devrites 7.2.7 → 7.3.0

package/engine/internal/lib/resolve.go

@@ -361,6 +361,10 @@ func clearAwaiting(sfile, qid string) error {
 		return fmt.Errorf("read state %s: %w", sfile, err)
 	}
 	lines := splitLinesNoTrailing(data)
+	visible, err := structuralLines(data)
+	if err != nil {
+		return fmt.Errorf("read state %s: %w", sfile, err)
+	}
 	resumePolicy, _ := state.PolicyFor(state.PhaseBuild)
 	if rawPhase, ok := state.CursorField(lines, state.CursorPhase); ok {
 		if fields := strings.Fields(strings.ToLower(rawPhase)); len(fields) > 0 {
@@ -373,7 +377,7 @@ func clearAwaiting(sfile, qid string) error {
 	// First check whether the awaiting block references this question at all.
 	inAw := false
 	var awaitingLines []string
-	for _, line := range lines {
+	for _, line := range visible {
 		switch {
 		case awaitingRe.MatchString(line):
 			inAw = true
@@ -400,7 +404,8 @@ func clearAwaiting(sfile, qid string) error {
 	ts := nowUTC()
 	var out []string
 	inAw, inLog, logAppended := false, false, false
-	for _, line := range lines {
+	for i, original := range lines {
+		line := visible[i]
 		if awaitingRe.MatchString(line) {
 			inAw = true
 			continue
@@ -413,7 +418,7 @@ func clearAwaiting(sfile, qid string) error {
 		}
 		switch {
 		case logHdrRe.MatchString(line):
-			out = append(out, line)
+			out = append(out, original)
 			inLog = true
 			continue
 		case inLog && hdrSpaceRe.MatchString(line):
@@ -422,10 +427,10 @@ func clearAwaiting(sfile, qid string) error {
 				logAppended = true
 			}
 			inLog = false
-			out = append(out, line)
+			out = append(out, original)
 			continue
 		}
-		out = append(out, line)
+		out = append(out, original)
 	}
 	if inLog && !logAppended {
 		out = append(out, fmt.Sprintf("- %s %s: resolved %s", ts, resumePolicy.Target, qid))

package/engine/internal/lib/slicecheck.go

@@ -7,6 +7,7 @@ import (
 	"regexp"
 	"strings"
 
+	"github.com/devrites/devrites/internal/markdowntext"
 	"github.com/devrites/devrites/internal/state"
 )
 
@@ -21,7 +22,7 @@ import (
 //	0  contract holds    2  usage error    3  blocked: problems listed
 
 var (
-	sliceFieldRe     = regexp.MustCompile(`(?m)^([A-Za-z][A-Za-z /_-]*):\s*(.*)$`)
+	sliceFieldRe     = regexp.MustCompile(`(?m)^([A-Za-z][A-Za-z /_-]*):[ \t]*(.*)$`)
 	sliceACRe        = regexp.MustCompile(`\bAC-\d+\b`)
 	pathGlobCharRe   = regexp.MustCompile(`[*?\[\]{}]`)
 	pathTraversalRe  = regexp.MustCompile(`(^|/)\.\.(/|$)`)
@@ -48,6 +49,11 @@ func sliceSizeAdvisory(block string) (int, bool) {
 // sliceFields extracts the single-line `Field: value` pairs of a slice block.
 func sliceFields(block string) map[string]string {
 	fields := map[string]string{}
+	structural, err := markdowntext.Structural([]byte(block))
+	if err != nil {
+		return fields
+	}
+	block = string(structural)
 	for _, m := range sliceFieldRe.FindAllStringSubmatch(block, -1) {
 		key := strings.ToLower(strings.TrimSpace(m[1]))
 		if _, seen := fields[key]; !seen {

package/engine/internal/lib/state_edit.go

@@ -58,10 +58,17 @@ func RunStateSet(root string, args []string, stdout, stderr io.Writer) int {
 				return fail(stderr, stateSetUsage, 2)
 			}
 		}
-		if !cursorKeyPattern.MatchString(key) || seen[key] {
+		if !cursorKeyPattern.MatchString(key) {
 			return fail(stderr, fmt.Sprintf("state set: key %q is not a snake_case cursor key or repeats", key), 2)
 		}
-		seen[key] = true
+		if canonical, ok := state.CanonicalCursorKey(key); ok {
+			key = canonical
+		}
+		identity := strings.ReplaceAll(key, "_", "")
+		if seen[identity] {
+			return fail(stderr, fmt.Sprintf("state set: key %q is not a snake_case cursor key or repeats", key), 2)
+		}
+		seen[identity] = true
 		changes = append(changes, change{key, value})
 	}
 	sfile, code := stateEditWorkspace(root, slug, "state.md", stderr)

package/engine/internal/lib/taskgraph.go

@@ -201,34 +201,10 @@ func PrecheckSkips(root, slug, slice string, gateIDs []string) (map[string]strin
 // manifest and lockfile when it declares external dependencies. root is the
 // .devrites directory.
 func planReady(root, slug string) ([]parallel.SlicePaths, error) {
-	raw, err := readWorkspaceArtifact(root, slug, "tasks.md")
-	if err != nil {
-		return nil, err
-	}
-	graph := ParseTaskGraph(raw)
-	if len(graph.Problems) > 0 {
-		return nil, fmt.Errorf("tasks.md: %s", strings.Join(graph.Problems, "; "))
-	}
-	built, err := builtSlices(root, slug)
-	if err != nil {
-		return nil, err
-	}
-	isBuilt := func(id string) bool { return built[sliceNumber(id)] }
-	paths, _ := sliceWritePaths(raw, graph)
-	project := filepath.Dir(root)
-	var ready []parallel.SlicePaths
-	for _, s := range graph.Slices {
-		if isBuilt(s.ID) || slices.ContainsFunc(s.Dependencies, func(dep string) bool { return !isBuilt(dep) }) {
-			continue
-		}
-		if len(paths[s.ID]) == 0 {
-			return nil, fmt.Errorf("%s has no Writer allowlist or Files likely touched", s.ID)
-		}
-		block, _ := state.ExtractTaskSlice(raw, s.ID)
-		external, _ := fieldValue(sliceFields(block), "external dependencies")
-		ready = append(ready, parallel.SlicePaths{ID: s.ID, Paths: withManifests(project, paths[s.ID], external)})
-	}
-	return ready, nil
+	ready, _, err := workspacePlanReady(root, slug, false, func(name string) ([]byte, error) {
+		return readWorkspaceArtifact(root, slug, name)
+	})
+	return ready, err
 }
 
 // builtWordRe marks a checked state.md item as a built checkpoint.
@@ -240,7 +216,13 @@ var builtWordRe = regexp.MustCompile(`(?i)\bbuilt\b`)
 // was checkpointed and whose section has a `Checkpoint: <sha>` line — a missed
 // checkbox must not keep dependents out of the ready set.
 func builtSlices(root, slug string) (map[string]bool, error) {
-	raw, err := readWorkspaceArtifact(root, slug, "state.md")
+	return builtSlicesFrom(func(name string) ([]byte, error) {
+		return readWorkspaceArtifact(root, slug, name)
+	})
+}
+
+func builtSlicesFrom(read func(string) ([]byte, error)) (map[string]bool, error) {
+	raw, err := read("state.md")
 	if err != nil {
 		return nil, err
 	}
@@ -257,7 +239,7 @@ func builtSlices(root, slug string) (map[string]bool, error) {
 			built[strings.TrimLeft(m[1], "0")] = true
 		}
 	}
-	extra, err := evidenceBuilt(root, slug)
+	extra, err := evidenceBuiltFrom(read)
 	if err != nil {
 		return nil, err
 	}
@@ -273,9 +255,9 @@ var (
 	checkpointSHARe       = regexp.MustCompile(`(?m)^[ \t]*Checkpoint: [0-9a-fA-F]{7,40}\b`)
 )
 
-// evidenceBuilt reads evidence.md checkpoint sections. A missing file is none.
-func evidenceBuilt(root, slug string) (map[string]bool, error) {
-	raw, err := readWorkspaceArtifact(root, slug, "evidence.md")
+// evidenceBuiltFrom reads evidence.md checkpoint sections. A missing file is none.
+func evidenceBuiltFrom(read func(string) ([]byte, error)) (map[string]bool, error) {
+	raw, err := read("evidence.md")
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
 			return map[string]bool{}, nil
@@ -421,9 +403,11 @@ func planBatch(root, slug string, capN int) (eligible, batch []string, err error
 		return nil, nil, err
 	}
 	ids := func(in []parallel.SlicePaths) []string {
-		out := make([]string, len(in))
-		for i, s := range in {
-			out[i] = s.ID
+		var out []string
+		for _, s := range in {
+			if s.Workspace == "" || s.Workspace == slug {
+				out = append(out, s.ID)
+			}
 		}
 		return out
 	}

package/engine/internal/lib/triggers.go

@@ -1,9 +1,8 @@
 package lib
 
 import (
-	"io"
+	"errors"
 	"os"
-	"path/filepath"
 	"regexp"
 	"slices"
 	"sort"
@@ -52,7 +51,7 @@ var (
 // corpus (minus the template's AI-SPEC annex) names a model, agent, RAG, or
 // tool surface.
 func keepModelSurface(role string, facts triggerFacts) bool {
-	return role == "security-auditor" || facts.aiSpec || strings.TrimSpace(facts.corpus) == "" ||
+	return roleBase(role) == "security-auditor" || facts.aiSpec || strings.TrimSpace(facts.corpus) == "" ||
 		aiSignalRe.MatchString(aiAnnexRe.ReplaceAllString(facts.corpus, "$1"))
 }
 
@@ -82,8 +81,7 @@ var triggerSignals = []struct {
 
 // suggestTriggers returns declared, unselected trigger names whose firing facts
 // hold in this workspace. Sorted for stable output.
-func suggestTriggers(manifest loadsManifest, root, featureDir string, opts contextOpts) []string {
-	facts := gatherTriggerFacts(root, featureDir, opts.role)
+func suggestTriggers(manifest loadsManifest, opts contextOpts, facts triggerFacts) []string {
 	var suggested []string
 	for name := range manifest.Triggers {
 		if slices.Contains(opts.triggers, name) {
@@ -101,45 +99,46 @@ func suggestTriggers(manifest loadsManifest, root, featureDir string, opts conte
 	return suggested
 }
 
-func gatherTriggerFacts(root, featureDir, role string) triggerFacts {
-	facts := triggerFacts{role: role}
+func gatherTriggerFacts(root, role string, sources *contextSources) (triggerFacts, error) {
+	facts := triggerFacts{role: roleBase(role)}
 	if root != "" {
-		afkPath := filepath.Join(root, "AFK")
-		if info, err := os.Stat(afkPath); err == nil && info.Mode().IsRegular() {
-			facts.afk = true
-			if data, err := os.ReadFile(afkPath); err == nil { // #nosec G304 -- .devrites/AFK sentinel
-				facts.afkParallel = afkAllowsParallel(string(data))
-			}
+		sentinels := contextSources{dir: root}
+		data, err := sentinels.read("AFK")
+		if err != nil && !errors.Is(err, os.ErrNotExist) {
+			return facts, err
 		}
-		if info, err := os.Stat(filepath.Join(root, "principles.md")); err == nil && info.Mode().IsRegular() {
-			facts.principles = true
+		facts.afk = err == nil
+		facts.afkParallel = afkAllowsParallel(string(data))
+		_, err = sentinels.read("principles.md")
+		if err != nil && !errors.Is(err, os.ErrNotExist) {
+			return facts, err
 		}
+		facts.principles = err == nil
 	}
-	if featureDir != "" {
-		if info, err := os.Stat(filepath.Join(featureDir, "ai-spec.md")); err == nil && info.Mode().IsRegular() {
-			facts.aiSpec = true
+	if sources.dir != "" {
+		_, err := sources.read("ai-spec.md")
+		if err != nil && !errors.Is(err, os.ErrNotExist) {
+			return facts, err
 		}
+		facts.aiSpec = err == nil
 		var corpus strings.Builder
 		for _, name := range triggerEvidenceFiles {
-			path := filepath.Join(featureDir, name)
-			info, err := os.Stat(path)
-			if err != nil || !info.Mode().IsRegular() {
-				continue
-			}
-			f, err := os.Open(path) // #nosec G304 -- workspace artifact; read is capped below
+			data, err := sources.read(name)
 			if err != nil {
-				continue
+				if errors.Is(err, os.ErrNotExist) {
+					continue
+				}
+				return facts, err
 			}
-			data, err := io.ReadAll(io.LimitReader(f, triggerEvidenceFileCap))
-			_ = f.Close()
-			if err == nil {
-				corpus.Write(data)
-				corpus.WriteByte('\n')
+			if len(data) > triggerEvidenceFileCap {
+				data = data[:triggerEvidenceFileCap]
 			}
+			corpus.Write(data)
+			corpus.WriteByte('\n')
 		}
 		facts.corpus = strings.ToLower(corpus.String())
 	}
-	return facts
+	return facts, nil
 }
 
 var afkParallelRe = regexp.MustCompile(`(?m)^\s*max_parallel\s*:\s*([0-9]+)\s*$`)

package/engine/internal/lib/workspace_pool.go

@@ -0,0 +1,330 @@
+package lib
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/devrites/devrites/internal/devritespaths"
+	"github.com/devrites/devrites/internal/gate"
+	"github.com/devrites/devrites/internal/markdowntext"
+	"github.com/devrites/devrites/internal/parallel"
+	"github.com/devrites/devrites/internal/state"
+)
+
+// WorkspaceReady admits only the controller or its recorded forward continuation.
+// Notices describe withheld work without removing other workspaces from the pool.
+func WorkspaceReady(repoRoot, controller, target string) ([]parallel.SlicePaths, []string, error) {
+	root := filepath.Join(repoRoot, devritespaths.DevritesRootName)
+	if !devritespaths.ValidSlug(controller) || !devritespaths.ValidSlug(target) {
+		return nil, nil, fmt.Errorf("invalid controller or target workspace slug")
+	}
+	if _, err := devritespaths.WorkspaceOverrideChecked(root, target); err != nil {
+		return nil, []string{fmt.Sprintf("%s: global workspace admission preserves DEVRITES_WORKSPACE scope: %v; unset DEVRITES_WORKSPACE to query the global pool", target, err)}, nil
+	}
+	if _, err := devritespaths.ExistingFeatureDirChecked(root, controller); err != nil {
+		return nil, nil, fmt.Errorf("controller %s: %w", controller, err)
+	}
+	observation, err := state.ObserveWorkspace(root, target)
+	if err != nil {
+		return nil, []string{fmt.Sprintf("%s: state unavailable: %v; repair workspace and rerun /rite-vet", target, err)}, nil
+	}
+	cursor, _ := observation.Fact(state.LedgerFile)
+	cursorBytes := cursor.Bytes()
+	if target != controller {
+		if err := forwardWorkspace(root, controller, target, cursorBytes); err != nil {
+			return nil, []string{fmt.Sprintf("%s: %v", target, err)}, nil
+		}
+	}
+	result, err := gate.CheckObserved(gate.Readiness, root, observation)
+	if err != nil {
+		return nil, []string{fmt.Sprintf("%s: readiness unavailable: %v; repair workspace and rerun /rite-vet", target, err)}, nil
+	}
+	structuralCursor, _ := markdowntext.Structural(cursorBytes)
+	status, _ := state.CursorField(strings.Split(string(structuralCursor), "\n"), state.CursorStatus)
+	var notices []string
+	if result.Phase != state.PhaseVet && result.Phase != state.PhaseBuild {
+		notices = append(notices, fmt.Sprintf("%s: phase %s is not Build entry; native Plan/Vet must prepare this workspace before admission", target, result.Phase))
+	}
+	if result.Phase == state.PhaseVet && status != "ready" {
+		notices = append(notices, fmt.Sprintf("%s: Vet is not ready; native Plan/Vet must complete before admission", target))
+	}
+	switch status {
+	case "awaiting_human", "blocked", "shipped", "done", "archived":
+		notices = append(notices, fmt.Sprintf("%s: status %s withholds writer admission; native controller must resolve this state", target, status))
+	}
+	if result.Blocked {
+		for _, line := range strings.Split(strings.TrimSpace(result.Render()), "\n") {
+			notices = append(notices, target+": "+line)
+		}
+	}
+	if len(notices) > 0 {
+		return nil, notices, nil
+	}
+	ready, notices, err := workspacePlanReady(root, target, target != controller, func(name string) ([]byte, error) {
+		fact, ok := observation.Fact(state.ArtifactPath(name))
+		if !ok || fact.State() == state.ArtifactAbsent {
+			return nil, os.ErrNotExist
+		}
+		if fact.State() != state.ArtifactPresent && fact.State() != state.ArtifactEmpty {
+			return nil, fmt.Errorf("%s: retained artifact is %s", name, fact.State())
+		}
+		return fact.Bytes(), nil
+	})
+	if err != nil {
+		return nil, notices, err
+	}
+	if target != controller {
+		for i := range ready {
+			ready[i].Workspace = target
+		}
+	}
+	return ready, notices, nil
+}
+
+// readSequenceArtifact permits archived predecessors, never an archived writer.
+func readSequenceArtifact(root, slug, name string) ([]byte, error) {
+	dir, err := devritespaths.ExistingCanonicalFeatureDirChecked(root, slug)
+	if errors.Is(err, os.ErrNotExist) {
+		dir, err = devritespaths.ExistingArchivedFeatureDirChecked(root, slug)
+	}
+	if err != nil {
+		return nil, err
+	}
+	return readBoundedRegularFile(filepath.Join(dir, name), workspaceArtifactLimit)
+}
+
+func forwardWorkspace(root, controller, target string, targetState []byte) error {
+	seen := map[string]bool{}
+	current := target
+	found := false
+	for range maxSequenceChain {
+		if seen[current] {
+			return fmt.Errorf("sequence_parent cycle at %s; repair native sequence cursor", current)
+		}
+		seen[current] = true
+		found = found || current == controller
+		// Target is already retained from its live workspace observation.
+		raw := targetState
+		if current != target {
+			var err error
+			raw, err = readSequenceArtifact(root, current, "state.md")
+			if err != nil {
+				return fmt.Errorf("sequence_parent %s unavailable: %w", current, err)
+			}
+		}
+		structural, err := markdowntext.Structural(raw)
+		if err != nil {
+			return fmt.Errorf("sequence_parent %s state.md is invalid Markdown", current)
+		}
+		parent, _ := state.CursorField(strings.Split(string(structural), "\n"), state.CursorSequenceParent)
+		if parent == "" {
+			if found {
+				return nil
+			}
+			return fmt.Errorf("not a recorded forward continuation of %s; native sequence authorization required", controller)
+		}
+		if !devritespaths.ValidSlug(parent) {
+			return fmt.Errorf("sequence_parent %q is not a workspace slug", parent)
+		}
+		current = parent
+	}
+	return fmt.Errorf("sequence_parent chain exceeds %d workspaces", maxSequenceChain)
+}
+
+type workspaceProducer struct {
+	workspace string
+	id        string
+}
+
+type workspacePlan struct {
+	raw   []byte
+	graph TaskGraphResult
+	built map[string]bool
+}
+
+type workspaceDependencies struct {
+	root  string
+	plans map[string]*workspacePlan
+}
+
+func (d *workspaceDependencies) load(slug string) (*workspacePlan, error) {
+	if plan := d.plans[slug]; plan != nil {
+		return plan, nil
+	}
+	raw, err := readSequenceArtifact(d.root, slug, "tasks.md")
+	if err != nil {
+		return nil, fmt.Errorf("producer %s tasks.md: %w", slug, err)
+	}
+	graph := ParseTaskGraph(raw)
+	if len(graph.Problems) > 0 {
+		return nil, fmt.Errorf("producer %s tasks.md: %s", slug, strings.Join(graph.Problems, "; "))
+	}
+	built, err := builtSlicesFrom(func(name string) ([]byte, error) {
+		return readSequenceArtifact(d.root, slug, name)
+	})
+	if err != nil {
+		return nil, fmt.Errorf("producer %s checkpoints: %w", slug, err)
+	}
+	plan := &workspacePlan{raw: raw, graph: graph, built: built}
+	d.plans[slug] = plan
+	return plan, nil
+}
+
+func declaredWorkspaceDependencies(block string) ([]workspaceProducer, bool, error) {
+	structural, err := markdowntext.Structural([]byte(block))
+	if err != nil {
+		return nil, false, fmt.Errorf("workspace dependencies cannot be read from invalid Markdown")
+	}
+	block = string(structural)
+	fields := sliceFields(block)
+	value, declared := fieldValue(fields, "workspace dependencies")
+	count := 0
+	for _, field := range sliceFieldRe.FindAllStringSubmatch(block, -1) {
+		if strings.EqualFold(strings.TrimSpace(field[1]), "workspace dependencies") {
+			count++
+		}
+	}
+	if count > 1 {
+		return nil, true, fmt.Errorf("duplicate Workspace dependencies; rerun native Plan/Vet")
+	}
+	if !declared || value == "none" {
+		return nil, declared, nil
+	}
+	var refs []workspaceProducer
+	seen := map[string]bool{}
+	for token := range strings.SplitSeq(value, ",") {
+		token = strings.TrimSpace(token)
+		slug, id, ok := strings.Cut(token, "/")
+		if !ok || !devritespaths.ValidSlug(slug) || !state.ValidSliceID(id) {
+			return nil, true, fmt.Errorf("malformed Workspace dependencies reference %q; use none or <slug>/SLICE-### and rerun native Plan/Vet", token)
+		}
+		if seen[token] {
+			return nil, true, fmt.Errorf("duplicate Workspace dependencies reference %q", token)
+		}
+		seen[token] = true
+		refs = append(refs, workspaceProducer{workspace: slug, id: id})
+	}
+	return refs, true, nil
+}
+
+// validate follows local and workspace edges even across built nodes: a recorded
+// checkpoint cannot make an unknown reference or a cyclic plan graph valid.
+func (d *workspaceDependencies) validate(ref workspaceProducer, visiting, valid map[string]bool) error {
+	key := parallel.SliceKey(ref.workspace, ref.id)
+	if visiting[key] {
+		return fmt.Errorf("workspace dependencies cycle at %s; repair native Plan/Vet", key)
+	}
+	if valid[key] {
+		return nil
+	}
+	if len(visiting)+len(valid) >= 4096 {
+		return fmt.Errorf("workspace dependencies graph exceeds 4096 slices")
+	}
+	plan, err := d.load(ref.workspace)
+	if err != nil {
+		return err
+	}
+	var node *TaskSlice
+	for i := range plan.graph.Slices {
+		if plan.graph.Slices[i].ID == ref.id {
+			node = &plan.graph.Slices[i]
+			break
+		}
+	}
+	if node == nil {
+		return fmt.Errorf("unknown Workspace dependencies producer %s", key)
+	}
+	block, _ := state.ExtractTaskSlice(plan.raw, ref.id)
+	refs, _, err := declaredWorkspaceDependencies(block)
+	if err != nil {
+		return fmt.Errorf("%s: %w", key, err)
+	}
+	for _, id := range node.Dependencies {
+		refs = append(refs, workspaceProducer{workspace: ref.workspace, id: id})
+	}
+	visiting[key] = true
+	defer delete(visiting, key)
+	for _, dependency := range refs {
+		if err := d.validate(dependency, visiting, valid); err != nil {
+			return err
+		}
+	}
+	valid[key] = true
+	return nil
+}
+
+func workspacePlanReady(root, slug string, requireDeclaration bool, read func(string) ([]byte, error)) ([]parallel.SlicePaths, []string, error) {
+	raw, err := read("tasks.md")
+	if err != nil {
+		return nil, nil, err
+	}
+	graph := ParseTaskGraph(raw)
+	if len(graph.Problems) > 0 {
+		return nil, nil, fmt.Errorf("tasks.md: %s", strings.Join(graph.Problems, "; "))
+	}
+	built, err := builtSlicesFrom(read)
+	if err != nil {
+		return nil, nil, err
+	}
+	deps := workspaceDependencies{root: root, plans: map[string]*workspacePlan{
+		slug: {raw: raw, graph: graph, built: built},
+	}}
+	paths, _ := sliceWritePaths(raw, graph)
+	var ready []parallel.SlicePaths
+	var notices []string
+	valid := map[string]bool{}
+	for _, node := range graph.Slices {
+		block, _ := state.ExtractTaskSlice(raw, node.ID)
+		if satisfies, _ := fieldValue(sliceFields(block), "satisfies"); strings.EqualFold(satisfies, "none") {
+			continue
+		}
+		if built[sliceNumber(node.ID)] || slicesUnbuilt(node.Dependencies, built) {
+			continue
+		}
+		key := parallel.SliceKey(slug, node.ID)
+		refs, declared, problem := declaredWorkspaceDependencies(block)
+		if problem == nil && requireDeclaration && !declared {
+			problem = fmt.Errorf("missing Workspace dependencies; native Plan/Vet must bind none or explicit producers before foreign admission")
+		}
+		if problem == nil {
+			problem = deps.validate(workspaceProducer{workspace: slug, id: node.ID}, map[string]bool{}, valid)
+		}
+		if problem != nil {
+			notices = append(notices, key+": "+problem.Error())
+			continue
+		}
+		waiting := false
+		for _, ref := range refs {
+			producer := deps.plans[ref.workspace] // validate loaded every referenced graph.
+			if !producer.built[sliceNumber(ref.id)] {
+				notices = append(notices, fmt.Sprintf("%s: waiting for durable BUILT/integrated producer %s", key, parallel.SliceKey(ref.workspace, ref.id)))
+				waiting = true
+			}
+		}
+		if waiting {
+			continue
+		}
+		if len(paths[node.ID]) == 0 {
+			if requireDeclaration {
+				notices = append(notices, key+": no Writer allowlist or Files likely touched; repair native Plan/Vet")
+				continue
+			}
+			return nil, notices, fmt.Errorf("%s has no Writer allowlist or Files likely touched", node.ID)
+		}
+		external, _ := fieldValue(sliceFields(block), "external dependencies")
+		ready = append(ready, parallel.SlicePaths{ID: node.ID, Paths: withManifests(filepath.Dir(root), paths[node.ID], external)})
+	}
+	return ready, notices, nil
+}
+
+func slicesUnbuilt(ids []string, built map[string]bool) bool {
+	for _, id := range ids {
+		if !built[sliceNumber(id)] {
+			return true
+		}
+	}
+	return false
+}