devrites 7.3.0 → 7.3.2

package/engine/internal/overhaul/records/consistency.go

@@ -115,6 +115,24 @@ func consistency(run, genDir string, R map[string]map[string]any, add func(strin
 	if err != nil {
 		return err
 	}
+	inputs := ovio.Obj(sc["inputs"])
+	for _, input := range []struct{ key, file string }{
+		{"rubric_sha256", join(run, str(ovio.Obj(ovio.Obj(R["run.json"]["revisions"])["rubric"]), "file"))},
+		{"results_sha256", join(genDir, results)},
+		{"gates_sha256", join(genDir, "gates.json")},
+	} {
+		if !isFile(input.file) {
+			add("scorecard: %s input is missing", input.key)
+			continue
+		}
+		digest, err := sha(input.file)
+		if err != nil {
+			return err
+		}
+		if !eq(inputs[input.key], digest) {
+			add("scorecard: %s does not match the selected calculator input", input.key)
+		}
+	}
 	gates := ovio.Obj(sc["gates"])
 	claims := func(g string) bool { return str(gates, g) == "PASS" }
 	for _, it := range fs {
@@ -131,10 +149,10 @@ func consistency(run, genDir string, R map[string]map[string]any, add func(strin
 	if !claims("G-COVERAGE") {
 		return nil
 	}
-	admitted := map[string]bool{}
+	admitted := map[string]map[string]any{}
 	for _, it := range ovio.List(R["dispatch.json"]["attempts"]) {
 		if x := ovio.Obj(it); str(x, "status") == "admitted" {
-			admitted[str(x, "receipt")] = true
+			admitted[str(x, "receipt")] = x
 		}
 	}
 	if len(cells) == 0 {
@@ -147,8 +165,8 @@ func consistency(run, genDir string, R map[string]map[string]any, add func(strin
 		case "blocked":
 			add("scorecard: G-COVERAGE is PASS but applicability %s is blocked", key)
 		case "applicable":
-			if !checkedBy(run, str(c, "domain"), ovio.List(c["receipts"]), admitted) {
-				add("scorecard: G-COVERAGE is PASS but no admitted, non-gap receipt of applicability %s lists %s in domains_checked", key, str(c, "domain"))
+			if !checkedBy(run, str(c, "domain"), str(c, "lane"), ovio.List(c["receipts"]), admitted) {
+				add("scorecard: G-COVERAGE is PASS but no admitted, non-gap receipt of applicability %s lists %s in domains_checked for its lane", key, str(c, "domain"))
 			}
 		}
 	}
@@ -169,18 +187,26 @@ func consistency(run, genDir string, R map[string]map[string]any, add func(strin
 	return nil
 }
 
-// checkedBy reports whether any admitted, non-gap receipt records domain in
-// domains_checked.
-func checkedBy(run, domain string, receipts []any, admitted map[string]bool) bool {
+// checkedBy requires the receipt's domain and lane to match the cell and its
+// identity to match the admitted dispatch attempt.
+func checkedBy(run, domain, lane string, receipts []any, admitted map[string]map[string]any) bool {
 	for _, r := range receipts {
 		p := ovio.Str(r)
-		if !admitted[p] || !inside(run, p) || !isFile(join(run, p)) {
+		attempt := admitted[p]
+		if attempt == nil || str(attempt, "lane") != lane || !inside(run, p) || !isFile(join(run, p)) {
 			continue
 		}
 		rc, err := ovio.LoadObject(join(run, p))
 		if err != nil || str(rc, "outcome") == "gap" {
 			continue
 		}
+		matches := true
+		for _, k := range []string{"task_id", "attempt_id", "role", "lane", "snapshot"} {
+			matches = matches && str(attempt, k) != "" && eq(rc[k], attempt[k])
+		}
+		if !matches {
+			continue
+		}
 		if slices.ContainsFunc(ovio.List(rc["domains_checked"]), func(d any) bool { return d == any(domain) }) {
 			return true
 		}

package/engine/internal/overhaul/records/run.go

@@ -111,15 +111,24 @@ func manifestOK(run, genDir string) ([]string, map[string]any, error) {
 		return nil, nil, err
 	}
 	var errs []string
-	files, revs := ovio.Obj(m["files"]), ovio.Obj(m["revisions"])
-	check := func(src map[string]any) error {
+	files, revs, receipts := ovio.Obj(m["files"]), ovio.Obj(m["revisions"]), ovio.Obj(m["receipts"])
+	if receipts == nil {
+		errs = append(errs, "manifest: receipts must record admitted receipt digests")
+	}
+	dispatch, err := ovio.LoadObject(join(genDir, "dispatch.json"))
+	if err != nil {
+		return nil, nil, err
+	}
+	for _, it := range ovio.List(dispatch["attempts"]) {
+		attempt := ovio.Obj(it)
+		if str(attempt, "status") == "admitted" && str(receipts, str(attempt, "receipt")) == "" {
+			errs = append(errs, "manifest: admitted receipt digest missing: "+str(attempt, "receipt"))
+		}
+	}
+	check := func(src map[string]any, base string) error {
 		for _, rel := range sortedKeys(src) {
-			base := run
-			if _, ok := files[rel]; ok {
-				base = genDir
-			}
 			p := join(base, rel)
-			ok := isFile(p)
+			ok := inside(base, rel) && isFile(p)
 			if ok {
 				d, err := sha(p)
 				if err != nil {
@@ -133,10 +142,13 @@ func manifestOK(run, genDir string) ([]string, map[string]any, error) {
 		}
 		return nil
 	}
-	if err := check(files); err != nil {
+	if err := check(files, genDir); err != nil {
+		return nil, nil, err
+	}
+	if err := check(revs, run); err != nil {
 		return nil, nil, err
 	}
-	if err := check(revs); err != nil {
+	if err := check(receipts, run); err != nil {
 		return nil, nil, err
 	}
 	return errs, m, nil
@@ -273,13 +285,22 @@ func publish(run string, stdout, stderr io.Writer) (int, error) {
 	if err != nil {
 		return 0, err
 	}
-	revs := map[string]any{}
+	revs, receipts := map[string]any{}, map[string]any{}
+	settledReceipts := map[string]string{}
 	if prevDir != "" {
 		pmErrs, pm, err := manifestOK(run, prevDir)
 		if err != nil {
 			return 0, err
 		}
 		errs = append(errs, pmErrs...)
+		for rel, digest := range ovio.Obj(pm["receipts"]) {
+			receipts[rel] = digest
+			rc, err := ovio.LoadObject(join(run, rel))
+			if err != nil {
+				return 0, err
+			}
+			settledReceipts[Repr([]any{rc["task_id"], rc["attempt_id"]})] = rel
+		}
 		prevRevs := ovio.Obj(pm["revisions"])
 		for _, rel := range sortedKeys(prevRevs) {
 			p := join(run, rel)
@@ -308,6 +329,29 @@ func publish(run string, stdout, stderr io.Writer) (int, error) {
 		}
 		revs["revisions/"+e.Name()] = d
 	}
+	dispatch, err := ovio.LoadObject(join(tmp, "dispatch.json"))
+	if err != nil {
+		return 0, err
+	}
+	for _, it := range ovio.List(dispatch["attempts"]) {
+		attempt := ovio.Obj(it)
+		rel := str(attempt, "receipt")
+		if str(attempt, "status") != "admitted" || !inside(run, rel) || !isFile(join(run, rel)) {
+			continue
+		}
+		if prior, settled := settledReceipts[Repr([]any{attempt["task_id"], attempt["attempt_id"]})]; settled && prior != rel {
+			errs = append(errs, "settled admitted attempt changed receipt: "+PyStr(attempt["task_id"])+"#"+PyStr(attempt["attempt_id"]))
+			continue
+		}
+		if _, settled := receipts[rel]; settled {
+			continue
+		}
+		digest, err := sha(join(run, rel))
+		if err != nil {
+			return 0, err
+		}
+		receipts[rel] = digest
+	}
 	if len(errs) > 0 {
 		for _, e := range errs {
 			fmt.Fprintln(stdout, "VIOLATION: "+e)
@@ -342,7 +386,7 @@ func publish(run string, stdout, stderr io.Writer) (int, error) {
 		previous = prev
 	}
 	manifest := map[string]any{"schema": "overhaul.manifest/1", "generation": gen, "previous": previous,
-		"files": files, "revisions": revs}
+		"files": files, "revisions": revs, "receipts": receipts}
 	if err := ovio.WriteJSON(join(tmp, "manifest.json"), manifest, 0o644); err != nil {
 		return 0, err
 	}

package/engine/internal/parallel/landing.go

@@ -199,6 +199,23 @@ func acceptedRetry(root string, lease *Lease, selector string) (string, error) {
 }
 
 func protectRawLease(current, next *Lease) error {
+	for _, candidate := range next.Slices {
+		if candidate.WrightStatus != WrightIntegrated {
+			continue
+		}
+		found := false
+		if current != nil {
+			for _, sl := range current.Slices {
+				if sl.WrightStatus == WrightIntegrated && reflect.DeepEqual(sl, candidate) {
+					found = true
+					break
+				}
+			}
+		}
+		if !found {
+			return fmt.Errorf("lease-write cannot introduce integrated slice %s; use integrate", SliceKey(candidate.Workspace, candidate.ID))
+		}
+	}
 	if current == nil {
 		if next.PendingLanding != nil || next.LastLanding != nil {
 			return fmt.Errorf("lease-write cannot fabricate landing evidence")

package/engine/internal/state/acceptance.go

@@ -11,7 +11,8 @@ import (
 var (
 	acceptanceHeadingRE = regexp.MustCompile(`(?i)^##\s+Acceptance criteria\s*$`)
 	canonicalACRE       = regexp.MustCompile(`\bAC-\d{3}\b`)
-	h2HeadingRE         = regexp.MustCompile(`^##\s+`)
+	acceptanceEndRE     = regexp.MustCompile(`^#{1,2}\s+`)
+	acDeclarationRE     = regexp.MustCompile("^\\s*(?:#{1,6}\\s+|[-+*]\\s+(?:\\[[ xX]\\]\\s+)?|\\d+[.)]\\s+|\\|\\s*)?(?:\\*\\*|__|`)?(AC-\\d{3})(?:\\*\\*|__|`)?(?:\\s*[:|]|[ \\t]+[-–—])")
 )
 
 // AcceptanceMapResult is the deterministic ID-presence check from spec.md
@@ -50,11 +51,40 @@ func ParseAcceptanceMap(spec, tasks, testPlan []byte, requireTasks, requireTestP
 }
 
 func acceptanceSection(spec []byte) string {
-	structural, err := markdowntext.Structural(spec)
+	structural, err := markdowntext.Prose(spec)
 	if err != nil {
 		return ""
 	}
 	lines := strings.Split(strings.ReplaceAll(string(structural), "\r\n", "\n"), "\n")
+	start, end := acceptanceSectionBounds(lines)
+	if start < 0 {
+		return ""
+	}
+	return strings.Join(lines[start:end], "\n")
+}
+
+// AcceptanceDeclarationsOutsideSection identifies definitions, not prose
+// references, that the canonical section parser would otherwise silently skip.
+func AcceptanceDeclarationsOutsideSection(spec []byte) []string {
+	structural, err := markdowntext.Prose(spec)
+	if err != nil {
+		return nil
+	}
+	lines := strings.Split(strings.ReplaceAll(string(structural), "\r\n", "\n"), "\n")
+	start, end := acceptanceSectionBounds(lines)
+	var ids []string
+	for i, line := range lines {
+		if start >= 0 && i >= start && i < end {
+			continue
+		}
+		if match := acDeclarationRE.FindStringSubmatch(line); match != nil {
+			ids = append(ids, match[1])
+		}
+	}
+	return ids
+}
+
+func acceptanceSectionBounds(lines []string) (int, int) {
 	start := -1
 	for i, line := range lines {
 		if acceptanceHeadingRE.MatchString(strings.TrimSpace(line)) {
@@ -63,16 +93,16 @@ func acceptanceSection(spec []byte) string {
 		}
 	}
 	if start < 0 {
-		return ""
+		return -1, -1
 	}
 	end := len(lines)
 	for i := start; i < len(lines); i++ {
-		if h2HeadingRE.MatchString(lines[i]) {
+		if acceptanceEndRE.MatchString(strings.TrimSpace(lines[i])) {
 			end = i
 			break
 		}
 	}
-	return strings.Join(lines[start:end], "\n")
+	return start, end
 }
 
 func uniqueCanonicalACs(text string) []string {

package/engine/internal/state/feature.go

@@ -63,12 +63,13 @@ func regularFileExists(path string) bool {
 	return err == nil && info.Mode().IsRegular()
 }
 
-func firstPhaseWord(value string) string {
+// CanonicalPhase reads the leading phase name, ignoring case and trailing annotations.
+func CanonicalPhase(value string) Phase {
 	word := strings.ToLower(strings.TrimSpace(value))
 	if i := strings.IndexAny(word, " 	"); i > 0 {
 		word = word[:i]
 	}
-	return word
+	return Phase(word)
 }
 
 // blankOrHash reports whether a trimmed line carries no meaningful content: it

package/engine/internal/state/observation.go

@@ -148,7 +148,7 @@ func (o *WorkspaceObservation) DeclaredPhase() (Phase, error) {
 	if !ok {
 		return "", fmt.Errorf("feature %q: no phase in %s ledger; record phase in state.md and retry", o.slug, LedgerFile)
 	}
-	phase := Phase(firstPhaseWord(value))
+	phase := CanonicalPhase(value)
 	policy, ok := PolicyFor(phase)
 	if !ok {
 		return "", fmt.Errorf("feature %q: unknown phase %q; record a known phase in state.md and retry", o.slug, phase)
@@ -244,11 +244,40 @@ func ObserveWorkspace(root, slug string) (*WorkspaceObservation, error) {
 	return observeWorkspace(root, slug, nil)
 }
 
+// ObserveReferencedWorkspace acquires a read-only planning source, live first
+// and archived only when its canonical live directory is absent. A different
+// valid active-workspace override never redirects this explicit source.
+func ObserveReferencedWorkspace(root, slug string) (*WorkspaceObservation, error) {
+	return observeWorkspaceSource(root, slug, true, nil)
+}
+
 func observeWorkspace(root, slug string, callback observationCallback) (*WorkspaceObservation, error) {
-	if !observationWorkspaceOverrideValid(root, slug) {
+	return observeWorkspaceSource(root, slug, false, callback)
+}
+
+func observeWorkspaceSource(root, slug string, allowArchive bool, callback observationCallback) (*WorkspaceObservation, error) {
+	override := os.Getenv("DEVRITES_WORKSPACE")
+	overrideSlug := slug
+	if allowArchive && override != "" {
+		overrideSlug = filepath.Base(filepath.Clean(override))
+	}
+	if !observationWorkspaceOverrideValid(root, overrideSlug) {
 		return nil, ObservationWorkspaceInvalid
 	}
-	workspacePath, err := devritespaths.ExistingFeatureDirChecked(root, slug)
+	workspacePath, err := devritespaths.ExistingFeatureDirChecked(root, overrideSlug)
+	canArchive := allowArchive && override == ""
+	if overrideSlug != slug {
+		if err != nil {
+			return nil, ObservationWorkspaceInvalid
+		}
+		workspacePath, err = devritespaths.ExistingCanonicalFeatureDirChecked(root, slug)
+		canArchive = allowArchive
+	}
+	archived := false
+	if err != nil && canArchive && errors.Is(err, fs.ErrNotExist) {
+		workspacePath, err = devritespaths.ExistingArchivedFeatureDirChecked(root, slug)
+		archived = err == nil
+	}
 	if err != nil {
 		return nil, ObservationWorkspaceInvalid
 	}
@@ -270,6 +299,9 @@ func observeWorkspace(root, slug string, callback observationCallback) (*Workspa
 	}
 	defer func() { _ = roots.devrites.Close() }()
 	defer func() { _ = roots.workspace.Close() }()
+	if archived && !liveWorkspaceAbsent(roots.devrites, slug) {
+		return nil, ObservationWorkspaceInvalid
+	}
 
 	inventory := observationInventory()
 	facts := make([]ArtifactFact, 0, len(inventory))
@@ -315,9 +347,24 @@ func observeWorkspace(root, slug string, callback observationCallback) (*Workspa
 	if err != nil {
 		return nil, ObservationWorkspaceInvalid
 	}
+	if archived && !liveWorkspaceAbsent(roots.devrites, slug) {
+		return nil, ObservationConcurrentChange
+	}
 	return &WorkspaceObservation{slug: slug, facts: facts, index: index, rootFiles: rootFiles}, nil
 }
 
+func liveWorkspaceAbsent(root *os.Root, slug string) bool {
+	work := inspectEntry(root, "work")
+	if work.state == entryAbsent {
+		return true
+	}
+	if work.state != entryPresent || work.info.Mode()&os.ModeSymlink != 0 || !work.info.IsDir() {
+		return false
+	}
+	workspace := inspectEntry(root, filepath.Join("work", slug))
+	return workspace.state == entryAbsent && sameObservedEntry(work, inspectEntry(root, "work"))
+}
+
 // readRootFiles lists the workspace directory's regular entries through the
 // already-verified root handle, so the list describes the same snapshot as the
 // artifact facts.

package/engine/internal/state/write.go

@@ -7,7 +7,6 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
-	"sync"
 
 	"github.com/devrites/devrites/internal/devritespaths"
 	"github.com/devrites/devrites/internal/fsutil"
@@ -77,57 +76,34 @@ func AppendLog(path, record string) error {
 // is released automatically even if the process dies mid-operation (crash-safe);
 // see lock_unix.go / lock_other.go.
 func WithFeatureLock(root, slug string, fn func() error) error {
-	lockPath, err := featureLockPath(root, slug)
-	if err != nil {
-		return err
+	if !devritespaths.ValidSlug(slug) {
+		return fmt.Errorf("lock feature %q: not a feature slug", slug)
+	}
+	// Keep the lock outside the movable workspace; never unlink it on release.
+	lockDir := filepath.Join(root, ".locks", "features", slug)
+	if err := os.MkdirAll(lockDir, 0o755); err != nil {
+		return fmt.Errorf("lock feature %q: %w", slug, err)
 	}
-	return WithLock(lockPath, fn)
+	return WithLock(filepath.Join(lockDir, ".lock"), func() error {
+		if _, err := os.Lstat(filepath.Join(root, "archive", slug)); err == nil {
+			return fmt.Errorf("lock feature %q: workspace is closed (archived)", slug)
+		} else if !errors.Is(err, fs.ErrNotExist) {
+			return fmt.Errorf("lock feature %q: %w", slug, err)
+		}
+		if err := os.MkdirAll(featureDir(root, slug), 0o755); err != nil {
+			return fmt.Errorf("lock feature %q: %w", slug, err)
+		}
+		return fn()
+	})
 }
 
 // WithLock runs fn while holding the same exclusive advisory lock as
 // WithFeatureLock, keyed on lockPath, for shared ledgers outside one feature.
 func WithLock(lockPath string, fn func() error) error {
-	return withLock(lockPath, func(func()) error { return fn() })
-}
-
-// WithFeatureLockRelease is WithFeatureLock for a caller that must drop the lock
-// before fn returns, for example because the platform refuses to rename the
-// directory that holds the open lock file. fn receives release, which is safe to
-// call more than once; the lock is also released when fn returns.
-func WithFeatureLockRelease(root, slug string, fn func(release func()) error) error {
-	lockPath, err := featureLockPath(root, slug)
-	if err != nil {
-		return err
-	}
-	return withLock(lockPath, fn)
-}
-
-// featureLockPath validates slug and creates the feature directory, returning
-// the lock file path inside it. A closed workspace (work/<slug> gone, archive/<slug>
-// present) is refused rather than resurrected by a late lock.
-func featureLockPath(root, slug string) (string, error) {
-	if !devritespaths.ValidSlug(slug) {
-		return "", fmt.Errorf("lock feature %q: not a feature slug", slug)
-	}
-	dir := featureDir(root, slug)
-	if _, err := os.Lstat(dir); errors.Is(err, fs.ErrNotExist) {
-		if _, archErr := os.Lstat(filepath.Join(root, "archive", slug)); archErr == nil {
-			return "", fmt.Errorf("lock feature %q: workspace is closed (archived)", slug)
-		}
-	}
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		return "", fmt.Errorf("lock feature %q: %w", slug, err)
-	}
-	return filepath.Join(dir, ".lock"), nil
-}
-
-func withLock(lockPath string, fn func(release func()) error) error {
 	l, err := acquireLock(lockPath)
 	if err != nil {
 		return fmt.Errorf("lock %s: %w", lockPath, err)
 	}
-	var once sync.Once
-	release := func() { once.Do(func() { _ = l.release() }) }
-	defer release()
-	return fn(release)
+	defer func() { _ = l.release() }()
+	return fn()
 }

package/engine/internal/workflow/commands.go

@@ -10,18 +10,20 @@ type Command struct {
 	Verb   string
 	Claude string
 	Codex  string
+	Skill  string
 }
 
-// ForVerb returns the Claude and Codex forms for a public rite verb. The empty
+// ForVerb returns native invocation forms for a public rite verb. The empty
 // verb returns an empty command so callers can omit suggestions safely.
 func ForVerb(verb string) Command {
 	verb = strings.TrimSpace(strings.TrimPrefix(strings.TrimPrefix(verb, "/"), "$"))
+	verb = strings.TrimPrefix(verb, "skill:")
 	verb = strings.TrimPrefix(verb, "rite-")
 	if verb == "" {
 		return Command{}
 	}
 	name := "rite-" + verb
-	return Command{Verb: verb, Claude: "/" + name, Codex: "$" + name}
+	return Command{Verb: verb, Claude: "/" + name, Codex: "$" + name, Skill: "/skill:" + name}
 }
 
 // ForAction extracts the first explicit rite invocation from a cursor action.
@@ -29,13 +31,33 @@ func ForVerb(verb string) Command {
 func ForAction(action string) Command {
 	for _, field := range strings.Fields(action) {
 		field = strings.Trim(field, "`'\"()[]{}<>,.;:")
-		if strings.HasPrefix(field, "/rite-") || strings.HasPrefix(field, "$rite-") {
+		if strings.HasPrefix(field, "/rite-") || strings.HasPrefix(field, "$rite-") || strings.HasPrefix(field, "/skill:rite-") {
 			return ForVerb(field)
 		}
 	}
 	return Command{}
 }
 
+// SourceIsFirstArgument distinguishes workspace slugs from phase-local
+// slice/mode/scope/target arguments. Plan's optional source follows its mode.
+func (c Command) SourceIsFirstArgument() bool {
+	switch c.Verb {
+	case "", "build", "plan", "review", "polish":
+		return false
+	default:
+		return true
+	}
+}
+
+// SourceInvocation renders an executable cursor command, never display prose.
+// Commands without a slug argument retain the caller's selected SOURCE.
+func (c Command) SourceInvocation(source string) string {
+	if source != "" && c.SourceIsFirstArgument() {
+		return c.Claude + " " + source
+	}
+	return c.Claude
+}
+
 // Both renders a command in host-neutral prose for engine stderr/stdout messages.
 func (c Command) Both() string {
 	if c.Verb == "" {

package/engine/main.go

@@ -334,6 +334,21 @@ func cmdGate(root string, kind gate.Kind, args []string, stdout, stderr io.Write
 		fmt.Fprintln(stdout, binding)
 		return exitOK
 	}
+	if kind == gate.Seal {
+		code := exitBlocked
+		if err := state.WithFeatureLock(root, args[0], func() error {
+			code = cmdGateLocked(root, kind, args, stdout, stderr)
+			return nil
+		}); err != nil {
+			fmt.Fprintf(stderr, "seal: BLOCKED: %v\n", err)
+			return exitBlocked
+		}
+		return code
+	}
+	return cmdGateLocked(root, kind, args, stdout, stderr)
+}
+
+func cmdGateLocked(root string, kind gate.Kind, args []string, stdout, stderr io.Writer) int {
 	result, err := gate.Check(kind, root, args[0])
 	if err != nil {
 		fmt.Fprintf(stderr, "devrites: %v\n", err)
@@ -369,6 +384,10 @@ func cmdGate(root string, kind gate.Kind, args []string, stdout, stderr io.Write
 			fmt.Fprintf(stdout, "release-union: BLOCKED: %v\n", err)
 			return sealBlocked()
 		}
+		if err := lib.CheckFinalPrerequisites(root, args[0]); err != nil {
+			fmt.Fprintf(stdout, "final-prerequisites: BLOCKED: %v\n", err)
+			return sealBlocked()
+		}
 		code := lib.EvidenceFresh(root, []string{args[0]}, stdout, stderr)
 		if code == exitUsage {
 			return exitUsage