are append-only proof ledgers: they scale with proof
@@ -73,15 +76,17 @@ func ArtifactLineBudget(name string) (int, bool) {
 
 // sanctionedRootFiles are workspace-root files the schema places there without a
 // line budget: conditional artifacts (`references.md`, `investigation-map.md`,
-// `dogfood.md`) and the engine-owned parallel lease. Anything else in the root
-// is unsanctioned placement — `packets/` and `history/` own by-reference
-// packets and relocated narrative (workspace-artifact-schema.md "Required by
-// phase").
+// `dogfood.md`) and engine-owned machine files (the parallel lease, the metrics
+// ledger, the regression baseline). Anything else in the root is unsanctioned
+// placement — `packets/` and `history/` own by-reference packets and relocated
+// narrative (workspace-artifact-schema.md "Required by phase").
 var sanctionedRootFiles = map[string]bool{
-	"references.md":        true,
-	"investigation-map.md": true,
-	"dogfood.md":           true,
-	"parallel-lease.md":    true,
+	"references.md":            true,
+	"investigation-map.md":     true,
+	"dogfood.md":               true,
+	"parallel-lease.md":        true,
+	"metrics.jsonl":            true,
+	"regression-baseline.json": true,
 }
 
 // SanctionedRootFile reports whether name is a legitimate workspace-root file:

package/engine/internal/state/observation_test.go

@@ -26,6 +26,7 @@ func TestWorkspaceObservationInventoryCanonicalArtifactsOnce(t *testing.T) {
 		"traceability.md",
 		"eng-review.md",
 		"test-plan.md",
+		"gates.md",
 		"evidence.md",
 		"touched-files.md",
 		"review.md",

package/engine/internal/state/schema.go

@@ -3,8 +3,9 @@ package state
 //go:generate go run ./cmd/workflowmanifest -out workflow_manifest.json
 
 // SchemaVersion versions the persisted workflow/state manifest and the
-// workspace contract the engine accepts.
-const SchemaVersion = 3
+// workspace contract the engine accepts. Schema 4 adds the gates.md
+// acceptance ledger to the vetted artifact set.
+const SchemaVersion = 4
 
 const EvidenceFile = "evidence.md"
 
@@ -93,7 +94,7 @@ var (
 	artifactsSpec    = []ArtifactPath{"brief.md", "spec.md", "state.md", "decisions.md", "assumptions.md", "questions.md"}
 	artifactsClarify = append(append([]ArtifactPath(nil), artifactsSpec...), "decision-coverage.md")
 	artifactsPlan    = append(append([]ArtifactPath(nil), artifactsClarify...), "architecture.md", "plan.md", "tasks.md", "traceability.md")
-	artifactsVetted  = append(append([]ArtifactPath(nil), artifactsPlan...), "eng-review.md", "test-plan.md")
+	artifactsVetted  = append(append([]ArtifactPath(nil), artifactsPlan...), "eng-review.md", "test-plan.md", "gates.md")
 	artifactsProof   = append(append([]ArtifactPath(nil), artifactsVetted...), "evidence.md", "touched-files.md")
 	artifactsFinal   = append(append([]ArtifactPath(nil), artifactsProof...), "review.md", "seal.md")
 )

package/engine/internal/state/state_test.go

@@ -27,7 +27,7 @@ func expectedPhasePolicies() []PhasePolicy {
 	artifactsSpec := []ArtifactPath{"brief.md", "spec.md", "state.md", "decisions.md", "assumptions.md", "questions.md"}
 	artifactsClarify := append(append([]ArtifactPath(nil), artifactsSpec...), "decision-coverage.md")
 	artifactsPlan := append(append([]ArtifactPath(nil), artifactsClarify...), "architecture.md", "plan.md", "tasks.md", "traceability.md")
-	artifactsVetted := append(append([]ArtifactPath(nil), artifactsPlan...), "eng-review.md", "test-plan.md")
+	artifactsVetted := append(append([]ArtifactPath(nil), artifactsPlan...), "eng-review.md", "test-plan.md", "gates.md")
 	artifactsProof := append(append([]ArtifactPath(nil), artifactsVetted...), "evidence.md", "touched-files.md")
 	artifactsFinal := append(append([]ArtifactPath(nil), artifactsProof...), "review.md", "seal.md")
 
@@ -703,7 +703,7 @@ func TestStatusRejectsCorruptStateMarkdownWithoutContentDisclosure(t *testing.T)
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(dir, "state.md"), []byte("| phase | build |\x00\n| schema | 3 |\n"), 0o644); err != nil {
+	if err := os.WriteFile(filepath.Join(dir, "state.md"), []byte("| phase | build |\x00\n| schema | 4 |\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	want := `compute status: feature "corrupt": state.md is malformed (malformed_markdown); repair state.md and retry`
@@ -720,7 +720,7 @@ func TestOnlyCanonicalWorkLayoutIsDiscovered(t *testing.T) {
 	if err := os.MkdirAll(legacy, 0o755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(legacy, "state.md"), []byte("- Phase: spec\n- Schema: 3\n"), 0o644); err != nil {
+	if err := os.WriteFile(filepath.Join(legacy, "state.md"), []byte("- Phase: spec\n- Schema: 4\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := Status(root, "alias"); err == nil {

package/engine/internal/state/workflow_manifest.json

@@ -1,6 +1,6 @@
 {
   "generatedBy": "go generate ./internal/state; DO NOT EDIT",
-  "schemaVersion": 3,
+  "schemaVersion": 4,
   "authorityPolicy": {
     "principlesTrust": "Project principles may become project policy only after explicit provenance and validation; arbitrary project-local Markdown is never inherently trusted executable instruction.",
     "trackedState": [
@@ -142,7 +142,8 @@
         "tasks.md",
         "traceability.md",
         "eng-review.md",
-        "test-plan.md"
+        "test-plan.md",
+        "gates.md"
       ],
       "blocksOpenQuestions": true
     },
@@ -169,7 +170,8 @@
         "tasks.md",
         "traceability.md",
         "eng-review.md",
-        "test-plan.md"
+        "test-plan.md",
+        "gates.md"
       ],
       "blocksOpenQuestions": true
     },
@@ -196,7 +198,8 @@
         "tasks.md",
         "traceability.md",
         "eng-review.md",
-        "test-plan.md"
+        "test-plan.md",
+        "gates.md"
       ],
       "blocksOpenQuestions": true
     },
@@ -225,6 +228,7 @@
         "traceability.md",
         "eng-review.md",
         "test-plan.md",
+        "gates.md",
         "evidence.md",
         "touched-files.md"
       ],
@@ -256,6 +260,7 @@
         "traceability.md",
         "eng-review.md",
         "test-plan.md",
+        "gates.md",
         "evidence.md",
         "touched-files.md"
       ],
@@ -287,6 +292,7 @@
         "traceability.md",
         "eng-review.md",
         "test-plan.md",
+        "gates.md",
         "evidence.md",
         "touched-files.md"
       ],
@@ -319,6 +325,7 @@
         "traceability.md",
         "eng-review.md",
         "test-plan.md",
+        "gates.md",
         "evidence.md",
         "touched-files.md",
         "review.md",
@@ -354,6 +361,7 @@
         "traceability.md",
         "eng-review.md",
         "test-plan.md",
+        "gates.md",
         "evidence.md",
         "touched-files.md",
         "review.md",
@@ -388,6 +396,7 @@
         "traceability.md",
         "eng-review.md",
         "test-plan.md",
+        "gates.md",
         "evidence.md",
         "touched-files.md",
         "review.md",

package/engine/internal/state/workspaceschema_test.go

@@ -37,12 +37,12 @@ func TestWorkspaceSchemaDefaultsToPreV5WhenRowIsAbsent(t *testing.T) {
 }
 
 func TestWorkspaceSchemaAcceptsCurrentAndRefusesNewer(t *testing.T) {
-	root, slug := writeSchemaWorkspace(t, "| phase | build |\n| schema | 3 |\n")
+	root, slug := writeSchemaWorkspace(t, "| phase | build |\n| schema | 4 |\n")
 	if err := RequireWorkspaceSchema(root, slug); err != nil {
 		t.Fatalf("current schema must pass, got %v", err)
 	}
 
-	root, slug = writeSchemaWorkspace(t, "| phase | build |\n| schema | 4 |\n")
+	root, slug = writeSchemaWorkspace(t, "| phase | build |\n| schema | 9 |\n")
 	err := RequireWorkspaceSchema(root, slug)
 	if err == nil {
 		t.Fatal("newer schema must be refused")

package/engine/internal/testutil/testutil.go

@@ -10,6 +10,10 @@ import (
 // CanonicalTasksMarkdown is a minimal valid slice graph for gate fixtures.
 const CanonicalTasksMarkdown = "# Tasks\n\n## SLICE-001 Ready\nSatisfies: AC-001\nDependencies: none\n"
 
+// CanonicalGatesMarkdown is a minimal all-met acceptance ledger for fixtures:
+// one checked manual gate with human attestation.
+const CanonicalGatesMarkdown = "# Gates\n\n- [x] G1: fixture outcome\n  EVIDENCE: fixture attestation\n"
+
 // CopyTree recursively copies the directory tree at src into dst, creating dst
 // and any parents. It is used to give each test an isolated, writable copy of a
 // read-only fixture.