devrites 5.14.3 → 6.0.0

package/engine/internal/acceptance/acceptance_test.go

@@ -231,10 +231,10 @@ func TestReduceCountsAndIds(t *testing.T) {
 	if len(red.UnapprIDs) != 2 {
 		t.Fatalf("unapproved ids=%v", red.UnapprIDs)
 	}
-	// A nil approved surface (unreadable plan) reports no unapproved diagnostic.
+	// A nil approval surface approves nothing: every unmet runnable gate is unapproved.
 	red = doc.Reduce(nil)
-	if len(red.UnapprIDs) != 0 {
-		t.Fatalf("nil approved must not flag: %v", red.UnapprIDs)
+	if len(red.UnapprIDs) != 2 {
+		t.Fatalf("nil approved must flag every unmet runnable gate: %v", red.UnapprIDs)
 	}
 }
 
@@ -293,8 +293,9 @@ func TestApprovedCommandsNoSection(t *testing.T) {
 	if approved := ApprovedCommands([]byte("# Plan\n\nno table\n")); len(approved) != 0 {
 		t.Fatalf("approved=%+v", approved)
 	}
-	if approved := ApprovedCommands(nil); approved != nil {
-		t.Fatalf("nil plan must approve nothing: %+v", approved)
+	// A nil plan approves nothing and reports it as an empty value, never nil.
+	if approved := ApprovedCommands(nil); approved == nil || len(approved) != 0 {
+		t.Fatalf("nil plan must approve nothing, and report it as a value: %+v", approved)
 	}
 }
 
@@ -553,8 +554,9 @@ func TestLintMostlyManualAndCounts(t *testing.T) {
 	if !mostlyManual {
 		t.Fatalf("findings=%+v", findings)
 	}
+	// The one runnable gate (G1) has no approved row, so lint reports an error.
 	errs, warns := LintCounts(findings)
-	if errs != 0 || warns == 0 {
+	if errs != 1 || warns == 0 {
 		t.Fatalf("counts=%d/%d", errs, warns)
 	}
 }
@@ -567,7 +569,7 @@ func TestScaffoldLedger(t *testing.T) {
 	if len(doc.Errors) != 0 || len(doc.Gates) != 1 || doc.Gates[0].ID != "G1" {
 		t.Fatalf("placeholder scaffold malformed: %v %+v", doc.Errors, doc.Gates)
 	}
-	spec := []byte("# Spec\n\n- AC-002 first\n- AC-001 second\n- AC-002 repeated\n")
+	spec := []byte("# Spec\n\n## Acceptance criteria\n\n- AC-002 first\n- AC-001 second\n- AC-002 repeated\n\n## Non-goals\n\n- AC-003 not required\n")
 	scaffolded := ScaffoldLedger("feat", spec)
 	doc = ParseLedger(scaffolded)
 	if len(doc.Errors) != 0 || len(doc.Gates) != 2 || doc.Gates[0].ID != "AC-002" || doc.Gates[1].ID != "AC-001" {
@@ -653,3 +655,292 @@ func mustRead(t *testing.T, path string) string {
 	}
 	return string(raw)
 }
+
+// An unresolvable approval surface is refused, never executed. Each consumer
+// (run, reduce, lint) is asserted at its own guard, and nil and empty surfaces
+// must behave identically.
+
+func TestApprovedCommandsNeverNilSurface(t *testing.T) {
+	// ApprovedCommands never returns nil: a consumer must be able to refuse on an
+	// empty surface.
+	cases := map[string][]byte{
+		"absent file (empty input)": nil,
+		"invalid utf8":              {0xff, 0xfe, 0x00, 'a'},
+		"no preflight section":      []byte("# Test plan\n\n## Plan\nnothing here\n"),
+		"heading only":              []byte("## Build-entry preflight\n"),
+		"header row only":           []byte("## Build-entry preflight\n| command | cwd |\n"),
+	}
+	for name, in := range cases {
+		got := ApprovedCommands(in)
+		if got == nil {
+			t.Errorf("CASE %s: ApprovedCommands returned nil; nil reads as 'approval not applicable' so every CHECK executes unreviewed. Must return a non-nil (possibly empty) surface.", name)
+			continue
+		}
+		if len(got) != 0 {
+			t.Errorf("CASE %s: ApprovedCommands = %v; want non-nil empty (nothing was approved)", name, got)
+		}
+	}
+}
+
+func TestRunGatesRefusesUnresolvableApprovalSurface(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		approved []ApprovedCommand
+	}{
+		{"nil surface", nil},
+		{"empty non-nil surface", []ApprovedCommand{}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			project := t.TempDir()
+			work := filepath.Join(project, ".devrites", "work", "feat")
+			if err := os.MkdirAll(work, 0o755); err != nil {
+				t.Fatal(err)
+			}
+			ledgerPath := filepath.Join(work, GatesFile)
+			body := "- [ ] G1: unreviewed oracle\n  CHECK: echo UNAPPROVED-MUST-NOT-RUN\n  EXPECT: UNAPPROVED-MUST-NOT-RUN\n  EVIDENCE: pending\n"
+			if err := os.WriteFile(ledgerPath, []byte(body), 0o644); err != nil {
+				t.Fatal(err)
+			}
+			doc := ParseLedger(mustRead(t, ledgerPath))
+			results := RunGates(context.Background(), project, ledgerPath, doc, tc.approved, false, 10*time.Second)
+			if len(results) != 1 {
+				t.Fatalf("results=%+v", results)
+			}
+			r := results[0]
+			if r.Ran {
+				t.Errorf("DEFECT: gate executed under a %s approval surface (passed=%v detail=%q). An unreviewed CHECK must not execute when approvals cannot be established.", tc.name, r.Passed, r.Detail)
+			}
+			if r.Passed {
+				t.Errorf("DEFECT: gate reported passed under a %s approval surface; certification must not happen.", tc.name)
+			}
+			if !strings.Contains(r.Detail, "not an approved") {
+				t.Errorf("detail=%q; want a refusal naming the unapproved CHECK", r.Detail)
+			}
+			after := mustRead(t, ledgerPath)
+			if strings.Contains(after, EvidenceMarker) {
+				t.Errorf("DEFECT: ledger was certified with automatic evidence under a %s approval surface:\n%s", tc.name, after)
+			}
+			if !strings.Contains(after, "EVIDENCE: pending") {
+				t.Errorf("ledger evidence was mutated under a %s approval surface:\n%s", tc.name, after)
+			}
+			if red := doc.Reduce(tc.approved); red.Unapproved != 1 {
+				t.Errorf("reduction under %s surface: Unapproved=%d; want 1 so `gates status` cannot report unapproved: 0", tc.name, red.Unapproved)
+			}
+		})
+	}
+}
+
+func TestLintFlagsNilAndEmptyApprovalSurfaceIdentically(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		approved []ApprovedCommand
+	}{
+		{"nil surface", nil},
+		{"empty surface", []ApprovedCommand{}},
+	} {
+		doc := &Document{Abandoned: map[string]string{}}
+		g := runnableGate("G1", true, "pending")
+		g.Check = "echo anything"
+		g.Cwd = ""
+		doc.Gates = []*Gate{g}
+		found := false
+		for _, f := range LintLedger(doc, tc.approved) {
+			if f.Rule == "unapproved-check" && strings.Contains(f.Message, "echo anything") {
+				found = true
+			}
+		}
+		if !found {
+			t.Errorf("DEFECT: Lint(%s) reported no unapproved-check finding; `gates lint --strict` reports LINT OK instead of the authorization error.", tc.name)
+		}
+	}
+}
+
+// Refusal applies only where a command would actually execute; manual and
+// already-met gates must not be blocked by an unresolvable approval surface.
+func TestUnresolvableApprovalDoesNotBlockNonExecutingGates(t *testing.T) {
+	project := t.TempDir()
+
+	// Manual gates execute nothing, so there is nothing to authorize.
+	manualOnly := ParseLedger("- [x] M1: human judged\n  EVIDENCE: a stranger checked the transcript\n")
+	if red := manualOnly.Reduce(nil); !red.AllMet() {
+		t.Errorf("a manual-only ledger has no CHECK to approve and must still reduce all-met: %+v", red)
+	}
+	if red := manualOnly.Reduce(nil); red.Unapproved != 0 {
+		t.Errorf("manual gates are not executions and must not count as unapproved: %+v", red)
+	}
+	for _, f := range LintLedger(manualOnly, nil) {
+		if f.Rule == "unapproved-check" {
+			t.Errorf("manual gates must never be flagged unapproved: %+v", f)
+		}
+	}
+
+	// An already-met runnable gate returns before the approval guard, so a
+	// workspace whose gates were vetted and met in an earlier run keeps its state.
+	met := runnableGate("R1", true, "")
+	met.Check = "echo already"
+	met.Expect = "already"
+	met.Evidence = FormatEvidence(met, OutputDigest("already\n"), 8, "2026-01-01T00:00:00Z")
+	if got := GateState(met, &Document{Abandoned: map[string]string{}}); got != StateMet {
+		t.Fatalf("fixture must be genuinely met, not %s", got)
+	}
+	manualUnmet := &Gate{ID: "M2", Title: "human judged", Evidence: "pending"}
+	doc := &Document{Abandoned: map[string]string{}, Gates: []*Gate{manualUnmet, met}}
+	for _, r := range RunGates(context.Background(), project, filepath.Join(project, "unused.md"), doc, nil, false, 10*time.Second) {
+		if strings.Contains(r.Detail, "not an approved") {
+			t.Errorf("gate %s was refused for approval although it never executes: %q", r.ID, r.Detail)
+		}
+		switch r.ID {
+		case "M2":
+			if !strings.Contains(r.Detail, "manual gate") {
+				t.Errorf("M2 detail=%q; want the manual-gate wording, proving the approval guard was never reached", r.Detail)
+			}
+		case "R1":
+			if !strings.Contains(r.Detail, "already met") {
+				t.Errorf("R1 detail=%q; want already-met, proving a vetted pass is not re-litigated", r.Detail)
+			}
+		}
+	}
+}
+
+// An unreadable test-plan.md leaves every runnable CHECK unapproved: the runner
+// refuses it and the reduction and lint report it, whatever the value's nil-ness.
+func TestLoadTestPlanUnreadableApprovesNothing(t *testing.T) {
+	approved := loadTestPlan(filepath.Join(t.TempDir(), "missing", "test-plan.md"))
+	if Approved("echo hi", "", approved) {
+		t.Fatalf("unreadable plan approved a command: %+v", approved)
+	}
+	g := runnableGate("G1", true, "pending")
+	g.Check = "echo hi"
+	doc := &Document{Abandoned: map[string]string{}, Gates: []*Gate{g}}
+	if red := doc.Reduce(approved); red.Unapproved != 1 {
+		t.Fatalf("Unapproved=%d; want 1", red.Unapproved)
+	}
+	errs, _ := LintCounts(LintLedger(doc, approved))
+	if errs != 1 {
+		t.Fatalf("lint errs=%d; want 1 unapproved-check", errs)
+	}
+}
+
+// `gates attest` refuses a placeholder note at write time, so a manual gate is
+// never left checked on evidence the reader would later reject.
+func TestAttestRefusesPlaceholderNotes(t *testing.T) {
+	placeholders := []string{"n/a", "tbd", "-", "ok", "done", "yes", "pending", "PENDING", "verified", "TODO", "N/A", "none", "n/a (see notes)", "done.", "AC-004: outcome seen", "outcome seen", "AC-004 - outcome seen", "**done**"}
+	for _, note := range placeholders {
+		project := t.TempDir()
+		root := filepath.Join(project, ".devrites")
+		work := filepath.Join(root, "work", "feat")
+		if err := os.MkdirAll(work, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		ledgerPath := filepath.Join(work, GatesFile)
+		body := "- [ ] AC-004: outcome seen\n  EVIDENCE: pending\n"
+		writeLedger(t, ledgerPath, body)
+		var stdout, stderr strings.Builder
+		if code := Run(root, []string{"attest", "feat", "AC-004", note}, &stdout, &stderr); code == ExitOK {
+			t.Errorf("placeholder %q was accepted at write time", note)
+		}
+		if !strings.Contains(stderr.String(), "placeholder") {
+			t.Errorf("placeholder %q: stderr=%q; want a message naming the placeholder", note, stderr.String())
+		}
+		if got := mustRead(t, ledgerPath); got != body {
+			t.Errorf("placeholder %q mutated the ledger:\n%s", note, got)
+		}
+	}
+}
+
+// The refusal must say a trailing parenthetical after a placeholder word is
+// ignored, since the note otherwise appears to already cite who and where.
+func TestAttestRefusalExplainsIgnoredParenthetical(t *testing.T) {
+	project := t.TempDir()
+	root := filepath.Join(project, ".devrites")
+	work := filepath.Join(root, "work", "feat")
+	if err := os.MkdirAll(work, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	writeLedger(t, filepath.Join(work, GatesFile), "- [ ] AC-004: outcome seen\n  EVIDENCE: pending\n")
+	var stdout, stderr strings.Builder
+	note := "done (verified on staging by Ann, q-12)"
+	if code := Run(root, []string{"attest", "feat", "AC-004", note}, &stdout, &stderr); code == ExitOK {
+		t.Fatalf("note %q was accepted", note)
+	}
+	for _, want := range []string{"placeholder", "trailing (", "is ignored"} {
+		if !strings.Contains(stderr.String(), want) {
+			t.Errorf("stderr=%q; want it to contain %q", stderr.String(), want)
+		}
+	}
+}
+
+func TestAttestAcceptsSubstantiveNote(t *testing.T) {
+	project := t.TempDir()
+	root := filepath.Join(project, ".devrites")
+	work := filepath.Join(root, "work", "feat")
+	if err := os.MkdirAll(work, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	ledgerPath := filepath.Join(work, GatesFile)
+	writeLedger(t, ledgerPath, "- [ ] AC-004: outcome seen\n  EVIDENCE: pending\n")
+	var stdout, stderr strings.Builder
+	if code := Run(root, []string{"attest", "feat", "AC-004", "verified on staging by reviewer"}, &stdout, &stderr); code != ExitOK {
+		t.Fatalf("substantive note refused: code=%d stderr=%q", code, stderr.String())
+	}
+	doc := ParseLedger(mustRead(t, ledgerPath))
+	if len(doc.Gates) != 1 || GateState(doc.Gates[0], doc) != StateMet {
+		t.Fatalf("substantive attestation not met: %+v", doc.Gates)
+	}
+}
+
+func manualLedger(note string) *Document {
+	return ParseLedger("# Gates\n\n- [x] AC-004: outcome seen\n  EVIDENCE: " + note + "\n")
+}
+
+func TestManualGatePlaceholdersNeverMet(t *testing.T) {
+	for _, ev := range []string{"n/a", "tbd", "-", "ok", "done", "yes", "pending", "PENDING", "Pending", "verified", "TODO", "N/A", "TBD", "none", "n/a (see notes)", "done.",
+		"AC-004 — outcome seen", "AC-004 - outcome seen", "`done`", "**done**", "\"n/a\"",
+		"AC-004: outcome seen", "outcome seen", "AC-004", "AC-004 – outcome seen", "*done*", "_done_", "'done'", "Done!", "  yes.  ", "N.A.", "—", "✅", "✓ done", "[done]", "> done", "~~tbd~~", "outcome seen (AC-004)", "AC-004 (outcome seen)", "AC004 outcome seen", "ac-004: OUTCOME SEEN.", "pass", "passed", "true", "0", "okay", "none.", "TODO: later", "not applicable", "N/A - not applicable", "AC-004 done", "done - AC-004", "AC004 outcome seen", "AC 004 done", "see above", "(done)", "TBD (see notes)"} {
+		d := manualLedger(ev)
+		if len(d.Gates) != 1 || d.Gates[0].ID != "AC-004" || d.Gates[0].Evidence == "" {
+			t.Logf("PARSE %q: gates=%d errs=%v", ev, len(d.Gates), d.Errors)
+			continue
+		}
+		if got := GateState(d.Gates[0], d); got == StateMet {
+			t.Errorf("placeholder %q reached met", ev)
+		}
+		if d.Reduce(nil).AllMet() {
+			t.Errorf("placeholder %q: AllMet", ev)
+		}
+	}
+}
+
+// A title's own trailing parenthetical is part of the title, so a note that
+// repeats only that parenthetical restates the title and stays unmet.
+func TestManualGateTitleParentheticalIsTitleText(t *testing.T) {
+	for _, title := range []string{"Refund appears in ledger. (REQ-002)", "Refund appears in ledger (REQ-002)"} {
+		for _, note := range []string{"REQ-002", "(REQ-002)", "req 002", "Refund appears in ledger (REQ-002)"} {
+			d := ParseLedger("# Gates\n\n- [x] AC-004: " + title + "\n  EVIDENCE: " + note + "\n")
+			if len(d.Gates) != 1 {
+				t.Fatalf("title %q note %q: gates=%d errs=%v", title, note, len(d.Gates), d.Errors)
+			}
+			if got := GateState(d.Gates[0], d); got == StateMet {
+				t.Errorf("title %q: title-only note %q reached met", title, note)
+			}
+		}
+		d := ParseLedger("# Gates\n\n- [x] AC-004: " + title + "\n  EVIDENCE: REQ-002 confirmed on staging by Brooke\n")
+		if got := GateState(d.Gates[0], d); got != StateMet {
+			t.Errorf("title %q: substantive note = %s, want met", title, got)
+		}
+	}
+}
+
+func TestManualGateSubstantiveNotesMet(t *testing.T) {
+	for _, ev := range []string{"verified on staging by reviewer", "Verified on staging by reviewer (ticket 42)", "done on prod: 3 orders replayed, outcome seen in dashboard",
+		"Done: reviewer confirmed checkout on staging (q-12)", "q-12: Brooke confirmed the outcome seen on staging", "Yes - Brooke saw the banner on iPhone 15 (q-7)",
+		"(q-12) Brooke confirmed refund on staging", "outcome seen on staging by Brooke", "AC-004 outcome seen on staging by Brooke, q-3", "(Brooke confirmed refund on staging, q-12)"} {
+		d := manualLedger(ev)
+		if got := GateState(d.Gates[0], d); got != StateMet {
+			t.Errorf("substantive %q = %s, want met", ev, got)
+		}
+		if !d.Reduce(nil).AllMet() {
+			t.Errorf("substantive %q not AllMet", ev)
+		}
+	}
+}

package/engine/internal/acceptance/approve.go

@@ -21,12 +21,17 @@ type ApprovedCommand struct {
 // other section approves execution — fenced examples, prose mentions, and
 // consumptive-action rows are not re-runnable oracles. A test plan without
 // the section approves nothing, so every runnable gate stays unapproved.
+//
+// The result is never nil: an absent, unreadable, or unparsable plan yields an
+// empty surface rather than an absent one, because "approvals could not be
+// determined" must be a value the caller can refuse on, never a nil that reads
+// as "no approval is applicable".
 func ApprovedCommands(testPlan []byte) []ApprovedCommand {
+	approved := []ApprovedCommand{}
 	structural, err := markdowntext.Structural(testPlan)
 	if err != nil {
-		return nil
+		return approved
 	}
-	var approved []ApprovedCommand
 	inSection := false
 	commandCol, cwdCol := -1, -1
 	for _, line := range strings.Split(string(structural), "\n") {

package/engine/internal/acceptance/cli.go

@@ -362,6 +362,9 @@ func cmdAttest(root string, args []string, stdout, stderr io.Writer) int {
 		if gate.Check != "" {
 			return fmt.Errorf("gate %s is runnable; evidence comes from `gates run`, not attestation", gateID)
 		}
+		if placeholderEvidence(note, gate.ID, gate.Title) {
+			return fmt.Errorf("evidence note %q is a placeholder: a note needs a word beyond done/n/a/ok/pending-style words, the gate ID or its title, and a trailing (…) after such words is ignored; say who observed what and where", note)
+		}
 		return writeResult(ledgerPath, gate, note, true)
 	})
 	if lockErr != nil {

package/engine/internal/acceptance/evidence.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"regexp"
 	"strings"
+	"unicode"
 )
 
 // Evidence state vocabulary. A runnable gate is met only when its recorded
@@ -55,9 +56,8 @@ func GateState(gate *Gate, doc *Document) string {
 		return StateAbandoned
 	}
 	if gate.Check == "" {
-		// Manual gate: met when checked with any non-empty human evidence.
-		evidence := strings.TrimSpace(gate.Evidence)
-		if gate.Checked && evidence != "" && evidence != "pending" {
+		// Manual gate: met when checked with substantive human evidence.
+		if gate.Checked && !placeholderEvidence(gate.Evidence, gate.ID, gate.Title) {
 			return StateMet
 		}
 		return StateUnmet
@@ -73,6 +73,68 @@ func GateState(gate *Gate, doc *Document) string {
 	return StateMet
 }
 
+// placeholderWords is the tautological vocabulary a manual attestation may not
+// consist of (gates.md), as normalised words. A note whose every word comes
+// from it, from the gate title, or is the gate ID is a placeholder.
+var placeholderWords = map[string]bool{
+	"n": true, "a": true, "na": true, "tbd": true, "todo": true, "later": true,
+	"ok": true, "okay": true, "done": true, "yes": true, "pass": true, "passed": true,
+	"true": true, "0": true, "pending": true, "none": true, "verified": true,
+	"not": true, "applicable": true, "see": true, "above": true,
+}
+
+var trailingParenRE = regexp.MustCompile(`\s*\([^()]*\)$`)
+
+// splitWords lowercases text and splits on every run of non-alphanumeric
+// characters (markdown marks, quotes, punctuation, dash variants).
+func splitWords(text string) []string {
+	return strings.FieldsFunc(strings.ToLower(text), func(r rune) bool { return !unicode.IsLetter(r) && !unicode.IsDigit(r) })
+}
+
+// noteWords is splitWords after dropping one trailing parenthetical when text
+// remains before it. Gate titles use splitWords: their parenthetical is title
+// text a note may not merely repeat.
+func noteWords(text string) []string {
+	text = strings.TrimSpace(text)
+	if stripped := trailingParenRE.ReplaceAllString(text, ""); strings.TrimSpace(stripped) != "" {
+		text = stripped
+	}
+	return splitWords(text)
+}
+
+// placeholderEvidence reports whether a manual note is only a placeholder, so
+// `N/A (see notes)`, `**done**`, `TODO: later` and `AC-004 - done` count while
+// real prose does not. The gate ID is recognised in any spacing (`AC004`,
+// `AC 004`, `AC-004`), and restating the gate title is also a placeholder.
+func placeholderEvidence(evidence, id, title string) bool {
+	titleWords := map[string]bool{}
+	for _, w := range splitWords(title) {
+		titleWords[w] = true
+	}
+	compactID := strings.Join(noteWords(id), "")
+	words := noteWords(evidence)
+	for i := 0; i < len(words); {
+		if compactID != "" {
+			skip := 0
+			for k, joined := 1, ""; i+k <= len(words) && len(joined) < len(compactID); k++ {
+				joined += words[i+k-1]
+				if joined == compactID {
+					skip = k
+				}
+			}
+			if skip > 0 {
+				i += skip
+				continue
+			}
+		}
+		if !placeholderWords[words[i]] && !titleWords[words[i]] {
+			return false
+		}
+		i++
+	}
+	return true
+}
+
 // Reduction is the non-executing ledger verdict shared by `gates status` and
 // the seal gate. Unmet counts every gate that is neither met nor abandoned;
 // Stale and Unapproved are diagnostic subsets of it.
@@ -102,7 +164,9 @@ func (r Reduction) HandoffRequired() bool {
 
 // Reduce computes the ledger reduction. approved is the vetted (command, cwd)
 // surface from test-plan.md; a runnable gate whose CHECK is absent also
-// records an unapproved diagnostic but always counts as unmet.
+// records an unapproved diagnostic but always counts as unmet. A nil or empty
+// approved surface approves nothing, so every unmet runnable gate is reported
+// unapproved rather than silently counted as approved.
 func (d *Document) Reduce(approved []ApprovedCommand) Reduction {
 	r := Reduction{Total: len(d.Gates)}
 	for _, gate := range d.Gates {
@@ -122,7 +186,7 @@ func (d *Document) Reduce(approved []ApprovedCommand) Reduction {
 				r.Stale++
 				r.StaleIDs = append(r.StaleIDs, gate.ID)
 			}
-			if approved != nil && !Approved(gate.Check, gate.Cwd, approved) {
+			if !Approved(gate.Check, gate.Cwd, approved) {
 				r.Unapproved++
 				r.UnapprIDs = append(r.UnapprIDs, gate.ID)
 			}

package/engine/internal/acceptance/lint.go

@@ -61,7 +61,7 @@ func LintLedger(doc *Document, approved []ApprovedCommand) []Finding {
 				add("warn", gate.ID, "tautological-check",
 					"CHECK looks like a fixed-output command: %q; use an oracle that observes the named outcome", gate.Check)
 			}
-			if approved != nil && !Approved(gate.Check, gate.Cwd, approved) {
+			if !Approved(gate.Check, gate.Cwd, approved) {
 				add("error", gate.ID, "unapproved-check",
 					"CHECK %q with CWD %q matches no Build-entry preflight row in test-plan.md; the runner refuses it", gate.Check, gate.Cwd)
 			}

package/engine/internal/acceptance/run.go

@@ -60,8 +60,10 @@ func ReadLedgerFile(ledgerPath string) (string, error) {
 // RunGates executes the runnable gates of ledgerPath. reverify re-runs every
 // runnable gate including already-met ones; the normal mode runs only unmet
 // runnable gates. approved is the vetted command set from test-plan.md; a
-// CHECK outside it never executes. Each pass writes definition-bound evidence;
-// each failure clears the box and restores EVIDENCE: pending.
+// CHECK outside it never executes, and neither does one outside a surface that
+// could not be determined — an absent preflight is a refusal, not permission.
+// Each pass writes definition-bound evidence; each failure clears the box and
+// restores EVIDENCE: pending.
 //
 // The caller holds the feature lock across this call.
 func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, approved []ApprovedCommand, reverify bool, timeout time.Duration) []GateResult {
@@ -79,7 +81,7 @@ func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, appro
 			results = append(results, GateResult{ID: gate.ID, Passed: true, Detail: "already met"})
 			continue
 		}
-		if approved != nil && !Approved(gate.Check, gate.Cwd, approved) {
+		if !Approved(gate.Check, gate.Cwd, approved) {
 			results = append(results, GateResult{ID: gate.ID, Detail: "CHECK/CWD is not an approved test-plan.md preflight row; not executed"})
 			continue
 		}

package/engine/internal/acceptance/scaffold.go

@@ -2,8 +2,9 @@ package acceptance
 
 import (
 	"fmt"
-	"regexp"
 	"strings"
+
+	"github.com/devrites/devrites/internal/state"
 )
 
 // ScaffoldLedger emits a template ledger: one pending gate per canonical
@@ -36,20 +37,8 @@ func ScaffoldLedger(slug string, spec []byte) string {
 	return b.String()
 }
 
-var scaffoldACRE = regexp.MustCompile(`\bAC-\d{3}\b`)
-
-// specACIDs returns the unique AC-### ids declared anywhere in the spec; the
-// scaffold does not restrict to one section because the gate contract is the
-// same set the acceptance map already enforces onto tasks.md/test-plan.md.
+// specACIDs returns the unique AC-### ids in the spec's Acceptance criteria
+// section, the same set the acceptance map enforces onto tasks.md/test-plan.md.
 func specACIDs(spec []byte) []string {
-	found := scaffoldACRE.FindAllString(string(spec), -1)
-	seen := map[string]bool{}
-	var ids []string
-	for _, id := range found {
-		if !seen[id] {
-			seen[id] = true
-			ids = append(ids, id)
-		}
-	}
-	return ids
+	return state.ParseAcceptanceMap(spec, nil, nil, false, false).SpecIDs
 }

package/engine/internal/devritespaths/paths.go

@@ -77,7 +77,7 @@ func WorkspaceOverrideChecked(root, slug string) (string, error) {
 	})
 	canonicalWorkspace := relErr == nil && len(parts) == 2 &&
 		parts[0] == "work"
-	if sameRoot || !canonicalWorkspace || !validSlug(filepath.Base(path)) {
+	if sameRoot || !canonicalWorkspace || !ValidSlug(filepath.Base(path)) {
 		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: DEVRITES_WORKSPACE %q is not a feature workspace; run `unset DEVRITES_WORKSPACE`", raw)
 	}
 	if slug != "" && filepath.Base(path) != slug {
@@ -99,7 +99,7 @@ func FeatureDir(root, slug string) string {
 // control-plane commands use this instead of FeatureDir so an attacker cannot
 // redirect archive/removal operations outside the selected DevRites root.
 func ExistingFeatureDirChecked(root, slug string) (string, error) {
-	if !validSlug(slug) {
+	if !ValidSlug(slug) {
 		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: %q is not a feature slug", slug)
 	}
 	if ws, err := WorkspaceOverrideChecked(root, slug); err != nil {
@@ -113,7 +113,7 @@ func ExistingFeatureDirChecked(root, slug string) (string, error) {
 		return resolved, nil
 	}
 	if errors.Is(err, os.ErrNotExist) {
-		return "", os.ErrNotExist
+		return "", fmt.Errorf("no workspace for feature %q at %s: %w", slug, candidate, os.ErrNotExist)
 	}
 	return "", err
 }
@@ -129,7 +129,7 @@ func ArchiveDirChecked(root string) (string, error) {
 // must already exist. A live workspace never satisfies this lookup; callers
 // that accept either location try ExistingFeatureDirChecked first.
 func ExistingArchivedFeatureDirChecked(root, slug string) (string, error) {
-	if !validSlug(slug) {
+	if !ValidSlug(slug) {
 		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: %q is not a feature slug", slug)
 	}
 	candidate := filepath.Join(root, "archive", slug)
@@ -208,13 +208,14 @@ func ActiveSlug(root string) (string, error) {
 		return "", fmt.Errorf("read active feature: %w", err)
 	}
 	slug := strings.TrimSpace(string(raw))
-	if slug != "" && !validSlug(slug) {
+	if slug != "" && !ValidSlug(slug) {
 		return "", fmt.Errorf("DRV-ACTIVE-INVALID: ACTIVE value %q is not a feature slug; run `rm -f %q`", slug, activePath)
 	}
 	return slug, nil
 }
 
-func validSlug(slug string) bool {
+// ValidSlug reports whether slug is a single, non-empty path element.
+func ValidSlug(slug string) bool {
 	return slug != "" && slug != "." && slug != ".." &&
 		filepath.Base(slug) == slug &&
 		!strings.ContainsAny(slug, `/\`)

package/engine/internal/devritespaths/paths_test.go

@@ -1,6 +1,7 @@
 package devritespaths
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 	"strings"
@@ -108,3 +109,20 @@ func TestActiveSlugRejectsPathTraversal(t *testing.T) {
 		t.Fatalf("ActiveSlug symlink error = %v, want stable pointer diagnostic", err)
 	}
 }
+
+func TestExistingFeatureDirCheckedMissingNamesSlugAndMatchesNotExist(t *testing.T) {
+	root := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(root, "work"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	_, err := ExistingFeatureDirChecked(root, "nosuch")
+	if err == nil {
+		t.Fatal("want error for missing workspace")
+	}
+	if !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("err = %v, want errors.Is os.ErrNotExist", err)
+	}
+	if !strings.Contains(err.Error(), "nosuch") {
+		t.Fatalf("err = %q, want it to name the slug", err.Error())
+	}
+}