devrites 5.14.4 → 6.0.0

package/engine/internal/parallel/parallel_test.go

@@ -7,6 +7,7 @@ import (
 	"path/filepath"
 	"strings"
 	"testing"
+	"time"
 )
 
 func gitOk(t *testing.T, dir string, args ...string) string {
@@ -573,9 +574,13 @@ func TestIntegrateRefusesDirtyControlOnSlicePaths(t *testing.T) {
 	if err := os.WriteFile(userWIP, []byte("user wip\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
-	if _, _, err := Integrate(IntegrateOpts{Root: repo, Slug: slug, ApplyToControl: true}); err == nil {
+	_, _, ierr := Integrate(IntegrateOpts{Root: repo, Slug: slug, ApplyToControl: true})
+	if ierr == nil {
 		t.Fatal("expected dirty-control refusal")
 	}
+	if msg := ierr.Error(); strings.Contains(msg, "commit or stash") || !strings.Contains(msg, "stop for the human") {
+		t.Fatalf("refusal must route user work to the human, not advise commit/stash: %v", msg)
+	}
 	leasePath, err := LeasePath(repo, slug)
 	if err != nil {
 		t.Fatal(err)
@@ -613,3 +618,28 @@ func mustRead(t *testing.T, path string) string {
 	}
 	return string(b)
 }
+
+func TestGitReturnsWhenHookGrandchildHoldsPipe(t *testing.T) {
+	repo, _ := setupRepo(t)
+	hook := filepath.Join(repo, ".git", "hooks", "pre-commit")
+	if err := os.WriteFile(hook, []byte("#!/bin/sh\nsleep 30\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(repo, "new.txt"), []byte("x\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	gitOk(t, repo, "add", "new.txt")
+	prev := gitTimeout
+	gitTimeout = time.Second
+	t.Cleanup(func() { gitTimeout = prev })
+
+	start := time.Now()
+	_, err := git(repo, "commit", "-m", "m")
+	elapsed := time.Since(start)
+	if err == nil {
+		t.Fatal("commit with a hanging hook succeeded")
+	}
+	if limit := gitTimeout + gitWaitDelay + 3*time.Second; elapsed > limit {
+		t.Fatalf("git returned after %v, want within %v", elapsed, limit)
+	}
+}

package/engine/internal/parallel/pathdisjoint.go

@@ -4,6 +4,7 @@ package parallel
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -12,6 +13,9 @@ import (
 	"strings"
 )
 
+// ErrPathOverlap marks a path-disjoint refusal caused by shared ownership.
+var ErrPathOverlap = errors.New("path sets overlap")
+
 var winAbsRE = regexp.MustCompile(`(?i)^[A-Za-z]:[/\\]`)
 
 // SlicePaths is one path-disjoint eligibility unit.
@@ -126,10 +130,24 @@ func CheckPathDisjoint(slices []SlicePaths, root string) ([]string, error) {
 		if len(labels) > 1 {
 			overlaps = append(overlaps, fmt.Sprintf("%q shared by %s", path, strings.Join(labels, ", ")))
 		}
+		// A path claimed by one slice contains every path beneath it, so a
+		// directory claim and a file under it are shared ownership.
+		for i := len(path) - 1; i > 0; i-- {
+			if path[i] != '/' {
+				continue
+			}
+			for _, outer := range owners[path[:i]] {
+				for _, inner := range labels {
+					if outer != inner {
+						overlaps = append(overlaps, fmt.Sprintf("%q (%s) contains %q (%s)", path[:i], outer, path, inner))
+					}
+				}
+			}
+		}
 	}
 	if len(overlaps) > 0 {
 		sort.Strings(overlaps)
-		return nil, fmt.Errorf("path sets overlap: %s", strings.Join(overlaps, "; "))
+		return nil, fmt.Errorf("%w: %s", ErrPathOverlap, strings.Join(overlaps, "; "))
 	}
 	return ids, nil
 }

package/engine/internal/parallel/pathdisjoint_test.go

@@ -1,6 +1,8 @@
 package parallel
 
 import (
+	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -40,6 +42,15 @@ func TestCheckPathDisjointOverlap(t *testing.T) {
 	if err == nil || !strings.Contains(err.Error(), "overlap") {
 		t.Fatalf("expected overlap error, got %v", err)
 	}
+	for _, c := range [][2]string{{"src", "src/a.go"}, {"src/a.go", "src"}, {"src/x", "src/x/y/z.go"}} {
+		_, err := CheckPathDisjoint([]SlicePaths{
+			{ID: "a", Paths: []string{c[0]}},
+			{ID: "b", Paths: []string{c[1]}},
+		}, "")
+		if err == nil || !strings.Contains(err.Error(), "overlap") {
+			t.Fatalf("%q vs %q: expected overlap error, got %v", c[0], c[1], err)
+		}
+	}
 }
 
 func TestCheckPathDisjointOK(t *testing.T) {
@@ -119,3 +130,64 @@ func TestParseSlicesJSONShapes(t *testing.T) {
 		t.Fatalf("array shape: %v %#v", err, b)
 	}
 }
+
+func TestCheckPathDisjointOverlapSentinel(t *testing.T) {
+	t.Parallel()
+	_, err := CheckPathDisjoint([]SlicePaths{
+		{ID: "a", Paths: []string{"src/a.go"}},
+		{ID: "b", Paths: []string{"src/a.go"}},
+	}, "")
+	if !errors.Is(err, ErrPathOverlap) {
+		t.Fatalf("expected ErrPathOverlap, got %v", err)
+	}
+}
+
+// A hard refusal whose message merely mentions "overlap" (here via the slice
+// id) must not be classified as a path overlap.
+func TestCheckPathDisjointSymlinkNotOverlap(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	target := filepath.Join(dir, "real")
+	if err := os.Mkdir(target, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(target, filepath.Join(dir, "linkdir")); err != nil {
+		t.Skip("symlinks unavailable")
+	}
+	slices := []SlicePaths{
+		{ID: "overlap-a", Paths: []string{"linkdir/x.go"}},
+		{ID: "b", Paths: []string{"other.go"}},
+	}
+	_, err := CheckPathDisjoint(slices, dir)
+	if err == nil || errors.Is(err, ErrPathOverlap) {
+		t.Fatalf("expected non-overlap refusal, got %v", err)
+	}
+	if _, err := SelectGreedy(2, slices, dir); err == nil || errors.Is(err, ErrPathOverlap) {
+		t.Fatalf("SelectGreedy must return the hard refusal, got %v", err)
+	}
+}
+
+// SelectGreedy must return a non-overlap refusal from the trial check even when
+// its message mentions "overlap", and must still skip a real overlap.
+func TestSelectGreedyTrialErrorClassification(t *testing.T) {
+	orig := checkPathDisjoint
+	t.Cleanup(func() { checkPathDisjoint = orig })
+	ready := []SlicePaths{
+		{ID: "a", Paths: []string{"a.go"}},
+		{ID: "b", Paths: []string{"b.go"}},
+	}
+
+	hard := errors.New("slice overlap-a: cannot verify paths")
+	checkPathDisjoint = func([]SlicePaths, string) ([]string, error) { return nil, hard }
+	if _, err := SelectGreedy(2, ready, ""); !errors.Is(err, hard) {
+		t.Fatalf("expected the hard refusal to be returned, got %v", err)
+	}
+
+	checkPathDisjoint = func([]SlicePaths, string) ([]string, error) {
+		return nil, fmt.Errorf("%w: x", ErrPathOverlap)
+	}
+	got, err := SelectGreedy(2, ready, "")
+	if err != nil || len(got) != 1 || got[0].ID != "a" {
+		t.Fatalf("real overlap must be skipped, got %v, %v", got, err)
+	}
+}

package/engine/internal/parallel/select.go

@@ -1,10 +1,14 @@
 package parallel
 
 import (
+	"errors"
 	"fmt"
 	"strings"
 )
 
+// checkPathDisjoint is a seam so tests can inject trial-check outcomes.
+var checkPathDisjoint = CheckPathDisjoint
+
 // SelectGreedy returns the largest plan-order pairwise-disjoint subset of ready
 // whose size is ≤ cap. ready must already be dependency-satisfied and in plan
 // order. cap is 1–MaxParallelSlices; 1 is a legal one-slice round, not a latch.
@@ -45,8 +49,8 @@ func SelectGreedy(cap int, ready []SlicePaths, root string) ([]SlicePaths, error
 			continue
 		}
 		trial := append(append([]SlicePaths{}, selected...), cand)
-		if _, err := CheckPathDisjoint(trial, root); err != nil {
-			if strings.Contains(err.Error(), "overlap") {
+		if _, err := checkPathDisjoint(trial, root); err != nil {
+			if errors.Is(err, ErrPathOverlap) {
 				continue
 			}
 			return nil, err

package/engine/internal/release/release.go

@@ -16,6 +16,7 @@ import (
 	"net/netip"
 	"net/url"
 	"os"
+	"os/exec"
 	"path"
 	"path/filepath"
 	"regexp"
@@ -97,7 +98,7 @@ func Acquire(ctx context.Context, repository, tag string) (Candidate, func(), er
 	bundleName := "devrites-" + tag + ".tar.gz"
 	bundleURL := base + "/" + bundleName
 	bundlePath := filepath.Join(tmp, bundleName)
-	if err := downloadVerified(ctx, bundleURL, bundlePath, bundleName, 0o644); err != nil {
+	if err := downloadVerified(ctx, bundleURL, bundlePath, bundleName, 0o644, repository); err != nil {
 		return fail(fmt.Errorf("download release bundle: %w", err))
 	}
 	source, err := extractBundle(bundlePath, tmp, tag)
@@ -107,7 +108,7 @@ func Acquire(ctx context.Context, repository, tag string) (Candidate, func(), er
 
 	engineURL := base + "/" + binaryName
 	enginePath := filepath.Join(tmp, binaryName)
-	if err := downloadVerified(ctx, engineURL, enginePath, binaryName, 0o755); err != nil {
+	if err := downloadVerified(ctx, engineURL, enginePath, binaryName, 0o755, repository); err != nil {
 		return fail(fmt.Errorf("download engine binary: %w", err))
 	}
 	return Candidate{
@@ -184,7 +185,7 @@ func fetchJSON(ctx context.Context, rawURL string, out any) error {
 	return nil
 }
 
-func downloadVerified(ctx context.Context, rawURL, destination, filename string, mode fs.FileMode) error {
+func downloadVerified(ctx context.Context, rawURL, destination, filename string, mode fs.FileMode, repository string) error {
 	if err := download(ctx, rawURL, destination, maxAssetBytes, mode); err != nil {
 		return err
 	}
@@ -222,6 +223,15 @@ func downloadVerified(ctx context.Context, rawURL, destination, filename string,
 	if !strings.EqualFold(hex.EncodeToString(hash.Sum(nil)), hex.EncodeToString(want)) {
 		return fmt.Errorf("checksum mismatch for %s", filename)
 	}
+	signer := repository + "/.github/workflows/ci.yml@refs/heads/main"
+	// #nosec G204 -- fixed gh argv; repository is matched by repositoryPattern (leading alphanumeric, so never a flag) in Acquire and destination is an absolute path under the engine-created temp dir
+	cmd := exec.CommandContext(ctx, "gh", "attestation", "verify", destination, "--repo", repository, "--signer-workflow", signer)
+	if _, err := cmd.CombinedOutput(); err != nil {
+		if errors.Is(err, exec.ErrNotFound) {
+			return errors.New("gh (GitHub CLI) is required and must be authenticated for attestation verification")
+		}
+		return fmt.Errorf("attestation verification failed for %s: %w", filename, err)
+	}
 	return nil
 }
 

package/engine/internal/release/release_test.go

@@ -10,7 +10,9 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"os"
+	"os/exec"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"testing"
 )
@@ -26,10 +28,12 @@ func TestLatestAndAcquireVerifiedRelease(t *testing.T) {
 	if err != nil {
 		t.Skip(err)
 	}
+	engine := []byte("#!/bin/sh\nprintf success > \"$MARKER\"\nexit 23\n")
 	assets := map[string][]byte{
 		bundleName: bundle,
-		binaryName: []byte("test engine"),
+		binaryName: engine,
 	}
+	installAttestationStandIn(t, bundle, engine)
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/repos/owner/repo/releases/latest" {
 			_, _ = fmt.Fprintf(w, `{"tag_name":%q}`, tag)
@@ -73,8 +77,16 @@ func TestLatestAndAcquireVerifiedRelease(t *testing.T) {
 	if _, err := os.Stat(filepath.Join(candidate.PayloadDir, "claude", "skills", "rite", "SKILL.md")); err != nil {
 		t.Fatalf("extracted payload: %v", err)
 	}
-	if got, err := os.ReadFile(candidate.EnginePath); err != nil || string(got) != "test engine" {
-		t.Fatalf("engine = %q, %v", got, err)
+	marker := filepath.Join(t.TempDir(), "marker")
+	cmd := exec.Command(candidate.EnginePath)
+	cmd.Env = append(os.Environ(), "MARKER="+marker)
+	if err := cmd.Run(); err == nil {
+		t.Fatal("attested engine exited successfully; want positive-control exit 23")
+	} else if exit, ok := err.(*exec.ExitError); !ok || exit.ExitCode() != 23 {
+		t.Fatalf("attested engine exit = %v, want 23", err)
+	}
+	if got, err := os.ReadFile(marker); err != nil || string(got) != "success" {
+		t.Fatalf("attested engine marker = %q, %v", got, err)
 	}
 	cleanup()
 	if _, err := os.Stat(root); !os.IsNotExist(err) {
@@ -99,6 +111,199 @@ func TestValidTag(t *testing.T) {
 	}
 }
 
+func TestAcquireRejectsOriginSubstitution(t *testing.T) {
+	const tag = "v4.1.0"
+	trusted := testBundle(t, tag, map[string]string{
+		"package.json": `{"version":"4.1.0"}`,
+		"pack/generated/claude/skills/rite/SKILL.md": "rite\n",
+	})
+	attacker := testBundle(t, tag, map[string]string{
+		"package.json": `{"version":"4.1.0"}`,
+		"pack/generated/claude/skills/rite/SKILL.md": "attacker\n",
+	})
+	binaryName, err := platformBinaryName()
+	if err != nil {
+		t.Skip(err)
+	}
+	installAttestationStandIn(t, trusted, []byte("trusted engine"))
+	assets := map[string][]byte{"devrites-" + tag + ".tar.gz": attacker, binaryName: []byte("attacker engine")}
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		name := filepath.Base(r.URL.Path)
+		assetName := strings.TrimSuffix(name, ".sha256")
+		asset, ok := assets[assetName]
+		if !ok {
+			http.NotFound(w, r)
+			return
+		}
+		if strings.HasSuffix(name, ".sha256") {
+			_, _ = fmt.Fprintf(w, "%x  %s\n", sha256.Sum256(asset), assetName)
+			return
+		}
+		_, _ = w.Write(asset)
+	}))
+	defer server.Close()
+	oldWeb := webBaseURL
+	webBaseURL = server.URL
+	t.Cleanup(func() { webBaseURL = oldWeb })
+
+	_, _, err = Acquire(context.Background(), "owner/repo", tag)
+	if err == nil || !strings.Contains(err.Error(), "attestation verification failed") {
+		t.Fatalf("Acquire error = %v, want attestation refusal despite a matching origin checksum", err)
+	}
+}
+
+func TestAcquireRejectsSingleAssetSubstitution(t *testing.T) {
+	const tag = "v4.1.0"
+	files := map[string]string{
+		"package.json": `{"version":"4.1.0"}`,
+		"pack/generated/claude/skills/rite/SKILL.md": "rite\n",
+	}
+	trustedBundle := testBundle(t, tag, files)
+	files["pack/generated/claude/skills/rite/SKILL.md"] = "attacker\n"
+	attackerBundle := testBundle(t, tag, files)
+	trustedEngine, attackerEngine := []byte("trusted engine"), []byte("attacker engine")
+	binaryName, err := platformBinaryName()
+	if err != nil {
+		t.Skip(err)
+	}
+	for _, tc := range []struct {
+		name, refusedAsset string
+		bundle, engine     []byte
+	}{
+		{"engine only", binaryName, trustedBundle, attackerEngine},
+		{"bundle only", "devrites-" + tag + ".tar.gz", attackerBundle, trustedEngine},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			installAttestationStandIn(t, trustedBundle, trustedEngine)
+			assets := map[string][]byte{"devrites-" + tag + ".tar.gz": tc.bundle, binaryName: tc.engine}
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				name := filepath.Base(r.URL.Path)
+				assetName := strings.TrimSuffix(name, ".sha256")
+				asset, ok := assets[assetName]
+				if !ok {
+					http.NotFound(w, r)
+					return
+				}
+				if strings.HasSuffix(name, ".sha256") {
+					_, _ = fmt.Fprintf(w, "%x  %s\n", sha256.Sum256(asset), assetName)
+					return
+				}
+				_, _ = w.Write(asset)
+			}))
+			defer server.Close()
+			oldWeb := webBaseURL
+			webBaseURL = server.URL
+			t.Cleanup(func() { webBaseURL = oldWeb })
+
+			_, cleanup, err := Acquire(context.Background(), "owner/repo", tag)
+			if err == nil {
+				cleanup()
+				t.Fatal("Acquire accepted a release with one unattested asset")
+			}
+			want := "attestation verification failed for " + tc.refusedAsset
+			if !strings.Contains(err.Error(), want) {
+				t.Fatalf("Acquire error = %v, want %q", err, want)
+			}
+		})
+	}
+}
+
+func installAttestationStandIn(t *testing.T, trusted ...[]byte) {
+	t.Helper()
+	if runtime.GOOS == "windows" {
+		t.Skip("attestation stand-in and positive-control engine are shell scripts")
+	}
+	dir := t.TempDir()
+	var hashes strings.Builder
+	for _, data := range trusted {
+		fmt.Fprintf(&hashes, "%x\n", sha256.Sum256(data))
+	}
+	allowed := filepath.Join(dir, "allowed-digests")
+	if err := os.WriteFile(allowed, []byte(hashes.String()), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	gh := filepath.Join(dir, "gh")
+	script := `#!/bin/sh
+[ "$1" = attestation ] && [ "$2" = verify ] && [ "$4" = --repo ] && [ "$5" = owner/repo ] && [ "$6" = --signer-workflow ] && [ "$7" = owner/repo/.github/workflows/ci.yml@refs/heads/main ] || exit 64
+got=$(shasum -a 256 "$3" | awk '{print $1}') || exit 65
+grep -Fxq "$got" "$ATTESTED_DIGESTS"
+`
+	if err := os.WriteFile(gh, []byte(script), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PATH", dir+string(os.PathListSeparator)+os.Getenv("PATH"))
+	t.Setenv("ATTESTED_DIGESTS", allowed)
+}
+
+func TestAttestationStandInIsStrict(t *testing.T) {
+	trusted := []byte("trusted engine")
+	installAttestationStandIn(t, trusted, []byte("other"))
+	dir := t.TempDir()
+	good := filepath.Join(dir, "good")
+	bad := filepath.Join(dir, "bad")
+	if err := os.WriteFile(good, trusted, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(bad, []byte("attacker engine"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	const signer = "owner/repo/.github/workflows/ci.yml@refs/heads/main"
+	run := func(file, repo, workflow string) error {
+		return exec.Command("gh", "attestation", "verify", file, "--repo", repo, "--signer-workflow", workflow).Run()
+	}
+	if err := run(good, "owner/repo", signer); err != nil {
+		t.Fatalf("stand-in rejected the pinned request: %v", err)
+	}
+	if run(good, "other/repo", signer) == nil {
+		t.Error("stand-in accepted a wrong repo")
+	}
+	if run(good, "owner/repo", "owner/repo/.github/workflows/other.yml@refs/heads/main") == nil {
+		t.Error("stand-in accepted a wrong signer workflow")
+	}
+	if run(bad, "owner/repo", signer) == nil {
+		t.Error("stand-in accepted an unattested digest")
+	}
+}
+
+func TestAcquireRejectsMissingAttestationVerifier(t *testing.T) {
+	const tag = "v4.1.0"
+	binaryName, err := platformBinaryName()
+	if err != nil {
+		t.Skip(err)
+	}
+	assets := map[string][]byte{
+		"devrites-" + tag + ".tar.gz": testBundle(t, tag, map[string]string{
+			"package.json": `{"version":"4.1.0"}`,
+			"pack/generated/claude/skills/rite/SKILL.md": "rite\n",
+		}),
+		binaryName: []byte("engine"),
+	}
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		name := filepath.Base(r.URL.Path)
+		assetName := strings.TrimSuffix(name, ".sha256")
+		asset, ok := assets[assetName]
+		if !ok {
+			http.NotFound(w, r)
+			return
+		}
+		if strings.HasSuffix(name, ".sha256") {
+			_, _ = fmt.Fprintf(w, "%x  %s\n", sha256.Sum256(asset), assetName)
+			return
+		}
+		_, _ = w.Write(asset)
+	}))
+	defer server.Close()
+	oldWeb := webBaseURL
+	webBaseURL = server.URL
+	t.Cleanup(func() { webBaseURL = oldWeb })
+	t.Setenv("PATH", t.TempDir())
+
+	_, _, err = Acquire(context.Background(), "owner/repo", tag)
+	if err == nil || !strings.Contains(err.Error(), "gh (GitHub CLI) is required") {
+		t.Fatalf("Acquire error = %v, want refusal when gh is not installed", err)
+	}
+}
+
 func TestAcquireRejectsChecksumMismatch(t *testing.T) {
 	const tag = "v4.1.0"
 	bundleName := "devrites-" + tag + ".tar.gz"

package/engine/internal/rootfacts/facts.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io/fs"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -274,6 +275,14 @@ func inspectWorkspaceState(facts *Facts) {
 				Refuse:      true,
 			})
 		}
+	} else if !errors.Is(err, fs.ErrNotExist) {
+		facts.Hazards = append(facts.Hazards, Hazard{
+			ID:          "DRV-WORKSPACE-SCAN-FAILED",
+			Severity:    "error",
+			Message:     fmt.Sprintf("cannot enumerate workspace directory: %v", err),
+			Remediation: fmt.Sprintf("chmod u+rx %s", shellQuote(filepath.Join(root, "work"))),
+			Refuse:      true,
+		})
 	}
 	if strings.TrimSpace(os.Getenv("DEVRITES_WORKSPACE")) != "" {
 		if _, err := devritespaths.WorkspaceOverrideChecked(root, ""); err != nil {

package/engine/internal/rootfacts/facts_test.go

@@ -324,3 +324,41 @@ func runGit(t *testing.T, dir string, args ...string) string {
 	}
 	return strings.TrimSpace(string(out))
 }
+
+func TestResolveRefusesUnreadableWorkDirectory(t *testing.T) {
+	for _, mode := range []os.FileMode{0o111, 0o000} {
+		project := filepath.Join(t.TempDir(), "project")
+		work := filepath.Join(project, ".devrites", "work")
+		outside := filepath.Join(t.TempDir(), "outside")
+		for _, dir := range []string{work, outside} {
+			if err := os.MkdirAll(dir, 0o755); err != nil {
+				t.Fatal(err)
+			}
+		}
+		if err := os.Symlink(outside, filepath.Join(work, "escaped")); err != nil {
+			t.Skipf("symlinks unavailable: %v", err)
+		}
+		if err := os.Chmod(work, mode); err != nil {
+			t.Fatal(err)
+		}
+		t.Cleanup(func() { _ = os.Chmod(work, 0o755) })
+		if _, err := os.ReadDir(work); err == nil {
+			t.Skip("work stays readable (running as root?)")
+		}
+		facts, err := ResolveFrom(project, project)
+		if !errors.Is(err, ErrUnsafeRoot) || hazard(facts, "DRV-WORKSPACE-SCAN-FAILED") == nil {
+			t.Fatalf("mode %o: unreadable work facts=%+v err=%v", mode, facts, err)
+		}
+	}
+}
+
+func TestResolveAcceptsRootWithoutWorkDirectory(t *testing.T) {
+	project := filepath.Join(t.TempDir(), "project")
+	if err := os.MkdirAll(filepath.Join(project, ".devrites"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	facts, err := ResolveFrom(project, project)
+	if err != nil || len(facts.Hazards) != 0 {
+		t.Fatalf("missing work facts=%+v err=%v", facts, err)
+	}
+}

package/engine/internal/state/acceptance.go

@@ -4,6 +4,8 @@ import (
 	"fmt"
 	"regexp"
 	"strings"
+
+	"github.com/devrites/devrites/internal/markdowntext"
 )
 
 var (
@@ -48,7 +50,11 @@ func ParseAcceptanceMap(spec, tasks, testPlan []byte, requireTasks, requireTestP
 }
 
 func acceptanceSection(spec []byte) string {
-	lines := strings.Split(strings.ReplaceAll(string(spec), "\r\n", "\n"), "\n")
+	structural, err := markdowntext.Structural(spec)
+	if err != nil {
+		return ""
+	}
+	lines := strings.Split(strings.ReplaceAll(string(structural), "\r\n", "\n"), "\n")
 	start := -1
 	for i, line := range lines {
 		if acceptanceHeadingRE.MatchString(strings.TrimSpace(line)) {

package/engine/internal/state/budgets.go

@@ -3,6 +3,8 @@ package state
 import (
 	"bytes"
 	"strings"
+
+	"github.com/devrites/devrites/internal/markdowntext"
 )
 
 // Artifact budgets mirror workspace-artifact-schema.md "What each file owns".
@@ -150,17 +152,16 @@ func CountLines(raw []byte) int {
 	return lines
 }
 
-// HasBudgetOverride reports a structural `Budget override:` line outside fenced
-// code blocks; a fenced example never counts.
+// HasBudgetOverride reports a structural `Budget override:` line with a reason
+// outside fenced code blocks; a fenced example never counts. Malformed Markdown carries no
+// structural override.
 func HasBudgetOverride(raw []byte) bool {
-	fenced := false
-	for _, line := range strings.Split(string(raw), "\n") {
-		trimmed := strings.TrimSpace(line)
-		if strings.HasPrefix(trimmed, "```") {
-			fenced = !fenced
-			continue
-		}
-		if !fenced && strings.HasPrefix(trimmed, "Budget override:") {
+	structural, err := markdowntext.Structural(raw)
+	if err != nil {
+		return false
+	}
+	for _, line := range strings.Split(string(structural), "\n") {
+		if reason, ok := strings.CutPrefix(strings.TrimSpace(line), "Budget override:"); ok && strings.TrimSpace(reason) != "" {
 			return true
 		}
 	}