devrites 5.14.3 → 6.0.0

package/engine/internal/overhaul/render/visual.go

@@ -3,11 +3,13 @@ package render
 import (
 	"encoding/json"
 	"fmt"
+	"maps"
 	"math/big"
 	"sort"
 	"strings"
 
 	"github.com/devrites/devrites/internal/overhaul/ovio"
+	"github.com/devrites/devrites/internal/overhaul/score"
 )
 
 // The HTML view leads with pictures of the gaps: a score answer, a domain ×
@@ -97,21 +99,21 @@ func laneDomain(sc map[string]any, lane, domain string) *big.Rat {
 	return ratOf(ovio.Obj(ovio.Obj(ovio.Obj(ovio.Obj(sc["lanes"])[lane])["domains"])[domain]))
 }
 
-// floorFor is the scope's recorded minimum, else the skill's default.
+// floorFor is the scope's recorded minimum. It is nil when none was recorded
+// or the recorded one cannot be read, so the view says the minimum is unknown
+// instead of printing a number the record never held.
 func floorFor(sc map[string]any, scope string) *big.Rat {
-	if _, least, _ := threshold(sc, scope); least != nil {
-		return least
-	}
-	if strings.HasPrefix(scope, "domain ") {
-		return big.NewRat(9, 1)
-	}
-	return big.NewRat(97, 10)
+	_, least, _ := threshold(sc, scope)
+	return least
 }
 
 func gapClass(val, floor *big.Rat) string {
 	if val == nil {
 		return "gx"
 	}
+	if floor == nil {
+		return "c-unk" // no floor was read, so no gap can be stated
+	}
 	gap := new(big.Rat).Sub(floor, val)
 	for _, s := range gapSteps {
 		if s.upTo == nil || gap.Cmp(s.upTo) <= 0 {
@@ -128,6 +130,14 @@ func f2(r *big.Rat) string {
 	return floor2(r)
 }
 
+// floorText names a floor in prose: the recorded minimum, or that none was.
+func floorText(f *big.Rat) string {
+	if f == nil {
+		return "not recorded"
+	}
+	return f2(f)
+}
+
 // frac maps r/of onto 0..100 for SVG geometry.
 func frac(r, of *big.Rat) float64 {
 	if r == nil || of.Sign() == 0 {
@@ -149,8 +159,10 @@ func bullet(val, floor, base *big.Rat, cls, label string) string {
 	if base != nil && (val == nil || base.Cmp(val) != 0) {
 		fmt.Fprintf(&w, `<rect class="was" x="%.2f" y="0" width="0.8" height="10"/>`, max(0, frac(base, ten)-0.4))
 	}
-	fmt.Fprintf(&w, `<rect class="tgt" x="%.2f" y="0" width="0.6" height="10"/></svg>`, max(0, frac(floor, ten)-0.3))
-	return w.String()
+	if floor != nil {
+		fmt.Fprintf(&w, `<rect class="tgt" x="%.2f" y="0" width="0.6" height="10"/>`, max(0, frac(floor, ten)-0.3))
+	}
+	return w.String() + "</svg>"
 }
 
 // stack draws one horizontal stacked bar: segments are (class, value, label)
@@ -216,13 +228,14 @@ func (v view) summaryBlock(b *built, summary string, decide bool) string {
 	fmt.Fprintf(&w, `<h1 class="verdict %s">%s</h1>`, tone(verdict), esc(v.redact(text)))
 	if q != nil {
 		fmt.Fprintf(&w, `<p class="hero-num">%s<span> / 10</span></p>`, f2(q))
-		gap := new(big.Rat).Sub(qf, q)
-		if gap.Sign() > 0 {
+		if qf == nil {
+			w.WriteString(`<p class="muted">Target not recorded</p>`)
+		} else if gap := new(big.Rat).Sub(qf, q); gap.Sign() > 0 {
 			fmt.Fprintf(&w, `<p class="muted">Target %s · %s to go</p>`, f2(qf), f2(gap))
 		} else {
 			fmt.Fprintf(&w, `<p class="muted">Target %s · met</p>`, f2(qf))
 		}
-		w.WriteString(bullet(q, qf, scoreFor(base, "global"), gapClass(q, qf), "Global score "+f2(q)+" of 10, target "+f2(qf)))
+		w.WriteString(bullet(q, qf, scoreFor(base, "global"), gapClass(q, qf), "Global score "+f2(q)+" of 10, target "+floorText(qf)))
 	} else {
 		w.WriteString(`<p class="hero-num muted">No score yet</p>`)
 	}
@@ -232,7 +245,7 @@ func (v view) summaryBlock(b *built, summary string, decide bool) string {
 		for _, l := range lanes {
 			s, fl := scoreFor(cur, "lane "+l), floorFor(cur, "lane "+l)
 			fmt.Fprintf(&w, `<li><span class="lbl">%s</span>%s<span class="val">%s</span></li>`, esc(v.redact(l)),
-				bullet(s, fl, scoreFor(base, "lane "+l), gapClass(s, fl), l+" lane "+f2(s)+" of 10, target "+f2(fl)), f2(s))
+				bullet(s, fl, scoreFor(base, "lane "+l), gapClass(s, fl), l+" lane "+f2(s)+" of 10, target "+floorText(fl)), f2(s))
 		}
 		w.WriteString(`</ul>`)
 	}
@@ -241,18 +254,41 @@ func (v view) summaryBlock(b *built, summary string, decide bool) string {
 	}
 	w.WriteString(`</div><div class="blockers">`)
 	gates := ovio.Obj(cur["gates"])
-	var open []string
-	passing := 0
+	var open, waived []string
+	passing, na := 0, 0
 	for _, g := range sortedKeys(gates) {
 		switch pyStr(gates[g]) {
-		case "PASS", "NOT_APPLICABLE":
+		case "PASS":
 			passing++
+		case "NOT_APPLICABLE":
+			na++
+		case "WAIVED_OPERATIONAL": // score admits it only on G-CONCURRENCY with an approval
+			waived = append(waived, g)
 		default:
 			open = append(open, g)
 		}
 	}
+	// A scorecard that omits a gate its run requires has not cleared it.
+	if len(cur) > 0 {
+		absent := map[string]string{}
+		for _, g := range score.GateIDs(!ovio.Truthy(b.rj["assessment_only"])) {
+			if _, ok := gates[g]; !ok {
+				open = append(open, g)
+				absent[g] = absentGate
+			}
+		}
+		if len(absent) > 0 {
+			gates = maps.Clone(gates)
+			if gates == nil {
+				gates = map[string]any{}
+			}
+			for g, st := range absent {
+				gates[g] = st
+			}
+		}
+	}
 	if len(open) == 0 && len(gates) > 0 {
-		w.WriteString(`<h2>Nothing blocks readiness</h2><p class="muted">All ` + plural(passing, "gate passes", "gates pass") + `.</p>`)
+		w.WriteString(`<h2>Nothing blocks readiness</h2><p class="muted">` + plural(passing, "gate passes", "gates pass") + v.gateRest(na, waived) + `.</p>`)
 	} else if len(open) > 0 {
 		w.WriteString(`<h2>What blocks readiness</h2><ul class="gates">`)
 		for _, g := range open {
@@ -270,8 +306,8 @@ func (v view) summaryBlock(b *built, summary string, decide bool) string {
 				tone(st), gateMark(st), esc(v.redact(name)), esc(v.redact(g)), esc(v.redact(st)))
 		}
 		w.WriteString(`</ul>`)
-		if passing > 0 {
-			w.WriteString(`<p class="muted">` + plural(passing, "other gate passes", "other gates pass") + `.</p>`)
+		if passing+na+len(waived) > 0 {
+			w.WriteString(`<p class="muted">` + plural(passing, "other gate passes", "other gates pass") + v.gateRest(na, waived) + `.</p>`)
 		}
 	}
 	w.WriteString(`</div></div>`)
@@ -284,8 +320,24 @@ func (v view) summaryBlock(b *built, summary string, decide bool) string {
 	return w.String() + `</header>`
 }
 
+// gateRest names the gates that neither pass nor block: not applicable, or
+// waived under an approved degradation.
+func (v view) gateRest(na int, waived []string) string {
+	s := ""
+	if na > 0 {
+		s += fmt.Sprintf(" · %d not applicable", na)
+	}
+	if len(waived) > 0 {
+		s += " · waived with approval: " + esc(v.redact(strings.Join(waived, ", ")))
+	}
+	return s
+}
+
+// absentGate is the status shown for a required gate the scorecard omits.
+const absentGate = "NOT_RECORDED"
+
 func gateMark(status string) string {
-	if status == "UNKNOWN" {
+	if status == "UNKNOWN" || status == absentGate {
 		return "?"
 	}
 	return "✕"
@@ -305,14 +357,24 @@ func (b *built) scoreLanes(sc map[string]any) []string {
 	return out
 }
 
+// openFindings drops findings whose repair was independently verified.
+func openFindings(fs []map[string]any) []map[string]any {
+	return filter(fs, func(f map[string]any) bool { return ovio.Str(f["status"]) != "verified" })
+}
+
 func (v view) severityStrip(b *built) string {
 	n := map[string]int{}
-	for _, f := range b.cards["findings"] {
+	live := openFindings(b.cards["findings"])
+	for _, f := range live {
 		n[sevKey(f)]++
 	}
-	total := len(b.cards["findings"])
+	total := len(live)
+	head := plural(total, "open finding", "open findings")
+	if done := len(b.cards["findings"]) - total; done > 0 {
+		head += fmt.Sprintf(" · %d verified repaired", done)
+	}
 	var w strings.Builder
-	fmt.Fprintf(&w, `<div class="strip"><h2>%s</h2>`, plural(total, "confirmed finding", "confirmed findings"))
+	fmt.Fprintf(&w, `<div class="strip"><h2>%s</h2>`, head)
 	if total == 0 {
 		return w.String() + `<p class="muted">None recorded.</p></div>`
 	}
@@ -326,7 +388,7 @@ func (v view) severityStrip(b *built) string {
 		segs = append(segs, [3]any{"s-" + s, float64(n[s]), label})
 		keys = append(keys, [2]string{"s-" + s, fmt.Sprintf(`<a href="#findings">%s</a> <strong>%d</strong>`, sevLabel[s], n[s])})
 	}
-	w.WriteString(stack(segs, float64(total), "Confirmed findings by severity"))
+	w.WriteString(stack(segs, float64(total), "Open findings by severity"))
 	return w.String() + legend(keys...) + `</div>`
 }
 
@@ -363,7 +425,7 @@ func (v view) gapMap(b *built) string {
 		cell := func(s *big.Rat, who string) string {
 			cls := gapClass(s, fl)
 			return fmt.Sprintf(`<td class="cell %s"><span class="val">%s</span>%s</td>`, cls, f2(s),
-				bullet(s, fl, nil, cls, d+" · "+who+": "+f2(s)+" of 10, floor "+f2(fl)))
+				bullet(s, fl, nil, cls, d+" · "+who+": "+f2(s)+" of 10, floor "+floorText(fl)))
 		}
 		w.WriteString(`<tr><th scope="row"><a href="#controls">` + esc(v.redact(d)) + `</a></th>` + cell(scoreFor(cur, "domain "+d), "all lanes"))
 		for _, l := range lanes {
@@ -376,7 +438,7 @@ func (v view) gapMap(b *built) string {
 	for _, s := range gapSteps {
 		keys = append(keys, [2]string{s.cls, s.label})
 	}
-	keys = append(keys, [2]string{"tgt", "floor"})
+	keys = append(keys, [2]string{"c-unk", "floor not recorded"}, [2]string{"gx", "not scored"}, [2]string{"tgt", "floor"})
 	return w.String() + legend(keys...) + `</section>`
 }
 
@@ -394,7 +456,7 @@ func (v view) controlLoss(b *built) string {
 	for _, c := range objs(b.rubric["controls"]) {
 		d := pyStr(c["domain"])
 		st := pyStr(status[pyStr(c["id"])])
-		if st == "NOT_APPLICABLE" {
+		if c["na"] != nil || st == "NOT_APPLICABLE" {
 			continue
 		}
 		wt := 1.0
@@ -461,11 +523,11 @@ func (v view) hotspots(b *built) string {
 		score int
 	}
 	by := map[string]*spot{}
-	for _, f := range b.cards["findings"] {
+	for _, f := range openFindings(b.cards["findings"]) {
 		p := "(no location)"
 		if l := ovio.List(f["locations"]); len(l) > 0 {
 			if s := ovio.Str(ovio.Obj(l[0])["path"]); s != "" {
-				p = area(s)
+				p = area(v.redact(s))
 			}
 		}
 		s := by[p]
@@ -507,7 +569,7 @@ func (v view) hotspots(b *built) string {
 		most = max(most, s.total)
 	}
 	var w strings.Builder
-	w.WriteString(`<section id="hotspots"><h2>Where in the code</h2><p class="lede">Confirmed findings by code area, ranked by severity.</p><ul class="rows">`)
+	w.WriteString(`<section id="hotspots"><h2>Where in the code</h2><p class="lede">Open findings by code area, ranked by severity.</p><ul class="rows">`)
 	for _, s := range spots {
 		var segs [][3]any
 		var parts []string
@@ -517,8 +579,8 @@ func (v view) hotspots(b *built) string {
 				parts = append(parts, fmt.Sprintf("%s %d", sevLabel[k], s.n[k]))
 			}
 		}
-		fmt.Fprintf(&w, `<li><span class="lbl"><code>%s</code></span>%s<span class="val">%d</span></li>`, esc(v.redact(s.name)),
-			stack(segs, float64(most), s.name+": "+strings.Join(parts, ", ")), s.total)
+		fmt.Fprintf(&w, `<li><span class="lbl"><code>%s</code></span>%s<span class="val wide">%d · %s</span></li>`, esc(v.redact(s.name)),
+			stack(segs, float64(most), s.name+": "+strings.Join(parts, ", ")), s.total, esc(strings.Join(parts, ", ")))
 	}
 	w.WriteString(`</ul>`)
 	var keys [][2]string

package/engine/internal/overhaul/score/run.go

@@ -6,6 +6,8 @@
 package score
 
 import (
+	"crypto/sha256"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -20,6 +22,16 @@ import (
 
 const calc = "overhaul-score/1"
 
+// GateIDs lists every gate a complete scorecard records: G-THRESHOLDS plus the
+// audit gates, and the repair gates for a remediation run.
+func GateIDs(remediation bool) []string {
+	ids := append([]string{"G-THRESHOLDS"}, auditGates...)
+	if remediation {
+		ids = append(ids, repairGates...)
+	}
+	return ids
+}
+
 const usage = `usage: overhaul score --rubric <r.json> --results <s.json> --gates <g.json> [--out <scorecard.json>]
        overhaul score compare --rubric <r.json> --baseline <a.json> --candidate <b.json>`
 
@@ -438,6 +450,14 @@ func score(rubric, results, gates map[string]any) (map[string]any, error) {
 	if results["schema"] != "overhaul.results/1" {
 		return nil, fmt.Errorf("results schema must be overhaul.results/1")
 	}
+	// The scorecard copies both fields verbatim and every consumer reads them
+	// from there, so an absent one publishes a scorecard bound to no code state.
+	if ovio.Str(results["subject"]) == "" {
+		return nil, fmt.Errorf("results: subject must be a non-empty string")
+	}
+	if sum, err := hex.DecodeString(ovio.Str(results["fingerprint"])); err != nil || len(sum) != sha256.Size {
+		return nil, fmt.Errorf("results: fingerprint must be 64 hex characters")
+	}
 	rres := ovio.Obj(results["results"])
 	if rres == nil && ovio.Truthy(results["results"]) {
 		return nil, fmt.Errorf("results.results must be an object")

package/engine/internal/overhaul/score/run_test.go

@@ -16,6 +16,8 @@ import (
 
 var doms = []string{"correctness", "security", "reliability", "performance", "tests", "architecture", "ux", "operations"}
 
+var fp = strings.Repeat("a", 64)
+
 func ctl(i int, d string, w any, lanes ...string) map[string]any {
 	if len(lanes) == 0 {
 		lanes = []string{"backend"}
@@ -34,7 +36,7 @@ func resOf(status map[string]string) map[string]any {
 	for k, v := range status {
 		r[k] = map[string]any{"status": v, "evidence": []string{"EV-1"}}
 	}
-	return map[string]any{"schema": "overhaul.results/1", "subject": "candidate", "results": r}
+	return map[string]any{"schema": "overhaul.results/1", "subject": "candidate", "fingerprint": fp, "results": r}
 }
 
 func passing() map[string]any {
@@ -258,6 +260,46 @@ func TestMonotonicity(t *testing.T) {
 	}
 }
 
+// Adding a FAIL or UNKNOWN control strictly lowers its own domain and never raises any domain.
+func TestAddedNonPassControlLowersItsDomain(t *testing.T) {
+	b := base()
+	top := mustScore(t, rubricOf(b), resOf(allPass(b)), passing())
+	for _, d := range doms {
+		for _, status := range []string{"FAIL", "UNKNOWN"} {
+			t.Run(d+"/"+status, func(t *testing.T) {
+				cs := append(base(), ctl(50, d, 1, "frontend", "backend"))
+				st := allPass(cs)
+				st["C-050"] = status
+				out := mustScore(t, rubricOf(cs), resOf(st), passing())
+				for _, o := range doms {
+					p := "global.domains." + o + ".exact"
+					cmp := exact(t, out, p).Cmp(exact(t, top, p))
+					if o == d && cmp >= 0 {
+						t.Fatalf("%s control did not lower %s: %s", status, d, get(out, p))
+					}
+					if cmp > 0 {
+						t.Fatalf("%s control in %s raised %s", status, d, o)
+					}
+				}
+			})
+		}
+	}
+}
+
+// A control shared by two lanes adds its weight to the global domain denominator once.
+func TestSharedControlWeightCountsOnceGlobally(t *testing.T) {
+	cs := []map[string]any{ctl(0, "correctness", 5, "frontend", "backend"), ctl(1, "correctness", 5, "backend")}
+	for _, d := range doms[1:] {
+		cs = append(cs, ctl(2+len(cs), d, 5, "frontend", "backend"))
+	}
+	st := allPass(cs)
+	st["C-001"] = "FAIL"
+	out := mustScore(t, rubricOf(cs), resOf(st), passing())
+	if got := get(out, "global.domains.correctness.exact"); got != "5/1" {
+		t.Fatalf("correctness = %s, want 5/1", got)
+	}
+}
+
 // 8. Duplicate control ids, weights off the 1/3/5 scale and unknown evaluations are invalid input.
 func TestInvalidCatalog(t *testing.T) {
 	zero := base()
@@ -479,3 +521,116 @@ func TestRubricDigestRequired(t *testing.T) {
 		}
 	}
 }
+
+// A results document that names no code state is invalid input: exit 2, one
+// diagnostic naming the absent field, and no scorecard written.
+func TestResultsMustIdentifyScoredState(t *testing.T) {
+	dir := t.TempDir()
+	b := base()
+	rp := writeJSON(t, dir, "r.json", rubricOf(b))
+	g := writeJSON(t, dir, "g.json", passing())
+	for i, tc := range []struct {
+		name   string
+		mutate func(map[string]any)
+		want   string
+	}{
+		{"fingerprint absent", func(r map[string]any) { delete(r, "fingerprint") }, "fingerprint"},
+		{"fingerprint null", func(r map[string]any) { r["fingerprint"] = nil }, "fingerprint"},
+		{"fingerprint empty", func(r map[string]any) { r["fingerprint"] = "" }, "fingerprint"},
+		{"fingerprint placeholder", func(r map[string]any) { r["fingerprint"] = "not-a-sha256" }, "fingerprint"},
+		{"fingerprint one short", func(r map[string]any) { r["fingerprint"] = fp[:len(fp)-1] }, "fingerprint"},
+		{"fingerprint non-hex", func(r map[string]any) { r["fingerprint"] = strings.Repeat("z", 64) }, "fingerprint"},
+		{"subject absent", func(r map[string]any) { delete(r, "subject") }, "subject"},
+		{"subject empty", func(r map[string]any) { r["subject"] = "" }, "subject"},
+		{"subject not a string", func(r map[string]any) { r["subject"] = 12 }, "subject"},
+	} {
+		res := pinned(t, rp, resOf(allPass(b)))
+		tc.mutate(res)
+		sp := writeJSON(t, dir, "s.json", res)
+		card := filepath.Join(dir, fmt.Sprintf("card-%d.json", i))
+		other := "fingerprint"
+		if tc.want == "fingerprint" {
+			other = "subject"
+		}
+		code, stdout, stderr := runCLI("--rubric", rp, "--results", sp, "--gates", g, "--out", card)
+		switch {
+		case code != 2:
+			t.Errorf("%s: exit %d, want 2 (stdout %q stderr %q)", tc.name, code, stdout, stderr)
+		case stdout != "":
+			t.Errorf("%s: published %q", tc.name, stdout)
+		case !strings.HasPrefix(stderr, "ERROR: "):
+			t.Errorf("%s: %q is not a tool diagnostic", tc.name, stderr)
+		case !strings.Contains(stderr, tc.want):
+			t.Errorf("%s: %q does not name %s", tc.name, stderr, tc.want)
+		case strings.Contains(stderr, other):
+			t.Errorf("%s: %q names %s, not %s", tc.name, stderr, other, tc.want)
+		case strings.Contains(stderr, "rubric_digest"):
+			t.Errorf("%s: the digest check fired, not the field check: %q", tc.name, stderr)
+		}
+		if _, err := os.Stat(card); err == nil {
+			t.Errorf("%s: wrote a scorecard for an unidentified code state", tc.name)
+		}
+	}
+}
+
+// The exit 2 above is the absent field, not scoring: identified results score,
+// and a failing control is a scorecard at exit 0 carrying the validated
+// fingerprint verbatim.
+func TestIdentifiedResultsStillScore(t *testing.T) {
+	dir := t.TempDir()
+	b := base()
+	rp := writeJSON(t, dir, "r.json", rubricOf(b))
+	g := writeJSON(t, dir, "g.json", passing())
+	card := filepath.Join(dir, "card.json")
+	code, stdout, stderr := runCLI("--rubric", rp, "--results", writeJSON(t, dir, "s.json", pinned(t, rp, resOf(allPass(b)))),
+		"--gates", g, "--out", card)
+	if code != 0 || stderr != "" {
+		t.Fatalf("identified results: exit %d stdout %q stderr %q", code, stdout, stderr)
+	}
+	c, err := ovio.LoadObject(card)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if get(c, "fingerprint") != fp || get(c, "subject") != "candidate" || get(c, "readiness_verdict") != "MEETS_TARGETS" {
+		t.Fatalf("scorecard %v", c)
+	}
+	st := allPass(b)
+	st[b[0]["id"].(string)] = "FAIL"
+	code, _, stderr = runCLI("--rubric", rp, "--results", writeJSON(t, dir, "f.json", pinned(t, rp, resOf(st))), "--gates", g)
+	if code != 0 || stderr != "" {
+		t.Fatalf("failing control: exit %d stderr %q", code, stderr)
+	}
+	out := mustScore(t, rubricOf(b), resOf(st), passing())
+	if get(out, "readiness_verdict") != "NOT_READY" || get(out, "fingerprint") != fp {
+		t.Fatalf("failing control: verdict %s fingerprint %s", get(out, "readiness_verdict"), get(out, "fingerprint"))
+	}
+}
+
+// compare scores both arms through the same check, so an arm that identifies no
+// code state is rejected with the arm named.
+func TestCompareArmsRequireScoredState(t *testing.T) {
+	dir := t.TempDir()
+	b := base()
+	rp := writeJSON(t, dir, "r.json", rubricOf(b))
+	arm := func(name string, identified bool) string {
+		res := pinned(t, rp, resOf(allPass(b)))
+		if !identified {
+			delete(res, "fingerprint")
+		}
+		return writeJSON(t, dir, name, res)
+	}
+	for _, tc := range []struct {
+		arm       string
+		baseline  string
+		candidate string
+	}{
+		{"baseline", arm("blank-baseline.json", false), arm("ok-candidate.json", true)},
+		{"candidate", arm("ok-baseline.json", true), arm("blank-candidate.json", false)},
+	} {
+		code, stdout, stderr := runCLI("compare", "--rubric", rp, "--baseline", tc.baseline, "--candidate", tc.candidate)
+		if code != 2 || stdout != "" || !strings.HasPrefix(stderr, "ERROR: "+tc.arm+": ") ||
+			!strings.Contains(stderr, "fingerprint") {
+			t.Fatalf("%s arm: exit %d stdout %q stderr %q", tc.arm, code, stdout, stderr)
+		}
+	}
+}

package/engine/internal/overhaul/snapshot/run.go

@@ -9,6 +9,7 @@ package snapshot
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -22,6 +23,7 @@ import (
 	"slices"
 	"sort"
 	"strings"
+	"syscall"
 	"time"
 
 	"github.com/devrites/devrites/internal/gitenv"
@@ -38,10 +40,14 @@ const usage = `usage: devrites-engine overhaul snapshot <command> ...
 `
 
 var sensitive = []string{".env", ".env.*", "*.key", "*.p12", "*.pfx", "*.keystore", "*.jks", ".npmrc", ".pypirc", ".netrc",
-	"*credentials*", "*secret*", "*.tfstate", "*.tfvars"}
+	"*credentials*", "*secret*", "*.tfstate", "*.tfvars", "*.pem", "*.asc", "*.pgp", "*.gpg", "*.p8"}
 
-// keyMarker flags private key material in any file, whatever its name.
-var keyMarker = []byte("PRIVATE KEY-----")
+// keyMarkers flag private key material in any file, whatever its name.
+var keyMarkers = [][]byte{[]byte("PRIVATE KEY-----"), []byte("PRIVATE KEY BLOCK-----")}
+
+// keyCarry is kept between reads so a marker split across two reads is still
+// matched; it must be at least the longest marker minus one.
+const keyCarry = 31
 
 var diffArgs = []string{"-c", "diff.autoRefreshIndex=false", "diff", "--no-ext-diff", "--no-textconv", "--no-color",
 	"--src-prefix=a/", "--dst-prefix=b/", "--binary"}
@@ -127,18 +133,48 @@ func exit(err error) (int, error) {
 	return 0, nil
 }
 
+var gitTimeout = 60 * time.Second
+
+// gitWaitDelay bounds how long git waits for output pipes to close after the
+// timeout kill; a hook grandchild may keep them open.
+const gitWaitDelay = 5 * time.Second
+
 func git(root string, args ...string) ([]byte, error) {
-	cmd := exec.Command("git", append([]string{"-C", root}, args...)...) // #nosec G204 -- fixed git binary; arguments passed as argv, no shell
+	var out bytes.Buffer
+	if err := gitTo(&out, root, args...); err != nil {
+		return nil, err
+	}
+	return out.Bytes(), nil
+}
+
+// gitTo streams git's stdout to w; the run is killed after gitTimeout.
+func gitTo(w io.Writer, root string, args ...string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), gitTimeout)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, "git", append([]string{"-C", root}, args...)...) // #nosec G204 -- fixed git binary; arguments passed as argv, no shell
 	cmd.Env = append(gitenv.Sanitize(os.Environ()), "GIT_OPTIONAL_LOCKS=0", "GIT_TERMINAL_PROMPT=0")
-	out, err := cmd.Output()
-	if err != nil {
-		var ee *exec.ExitError
-		if errors.As(err, &ee) {
-			return nil, fmt.Errorf("git %s: %v: %s", strings.Join(args, " "), err, bytes.TrimSpace(ee.Stderr))
+	cmd.WaitDelay = gitWaitDelay
+	var stderr bytes.Buffer
+	cmd.Stdout, cmd.Stderr = w, &stderr
+	if err := cmd.Run(); err != nil {
+		if ctx.Err() != nil {
+			err = fmt.Errorf("%w: %v", ctx.Err(), err)
 		}
-		return nil, fmt.Errorf("git %s: %v", strings.Join(args, " "), err)
+		return fmt.Errorf("git %s: %v: %s", strings.Join(args, " "), err, bytes.TrimSpace(stderr.Bytes()))
 	}
-	return out, nil
+	return nil
+}
+
+func gitToFile(dst, root string, args ...string) error {
+	f, err := os.OpenFile(dst, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600) // #nosec G304 -- destination inside the new owner-only snapshot directory
+	if err != nil {
+		return err
+	}
+	err = gitTo(f, root, args...)
+	if cerr := f.Close(); err == nil {
+		err = cerr
+	}
+	return err
 }
 
 func split0(b []byte) []string {
@@ -240,9 +276,12 @@ func permBits(m fs.FileMode) int {
 
 func digest(p string) (string, int, error) {
 	fi, err := os.Lstat(p)
-	if err != nil {
+	if errors.Is(err, fs.ErrNotExist) || errors.Is(err, syscall.ENOTDIR) {
 		return "deleted", 0, nil
 	}
+	if err != nil {
+		return "", 0, err
+	}
 	switch {
 	case fi.Mode()&fs.ModeSymlink != 0:
 		target, err := os.Readlink(p)
@@ -267,8 +306,25 @@ func holdsKey(p string) (bool, error) {
 		return false, err
 	}
 	defer func() { _ = f.Close() }()
-	head, err := io.ReadAll(io.LimitReader(f, 65536))
-	return bytes.Contains(head, keyMarker), err
+	const chunk = 65536
+	buf := make([]byte, chunk+keyCarry)
+	n := 0 // bytes of buf already holding carry
+	for {
+		m, err := f.Read(buf[n : n+chunk])
+		window := buf[:n+m]
+		for _, marker := range keyMarkers {
+			if bytes.Contains(window, marker) {
+				return true, nil
+			}
+		}
+		if err == io.EOF {
+			return false, nil
+		}
+		if err != nil {
+			return true, err
+		}
+		n = copy(buf, window[max(0, len(window)-keyCarry):])
+	}
 }
 
 func isSensitiveName(p string) bool {
@@ -309,7 +365,8 @@ func state(root string) (map[string]*entry, error) {
 	return out, nil
 }
 
-func indexDigest(root string) (string, error) {
+// indexDigest is a variable so tests can simulate the index moving mid-capture.
+var indexDigest = func(root string) (string, error) {
 	b, err := git(root, "ls-files", "-s", "-z")
 	if err != nil {
 		return "", err
@@ -420,11 +477,7 @@ func capture(root, out string, stdout io.Writer) error {
 		{"staged.patch", slices.Concat(diffArgs, []string{"--cached"}, safe)},
 		{"unstaged.patch", slices.Concat(diffArgs, safe)},
 	} {
-		b, err := git(root, o.args...)
-		if err != nil {
-			return err
-		}
-		if err := os.WriteFile(filepath.Join(out, o.name), b, 0o600); err != nil {
+		if err := gitToFile(filepath.Join(out, o.name), root, o.args...); err != nil {
 			return err
 		}
 	}
@@ -445,8 +498,12 @@ func capture(root, out string, stdout io.Writer) error {
 	if err != nil {
 		return err
 	}
+	fp := fingerprint(st)
+	if fingerprint(now) != fp {
+		return errors.New("working tree changed during capture; stop and reconcile with the user")
+	}
 	man := manifest{Schema: "overhaul.snapshot/1", Root: root, Head: head, IndexSHA256: before,
-		Fingerprint: fingerprint(now), Files: st, Submodules: gitlinks}
+		Fingerprint: fp, Files: st, Submodules: gitlinks}
 	if err := ovio.WriteJSON(filepath.Join(out, "manifest.json"), man, 0o600); err != nil {
 		return err
 	}