devrites 5.13.1 → 5.14.1

package/engine/internal/overhaul/bench/stats.go

@@ -0,0 +1,154 @@
+package bench
+
+import (
+	"math"
+	"sort"
+)
+
+// uNull returns P(U = u) for u = 0..n*m under the Mann-Whitney null with arm
+// sizes n and m, from the generating function prod_i (1-q^(m+i))/(1-q^i).
+// Cancellation leaves the upper half inaccurate; only the lower tail is read.
+func uNull(n, m int) []float64 {
+	c := make([]float64, n*m+1)
+	c[0] = 1
+	for i := 1; i <= n; i++ {
+		for u := len(c) - 1; u >= m+i; u-- {
+			c[u] -= c[u-m-i]
+		}
+		for u := i; u < len(c); u++ {
+			c[u] += c[u-i]
+		}
+	}
+	total := 0.0
+	for _, v := range c {
+		total += v
+	}
+	for i := range c {
+		c[i] /= total
+	}
+	return c
+}
+
+// exactLimit bounds the arm sizes for the exact null distribution, well inside
+// float64 range and cheap to compute; beyond it the (slightly conservative)
+// normal approximation takes over.
+const exactLimit = 400
+
+// maxPairs caps n*m for the pairwise differences, which are held in memory.
+const maxPairs = 4_000_000
+
+// tailCount returns the largest k with P(U <= k-1) <= alpha/2: the pairwise
+// differences D_(1..k-1) and D_(nm-k+2..nm) fall outside a (1-alpha) interval,
+// whose endpoints are D_(k) and D_(nm+1-k). Zero means no finite interval.
+func tailCount(n, m int, alpha float64) int {
+	if n+m <= exactLimit {
+		p, cum, k := uNull(n, m), 0.0, 0
+		for u := range p {
+			if cum += p[u]; cum > alpha/2 {
+				break
+			}
+			k = u + 1
+		}
+		return k
+	}
+	mean := float64(n*m) / 2
+	sd := math.Sqrt(float64(n*m*(n+m+1)) / 12)
+	return max(0, int(math.Floor(mean-normalQuantile(1-alpha/2)*sd-0.5))+1)
+}
+
+// hlRatio is the Hodges-Lehmann ratio estimate exp(median(ln x_i - ln y_j))
+// with its distribution-free (1-alpha) bounds. ok is false when a sample is
+// not positive or the arms are too small for a finite interval.
+func hlRatio(x, y []float64, alpha float64) (est, lo, hi float64, ok bool) {
+	if len(x)*len(y) > maxPairs {
+		return 0, 0, 0, false
+	}
+	z := make([]float64, 0, len(x)*len(y))
+	for _, a := range x {
+		for _, b := range y {
+			if a <= 0 || b <= 0 {
+				return 0, 0, 0, false
+			}
+			z = append(z, math.Log(a)-math.Log(b))
+		}
+	}
+	k := tailCount(len(x), len(y), alpha)
+	if k == 0 {
+		return 0, 0, 0, false
+	}
+	sort.Float64s(z)
+	return math.Exp(median(z)), math.Exp(z[k-1]), math.Exp(z[len(z)-k]), true
+}
+
+// quantileBounds returns one-sided (1-alpha) distribution-free bounds for the
+// p-quantile of xs from its order statistics; a missing bound is ±Inf. With
+// F(j) = P(Bin(n, p) <= j), the upper bound is x_(k) for the smallest k with
+// F(k-1) >= 1-alpha and the lower bound x_(j) for the largest j with
+// F(j-1) <= alpha.
+func quantileBounds(xs []float64, p, alpha float64) (lcb, ucb float64) {
+	s := append([]float64(nil), xs...)
+	sort.Float64s(s)
+	n := len(s)
+	lcb, ucb = math.Inf(-1), math.Inf(1)
+	lg := func(k int) float64 { v, _ := math.Lgamma(float64(k) + 1); return v }
+	cdf := 0.0
+	for i := 0; i < n; i++ { // cdf = F(i) after this step
+		cdf += math.Exp(lg(n) - lg(i) - lg(n-i) + float64(i)*math.Log(p) + float64(n-i)*math.Log1p(-p))
+		if cdf <= alpha {
+			lcb = s[i] // j = i+1
+		}
+		if cdf >= 1-alpha {
+			ucb = s[i] // k = i+1
+			break
+		}
+	}
+	return lcb, ucb
+}
+
+// quantile7 is the linearly interpolated sample quantile (Hyndman-Fan type 7).
+func quantile7(xs []float64, p float64) float64 {
+	s := append([]float64(nil), xs...)
+	sort.Float64s(s)
+	h := p * float64(len(s)-1)
+	i := int(math.Floor(h))
+	if i+1 >= len(s) {
+		return s[len(s)-1]
+	}
+	return s[i] + (h-float64(i))*(s[i+1]-s[i])
+}
+
+// wilson returns the Wilson score interval for e events in n trials.
+func wilson(p float64, n, z float64) (lo, hi float64) {
+	d := 1 + z*z/n
+	c := (p + z*z/(2*n)) / d
+	h := z * math.Sqrt(p*(1-p)/n+z*z/(4*n*n)) / d
+	return max(0, c-h), min(1, c+h)
+}
+
+// newcombe returns the hybrid score interval (Newcombe 1998, method 10) for
+// p1 - p2 from proportions over n1 and n2 trials.
+func newcombe(p1, n1, p2, n2, z float64) (lo, hi float64) {
+	l1, u1 := wilson(p1, n1, z)
+	l2, u2 := wilson(p2, n2, z)
+	d := p1 - p2
+	return d - math.Sqrt((p1-l1)*(p1-l1)+(u2-p2)*(u2-p2)), d + math.Sqrt((u1-p1)*(u1-p1)+(p2-l2)*(p2-l2))
+}
+
+// normalQuantile is the standard normal inverse CDF (Acklam's rational
+// approximation, relative error below 1.2e-9).
+func normalQuantile(p float64) float64 {
+	a := []float64{-3.969683028665376e+01, 2.209460984245205e+02, -2.759285104469687e+02, 1.383577518672690e+02, -3.066479806614716e+01, 2.506628277459239e+00}
+	b := []float64{-5.447609879822406e+01, 1.615858368580409e+02, -1.556989798598866e+02, 6.680131188771972e+01, -1.328068155288572e+01}
+	c := []float64{-7.784894002430293e-03, -3.223964580411365e-01, -2.400758277161838e+00, -2.549732539343734e+00, 4.374664141464968e+00, 2.938163982698783e+00}
+	d := []float64{7.784695709041462e-03, 3.224671290700398e-01, 2.445134137142996e+00, 3.754408661907416e+00}
+	switch {
+	case p < 0.02425:
+		q := math.Sqrt(-2 * math.Log(p))
+		return (((((c[0]*q+c[1])*q+c[2])*q+c[3])*q+c[4])*q + c[5]) / ((((d[0]*q+d[1])*q+d[2])*q+d[3])*q + 1)
+	case p > 1-0.02425:
+		return -normalQuantile(1 - p)
+	}
+	q := p - 0.5
+	r := q * q
+	return (((((a[0]*r+a[1])*r+a[2])*r+a[3])*r+a[4])*r + a[5]) * q / (((((b[0]*r+b[1])*r+b[2])*r+b[3])*r+b[4])*r + 1)
+}

package/engine/internal/overhaul/overhaul.go

@@ -19,6 +19,7 @@ import (
 // Usage is the command-family help text.
 const Usage = `usage: devrites-engine overhaul <tool> ...
 
+  overhaul records init <repo> <run-id>
   overhaul records digest <file>
   overhaul records stage <run>
   overhaul records publish <run>

package/engine/internal/overhaul/ovio/ovio.go

@@ -156,3 +156,7 @@ func Truthy(v any) bool {
 	}
 	return true
 }
+
+// Domains is the fixed set of score domains in their documented order. Findings,
+// receipts, the applicability matrix and the rubric all use these keys.
+var Domains = []string{"correctness", "security", "reliability", "performance", "tests", "architecture", "ux", "operations"}

package/engine/internal/overhaul/records/check.go

@@ -12,6 +12,7 @@ import (
 	"strings"
 
 	"github.com/devrites/devrites/internal/overhaul/ovio"
+	"github.com/devrites/devrites/internal/overhaul/snapshot"
 )
 
 func set(vals ...string) map[string]bool {
@@ -199,6 +200,9 @@ func BadPath(p any, repo string) string {
 			return "names a directory or git metadata"
 		}
 	}
+	if strings.HasPrefix(s, snapshot.RunAreaDir) {
+		return "names the overhaul run area"
+	}
 	if isDir(join(repo, s)) {
 		return "names a directory or git metadata"
 	}
@@ -576,6 +580,9 @@ func Check(run, genDir, prevDir string) ([]string, error) {
 			add("run.json: readiness_verdict differs from scorecard.json")
 		}
 	}
+	if err := consistency(run, genDir, R, add); err != nil {
+		return nil, err
+	}
 	ap := ovio.List(R["approval.json"]["events"])
 	uniq(ap, idKey, "approval", add)
 	stopAt := -1
@@ -820,6 +827,26 @@ func Check(run, genDir, prevDir string) ([]string, error) {
 			}
 		}
 	}
+	// Views are how the user reads a stop: every stop carries the report, and a
+	// pending approval carries the review page and the plan it approves.
+	if outcome := str(rj, "execution_outcome"); outcome != "" && outcome != "RUNNING" {
+		for _, v := range []string{"report.html", "report.md"} {
+			if !isFile(join(vdir, v)) {
+				add("views/%s is required once the run stops (execution_outcome %s)", v, outcome)
+			}
+		}
+	}
+	if str(rj, "phase") == "AWAITING_APPROVAL" {
+		need := []string{"review.html", "review.md"}
+		if hasPR {
+			need = append(need, "plan.md")
+		}
+		for _, v := range need {
+			if !isFile(join(vdir, v)) {
+				add("views/%s is required while awaiting approval", v)
+			}
+		}
+	}
 	return errs, nil
 }
 

package/engine/internal/overhaul/records/consistency.go

@@ -0,0 +1,217 @@
+package records
+
+import (
+	"encoding/json"
+	"slices"
+
+	"github.com/devrites/devrites/internal/overhaul/ovio"
+)
+
+var (
+	jsonZero      = any(json.Number("0"))
+	domains       = set(ovio.Domains...)
+	cellStates    = set("applicable", "not-applicable", "blocked")
+	rangeStates   = set("inventoried", "tool-scanned", "semantically-reviewed", "cross-boundary-reviewed", "verified", "excluded", "blocked")
+	reviewedRange = set("semantically-reviewed", "cross-boundary-reviewed", "verified", "excluded")
+	openFinding   = set("confirmed", "approved-for-fix", "in-progress", "fixed-unverified", "deferred", "accepted-risk")
+	serious       = set("critical", "high")
+)
+
+// consistency checks that findings, the coverage ledger, the applicability
+// matrix, the control results and the recorded gates agree with each other, so
+// a gate or control cannot claim PASS against the run's own records.
+func consistency(run, genDir string, R map[string]map[string]any, add func(string, ...any)) error {
+	controls, err := rubricControls(run, R["run.json"])
+	if err != nil {
+		return err
+	}
+	fs := ovio.List(R["findings.json"]["findings"])
+	for _, it := range fs {
+		f := ovio.Obj(it)
+		fid := PyStr(f["id"])
+		if !domains[str(f, "domain")] {
+			add("finding %s: domain must be one of %s", fid, Repr(ovio.Domains))
+		}
+		if controls == nil {
+			continue
+		}
+		cs := ovio.List(f["controls"])
+		if len(cs) == 0 && severityOK[str(f, "status")] {
+			add("finding %s: a confirmed finding names the rubric controls it fails", fid)
+		}
+		for _, c := range cs {
+			if !controls.has(c) {
+				add("finding %s: unknown control %s", fid, PyStr(c))
+			}
+		}
+	}
+
+	cov := R["coverage.json"]
+	cells := ovio.List(cov["applicability"])
+	seen := vset{}
+	for _, it := range cells {
+		c := ovio.Obj(it)
+		key := Repr([]any{c["domain"], c["component"], c["lane"]})
+		if seen.has(key) {
+			add("applicability %s: duplicate cell", key)
+		}
+		seen.add(key)
+		if !domains[str(c, "domain")] || str(c, "component") == "" || str(c, "lane") == "" {
+			add("applicability %s: needs a known domain, a component and a lane", key)
+		}
+		st := str(c, "state")
+		if !cellStates[st] {
+			add("applicability %s: state must be applicable, not-applicable or blocked", key)
+		}
+		if st != "applicable" && !ovio.Truthy(c["reason"]) {
+			add("applicability %s: %s needs a reason", key, st)
+		}
+		for _, r := range ovio.List(c["receipts"]) {
+			if p := ovio.Str(r); p == "" || !inside(run, p) || !isFile(join(run, p)) {
+				add("applicability %s: receipt %s missing or outside the run dir", key, PyStr(r))
+			}
+		}
+	}
+	for _, it := range ovio.List(cov["files"]) {
+		for _, r := range ovio.List(ovio.Obj(it)["ranges"]) {
+			if st := str(ovio.Obj(r), "state"); !rangeStates[st] {
+				add("coverage %s: range state %s is not a coverage state", PyStr(ovio.Obj(it)["path"]), Repr(st))
+			}
+		}
+	}
+
+	results := ""
+	for _, name := range []string{"results-candidate.json", "results-baseline.json"} {
+		if isFile(join(genDir, name)) {
+			results = name
+			break
+		}
+	}
+	if results != "" {
+		doc, err := ovio.LoadObject(join(genDir, results))
+		if err != nil {
+			return err
+		}
+		res := ovio.Obj(doc["results"])
+		for _, it := range fs {
+			f := ovio.Obj(it)
+			if !openFinding[str(f, "status")] {
+				continue
+			}
+			for _, c := range ovio.List(f["controls"]) {
+				if str(ovio.Obj(res[ovio.Str(c)]), "status") == "PASS" {
+					add("finding %s: control %s is PASS in %s while the finding is %s",
+						PyStr(f["id"]), PyStr(c), results, str(f, "status"))
+				}
+			}
+		}
+	}
+
+	scp := join(genDir, "scorecard.json")
+	if !isFile(scp) {
+		return nil
+	}
+	sc, err := ovio.LoadObject(scp)
+	if err != nil {
+		return err
+	}
+	gates := ovio.Obj(sc["gates"])
+	claims := func(g string) bool { return str(gates, g) == "PASS" }
+	for _, it := range fs {
+		f := ovio.Obj(it)
+		fid, status := PyStr(f["id"]), str(f, "status")
+		if claims("G-NO-CRITICAL-HIGH") && openFinding[status] && serious[str(f, "severity")] {
+			add("scorecard: G-NO-CRITICAL-HIGH is PASS but finding %s is %s %s", fid, status, str(f, "severity"))
+		}
+		if claims("G-NO-OPEN-SERIOUS-LEAD") && (status == "candidate" || status == "needs-validation") &&
+			serious[str(f, "potential_impact")] {
+			add("scorecard: G-NO-OPEN-SERIOUS-LEAD is PASS but lead %s is open with potential impact %s", fid, str(f, "potential_impact"))
+		}
+	}
+	if !claims("G-COVERAGE") {
+		return nil
+	}
+	admitted := map[string]bool{}
+	for _, it := range ovio.List(R["dispatch.json"]["attempts"]) {
+		if x := ovio.Obj(it); str(x, "status") == "admitted" {
+			admitted[str(x, "receipt")] = true
+		}
+	}
+	if len(cells) == 0 {
+		add("scorecard: G-COVERAGE is PASS without an applicability matrix in coverage.json")
+	}
+	for _, it := range cells {
+		c := ovio.Obj(it)
+		key := Repr([]any{c["domain"], c["component"], c["lane"]})
+		switch str(c, "state") {
+		case "blocked":
+			add("scorecard: G-COVERAGE is PASS but applicability %s is blocked", key)
+		case "applicable":
+			if !checkedBy(run, str(c, "domain"), ovio.List(c["receipts"]), admitted) {
+				add("scorecard: G-COVERAGE is PASS but no admitted, non-gap receipt of applicability %s lists %s in domains_checked", key, str(c, "domain"))
+			}
+		}
+	}
+	for _, it := range ovio.List(cov["files"]) {
+		f := ovio.Obj(it)
+		if !ovio.Truthy(f["eligible"]) {
+			continue
+		}
+		rs := ovio.List(f["ranges"])
+		done := len(rs) > 0 || eq(f["lines"], jsonZero)
+		for _, r := range rs {
+			done = done && reviewedRange[str(ovio.Obj(r), "state")]
+		}
+		if !done {
+			add("scorecard: G-COVERAGE is PASS but eligible file %s has unreviewed ranges", PyStr(f["path"]))
+		}
+	}
+	return nil
+}
+
+// checkedBy reports whether any admitted, non-gap receipt records domain in
+// domains_checked.
+func checkedBy(run, domain string, receipts []any, admitted map[string]bool) bool {
+	for _, r := range receipts {
+		p := ovio.Str(r)
+		if !admitted[p] || !inside(run, p) || !isFile(join(run, p)) {
+			continue
+		}
+		rc, err := ovio.LoadObject(join(run, p))
+		if err != nil || str(rc, "outcome") == "gap" {
+			continue
+		}
+		if slices.ContainsFunc(ovio.List(rc["domains_checked"]), func(d any) bool { return d == any(domain) }) {
+			return true
+		}
+	}
+	return false
+}
+
+// rubricControls returns the control IDs of the run's rubric (revisions.rubric,
+// else the plan's pinned rubric), or nil when no rubric is frozen yet.
+func rubricControls(run string, rj map[string]any) (vset, error) {
+	revs := ovio.Obj(rj["revisions"])
+	rf := str(ovio.Obj(revs["rubric"]), "file")
+	if rf == "" {
+		if pf := str(ovio.Obj(revs["plan"]), "file"); pf != "" && inside(run, pf) && isFile(join(run, pf)) {
+			plan, err := ovio.LoadObject(join(run, pf))
+			if err != nil {
+				return nil, err
+			}
+			rf = str(ovio.Obj(plan["rubric"]), "file")
+		}
+	}
+	if rf == "" || !inside(run, rf) || !isFile(join(run, rf)) {
+		return nil, nil
+	}
+	doc, err := ovio.LoadObject(join(run, rf))
+	if err != nil {
+		return nil, err
+	}
+	ids := vset{}
+	for _, c := range ovio.List(doc["controls"]) {
+		ids.add(ovio.Obj(c)["id"])
+	}
+	return ids, nil
+}

package/engine/internal/overhaul/records/init.go

@@ -0,0 +1,132 @@
+package records
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"github.com/devrites/devrites/internal/gitenv"
+	"github.com/devrites/devrites/internal/overhaul/snapshot"
+)
+
+var runIDPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$`)
+
+// excludeLine is what init adds to the local .git/info/exclude when git does
+// not already ignore the run area. It never edits the shared .gitignore.
+const excludeLine = "/" + snapshot.RunAreaDir
+
+// initRun creates <repo>/.devrites/overhaul/<run-id>/ owner-only and makes
+// sure git ignores it, so run records never show up as repository changes.
+func initRun(repo, runID string, stdout io.Writer) error {
+	if !runIDPattern.MatchString(runID) {
+		return fmt.Errorf("run id %q: use 1-64 letters, digits, '.', '_' or '-', starting with a letter or digit", runID)
+	}
+	top, err := gitText(repo, "rev-parse", "--show-toplevel")
+	if err != nil {
+		return fmt.Errorf("%s is not a git repository: %v", repo, err)
+	}
+	runDir := filepath.Join(filepath.FromSlash(top), filepath.FromSlash(snapshot.RunAreaDir), runID)
+	if _, err := os.Lstat(runDir); err == nil {
+		return fmt.Errorf("run area %s already exists; resume it or pick a new run id", runDir)
+	}
+	probe := snapshot.RunAreaDir + runID + "/probe"
+	how := "already-ignored"
+	ignored, err := gitIgnores(top, probe)
+	if err != nil {
+		return err
+	}
+	if !ignored {
+		if err := addExclude(top); err != nil {
+			return err
+		}
+		if ignored, err = gitIgnores(top, probe); err != nil {
+			return err
+		}
+		if !ignored {
+			return fmt.Errorf("git still does not ignore %s after adding %s to info/exclude; a negated rule may re-include it", snapshot.RunAreaDir, excludeLine)
+		}
+		how = "added-to-info-exclude"
+	}
+	if err := os.MkdirAll(filepath.Dir(runDir), 0o700); err != nil {
+		return err
+	}
+	if err := os.Mkdir(runDir, 0o700); err != nil {
+		return err
+	}
+	b, err := json.Marshal(struct {
+		Run    string `json:"run"`
+		Ignore string `json:"ignore"`
+	}{runDir, how})
+	if err != nil {
+		return err
+	}
+	_, err = fmt.Fprintln(stdout, string(b))
+	return err
+}
+
+func addExclude(top string) error {
+	p, err := gitText(top, "rev-parse", "--git-path", "info/exclude")
+	if err != nil {
+		return err
+	}
+	path := filepath.FromSlash(p)
+	if !filepath.IsAbs(path) {
+		path = filepath.Join(top, path)
+	}
+	// #nosec G304 -- exclude file inside the repo's own resolved git dir
+	if data, err := os.ReadFile(path); err == nil {
+		for _, l := range strings.Split(string(data), "\n") {
+			if strings.TrimSpace(l) == excludeLine {
+				return nil
+			}
+		}
+	}
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		return err
+	}
+	// #nosec G304 -- exclude file inside the repo's own resolved git dir
+	f, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o644)
+	if err != nil {
+		return err
+	}
+	_, werr := fmt.Fprintf(f, "\n# /overhaul run records (local only)\n%s\n", excludeLine)
+	if cerr := f.Close(); werr == nil {
+		werr = cerr
+	}
+	return werr
+}
+
+// gitIgnores reports whether git's ignore rules match rel (tracked or not).
+func gitIgnores(top, rel string) (bool, error) {
+	cmd := gitCmd(top, "check-ignore", "-q", "--no-index", rel)
+	err := cmd.Run()
+	var ee *exec.ExitError
+	switch {
+	case err == nil:
+		return true, nil
+	case errors.As(err, &ee) && ee.ExitCode() == 1:
+		return false, nil
+	default:
+		return false, fmt.Errorf("git check-ignore: %v", err)
+	}
+}
+
+func gitText(dir string, args ...string) (string, error) {
+	out, err := gitCmd(dir, args...).Output()
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(string(out)), nil
+}
+
+func gitCmd(dir string, args ...string) *exec.Cmd {
+	cmd := exec.Command("git", append([]string{"-C", dir}, args...)...) // #nosec G204 -- fixed git binary; arguments passed as argv, no shell
+	cmd.Env = append(gitenv.Sanitize(os.Environ()), "GIT_OPTIONAL_LOCKS=0", "GIT_TERMINAL_PROMPT=0")
+	return cmd
+}

package/engine/internal/overhaul/records/init_test.go

@@ -0,0 +1,96 @@
+package records
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func gitRepo(t *testing.T) string {
+	t.Helper()
+	root := t.TempDir()
+	cmd := exec.Command("git", "init", "-q", root)
+	cmd.Env = append(os.Environ(), "GIT_CONFIG_GLOBAL="+os.DevNull, "GIT_CONFIG_NOSYSTEM=1")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("git init: %v %s", err, out)
+	}
+	return root
+}
+
+func initRunCmd(args ...string) (int, string, string) {
+	var o, e bytes.Buffer
+	code := Run(append([]string{"init"}, args...), &o, &e)
+	return code, o.String(), e.String()
+}
+
+func TestInitCreatesIgnoredRunArea(t *testing.T) {
+	repo := gitRepo(t)
+	code, out, errs := initRunCmd(repo, "ov-1")
+	if code != 0 {
+		t.Fatalf("init: %d %s", code, errs)
+	}
+	var got struct{ Run, Ignore string }
+	if err := json.Unmarshal([]byte(out), &got); err != nil {
+		t.Fatalf("output %q: %v", out, err)
+	}
+	want := filepath.Join(repo, ".devrites", "overhaul", "ov-1")
+	if r1, _ := filepath.EvalSymlinks(got.Run); r1 != mustEval(t, want) || got.Ignore != "added-to-info-exclude" {
+		t.Fatalf("got %+v, want run %s added-to-info-exclude", got, want)
+	}
+	if fi, err := os.Stat(want); err != nil || !fi.IsDir() || (runtime.GOOS != "windows" && fi.Mode().Perm() != 0o700) {
+		t.Fatalf("run dir: %v %v", fi, err)
+	}
+	b, _ := os.ReadFile(filepath.Join(repo, ".git", "info", "exclude"))
+	if !strings.Contains(string(b), "/.devrites/overhaul/\n") {
+		t.Fatalf("exclude file: %q", b)
+	}
+	// Idempotent exclude, refused reuse of an existing run id.
+	if code, _, _ := initRunCmd(repo, "ov-2"); code != 0 {
+		t.Fatal("second run id refused")
+	}
+	b2, _ := os.ReadFile(filepath.Join(repo, ".git", "info", "exclude"))
+	if strings.Count(string(b2), "/.devrites/overhaul/") != 1 {
+		t.Fatalf("exclude line duplicated: %q", b2)
+	}
+	if code, _, errs := initRunCmd(repo, "ov-1"); code != 2 || !strings.Contains(errs, "already exists") {
+		t.Fatalf("reuse: %d %s", code, errs)
+	}
+}
+
+func TestInitRespectsExistingIgnore(t *testing.T) {
+	repo := gitRepo(t)
+	write(t, filepath.Join(repo, ".gitignore"), ".devrites/\n")
+	code, out, errs := initRunCmd(repo, "ov-1")
+	if code != 0 || !strings.Contains(out, `"already-ignored"`) {
+		t.Fatalf("init: %d %s %s", code, out, errs)
+	}
+	if b, err := os.ReadFile(filepath.Join(repo, ".git", "info", "exclude")); err == nil && strings.Contains(string(b), "overhaul") {
+		t.Fatalf("exclude touched although already ignored: %q", b)
+	}
+}
+
+func TestInitRejectsBadInput(t *testing.T) {
+	repo := gitRepo(t)
+	for _, id := range []string{"", "../x", "a/b", ".hidden", "x y"} {
+		if code, _, _ := initRunCmd(repo, id); code != 2 {
+			t.Errorf("run id %q accepted", id)
+		}
+	}
+	if code, _, _ := initRunCmd(t.TempDir(), "ov-1"); code != 2 {
+		t.Error("non-repository accepted")
+	}
+}
+
+func mustEval(t *testing.T, p string) string {
+	t.Helper()
+	r, err := filepath.EvalSymlinks(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return r
+}