devrites 5.14.4 → 6.0.0

package/engine/internal/lib/resolve.go

@@ -39,6 +39,10 @@ func Resolve(root string, args []string, stdout, stderr io.Writer) int {
 		return fail(stderr, err.Error(), 3)
 	}
 
+	human := argAt(args, 0) == "--human"
+	if human {
+		args = args[1:]
+	}
 	var mode, qid, payload string
 	switch first := argAt(args, 0); first {
 	case "--drop":
@@ -55,7 +59,7 @@ func Resolve(root string, args []string, stdout, stderr io.Writer) int {
 			return fail(stderr, "Batch file not found: "+payload, 5)
 		}
 	case "":
-		return fail(stderr, `Usage: devrites-engine state resolve <qid> "<answer>"  |  state resolve --drop <qid> ["<reason>"]  |  state resolve --batch <file>`, 5)
+		return fail(stderr, `Usage: devrites-engine state resolve [--human] <qid> "<answer>"  |  state resolve [--human] --drop <qid> ["<reason>"]  |  state resolve [--human] --batch <file>`, 5)
 	default:
 		mode = "answer"
 		qid = first
@@ -67,7 +71,7 @@ func Resolve(root string, args []string, stdout, stderr io.Writer) int {
 
 	code := 0
 	if err := state.WithFeatureLock(root, slug, func() error {
-		code = resolveMutation(mode, qid, payload, qfile, sfile, stdout, stderr)
+		code = resolveMutation(mode, qid, payload, qfile, sfile, human, stdout, stderr)
 		return nil
 	}); err != nil {
 		return fail(stderr, err.Error(), 1)
@@ -75,10 +79,10 @@ func Resolve(root string, args []string, stdout, stderr io.Writer) int {
 	return code
 }
 
-func resolveMutation(mode, qid, payload, qfile, sfile string, stdout, stderr io.Writer) int {
+func resolveMutation(mode, qid, payload, qfile, sfile string, human bool, stdout, stderr io.Writer) int {
 	switch mode {
 	case "answer":
-		if code := resolveQuestion(qfile, qid, "answered", payload, stderr); code != 0 {
+		if code := resolveQuestion(qfile, qid, "answered", payload, human, stderr); code != 0 {
 			return code
 		}
 		if err := clearAwaiting(sfile, qid); err != nil {
@@ -88,7 +92,7 @@ func resolveMutation(mode, qid, payload, qfile, sfile string, stdout, stderr io.
 		fmt.Fprintf(stdout, "Status:   answered\n")
 		fmt.Fprintf(stdout, "Workspace: questions.md + state.md updated.\n")
 	case "drop":
-		if code := resolveQuestion(qfile, qid, "dropped", payload, stderr); code != 0 {
+		if code := resolveQuestion(qfile, qid, "dropped", payload, human, stderr); code != 0 {
 			return code
 		}
 		if err := clearAwaiting(sfile, qid); err != nil {
@@ -111,7 +115,7 @@ func resolveMutation(mode, qid, payload, qfile, sfile string, stdout, stderr io.
 				rest := strings.TrimPrefix(line, "--drop ")
 				bid, reason := splitColon(rest)
 				reason = strings.TrimPrefix(reason, " ")
-				if code := resolveQuestion(qfile, bid, "dropped", reason, stderr); code != 0 {
+				if code := resolveQuestion(qfile, bid, "dropped", reason, human, stderr); code != 0 {
 					return code
 				}
 				if err := clearAwaiting(sfile, bid); err != nil {
@@ -121,7 +125,7 @@ func resolveMutation(mode, qid, payload, qfile, sfile string, stdout, stderr io.
 			} else {
 				bid, ans := splitColon(line)
 				ans = strings.TrimPrefix(ans, " ")
-				if code := resolveQuestion(qfile, bid, "answered", ans, stderr); code != 0 {
+				if code := resolveQuestion(qfile, bid, "answered", ans, human, stderr); code != 0 {
 					return code
 				}
 				if err := clearAwaiting(sfile, bid); err != nil {
@@ -156,12 +160,15 @@ func isFile(path string) bool {
 	return err == nil && info.Mode().IsRegular()
 }
 
-// batchLines returns the newline-terminated lines of a batch file. An unterminated
-// final line is dropped, matching a shell `read` loop, so a partial trailing line
-// is never applied as an entry.
+// batchLines returns the lines of a batch file. A final line without a
+// terminating newline is kept; only the empty element after a trailing newline
+// is dropped.
 func batchLines(data []byte) []string {
 	lines := strings.Split(string(data), "\n")
-	return lines[:len(lines)-1]
+	if lines[len(lines)-1] == "" {
+		lines = lines[:len(lines)-1]
+	}
+	return lines
 }
 
 // splitColon splits s at the first ':', returning the parts before and after it
@@ -192,9 +199,12 @@ func clockNow() time.Time {
 func nowUTC() string { return clockNow().UTC().Format("2006-01-02T15:04:05Z") }
 
 // resolveQuestion rewrites the <qid> block in questions.md so it records the new
-// status, answer, and answered-at time in one pass. Returns 0, or 3 (qid
+// status, answer, and answered-at time in one pass. With human set it also records
+// answered_by: human; without it any answered_by line in the block, whatever its
+// indentation or case, is removed, so
+// an identity written before the resolve cannot survive it. Returns 0, or 3 (qid
 // not found) / 4 (qid not open), writing the message on failure.
-func resolveQuestion(qfile, qid, status, answer string, stderr io.Writer) int {
+func resolveQuestion(qfile, qid, status, answer string, human bool, stderr io.Writer) int {
 	// #nosec G304 -- questions.md path inside the feature workspace
 	data, err := os.ReadFile(qfile)
 	if err != nil {
@@ -204,7 +214,7 @@ func resolveQuestion(qfile, qid, status, answer string, stderr io.Writer) int {
 	answer = oneLine(answer)
 	target := regexp.MustCompile(`^## ` + regexp.QuoteMeta(qid) + `([[:space:]]|$)`)
 
-	updated, found, notOpen := rewriteQuestionFields(splitLinesNoTrailing(data), target, status, answer, ts)
+	updated, found, notOpen := rewriteQuestionFields(splitLinesNoTrailing(data), target, status, answer, ts, human)
 	if !found {
 		return fail(stderr, "qid not found: "+qid, 3)
 	}
@@ -224,6 +234,7 @@ var (
 	statusStrip  = regexp.MustCompile(`^status:[[:space:]]*`)
 	answeredAtRe = regexp.MustCompile(`^answered_at:`)
 	answerRe     = regexp.MustCompile(`^answer:`)
+	answeredByRe = regexp.MustCompile(`(?i)^[[:space:]]*answered_by:`)
 )
 
 // rewriteQuestionFields walks questions.md and, inside the target question's
@@ -231,9 +242,9 @@ var (
 // reports whether the block was found and whether it was already not open (an
 // attempt to re-answer). A target block with no status line at all gets a full set
 // of closing fields appended.
-func rewriteQuestionFields(lines []string, target *regexp.Regexp, status, answer, ts string) (out []string, found, notOpen bool) {
+func rewriteQuestionFields(lines []string, target *regexp.Regexp, status, answer, ts string, human bool) (out []string, found, notOpen bool) {
 	inQ := false
-	statusSeen, answeredAtSeen, answerSeen := false, false, false
+	statusSeen, answeredAtSeen, answerSeen, answeredBySeen := false, false, false, false
 	closeBlock := func() {
 		if !inQ {
 			return
@@ -247,13 +258,16 @@ func rewriteQuestionFields(lines []string, target *regexp.Regexp, status, answer
 		if !answerSeen {
 			out = append(out, "answer: "+answer)
 		}
+		if human && !answeredBySeen {
+			out = append(out, "answered_by: human")
+		}
 	}
 	for _, line := range lines {
 		switch {
 		case qHeaderRe.MatchString(line):
 			closeBlock()
 			inQ = target.MatchString(line)
-			statusSeen, answeredAtSeen, answerSeen = false, false, false
+			statusSeen, answeredAtSeen, answerSeen, answeredBySeen = false, false, false, false
 			if inQ {
 				found = true
 			}
@@ -274,6 +288,11 @@ func rewriteQuestionFields(lines []string, target *regexp.Regexp, status, answer
 		case inQ && answerRe.MatchString(line):
 			answerSeen = true
 			out = append(out, "answer: "+answer)
+		case inQ && answeredByRe.MatchString(line):
+			if human && !answeredBySeen {
+				answeredBySeen = true
+				out = append(out, "answered_by: human")
+			}
 		default:
 			out = append(out, line)
 		}

package/engine/internal/lib/resolve_remediation_test.go

@@ -58,3 +58,135 @@ func resolveWorkspace(t *testing.T, questions string) string {
 	testutil.WriteFile(t, filepath.Join(root, "work", "feat", "state.md"), "- Status: running\n- Next step: continue\n- Schema: 4\n")
 	return root
 }
+
+func TestResolveHumanFlagRecordsResolverIdentity(t *testing.T) {
+	root := resolveWorkspace(t, "## q-1 blocking\nstatus: open\n")
+	var stdout, stderr bytes.Buffer
+
+	if code := Resolve(root, []string{"--human", "q-1", "yes"}, &stdout, &stderr); code != 0 {
+		t.Fatalf("code = %d, want 0; stderr=%q", code, stderr.String())
+	}
+	data, err := os.ReadFile(filepath.Join(root, "work", "feat", "questions.md"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(data), "answered_by: human\n") {
+		t.Fatalf("questions.md missing answered_by: human:\n%s", data)
+	}
+}
+
+func TestResolveWithoutHumanFlagDropsPreSeededIdentity(t *testing.T) {
+	root := resolveWorkspace(t, "## q-1 blocking\nstatus: open\nanswered_by: human\n")
+	var stdout, stderr bytes.Buffer
+
+	if code := Resolve(root, []string{"q-1", "yes"}, &stdout, &stderr); code != 0 {
+		t.Fatalf("code = %d, want 0; stderr=%q", code, stderr.String())
+	}
+	data, err := os.ReadFile(filepath.Join(root, "work", "feat", "questions.md"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(data), "answered_by") {
+		t.Fatalf("forged answered_by survived an unflagged resolve:\n%s", data)
+	}
+}
+
+func TestResolveWithoutHumanFlagDropsVariantPreSeededIdentity(t *testing.T) {
+	for _, seed := range []string{"  answered_by: human", "Answered_By: human", "\tANSWERED_BY: human"} {
+		root := resolveWorkspace(t, "## q-1 blocking\nstatus: open\n"+seed+"\n")
+		var stdout, stderr bytes.Buffer
+
+		if code := Resolve(root, []string{"q-1", "yes"}, &stdout, &stderr); code != 0 {
+			t.Fatalf("%q: code = %d, want 0; stderr=%q", seed, code, stderr.String())
+		}
+		if text := readQuestions(t, root); strings.Contains(strings.ToLower(text), "answered_by") {
+			t.Fatalf("%q: forged answered_by survived an unflagged resolve:\n%s", seed, text)
+		}
+	}
+}
+
+func TestResolveHumanFlagKeepsSingleCanonicalIdentity(t *testing.T) {
+	root := resolveWorkspace(t, "## q-1 blocking\nstatus: open\n  answered_by: agent\nAnswered_By: agent\n")
+	var stdout, stderr bytes.Buffer
+
+	if code := Resolve(root, []string{"--human", "q-1", "yes"}, &stdout, &stderr); code != 0 {
+		t.Fatalf("code = %d, want 0; stderr=%q", code, stderr.String())
+	}
+	text := readQuestions(t, root)
+	if strings.Count(strings.ToLower(text), "answered_by") != 1 || !strings.Contains(text, "\nanswered_by: human\n") {
+		t.Fatalf("want exactly one canonical answered_by: human:\n%s", text)
+	}
+}
+
+func TestResolveDropHonorsHumanFlag(t *testing.T) {
+	seeded := "## q-1 blocking\nstatus: open\n  answered_by: human\n"
+	for _, tc := range []struct {
+		args []string
+		want bool
+	}{
+		{[]string{"--human", "--drop", "q-1", "obsolete"}, true},
+		{[]string{"--drop", "q-1", "obsolete"}, false},
+	} {
+		root := resolveWorkspace(t, seeded)
+		var stdout, stderr bytes.Buffer
+
+		if code := Resolve(root, tc.args, &stdout, &stderr); code != 0 {
+			t.Fatalf("%v: code = %d, want 0; stderr=%q", tc.args, code, stderr.String())
+		}
+		text := readQuestions(t, root)
+		if got := strings.Contains(text, "\nanswered_by: human\n"); got != tc.want || !strings.Contains(text, "status: dropped") {
+			t.Fatalf("%v: canonical answered_by = %v, want %v:\n%s", tc.args, got, tc.want, text)
+		}
+		if !tc.want && strings.Contains(text, "answered_by") {
+			t.Fatalf("%v: answered_by survived:\n%s", tc.args, text)
+		}
+	}
+}
+
+func TestResolveBatchHonorsHumanFlag(t *testing.T) {
+	questions := "## q-1 blocking\nstatus: open\n  answered_by: human\n## q-2 blocking\nstatus: open\n"
+	batch := "q-1: yes\n--drop q-2: obsolete\n"
+	for _, tc := range []struct {
+		args []string
+		want int
+	}{
+		{[]string{"--human"}, 2},
+		{nil, 0},
+	} {
+		root := resolveWorkspace(t, questions)
+		file := filepath.Join(t.TempDir(), "batch.txt")
+		testutil.WriteFile(t, file, batch)
+		var stdout, stderr bytes.Buffer
+
+		if code := Resolve(root, append(tc.args, "--batch", file), &stdout, &stderr); code != 0 {
+			t.Fatalf("%v: code = %d, want 0; stderr=%q", tc.args, code, stderr.String())
+		}
+		text := readQuestions(t, root)
+		if got := strings.Count(text, "\nanswered_by: human\n"); got != tc.want || (tc.want == 0 && strings.Contains(text, "answered_by")) {
+			t.Fatalf("%v: answered_by count = %d, want %d:\n%s", tc.args, got, tc.want, text)
+		}
+	}
+}
+
+func readQuestions(t *testing.T, root string) string {
+	t.Helper()
+	data, err := os.ReadFile(filepath.Join(root, "work", "feat", "questions.md"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(data)
+}
+
+func TestResolveBatchAppliesUnterminatedFinalLine(t *testing.T) {
+	root := resolveWorkspace(t, "## q-1 blocking\nstatus: open\n## q-2 blocking\nstatus: open\n")
+	file := filepath.Join(t.TempDir(), "batch.txt")
+	testutil.WriteFile(t, file, "q-1: yes\n--drop q-2: obsolete")
+	var stdout, stderr bytes.Buffer
+
+	if code := Resolve(root, []string{"--batch", file}, &stdout, &stderr); code != 0 {
+		t.Fatalf("code = %d, want 0; stderr=%q", code, stderr.String())
+	}
+	if text := readQuestions(t, root); strings.Contains(text, "status: open") {
+		t.Fatalf("a question stayed open:\n%s", text)
+	}
+}

package/engine/internal/lib/skilltrust.go

@@ -7,7 +7,6 @@ import (
 	"path/filepath"
 	"regexp"
 	"strings"
-	"unicode"
 )
 
 // SkillTrustFinding is one deterministic trust scan result.
@@ -185,13 +184,3 @@ func FormatSkillTrust(result SkillTrustResult) string {
 	}
 	return b.String()
 }
-
-// ContainsOnlyASCII returns false when non-ASCII control or bidi characters appear.
-func ContainsOnlyASCII(text string) bool {
-	for _, r := range text {
-		if r > unicode.MaxASCII && isSuspiciousUnicode(r) {
-			return false
-		}
-	}
-	return true
-}

package/engine/internal/lib/slicecheck.go

@@ -3,6 +3,7 @@ package lib
 import (
 	"fmt"
 	"io"
+	"path"
 	"regexp"
 	"strings"
 
@@ -68,6 +69,7 @@ func checkAllowlistPaths(paths []string) []string {
 	var problems []string
 	seen := map[string]bool{}
 	for _, p := range paths {
+		c := path.Clean(p)
 		switch {
 		case strings.HasPrefix(p, "/") || windowsDrivePath.MatchString(p):
 			problems = append(problems, fmt.Sprintf("allowlist path %q is not project-relative", p))
@@ -77,12 +79,12 @@ func checkAllowlistPaths(paths []string) []string {
 			problems = append(problems, fmt.Sprintf("allowlist path %q uses a glob — exact paths only", p))
 		case strings.HasSuffix(p, "/"):
 			problems = append(problems, fmt.Sprintf("allowlist path %q is a directory — exact files only", p))
-		case devritesPathRe.MatchString(p):
+		case devritesPathRe.MatchString(c):
 			problems = append(problems, fmt.Sprintf("allowlist path %q targets .devrites — wrights never write workflow state", p))
-		case seen[p]:
+		case seen[c]:
 			problems = append(problems, fmt.Sprintf("allowlist path %q is duplicated", p))
 		}
-		seen[p] = true
+		seen[c] = true
 	}
 	return problems
 }
@@ -128,10 +130,10 @@ func RunCheckSlice(root string, args []string, stdout, stderr io.Writer) int {
 	if touchedRaw, ok := fieldValue(fields, "files likely touched"); ok {
 		allowed := map[string]bool{}
 		for _, p := range allowlist {
-			allowed[p] = true
+			allowed[path.Clean(p)] = true
 		}
 		for _, p := range parsePathList(touchedRaw) {
-			if hasAllow && !allowed[p] {
+			if hasAllow && !allowed[path.Clean(p)] {
 				problems = append(problems, fmt.Sprintf("Files likely touched %q is outside the Writer allowlist", p))
 			}
 		}

package/engine/internal/lib/slicecheck_test.go

@@ -109,3 +109,21 @@ Tests/proof: none needed
 		t.Fatalf("code=%d out:\n%s%s", code, stdout, stderr)
 	}
 }
+
+func TestCheckAllowlistPathsNormalizesBeforeRules(t *testing.T) {
+	if got := checkAllowlistPaths([]string{"./.devrites/state.md"}); len(got) != 1 || !strings.Contains(got[0], ".devrites") {
+		t.Fatalf("./.devrites path not rejected as workflow state: %v", got)
+	}
+	if got := checkAllowlistPaths([]string{"src/a.go", "./src/a.go"}); len(got) != 1 || !strings.Contains(got[0], "duplicated") {
+		t.Fatalf("./src/a.go not detected as duplicate of src/a.go: %v", got)
+	}
+}
+
+func TestCheckSliceTouchedComparesNormalizedPaths(t *testing.T) {
+	tasks := strings.Replace(goodSliceTasks, "Files likely touched: src/a.go; src/a_test.go", "Files likely touched: ./src/a.go; src/a_test.go", 1)
+	root := sliceWorkspace(t, tasks, sliceSpec)
+	stdout, stderr := &bytes.Buffer{}, &bytes.Buffer{}
+	if code := RunCheckSlice(root, []string{"feat", "SLICE-001"}, stdout, stderr); code != 0 {
+		t.Fatalf("code=%d want 0\n%s%s", code, stdout, stderr)
+	}
+}

package/engine/internal/lib/triggers.go

@@ -1,6 +1,7 @@
 package lib
 
 import (
+	"io"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -103,11 +104,16 @@ func gatherTriggerFacts(root, featureDir, role string) triggerFacts {
 		for _, name := range triggerEvidenceFiles {
 			path := filepath.Join(featureDir, name)
 			info, err := os.Stat(path)
-			if err != nil || !info.Mode().IsRegular() || info.Size() > triggerEvidenceFileCap {
+			if err != nil || !info.Mode().IsRegular() {
 				continue
 			}
-			// #nosec G304 -- workspace artifact; size cap checked above
-			if data, err := os.ReadFile(path); err == nil {
+			f, err := os.Open(path) // #nosec G304 -- workspace artifact; read is capped below
+			if err != nil {
+				continue
+			}
+			data, err := io.ReadAll(io.LimitReader(f, triggerEvidenceFileCap))
+			_ = f.Close()
+			if err == nil {
 				corpus.Write(data)
 				corpus.WriteByte('\n')
 			}

package/engine/internal/lib/triggers_test.go

@@ -0,0 +1,23 @@
+package lib
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestGatherTriggerFactsReadsCappedPrefixOfOversizedArtifact(t *testing.T) {
+	dir := t.TempDir()
+	body := "this feature adds a frontend component\n" + strings.Repeat(" ", triggerEvidenceFileCap)
+	if err := os.WriteFile(filepath.Join(dir, "spec.md"), []byte(body), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	facts := gatherTriggerFacts("", dir, "")
+	if !uiSignalRe.MatchString(facts.corpus) {
+		t.Fatalf("oversized artifact contributed no corpus (len=%d)", len(facts.corpus))
+	}
+	if len(facts.corpus) > triggerEvidenceFileCap+1 {
+		t.Fatalf("corpus exceeds cap: %d", len(facts.corpus))
+	}
+}

package/engine/internal/lib/util.go

@@ -9,6 +9,7 @@ import (
 	"os"
 	"os/exec"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/devrites/devrites/internal/devritespaths"
@@ -21,18 +22,27 @@ const (
 )
 
 type cappedGitOutput struct {
-	bytes.Buffer
+	mu        sync.Mutex
+	buffer    bytes.Buffer
 	truncated bool
 }
 
+func (w *cappedGitOutput) Len() int { return w.buffer.Len() }
+
+func (w *cappedGitOutput) Bytes() []byte { return w.buffer.Bytes() }
+
+func (w *cappedGitOutput) String() string { return w.buffer.String() }
+
 func (w *cappedGitOutput) Write(p []byte) (int, error) {
+	w.mu.Lock()
+	defer w.mu.Unlock()
 	remaining := gitOutputLimit - w.Len()
 	if remaining > 0 {
 		if len(p) > remaining {
-			_, _ = w.Buffer.Write(p[:remaining])
+			_, _ = w.buffer.Write(p[:remaining])
 			w.truncated = true
 		} else {
-			_, _ = w.Buffer.Write(p)
+			_, _ = w.buffer.Write(p)
 		}
 	} else {
 		w.truncated = true
@@ -77,6 +87,7 @@ func runGitCommandIO(dir string, env []string, input []byte, stdout io.Writer, a
 	env = gitenv.Sanitize(env)
 	cmd.Env = append(
 		env,
+		"GIT_OPTIONAL_LOCKS=0",
 		"GIT_TERMINAL_PROMPT=0",
 		"GCM_INTERACTIVE=never",
 		"GIT_PAGER=cat",
@@ -92,6 +103,9 @@ func runGitCommandIO(dir string, env []string, input []byte, stdout io.Writer, a
 	cmd.Stderr = &output
 	err := cmd.Run()
 	if err == nil {
+		if output.truncated {
+			return nil, &gitCommandError{args: args, exitCode: 0, err: errors.New("git output exceeds limit")}
+		}
 		return output.Bytes(), nil
 	}
 	code := -1

package/engine/internal/lib/util_test.go

@@ -1,11 +1,15 @@
 package lib
 
 import (
+	"bytes"
+	"io"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
+	"sync"
 	"testing"
+	"time"
 )
 
 func TestRunGitCommandIgnoresInheritedRepositoryTargets(t *testing.T) {
@@ -30,6 +34,41 @@ func TestRunGitCommandIgnoresInheritedRepositoryTargets(t *testing.T) {
 	}
 }
 
+func TestGitStatusPathsLeavesStaleIndexUntouched(t *testing.T) {
+	t.Setenv("GIT_OPTIONAL_LOCKS", "")
+	if err := os.Unsetenv("GIT_OPTIONAL_LOCKS"); err != nil {
+		t.Fatal(err)
+	}
+	repo := initGitRepository(t, filepath.Join(t.TempDir(), "repo"))
+	file := filepath.Join(repo, "a.txt")
+	if err := os.WriteFile(file, []byte("one\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	add := exec.Command("git", "-C", repo, "add", "a.txt")
+	if out, err := add.CombinedOutput(); err != nil {
+		t.Fatalf("git add: %v\n%s", err, out)
+	}
+	stale := time.Now().Add(-time.Hour)
+	if err := os.Chtimes(file, stale, stale); err != nil {
+		t.Fatal(err)
+	}
+	indexPath := filepath.Join(repo, ".git", "index")
+	before, err := os.ReadFile(indexPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := gitStatusPaths(repo); err != nil {
+		t.Fatal(err)
+	}
+	after, err := os.ReadFile(indexPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(before, after) {
+		t.Fatal("git status rewrote .git/index")
+	}
+}
+
 func initGitRepository(t *testing.T, path string) string {
 	t.Helper()
 	if err := os.MkdirAll(path, 0o755); err != nil {
@@ -42,3 +81,68 @@ func initGitRepository(t *testing.T, path string) string {
 	}
 	return path
 }
+
+// cappedGitOutput is installed as both cmd.Stdout and cmd.Stderr; this drives
+// two concurrent writers at it so -race flags any unsynchronized access.
+func TestCappedGitOutputConcurrentWriters(t *testing.T) {
+	const writes, size = 2000, 64
+	chunk := []byte(strings.Repeat("x", size))
+
+	var seq cappedGitOutput
+	for i := 0; i < 2*writes; i++ {
+		_, _ = seq.Write(chunk)
+	}
+	if seq.Len() != 2*writes*size || seq.truncated {
+		t.Fatalf("sequential: got %d bytes truncated=%v, want %d", seq.Len(), seq.truncated, 2*writes*size)
+	}
+
+	var out cappedGitOutput
+	var wg sync.WaitGroup
+	for w := 0; w < 2; w++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for i := 0; i < writes; i++ {
+				_, _ = out.Write(chunk)
+			}
+		}()
+	}
+	wg.Wait()
+	t.Logf("concurrent bytes %d of %d", out.Len(), 2*writes*size)
+}
+
+func TestCappedGitOutputBoundsIOCopy(t *testing.T) {
+	src := func() io.Reader { return io.LimitReader(zeroReader{}, 25<<20) }
+
+	var control boundedSecretScanBuffer
+	control.limit = gitOutputLimit
+	_, _ = io.Copy(&control, src())
+	if control.Len() != gitOutputLimit || !control.overflow {
+		t.Fatalf("control: got %d bytes overflow=%v, want %d and overflow", control.Len(), control.overflow, gitOutputLimit)
+	}
+
+	var out cappedGitOutput
+	_, _ = io.Copy(&out, src())
+	if out.Len() > gitOutputLimit || !out.truncated {
+		t.Fatalf("got %d bytes truncated=%v, want at most %d and truncated", out.Len(), out.truncated, gitOutputLimit)
+	}
+}
+
+func TestRunGitCommandRejectsTruncatedOutput(t *testing.T) {
+	repo := initGitRepository(t, t.TempDir())
+	blob := filepath.Join(t.TempDir(), "big")
+	if err := os.WriteFile(blob, bytes.Repeat([]byte("x"), gitOutputLimit+1), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	oid, err := runGitCommand(repo, nil, "hash-object", "-w", blob)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := runGitCommand(repo, nil, "cat-file", "blob", strings.TrimSpace(string(oid))); err == nil {
+		t.Fatal("truncated git output returned without error")
+	}
+}
+
+type zeroReader struct{}
+
+func (zeroReader) Read(p []byte) (int, error) { return len(p), nil }

package/engine/internal/lib/visual_outline.go

@@ -5,8 +5,9 @@ import (
 	"strings"
 )
 
-// htmlIDAttrRE matches id="..." or id='...' attributes without a full HTML parser.
-var htmlIDAttrRE = regexp.MustCompile(`(?i)\bid\s*=\s*(?:"([^"]*)"|'([^']*)')`)
+// htmlIDAttrRE matches quoted and unquoted id attributes without a full HTML
+// parser. The attribute name is anchored so data-id and similar do not match.
+var htmlIDAttrRE = regexp.MustCompile(`(?i)(?:^|[\s"'/])id\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>` + "`" + `]+))`)
 
 // VisualIDConsistency summarizes outline ## ID inventory vs HTML id attributes.
 //
@@ -29,7 +30,7 @@ func ParseOutlineInventoryIDs(outline string) []string {
 	return parseMarkdownFirstColumnIDs(section)
 }
 
-// ScanHTMLIDs returns unique id="..." / id='...' attribute values in document order.
+// ScanHTMLIDs returns unique id="..." / id='...' / id=value attribute values in document order.
 func ScanHTMLIDs(html string) []string {
 	matches := htmlIDAttrRE.FindAllStringSubmatch(html, -1)
 	if len(matches) == 0 {
@@ -42,6 +43,9 @@ func ScanHTMLIDs(html string) []string {
 		if id == "" {
 			id = m[2]
 		}
+		if id == "" {
+			id = m[3]
+		}
 		id = strings.TrimSpace(id)
 		if id == "" {
 			continue

package/engine/internal/lib/visual_outline_test.go

@@ -159,3 +159,31 @@ func TestOpenVisualIDsOkTip(t *testing.T) {
 		t.Fatalf("stdout = %q, want ids=ok tip", stdout.String())
 	}
 }
+
+func TestCheckVisualIDConsistencyAttributeForms(t *testing.T) {
+	outline := `## ID inventory
+| HTML id | Meaning |
+| --- | --- |
+| viz-title | Header |
+`
+	cases := []struct {
+		name        string
+		html        string
+		wantMissing []string
+	}{
+		{"unquoted", `<section id=viz-title></section>`, nil},
+		{"unquoted before close", `<section id=viz-title>x</section>`, nil},
+		{"single quoted", `<section id='viz-title'></section>`, nil},
+		{"data-id is not id", `<section data-id="viz-title"></section>`, []string{"viz-title"}},
+		{"hyphenated name ending in id", `<section grid-id=viz-title></section>`, []string{"viz-title"}},
+		{"newline before attribute", "<section\nid=viz-title></section>", nil},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := CheckVisualIDConsistency(tc.html, outline).MissingInHTML
+			if len(got) != len(tc.wantMissing) || (len(got) == 1 && got[0] != tc.wantMissing[0]) {
+				t.Fatalf("MissingInHTML = %#v, want %#v", got, tc.wantMissing)
+			}
+		})
+	}
+}