devrites 7.2.7 → 7.3.0

package/engine/internal/acceptance/run.go

@@ -28,10 +28,11 @@ type GateResult struct {
 	Ran       bool
 	Passed    bool
 	Detail    string // exit/match/timeout/approval diagnostic
-	Discarded bool   // result dropped: ledger changed under the run
+	Discarded bool   // result dropped: bound oracle or inputs changed during the run
 	WriteErr  error  // evidence writeback failed for a reason other than drift
-	Reused    bool   // met gate kept because its INPUTS are unchanged
+	Reused    bool   // met gate kept under the selected reuse policy
 	Inputs    string // INPUTS content digest at run time, when declared
+	Origin    string // complete executed transcript retained when proof is reused
 	// Outcome, Started and Ended describe the execution this result judged;
 	// they are zero when the gate did not execute.
 	Outcome        RunOutcome
@@ -63,27 +64,52 @@ func ReadLedgerFile(ledgerPath string) (string, error) {
 	return string(raw), nil
 }
 
-// RunGates executes the runnable gates of ledgerPath. reverify re-runs every
-// runnable gate including already-met ones; the normal mode runs only unmet
-// runnable gates. approved is the vetted command set from test-plan.md; a
+// RunOptions controls evidence reuse and short ledger writeback locking.
+// TranscriptWork requires a usable executed origin before a met gate can skip.
+// The caller holds the gates execution lock through transcript publication.
+type RunOptions struct {
+	WriteLock      func(func() error) error
+	TranscriptWork string
+}
+
+// RunGates executes the runnable gates of ledgerPath. reverify also runs met
+// gates without INPUTS; met gates with unchanged INPUTS reuse their proof in
+// either mode, subject to options.TranscriptWork's executed-origin requirement.
+// approved is the vetted command set from test-plan.md; a
 // CHECK outside it never executes, and neither does one outside a surface that
 // could not be determined — an absent preflight is a refusal, not permission.
 // Each pass writes definition-bound evidence; each failure clears the box and
 // restores EVIDENCE: pending.
 //
 // Gates sharing one CHECK and CWD execute once per call; each matches its own
-// EXPECT against that shared output. writeLock, when non-nil, wraps every
+// EXPECT against that shared output. options.WriteLock, when non-nil, wraps every
 // ledger writeback so the caller need not hold the feature lock while checks
 // execute; writeResult re-verifies the gate's oracle before it writes.
-func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, approved []ApprovedCommand, reverify bool, timeout time.Duration, writeLock func(func() error) error) []GateResult {
+func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, approved []ApprovedCommand, reverify bool, timeout time.Duration, options *RunOptions) []GateResult {
+	var writeLock func(func() error) error
+	transcriptWork := ""
+	if options != nil {
+		writeLock, transcriptWork = options.WriteLock, options.TranscriptWork
+	}
 	var results []GateResult
-	outcomes := map[string]RunOutcome{}
-	spans := map[string][2]time.Time{}
-	write := func(gate *Gate, evidence string, checked bool) error {
-		if writeLock == nil {
-			return writeResult(ledgerPath, gate, evidence, checked)
+	executions := map[string]struct {
+		ran     bool
+		outcome RunOutcome
+		span    [2]time.Time
+		inputs  map[string]string
+	}{}
+	// Collect every dependent INPUTS spec before any shared command can run.
+	for _, gate := range doc.Gates {
+		if gate.Check == "" || gate.Inputs == "" {
+			continue
 		}
-		return writeLock(func() error { return writeResult(ledgerPath, gate, evidence, checked) })
+		key := gate.Check + "\x00" + filepath.Join(root, filepath.FromSlash(gate.Cwd))
+		execution := executions[key]
+		if execution.inputs == nil {
+			execution.inputs = map[string]string{}
+		}
+		execution.inputs[gate.Inputs] = ""
+		executions[key] = execution
 	}
 	for _, gate := range doc.Gates {
 		if _, abandoned := doc.Abandoned[gate.ID]; abandoned {
@@ -94,24 +120,35 @@ func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, appro
 			results = append(results, GateResult{ID: gate.ID, Detail: "manual gate; evidence is judged, not executed"})
 			continue
 		}
-		inputs := ""
-		if gate.Inputs != "" {
-			// An unreadable or unmatched spec yields "", which never matches, so the gate re-executes.
-			inputs, _ = InputsDigest(root, gate.Inputs)
+		isApproved := Approved(gate.Check, gate.Cwd, approved)
+		if transcriptWork != "" && !isApproved {
+			results = append(results, GateResult{ID: gate.ID, Detail: "CHECK/CWD is not an approved test-plan.md preflight row; not executed"})
+			continue
 		}
+		inputs := ""
 		if GateState(gate, doc) == StateMet {
-			if gate.Inputs == "" && !reverify {
-				results = append(results, GateResult{ID: gate.ID, Passed: true, Detail: "already met"})
-				continue
+			canReuse := gate.Inputs == "" && !reverify
+			if gate.Inputs != "" {
+				// An unreadable or unmatched spec never matches recorded evidence.
+				inputs, _ = InputsDigest(root, gate.Inputs)
+				canReuse = inputs != "" && inputs == recordedInputs(gate)
 			}
-			// A gate that declares INPUTS is reused, under run and reverify alike,
-			// exactly while the files it depends on are byte-identical; any change re-executes it.
-			if inputs != "" && inputs == recordedInputs(gate) {
-				results = append(results, GateResult{ID: gate.ID, Passed: true, Reused: true, Inputs: inputs, Detail: "reused: inputs unchanged"})
-				continue
+			if canReuse {
+				origin := ""
+				if transcriptWork != "" {
+					origin = passingOrigin(transcriptWork, gate)
+				}
+				if transcriptWork == "" || origin != "" {
+					detail := "already met"
+					if gate.Inputs != "" {
+						detail = "reused: inputs unchanged"
+					}
+					results = append(results, GateResult{ID: gate.ID, Passed: true, Reused: gate.Inputs != "" || origin != "", Inputs: inputs, Origin: origin, Detail: detail})
+					continue
+				}
 			}
 		}
-		if !Approved(gate.Check, gate.Cwd, approved) {
+		if !isApproved {
 			results = append(results, GateResult{ID: gate.ID, Detail: "CHECK/CWD is not an approved test-plan.md preflight row; not executed"})
 			continue
 		}
@@ -120,36 +157,84 @@ func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, appro
 			results = append(results, GateResult{ID: gate.ID, Detail: err.Error()})
 			continue
 		}
-		cwd := root
-		if gate.Cwd != "" {
-			cwd = filepath.Join(root, filepath.FromSlash(gate.Cwd))
-		}
+		cwd := filepath.Join(root, filepath.FromSlash(gate.Cwd))
 		key := gate.Check + "\x00" + cwd
-		outcome, ran := outcomes[key]
-		if !ran {
+		execution := executions[key]
+		if !execution.ran {
+			for spec := range execution.inputs {
+				execution.inputs[spec], _ = InputsDigest(root, spec)
+			}
 			started := time.Now().UTC()
-			outcome = Execute(ctx, gate.Check, cwd, timeout)
-			outcomes[key] = outcome
-			spans[key] = [2]time.Time{started, time.Now().UTC()}
-		}
-		span := spans[key]
-		if outcome.Err == nil && outcome.ExitCode == 0 && expectation.Matches(outcome.Output) {
-			evidence := withInputs(FormatEvidence(gate, OutputDigest(outcome.Output), outcome.OutputBytes, time.Now().UTC().Format(time.RFC3339)), inputs)
-			writeErr := write(gate, evidence, true)
-			results = append(results, GateResult{
-				ID: gate.ID, Ran: true, Passed: true,
-				Discarded: errors.Is(writeErr, ErrOracleMoved), WriteErr: writeErr,
-				Detail: resultDetail(writeErr, "pass"),
-				Inputs: inputs, Outcome: outcome, Started: span[0], Ended: span[1],
-			})
+			execution.outcome = Execute(ctx, gate.Check, cwd, timeout)
+			execution.span = [2]time.Time{started, time.Now().UTC()}
+			for spec, before := range execution.inputs {
+				after, _ := InputsDigest(root, spec)
+				if after != before {
+					execution.inputs[spec] = ""
+				}
+			}
+			execution.ran = true
+			executions[key] = execution
+		}
+		outcome := execution.outcome
+		inputs = execution.inputs[gate.Inputs]
+		passed := outcome.Err == nil && outcome.ExitCode == 0 && expectation.Matches(outcome.Output)
+		detail := "pass"
+		if !passed {
+			detail = failDetail(outcome, expectation)
+		}
+		write := func() error {
+			if passed && gate.Inputs != "" {
+				// Earlier writebacks may have moved files since execution.
+				current, _ := InputsDigest(root, gate.Inputs)
+				if inputs == "" || current != inputs {
+					passed = false
+					detail = "INPUTS changed or could not be read during the run"
+				}
+			}
+			evidence := "pending"
+			if passed {
+				evidence = withInputs(FormatEvidence(gate, OutputDigest(outcome.Output), outcome.OutputBytes, time.Now().UTC().Format(time.RFC3339)), inputs)
+			}
+			return writeResult(ledgerPath, gate, evidence, passed)
+		}
+		var writeErr error
+		if writeLock == nil {
+			writeErr = write()
 		} else {
-			writeErr := write(gate, "pending", false)
-			results = append(results, GateResult{
-				ID: gate.ID, Ran: true,
-				Discarded: errors.Is(writeErr, ErrOracleMoved), WriteErr: writeErr,
-				Detail: resultDetail(writeErr, failDetail(outcome, expectation)),
-				Inputs: inputs, Outcome: outcome, Started: span[0], Ended: span[1],
-			})
+			writeErr = writeLock(write)
+		}
+		results = append(results, GateResult{
+			ID: gate.ID, Ran: true, Passed: passed,
+			Discarded: errors.Is(writeErr, ErrOracleMoved), WriteErr: writeErr,
+			Detail: resultDetail(writeErr, detail),
+			Inputs: inputs, Outcome: outcome, Started: execution.span[0], Ended: execution.span[1],
+		})
+	}
+	// Later checks may invalidate an earlier execution or reused pass.
+	for i, gate := range doc.Gates {
+		result := &results[i]
+		if !result.Passed || result.Discarded || result.WriteErr != nil || gate.Inputs == "" {
+			continue
+		}
+		validate := func() error {
+			current, _ := InputsDigest(root, gate.Inputs)
+			if current != "" && current == result.Inputs {
+				return nil
+			}
+			result.Passed, result.Reused, result.Discarded = false, false, true
+			result.Detail = "INPUTS changed or could not be read after a later check"
+			return writeResult(ledgerPath, gate, "pending", false)
+		}
+		var err error
+		if writeLock == nil {
+			err = validate()
+		} else {
+			err = writeLock(validate)
+		}
+		if err != nil {
+			result.WriteErr = err
+			result.Detail = resultDetail(err, result.Detail)
 		}
 	}
 	return results

package/engine/internal/acceptance/transcript.go

@@ -1,13 +1,17 @@
 package acceptance
 
 import (
+	"errors"
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
 	"regexp"
+	"strconv"
 	"strings"
 	"time"
 
+	"github.com/devrites/devrites/internal/fsutil"
 	"github.com/devrites/devrites/internal/secretpattern"
 )
 
@@ -19,7 +23,11 @@ var CandidateDigest func(root, slug string) (string, error)
 // maxTranscriptOutput caps the redacted output a transcript keeps.
 const maxTranscriptOutput = 1 << 20
 
+// Redaction can expand short credentials in metadata as well as output.
+const maxTranscriptBytes = 2*MaxLedgerBytes + maxTranscriptOutput + (64 << 10)
+
 var unsafeNameRE = regexp.MustCompile(`[^A-Za-z0-9._-]`)
+var transcriptDigestRE = regexp.MustCompile(`^[0-9a-f]{64}$`)
 
 func candidateLabel(root, slug string) string {
 	if CandidateDigest == nil {
@@ -27,77 +35,260 @@ func candidateLabel(root, slug string) string {
 	}
 	digest, err := CandidateDigest(root, slug)
 	if err != nil {
-		return "unavailable: " + oneLine(err.Error())
+		return "unavailable: " + transcriptMetadata(err.Error())
 	}
 	return digest
 }
 
-// writeTranscripts records one immutable file per executed or reused gate under
-// <work>/references/gates/<gate-id>/, binding the exact command, cwd, attempt,
-// exit, EXPECT verdict and redacted output to the candidate identity read
-// before and after the run. OUTPUT_SHA256 equals the ledger evidence digest.
+func transcriptMetadata(value string) string {
+	redacted, _ := secretpattern.Redact(oneLine(value))
+	return redacted
+}
+
+func transcriptGateName(id string) string {
+	name := unsafeNameRE.ReplaceAllString(transcriptMetadata(id), "_")
+	if name == "." || name == ".." || name == "" {
+		return "_"
+	}
+	return name
+}
+
+// transcriptDirectory opens each directory without accepting symlink parents.
+// Holding the resulting root also confines publication if a parent is renamed.
+func transcriptDirectory(work, id string, create bool) (*os.Root, error) {
+	root, err := os.OpenRoot(work)
+	if err != nil {
+		return nil, err
+	}
+	for _, name := range []string{"references", "gates", transcriptGateName(id)} {
+		info, err := root.Lstat(name)
+		if errors.Is(err, os.ErrNotExist) && create {
+			if err = root.Mkdir(name, 0o700); err == nil || errors.Is(err, os.ErrExist) {
+				info, err = root.Lstat(name)
+			}
+		}
+		if err != nil || !info.IsDir() {
+			_ = root.Close()
+			if err == nil {
+				err = fmt.Errorf("unsafe transcript directory %s", name)
+			}
+			return nil, err
+		}
+		next, err := root.OpenRoot(name)
+		if err == nil {
+			var opened os.FileInfo
+			opened, err = next.Stat(".")
+			if err == nil && !os.SameFile(info, opened) {
+				err = fmt.Errorf("transcript directory changed: %s", name)
+			}
+		}
+		_ = root.Close()
+		if err != nil {
+			if next != nil {
+				_ = next.Close()
+			}
+			return nil, err
+		}
+		root = next
+	}
+	return root, nil
+}
+
+// writeTranscripts atomically publishes private, complete executed records.
+// Reuse points to the original file, preserving its historical candidate labels.
+// OUTPUT_SHA256 and OUTPUT_BYTES always describe original, not redacted output.
 func writeTranscripts(work string, doc *Document, results []GateResult, before, after string) ([]string, error) {
 	gates := map[string]*Gate{}
 	for _, gate := range doc.Gates {
 		gates[gate.ID] = gate
 	}
 	prefix := "nodigest"
-	if len(before) >= 12 && !strings.HasPrefix(before, "unavailable") {
+	if transcriptDigestRE.MatchString(before) {
 		prefix = before[:12]
 	}
 	var paths []string
 	for _, result := range results {
 		gate := gates[result.ID]
-		if gate == nil || (!result.Ran && !result.Reused) {
+		if gate == nil {
 			continue
 		}
-		name := unsafeNameRE.ReplaceAllString(gate.ID, "_")
-		if name == "." || name == ".." {
-			name = "_"
+		if result.Reused && result.Origin != "" {
+			paths = append(paths, result.Origin)
+			continue
 		}
-		dir := filepath.Join(work, "references", "gates", name)
-		if err := os.MkdirAll(dir, 0o755); err != nil {
-			return paths, err
+		if !result.Ran {
+			continue
 		}
-		var body strings.Builder
-		fmt.Fprintf(&body, "DEVRITES-GATE-TRANSCRIPT v1\nGATE: %s\nTITLE: %s\nCOMMAND: %s\nCWD: %s\n", gate.ID, gate.Title, gate.Check, valueOr(gate.Cwd, "."))
-		fmt.Fprintf(&body, "INPUTS: %s\nINPUTS_SHA256: %s\nCANDIDATE_BEFORE: %s\nCANDIDATE_AFTER: %s\n", valueOr(gate.Inputs, "none"), valueOr(result.Inputs, "none"), before, after)
-		var file string
-		if result.Reused {
-			file = filepath.Join(dir, prefix+"-reused.log")
-			fmt.Fprintf(&body, "RESULT: reused (inputs unchanged; not executed)\nPRIOR_EVIDENCE: %s\n", gate.Evidence)
-		} else {
-			attempt := 1
-			if entries, err := os.ReadDir(dir); err == nil {
-				for _, entry := range entries {
-					if strings.HasPrefix(entry.Name(), prefix+"-a") {
-						attempt++
-					}
-				}
-			}
-			file = filepath.Join(dir, fmt.Sprintf("%s-a%d.log", prefix, attempt))
-			output, masked := secretpattern.Redact(result.Outcome.Output)
-			truncated := len(output) > maxTranscriptOutput
-			if truncated {
-				output = output[:maxTranscriptOutput]
-			}
-			verdict := "fail"
-			if result.Passed {
-				verdict = "pass"
-			}
-			fmt.Fprintf(&body, "ATTEMPT: %d\nSTARTED: %s\nENDED: %s\nEXIT: %s\nEXPECT: %s\nRESULT: %s\n",
-				attempt, result.Started.Format(time.RFC3339Nano), result.Ended.Format(time.RFC3339Nano), exitLabel(result.Outcome), gate.Expect, verdict)
-			fmt.Fprintf(&body, "OUTPUT_SHA256: %s\nOUTPUT_BYTES: %d\nREDACTIONS: %d\nTRUNCATED: %t\n--- OUTPUT ---\n%s\n--- END OUTPUT ---\n",
-				OutputDigest(result.Outcome.Output), result.Outcome.OutputBytes, masked, truncated, output)
+		dir, err := transcriptDirectory(work, gate.ID, true)
+		if err != nil {
+			return paths, err
 		}
-		if err := os.WriteFile(file, []byte(body.String()), 0o644); err != nil {
+		file, err := publishTranscript(dir, gate, result, prefix, before, after)
+		_ = dir.Close()
+		if err != nil {
 			return paths, err
 		}
-		paths = append(paths, file)
+		paths = append(paths, filepath.Join(work, "references", "gates", transcriptGateName(gate.ID), file))
 	}
 	return paths, nil
 }
 
+func publishTranscript(dir *os.Root, gate *Gate, result GateResult, prefix, before, after string) (string, error) {
+	attempt := 1
+	for {
+		file := fmt.Sprintf("%s-a%d.log", prefix, attempt)
+		if _, err := dir.Lstat(file); errors.Is(err, os.ErrNotExist) {
+			break
+		} else if err != nil {
+			return "", err
+		}
+		attempt++
+	}
+	var body strings.Builder
+	fmt.Fprintf(&body, "DEVRITES-GATE-TRANSCRIPT v2\nGATE: %s\nTITLE: %s\nCOMMAND: %s\nCWD: %s\nDEFINITION_SHA256: %s\n",
+		transcriptMetadata(gate.ID), transcriptMetadata(gate.Title), transcriptMetadata(gate.Check), transcriptMetadata(valueOr(gate.Cwd, ".")), DefinitionDigest(gate))
+	fmt.Fprintf(&body, "INPUTS: %s\nINPUTS_SHA256: %s\nCANDIDATE_BEFORE: %s\nCANDIDATE_AFTER: %s\n",
+		transcriptMetadata(valueOr(gate.Inputs, "none")), valueOr(result.Inputs, "none"), transcriptMetadata(before), transcriptMetadata(after))
+	output, masked := secretpattern.Redact(result.Outcome.Output)
+	truncated := len(output) > maxTranscriptOutput
+	if truncated {
+		output = output[:maxTranscriptOutput]
+	}
+	verdict := "fail"
+	if result.Passed && !result.Discarded && result.WriteErr == nil {
+		verdict = "pass"
+	}
+	fmt.Fprintf(&body, "ATTEMPT: %d\nSTARTED: %s\nENDED: %s\nEXIT: %s\nEXPECT: %s\nRESULT: %s\n",
+		attempt, result.Started.Format(time.RFC3339Nano), result.Ended.Format(time.RFC3339Nano), transcriptMetadata(exitLabel(result.Outcome)), transcriptMetadata(gate.Expect), verdict)
+	fmt.Fprintf(&body, "OUTPUT_SHA256: %s\nOUTPUT_BYTES: %d\nREDACTIONS: %d\nTRUNCATED: %t\n--- OUTPUT ---\n%s\n--- END OUTPUT ---\n",
+		OutputDigest(result.Outcome.Output), result.Outcome.OutputBytes, masked, truncated, output)
+	checksum := OutputDigest(body.String())
+	fmt.Fprintf(&body, "TRANSCRIPT_SHA256: %s\n", checksum)
+	file := fmt.Sprintf("%s-a%d.log", prefix, attempt)
+	return file, fsutil.WriteFileAtomicIn(dir, file, []byte(body.String()), 0o600)
+}
+
+// passingOrigin accepts only an executed, complete pass bound to ledger proof.
+// Candidate labels are historical context, not a dependency of scoped INPUTS.
+func passingOrigin(work string, gate *Gate) string {
+	evidence := automaticEvidenceRE.FindStringSubmatch(strings.TrimSpace(gate.Evidence))
+	if evidence == nil || evidence[1] != DefinitionDigest(gate) {
+		return ""
+	}
+	dir, err := transcriptDirectory(work, gate.ID, false)
+	if err != nil {
+		return ""
+	}
+	defer func() { _ = dir.Close() }()
+	listing, err := dir.Open(".")
+	if err != nil {
+		return ""
+	}
+	entries, err := listing.ReadDir(-1)
+	_ = listing.Close()
+	if err != nil {
+		return ""
+	}
+	for _, entry := range entries {
+		if !strings.HasSuffix(entry.Name(), ".log") {
+			continue
+		}
+		raw, err := readTranscript(dir, entry.Name())
+		if err == nil && validOrigin(string(raw), gate, evidence) {
+			return filepath.Join(work, "references", "gates", transcriptGateName(gate.ID), entry.Name())
+		}
+	}
+	return ""
+}
+
+func readTranscript(dir *os.Root, name string) ([]byte, error) {
+	info, err := dir.Lstat(name)
+	if err != nil {
+		return nil, err
+	}
+	if !info.Mode().IsRegular() || info.Size() > maxTranscriptBytes {
+		return nil, fmt.Errorf("unsafe or oversized transcript")
+	}
+	file, err := dir.Open(name)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = file.Close() }()
+	opened, err := file.Stat()
+	if err != nil {
+		return nil, err
+	}
+	if !os.SameFile(info, opened) {
+		return nil, fmt.Errorf("transcript changed while opening")
+	}
+	raw, err := io.ReadAll(io.LimitReader(file, maxTranscriptBytes+1))
+	if err != nil {
+		return nil, err
+	}
+	current, err := dir.Lstat(name)
+	if err != nil {
+		return nil, err
+	}
+	if len(raw) > maxTranscriptBytes || !current.Mode().IsRegular() || !os.SameFile(opened, current) || current.Size() != int64(len(raw)) {
+		return nil, fmt.Errorf("transcript changed while reading")
+	}
+	return raw, nil
+}
+
+func validOrigin(raw string, gate *Gate, evidence []string) bool {
+	const footer = "TRANSCRIPT_SHA256: "
+	end := strings.LastIndex(raw, footer)
+	if end < 0 || raw[end:] != footer+OutputDigest(raw[:end])+"\n" {
+		return false
+	}
+	header, output, ok := strings.Cut(raw[:end], "\n--- OUTPUT ---\n")
+	if !ok || !strings.HasSuffix(output, "\n--- END OUTPUT ---\n") {
+		return false
+	}
+	output = strings.TrimSuffix(output, "\n--- END OUTPUT ---\n")
+	lines := strings.Split(header, "\n")
+	if lines[0] != "DEVRITES-GATE-TRANSCRIPT v2" {
+		return false
+	}
+	fields := map[string]string{}
+	for _, line := range lines[1:] {
+		key, value, ok := strings.Cut(line, ": ")
+		if _, duplicate := fields[key]; !ok || duplicate {
+			return false
+		}
+		fields[key] = value
+	}
+	for key, want := range map[string]string{
+		"GATE": transcriptMetadata(gate.ID), "TITLE": transcriptMetadata(gate.Title),
+		"COMMAND": transcriptMetadata(gate.Check), "CWD": transcriptMetadata(valueOr(gate.Cwd, ".")),
+		"EXPECT": transcriptMetadata(gate.Expect), "DEFINITION_SHA256": evidence[1],
+		"INPUTS": transcriptMetadata(valueOr(gate.Inputs, "none")), "INPUTS_SHA256": valueOr(evidence[4], "none"),
+		"RESULT": "pass", "EXIT": "0", "OUTPUT_SHA256": evidence[2], "OUTPUT_BYTES": evidence[3],
+	} {
+		if got, exists := fields[key]; !exists || got != want {
+			return false
+		}
+	}
+	started, err := time.Parse(time.RFC3339Nano, fields["STARTED"])
+	if err != nil || started.IsZero() {
+		return false
+	}
+	ended, err := time.Parse(time.RFC3339Nano, fields["ENDED"])
+	if err != nil || ended.Before(started) {
+		return false
+	}
+	attempt, err := strconv.Atoi(fields["ATTEMPT"])
+	if err != nil || attempt < 1 || fields["CANDIDATE_BEFORE"] == "" || fields["CANDIDATE_AFTER"] == "" {
+		return false
+	}
+	redactions, err := strconv.Atoi(fields["REDACTIONS"])
+	if err != nil || redactions < 0 {
+		return false
+	}
+	truncated, err := strconv.ParseBool(fields["TRUNCATED"])
+	return err == nil && len(output) <= maxTranscriptOutput && (!truncated || len(output) == maxTranscriptOutput)
+}
+
 func exitLabel(outcome RunOutcome) string {
 	switch {
 	case outcome.TimedOut:

package/engine/internal/devritespaths/paths.go

@@ -47,9 +47,13 @@ func WorkspaceOverrideChecked(root, slug string) (string, error) {
 	if raw == "" {
 		return "", nil
 	}
+	absoluteRoot, err := filepath.Abs(root)
+	if err != nil {
+		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: resolve DevRites root %q: %w", root, err)
+	}
 	path := raw
 	if !filepath.IsAbs(path) {
-		path = filepath.Join(filepath.Dir(root), path)
+		path = filepath.Join(filepath.Dir(absoluteRoot), path)
 	}
 	abs, err := filepath.Abs(path)
 	if err != nil {
@@ -59,10 +63,10 @@ func WorkspaceOverrideChecked(root, slug string) (string, error) {
 	if err != nil {
 		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: resolve DEVRITES_WORKSPACE %q: %w", raw, err)
 	}
-	if !safepath.WithinResolved(path, root) {
+	if !safepath.WithinResolved(path, absoluteRoot) {
 		return "", fmt.Errorf("DRV-WORKSPACE-OUTSIDE-ROOT: DEVRITES_WORKSPACE %q is outside %q; run `unset DEVRITES_WORKSPACE`", raw, root)
 	}
-	resolvedRoot, err := safepath.ResolveExisting(root)
+	resolvedRoot, err := safepath.ResolveExisting(absoluteRoot)
 	if err != nil {
 		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: resolve DevRites root %q: %w", root, err)
 	}
@@ -114,6 +118,15 @@ func ExistingFeatureDirChecked(root, slug string) (string, error) {
 		}
 		return ws, nil
 	}
+	return ExistingCanonicalFeatureDirChecked(root, slug)
+}
+
+// ExistingCanonicalFeatureDirChecked resolves an explicit producer workspace
+// inside root without redirecting it through a consumer's workspace override.
+func ExistingCanonicalFeatureDirChecked(root, slug string) (string, error) {
+	if !ValidSlug(slug) {
+		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: %q is not a feature slug", slug)
+	}
 	candidate := filepath.Join(root, "work", slug)
 	resolved, err := checkedCanonicalDir(root, candidate, "work", slug)
 	if err == nil {
@@ -194,14 +207,19 @@ func checkedCanonicalDir(root, candidate, parent, slug string) (string, error) {
 	return filepath.Clean(candidate), nil
 }
 
-// ActiveSlug reads and trims the active-feature pointer. A missing pointer file
-// is not an error; it yields the empty slug.
+// ActiveSlug resolves the workspace override, or reads the active-feature pointer.
+// A missing pointer file is not an error; it yields the empty slug.
 func ActiveSlug(root string) (string, error) {
 	if ws, err := WorkspaceOverrideChecked(root, ""); err != nil {
 		return "", err
 	} else if ws != "" {
 		return filepath.Base(ws), nil
 	}
+	return PhysicalActiveSlug(root)
+}
+
+// PhysicalActiveSlug reads the validated ACTIVE pointer without workspace overrides.
+func PhysicalActiveSlug(root string) (string, error) {
 	activePath := filepath.Join(root, "ACTIVE")
 	if info, err := os.Lstat(activePath); err == nil && info.Mode()&os.ModeSymlink != 0 {
 		return "", fmt.Errorf("DRV-ACTIVE-SYMLINK: ACTIVE is a symlink; run `rm -f %q`", activePath)

package/engine/internal/gate/gate.go

@@ -51,6 +51,12 @@ func Check(kind Kind, root, slug string) (*Result, error) {
 	if err != nil {
 		return nil, fmt.Errorf("gate %s: %w", kind, err)
 	}
+	return CheckObserved(kind, root, observation)
+}
+
+// CheckObserved checks retained facts acquired from root, so a caller can use
+// those same vetted bytes for subsequent admission without rereading the workspace.
+func CheckObserved(kind Kind, root string, observation *state.WorkspaceObservation) (*Result, error) {
 	result, err := checkObservation(kind, observation)
 	if err != nil {
 		return nil, fmt.Errorf("gate %s: %w", kind, err)

package/engine/internal/install/apply.go

@@ -231,6 +231,11 @@ func (r *runner) writeConfined(dest string, data []byte, perm fs.FileMode) error
 		return err
 	}
 	defer func() { _ = root.Close() }()
+	if info, err := root.Stat(rel); err == nil {
+		perm = info.Mode().Perm()
+	} else if !os.IsNotExist(err) {
+		return err
+	}
 	return fsutil.WriteFileAtomicIn(root, rel, data, perm)
 }