devrites 6.10.0 → 7.0.0

package/engine/internal/lib/treebaseline.go

@@ -0,0 +1,331 @@
+package lib
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/devrites/devrites/internal/devritespaths"
+	"github.com/devrites/devrites/internal/state"
+)
+
+// treeBaselineFile is the feature-root map of dirty product paths to their
+// pathDigest fingerprint (ADR-0038). `dispatch open` writes it when absent
+// (run start: pre-existing dirt is accepted user work), the return that
+// completes a wright wave takes that wave's write set, and `dispatch
+// attribute` takes the paths it names. Paths no longer dirty keep their
+// recorded fingerprint, so a checkpoint commit later collapsed back into the
+// work tree (git reset --soft) is not flagged. The engine never reverts a file.
+const treeBaselineFile = "tree-baseline.json"
+
+// treeProject returns the project directory and its path inside the git
+// repository ("" at the top, else "sub/"). ok is false when root is not a
+// project's .devrites tree or the project is not in a git work tree; the
+// tripwire is then off.
+func treeProject(root string) (project, prefix string, ok bool) {
+	if filepath.Base(root) != devritespaths.DevritesRootName {
+		return "", "", false
+	}
+	project = filepath.Dir(root)
+	out, err := runGitCommand(project, nil, "rev-parse", "--show-prefix")
+	if err != nil {
+		return "", "", false
+	}
+	return project, strings.TrimSpace(string(out)), true
+}
+
+// productDirt fingerprints every dirty product path, project-relative: git
+// status entries (tracked, staged, untracked; gitignored files never appear)
+// outside .devrites/ and .scratch/.
+func productDirt(project, prefix string) (map[string]string, error) {
+	paths, err := gitStatusPaths(project)
+	if err != nil {
+		return nil, err
+	}
+	dirt := make(map[string]string, len(paths))
+	for _, path := range paths {
+		rel, ok := strings.CutPrefix(path, prefix)
+		if !ok || rel == ".devrites" || rel == ".scratch" || strings.HasPrefix(rel, ".devrites/") || strings.HasPrefix(rel, ".scratch/") {
+			continue
+		}
+		dirt[rel] = pathDigest(project, rel)
+	}
+	return dirt, nil
+}
+
+// loadTreeBaseline reads the feature's baseline; ok is false when it is absent.
+func loadTreeBaseline(root, slug string) (map[string]string, bool, error) {
+	dir, err := devritespaths.ExistingFeatureDirChecked(root, slug)
+	if err != nil {
+		return nil, false, err
+	}
+	data, err := os.ReadFile(filepath.Join(dir, treeBaselineFile)) // #nosec G304 -- validated feature workspace artifact
+	if errors.Is(err, os.ErrNotExist) {
+		return nil, false, nil
+	}
+	if err != nil {
+		return nil, false, fmt.Errorf("%s: %w", treeBaselineFile, err)
+	}
+	var baseline map[string]string
+	if err := json.Unmarshal(data, &baseline); err != nil {
+		return nil, false, fmt.Errorf("%s is not valid JSON: %w", treeBaselineFile, err)
+	}
+	return baseline, true, nil
+}
+
+// recordTreeBaseline rewrites the baseline from the current dirty set and
+// carries clean paths' recorded values forward. A path
+// whose fingerprint changed is taken when accept covers it (always when no
+// baseline exists yet); otherwise it keeps its recorded value, or stays
+// unrecorded, and remains flagged. It returns how many paths it took and
+// writes nothing outside a git project. Callers hold the feature lock.
+func recordTreeBaseline(root, slug string, accept func(string) bool) (int, error) {
+	project, prefix, ok := treeProject(root)
+	if !ok {
+		return 0, nil
+	}
+	baseline, exists, err := loadTreeBaseline(root, slug)
+	if err != nil {
+		return 0, err
+	}
+	dirt, err := productDirt(project, prefix)
+	if err != nil {
+		return 0, err
+	}
+	next := make(map[string]string, len(dirt))
+	taken := 0
+	for path, digest := range dirt {
+		was, recorded := baseline[path]
+		switch {
+		case recorded && was == digest:
+			next[path] = was
+		case !exists || accept(path):
+			next[path] = digest
+			taken++
+		case recorded:
+			next[path] = was
+		}
+	}
+	for path, was := range baseline {
+		if _, dirty := dirt[path]; !dirty {
+			next[path] = was
+		}
+	}
+	data, err := json.MarshalIndent(next, "", "  ")
+	if err != nil {
+		return 0, err
+	}
+	return taken, state.AtomicWrite(filepath.Join(devritespaths.FeatureDir(root, slug), treeBaselineFile), append(data, '\n'), 0o600)
+}
+
+// ensureTreeBaseline records the run-start baseline when none exists.
+func ensureTreeBaseline(root, slug string, stdout io.Writer) error {
+	if _, exists, err := loadTreeBaseline(root, slug); err != nil || exists {
+		return err
+	}
+	if _, _, ok := treeProject(root); !ok {
+		return nil
+	}
+	n, err := recordTreeBaseline(root, slug, nil)
+	if err == nil {
+		fmt.Fprintf(stdout, "dispatch: tree baseline recorded (%d dirty product path(s) accepted as user work)\n", n)
+	}
+	return err
+}
+
+// unattributedEdits lists, sorted, the dirty product paths whose fingerprint
+// differs from the baseline and that neither a live claim nor an in-flight
+// wright wave's slice write set covers. A workspace without a baseline,
+// or a project outside git, has none.
+func unattributedEdits(root, slug string) ([]string, error) {
+	baseline, exists, err := loadTreeBaseline(root, slug)
+	if err != nil || !exists {
+		return nil, err
+	}
+	project, prefix, ok := treeProject(root)
+	if !ok {
+		return nil, nil
+	}
+	dirt, err := productDirt(project, prefix)
+	if err != nil {
+		return nil, err
+	}
+	covered, err := liveAttribution(root, slug)
+	if err != nil {
+		return nil, err
+	}
+	var out []string
+	for path, digest := range dirt {
+		if was, recorded := baseline[path]; (!recorded || was != digest) && !covers(covered, path) {
+			out = append(out, path)
+		}
+	}
+	slices.Sort(out)
+	return out, nil
+}
+
+// liveAttribution is every path a wright may be writing now: live claims in
+// the ledger plus the slice write sets of open or sealed wright waves, in
+// any phase.
+func liveAttribution(root, slug string) ([]string, error) {
+	latest, order, _, err := readClaims(claimsPath(root))
+	if err != nil {
+		return nil, err
+	}
+	var paths []string
+	for _, rec := range liveClaims(latest, order, time.Now().UTC()) {
+		paths = append(paths, rec.Paths...)
+	}
+	f, _, err := loadDispatch(root, slug)
+	if err != nil {
+		return nil, err
+	}
+	for _, w := range f.Waves {
+		if (w.State == "open" || w.State == "sealed") && isWrightWave(w) {
+			paths = append(paths, sliceWriteSet(root, slug, w.Slices)...)
+		}
+	}
+	return paths, nil
+}
+
+// waveWriteSet is what a completed wright wave owns: its slices' write
+// sets plus the paths of its claim, released or not.
+func waveWriteSet(root, slug string, w *dispatchWave) []string {
+	paths := sliceWriteSet(root, slug, w.Slices)
+	if w.Claim != "" {
+		if latest, _, _, err := readClaims(claimsPath(root)); err == nil && latest[w.Claim] != nil {
+			paths = append(paths, latest[w.Claim].Paths...)
+		}
+	}
+	return paths
+}
+
+// sliceWriteSet is the tasks.md write set (Writer allowlist, else Files likely
+// touched) of each named slice; an unreadable tasks.md yields none.
+func sliceWriteSet(root, slug string, ids []string) []string {
+	raw, err := readWorkspaceArtifact(root, slug, "tasks.md")
+	if err != nil {
+		return nil
+	}
+	byID, _ := sliceWritePaths(raw, ParseTaskGraph(raw))
+	var out []string
+	for id, paths := range byID {
+		if containsSlice(ids, id) {
+			out = append(out, paths...)
+		}
+	}
+	return out
+}
+
+// covers reports whether a held path (file or directory) covers path.
+func covers(held []string, path string) bool {
+	return slices.ContainsFunc(held, func(h string) bool { return claimPathsOverlap(h, path) })
+}
+
+// unattributedMessage names the flagged paths and both remedies; neither
+// stops for a human and the engine reverts nothing.
+func unattributedMessage(slug string, paths []string) string {
+	return fmt.Sprintf("unattributed root edit: %s; route each path through a bounded wright (its `dispatch open` names it with --claim <path>, or a slice write set covers it) or record the evidence that it is owner work, gate output, a returned wright outside a dispatch wave, or a protocol-sanctioned root write (Polish ADR promotion, DESIGN.md): devrites-engine dispatch %s attribute --reason <evidence> --path <path> (ADR-0038)",
+		strings.Join(paths, ", "), slug)
+}
+
+// recordUnattributed logs one tripwire finding to metrics.jsonl.
+func recordUnattributed(root, slug, phase string, paths []string) {
+	recordMetricNote(root, slug, phase, "unattributed-edit", "", "paths="+strings.Join(paths, ","))
+}
+
+// CheckTreeBaseline is the `check candidate` tripwire: it fails while a dirty
+// product path changed since the tree baseline with no live wright
+// attribution. A workspace without tree-baseline.json always passes.
+func CheckTreeBaseline(root, slug string) error {
+	flagged, err := unattributedEdits(root, slug)
+	if err != nil {
+		return fmt.Errorf("tree baseline: %w", err)
+	}
+	if len(flagged) > 0 {
+		recordUnattributed(root, slug, cursorPhase(root, slug), flagged)
+		return errors.New(unattributedMessage(slug, flagged))
+	}
+	return nil
+}
+
+// attributeEdits records evidence-backed attribution for flagged paths: each
+// must be an unattributed edit now, and its current fingerprint joins the
+// baseline. The reason and paths land in metrics.jsonl.
+func attributeEdits(root, slug, reason string, paths []string, stdout, stderr io.Writer) int {
+	if strings.TrimSpace(reason) == "" || len(paths) == 0 {
+		fmt.Fprintln(stderr, "dispatch: attribute needs --reason <evidence> and at least one --path <path>")
+		return 2
+	}
+	code := 0
+	err := state.WithFeatureLock(root, slug, func() error {
+		flagged, err := unattributedEdits(root, slug)
+		if err != nil {
+			return err
+		}
+		for _, path := range paths {
+			if !slices.Contains(flagged, path) {
+				fmt.Fprintf(stderr, "dispatch: %s is not an unattributed edit (flagged: %s)\n", path, listOrNone(flagged))
+				code = 2
+				return nil
+			}
+		}
+		if _, err := recordTreeBaseline(root, slug, func(p string) bool { return slices.Contains(paths, p) }); err != nil {
+			return err
+		}
+		recordMetricNote(root, slug, cursorPhase(root, slug), "unattributed-edit", "", "attributed="+strings.Join(paths, ",")+" reason="+reason)
+		for _, path := range paths {
+			fmt.Fprintf(stdout, "dispatch: attributed %s (%s)\n", path, reason)
+		}
+		return nil
+	})
+	if err != nil {
+		fmt.Fprintf(stderr, "dispatch: attribute: %v\n", err)
+		return 3
+	}
+	return code
+}
+
+func listOrNone(paths []string) string {
+	if len(paths) == 0 {
+		return "none"
+	}
+	return strings.Join(paths, ", ")
+}
+
+// openTripwire refuses a wave open while an unattributed edit remains that
+// the new wave does not take on: only a wright wave (any phase) takes on
+// paths, through its --claim paths and its slices' write sets.
+func openTripwire(root, slug string, w *dispatchWave, claimPaths []string) error {
+	flagged, err := unattributedEdits(root, slug)
+	if err != nil {
+		return fmt.Errorf("tree baseline: %w", err)
+	}
+	if isWrightWave(w) {
+		own := append(sliceWriteSet(root, slug, w.Slices), claimPaths...)
+		flagged = slices.DeleteFunc(flagged, func(p string) bool { return covers(own, p) })
+	}
+	if len(flagged) == 0 {
+		return nil
+	}
+	recordUnattributed(root, slug, w.Phase, flagged)
+	return errors.New(unattributedMessage(slug, flagged))
+}
+
+// absorbWave takes a completed wright wave's write set into the
+// baseline. A failure only warns: the return is already recorded.
+func absorbWave(root, slug string, w *dispatchWave, stderr io.Writer) {
+	if !isWrightWave(w) {
+		return
+	}
+	own := waveWriteSet(root, slug, w)
+	if _, err := recordTreeBaseline(root, slug, func(p string) bool { return covers(own, p) }); err != nil {
+		fmt.Fprintf(stderr, "dispatch: WARNING: %s not updated: %v\n", treeBaselineFile, err)
+	}
+}

package/engine/internal/lib/triggers.go

@@ -24,6 +24,7 @@ type triggerFacts struct {
 	afk         bool
 	afkParallel bool
 	principles  bool
+	aiSpec      bool   // featureDir/ai-spec.md exists: the spec process marked an AI feature
 	corpus      string // lowercased text of spec/plan/tasks/design brief
 }
 
@@ -38,8 +39,23 @@ var (
 	tddSignalRe  = regexp.MustCompile(`\b(tdd|test[- ]first|test driven)\b`)
 	topoSignalRe = regexp.MustCompile(`(migrat|\bschema\b|\bsql\b|database|postgres|mysql|sqlite|mongo|\bqueue\b|kafka|rabbitmq|redis|\bcache\b|webhook|monorepo|multi[- ]root|multi[- ]service|microservice|\bgrpc\b|graphql|\brest\b|\bapi\b|message broker)`)
 	wfaSignalRe  = regexp.MustCompile(`workflow[- ]artifact`)
+	aiSignalRe   = regexp.MustCompile(`\b(llms?|prompts?|rag|embeddings?|model output|agents?|agentic|tool[- ]use|skill packages?|mcp|chatbot)\b`)
+	// aiAnnexRe drops the spec template's always-present "AI-SPEC annex" section
+	// (its boilerplate names LLM/RAG/agent) up to the next heading, kept via $1.
+	aiAnnexRe = regexp.MustCompile(`(?ms)^#{1,6}[ \t]*ai-spec annex[^\n]*\n.*?(^#|\z)`)
 )
 
+// keepModelSurface reports whether a --role bundle inlines <!-- model-surface -->
+// sections. Unlike suggestions this is decided by the engine, and it fails
+// safe: the security auditor always keeps them, and so does any role whose
+// spec/plan/tasks corpus is absent, whose feature has an ai-spec.md, or whose
+// corpus (minus the template's AI-SPEC annex) names a model, agent, RAG, or
+// tool surface.
+func keepModelSurface(role string, facts triggerFacts) bool {
+	return role == "security-auditor" || facts.aiSpec || strings.TrimSpace(facts.corpus) == "" ||
+		aiSignalRe.MatchString(aiAnnexRe.ReplaceAllString(facts.corpus, "$1"))
+}
+
 // triggerSignals maps declared trigger-name shapes to facts. nameRe is matched
 // case-insensitively against each declared (unselected) trigger name.
 var triggerSignals = []struct {
@@ -100,6 +116,9 @@ func gatherTriggerFacts(root, featureDir, role string) triggerFacts {
 		}
 	}
 	if featureDir != "" {
+		if info, err := os.Stat(filepath.Join(featureDir, "ai-spec.md")); err == nil && info.Mode().IsRegular() {
+			facts.aiSpec = true
+		}
 		var corpus strings.Builder
 		for _, name := range triggerEvidenceFiles {
 			path := filepath.Join(featureDir, name)

package/engine/internal/lib/windows.go

@@ -1,16 +1,21 @@
 package lib
 
 import (
+	"bytes"
+	"context"
 	"fmt"
 	"io"
 	"os"
+	"os/exec"
 	"path"
 	"path/filepath"
 	"regexp"
 	"strconv"
 	"strings"
+	"time"
 
 	"github.com/devrites/devrites/internal/devritespaths"
+	"github.com/devrites/devrites/internal/gitenv"
 )
 
 // windows.go — the broken-windows check. Review prose flags a new TODO, stub,
@@ -20,7 +25,7 @@ import (
 // recorded waiver row in the workspace's windows.md, or the check fails. A
 // silent deferral or lowered bar is the bug.
 //
-//	devrites-engine check windows <slug> [--worktree|--staged|--base <ref>] [--cwd <dir>]
+//	devrites-engine check windows <slug> [--worktree|--staged|--base <ref>|--since-dispatch <wave>] [--cwd <dir>]
 //
 //	0  no unwaived markers    2  usage error    3  unwaived markers or blocked
 //
@@ -30,6 +35,10 @@ import (
 // that remains (`removed-assertion`). Each windows.md row waives exactly one hit —
 // one blanket row cannot cover a file's five new TODOs.
 //
+// --since-dispatch <wave> reports only those removals, against the work-tree
+// snapshot that wave's build wright open recorded: same-tree repair rounds stay
+// uncommitted, so a test an earlier round added is plain additions against HEAD.
+//
 // windows.md row grammar (one waiver per line):
 //
 //	- <project-relative path> | <marker token> | <reason>
@@ -37,7 +46,7 @@ import (
 // A row waives one hit at that path carrying that marker; empty reasons do not
 // waive. Rows never suppress coverage — they explain it.
 
-const windowsUsage = `usage: devrites-engine check windows <slug> [--worktree|--staged|--base <ref>] [--cwd <dir>]
+const windowsUsage = `usage: devrites-engine check windows <slug> [--worktree|--staged|--base <ref>|--since-dispatch <wave>] [--cwd <dir>]
 
 Reports deferral and bar-lowering markers introduced by the change (added lines:
 TODO/stub/skip/focus idioms, checker suppressions, empty-catch; removals:
@@ -45,6 +54,8 @@ deleted-test, removed-assertion) and requires each to be waived by a row in
 .devrites/work/<slug>/windows.md:
   - <path> | <marker> | <reason>
 Each row waives one hit at that path with that marker token.
+--since-dispatch <wave> reports only removals since that build wright wave
+opened (its recorded work-tree snapshot), untracked files included.
 Exit 0 clean or fully waived, 3 unwaived markers or blocked.`
 
 // deferralTokenRe catches uppercase comment markers: TODO, FIXME, XXX, HACK.
@@ -312,12 +323,22 @@ func windowsHits(opts diffScopeOpts) ([]windowHit, error) {
 		diffArgs = append(diffArgs, "--cached", "-M", "-U0", "--")
 	case "base":
 		diffArgs = append(diffArgs, opts.base, "-M", "-U0", "--")
+	case "since":
+		after, err := worktreeTree(dir)
+		if err != nil {
+			return nil, err
+		}
+		diffArgs = append(diffArgs, opts.base, after, "-M", "-U0", "--")
 	default:
 		diffArgs = append(diffArgs, "HEAD", "-M", "-U0", "--")
 	}
 	diff, err := runGitCommand(dir, nil, diffArgs...)
 	var diffPaths map[string]bool
 	switch {
+	case err == nil && opts.mode == "since":
+		// Added markers are the HEAD-based run's job; round over round only
+		// removals are new.
+		hits = removedTestHits(string(diff))
 	case err == nil:
 		hits, diffPaths = addedLinesFromDiff(string(diff))
 		hits = append(hits, removedTestHits(string(diff))...)
@@ -368,6 +389,55 @@ func windowsHits(opts diffScopeOpts) ([]windowHit, error) {
 	return kept, nil
 }
 
+// worktreeTree snapshots the work tree (tracked, staged, and untracked files
+// git does not ignore) as a tree object and returns its id. It stages into a
+// private copy of the index, so the real index, refs, and files stay untouched;
+// the only trace is unreferenced objects git gc prunes.
+func worktreeTree(dir string) (string, error) {
+	tmp, err := os.MkdirTemp("", "devrites-tree-")
+	if err != nil {
+		return "", err
+	}
+	defer func() { _ = os.RemoveAll(tmp) }()
+	index := filepath.Join(tmp, "index")
+	// Seeding from the real index reuses its stat cache: only changed files rehash.
+	if out, err := runGitCommand(dir, nil, "rev-parse", "--git-path", "index"); err == nil {
+		live := strings.TrimSpace(string(out))
+		if !filepath.IsAbs(live) {
+			live = filepath.Join(dir, live)
+		}
+		if raw, err := os.ReadFile(live); err == nil { // #nosec G304 -- git's own index path
+			if err := os.WriteFile(index, raw, 0o600); err != nil { // #nosec G703 -- index is a fixed name in our own MkdirTemp dir
+				return "", err
+			}
+		}
+	}
+	if _, err := gitWithIndex(dir, index, "add", "-A"); err != nil {
+		return "", err
+	}
+	tree, err := gitWithIndex(dir, index, "write-tree")
+	return strings.TrimSpace(tree), err
+}
+
+// gitWithIndex runs git on a private index. runGitCommand strips
+// GIT_INDEX_FILE with the other repository-targeting variables, so it is set
+// here after sanitizing.
+func gitWithIndex(dir, index string, args ...string) (string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), gitCommandTimeout)
+	defer cancel()
+	// #nosec G204 -- git -C <project dir>; fixed binary, sanitized env plus a private index
+	cmd := exec.CommandContext(ctx, "git", append([]string{"-C", dir}, args...)...)
+	cmd.Env = append(gitenv.Sanitize(os.Environ()), "GIT_INDEX_FILE="+index, "GIT_TERMINAL_PROMPT=0", "LC_ALL=C")
+	cmd.WaitDelay = 2 * time.Second
+	var stderr bytes.Buffer
+	cmd.Stderr = &stderr
+	out, err := cmd.Output()
+	if err != nil {
+		return "", fmt.Errorf("git %s: %w: %s", strings.Join(args, " "), err, strings.TrimSpace(stderr.String()))
+	}
+	return string(out), nil
+}
+
 func isUnbornHEAD(dir string) bool {
 	_, err := runGitCommand(dir, nil, "rev-parse", "--verify", "HEAD")
 	return err != nil
@@ -410,6 +480,7 @@ func parseWindowsWaivers(raw string) (map[windowWaiver]int, []string) {
 func parseWindowsArgs(root string, args []string, stderr io.Writer) (diffScopeOpts, int) {
 	opts := diffScopeOpts{mode: "worktree", root: root}
 	var positional []string
+	var wave string
 	for i := 0; i < len(args); i++ {
 		switch args[i] {
 		case "--phase":
@@ -427,6 +498,14 @@ func parseWindowsArgs(root string, args []string, stderr io.Writer) (diffScopeOp
 				return opts, 2
 			}
 			i++
+		case "--since-dispatch":
+			opts.mode = "since"
+			wave = argAt(args, i+1)
+			if wave == "" || strings.HasPrefix(wave, "-") {
+				fmt.Fprintln(stderr, "windows: --since-dispatch requires a wave name (not a flag)")
+				return opts, 2
+			}
+			i++
 		case "--cwd":
 			opts.cwd = argAt(args, i+1)
 			i++
@@ -443,6 +522,28 @@ func parseWindowsArgs(root string, args []string, stderr io.Writer) (diffScopeOp
 		return opts, 2
 	}
 	opts.slug = positional[0]
+	if opts.mode == "since" {
+		if opts.cwd != "" {
+			fmt.Fprintln(stderr, "windows: --since-dispatch compares the project checkout; it takes no --cwd")
+			return opts, 2
+		}
+		// opts.base carries the wave's recorded tree: the diff's old side.
+		if _, err := devritespaths.ExistingFeatureDirChecked(root, opts.slug); err != nil {
+			fmt.Fprintf(stderr, "windows: workspace unavailable: %v\n", err)
+			return opts, 2
+		}
+		f, _, err := loadDispatch(root, opts.slug)
+		if err != nil {
+			fmt.Fprintf(stderr, "windows: %v\n", err)
+			return opts, 2
+		}
+		w := f.Waves[wave]
+		if w == nil || w.Tree == "" {
+			fmt.Fprintf(stderr, "windows: wave %q has no recorded tree snapshot (only a build wright wave opened in a git project records one)\n", wave)
+			return opts, 2
+		}
+		opts.base = w.Tree
+	}
 	if opts.phase == "" {
 		opts.phase = cursorPhase(root, opts.slug)
 	}
@@ -477,6 +578,10 @@ func RunCheckWindows(root string, args []string, stdout, stderr io.Writer) int {
 	for _, w := range warnings {
 		fmt.Fprintf(stdout, "windows: %s\n", w)
 	}
+	event := "windows"
+	if opts.mode == "since" {
+		event = "windows-since" // per-round removals stay apart from HEAD-based runs
+	}
 	var unwaived, waived int
 	for _, h := range hits {
 		w := windowWaiver{Path: h.Path, Marker: h.Marker}
@@ -492,15 +597,15 @@ func RunCheckWindows(root string, args []string, stdout, stderr io.Writer) int {
 	switch {
 	case len(hits) == 0:
 		fmt.Fprintln(stdout, "windows: ok (no deferral markers introduced)")
-		recordMetric(root, opts.slug, opts.phase, "windows", "", 0)
+		recordMetric(root, opts.slug, opts.phase, event, "", 0)
 		return 0
 	case unwaived == 0:
 		fmt.Fprintf(stdout, "windows: ok (%d marker(s), all waived in windows.md)\n", len(hits))
-		recordMetric(root, opts.slug, opts.phase, "windows", "", int64(len(hits)))
+		recordMetric(root, opts.slug, opts.phase, event, "", int64(len(hits)))
 		return 0
 	default:
 		fmt.Fprintf(stdout, "windows: BLOCKED: %d unwaived deferral marker(s) introduced — remove them or record waivers in windows.md\n", unwaived)
-		recordMetric(root, opts.slug, opts.phase, "windows", "", int64(unwaived))
+		recordMetric(root, opts.slug, opts.phase, event, "", int64(unwaived))
 		return 3
 	}
 }

package/engine/internal/overhaul/admit/run.go

@@ -22,8 +22,8 @@ import (
 	"strconv"
 	"strings"
 	"unicode/utf16"
-	"unicode/utf8"
 
+	"github.com/devrites/devrites/internal/anchor"
 	"github.com/devrites/devrites/internal/overhaul/ovio"
 	"github.com/devrites/devrites/internal/overhaul/packet"
 	"github.com/devrites/devrites/internal/overhaul/records"
@@ -56,7 +56,7 @@ func Run(args []string, stdout, stderr io.Writer) int {
 	case len(args) == 3 && args[0] == "packet":
 		code, err = packetAdmit(args[1], args[2], stdout)
 	case len(args) == 3 && args[0] == "anchor":
-		code, err = anchor(args[1], args[2], stdout, stderr)
+		code, err = anchorFindings(args[1], args[2], stdout, stderr)
 	default:
 		fmt.Fprint(stderr, usage)
 		return 2
@@ -332,28 +332,6 @@ func result(stdout io.Writer, why []string, ok string) int {
 	return 0
 }
 
-// splitlines is Python's str.splitlines().
-func splitlines(s string) []string {
-	var out []string
-	start := 0
-	for i := 0; i < len(s); {
-		r, size := utf8.DecodeRuneInString(s[i:])
-		i += size
-		switch r {
-		case '\n', '\r', '\v', '\f', 0x1c, 0x1d, 0x1e, 0x85, 0x2028, 0x2029:
-			out = append(out, s[start:i-size])
-			if r == '\r' && i < len(s) && s[i] == '\n' {
-				i++
-			}
-			start = i
-		}
-	}
-	if start < len(s) {
-		out = append(out, s[start:])
-	}
-	return out
-}
-
 // pyInt is Python's int() on a decoded JSON value.
 func pyInt(v any) (int, error) {
 	switch x := v.(type) {
@@ -381,7 +359,7 @@ func pyInt(v any) (int, error) {
 	return 0, fmt.Errorf("int() argument must be a string or a number, not %s", records.Repr(v))
 }
 
-func anchor(root, path string, stdout, stderr io.Writer) (int, error) {
+func anchorFindings(root, path string, stdout, stderr io.Writer) (int, error) {
 	doc, err := ovio.LoadJSON(path)
 	if err != nil {
 		return 0, err
@@ -411,7 +389,7 @@ func anchor(root, path string, stdout, stderr io.Writer) (int, error) {
 			if err != nil {
 				return 0, err
 			}
-			lines := splitlines(strings.ToValidUTF8(string(b), "�"))
+			lines := anchor.Lines(b)
 			start, ok := loc["start"]
 			if !ok {
 				start = json.Number("0")
@@ -432,11 +410,10 @@ func anchor(root, path string, stdout, stderr io.Writer) (int, error) {
 				why = append(why, fmt.Sprintf("%s: %s lines %d-%d outside file (%d lines)", id, rel, s, e, len(lines)))
 				continue
 			}
-			q := strings.Join(strings.Fields(quote), " ")
-			w := strings.Join(strings.Fields(strings.Join(lines[s-1:e], " ")), " ")
-			if q == "" || !strings.Contains(w, q) {
+			switch anchor.At(lines, s, e, quote) {
+			case anchor.NotFound:
 				why = append(why, fmt.Sprintf("%s: quote not found at %s:%d-%d", id, rel, s, e))
-			} else if utf8.RuneCountInString(strings.ReplaceAll(q, " ", "")) < 8 && q != w {
+			case anchor.TooShort:
 				why = append(why, fmt.Sprintf("%s: quote at %s:%d is too short to anchor; quote the whole line", id, rel, s))
 			}
 		}