devrites 7.3.1 → 7.3.3

package/engine/internal/overhaul/records/consistency.go

@@ -115,6 +115,24 @@ func consistency(run, genDir string, R map[string]map[string]any, add func(strin
 	if err != nil {
 		return err
 	}
+	inputs := ovio.Obj(sc["inputs"])
+	for _, input := range []struct{ key, file string }{
+		{"rubric_sha256", join(run, str(ovio.Obj(ovio.Obj(R["run.json"]["revisions"])["rubric"]), "file"))},
+		{"results_sha256", join(genDir, results)},
+		{"gates_sha256", join(genDir, "gates.json")},
+	} {
+		if !isFile(input.file) {
+			add("scorecard: %s input is missing", input.key)
+			continue
+		}
+		digest, err := sha(input.file)
+		if err != nil {
+			return err
+		}
+		if !eq(inputs[input.key], digest) {
+			add("scorecard: %s does not match the selected calculator input", input.key)
+		}
+	}
 	gates := ovio.Obj(sc["gates"])
 	claims := func(g string) bool { return str(gates, g) == "PASS" }
 	for _, it := range fs {
@@ -131,10 +149,10 @@ func consistency(run, genDir string, R map[string]map[string]any, add func(strin
 	if !claims("G-COVERAGE") {
 		return nil
 	}
-	admitted := map[string]bool{}
+	admitted := map[string]map[string]any{}
 	for _, it := range ovio.List(R["dispatch.json"]["attempts"]) {
 		if x := ovio.Obj(it); str(x, "status") == "admitted" {
-			admitted[str(x, "receipt")] = true
+			admitted[str(x, "receipt")] = x
 		}
 	}
 	if len(cells) == 0 {
@@ -147,8 +165,8 @@ func consistency(run, genDir string, R map[string]map[string]any, add func(strin
 		case "blocked":
 			add("scorecard: G-COVERAGE is PASS but applicability %s is blocked", key)
 		case "applicable":
-			if !checkedBy(run, str(c, "domain"), ovio.List(c["receipts"]), admitted) {
-				add("scorecard: G-COVERAGE is PASS but no admitted, non-gap receipt of applicability %s lists %s in domains_checked", key, str(c, "domain"))
+			if !checkedBy(run, str(c, "domain"), str(c, "lane"), ovio.List(c["receipts"]), admitted) {
+				add("scorecard: G-COVERAGE is PASS but no admitted, non-gap receipt of applicability %s lists %s in domains_checked for its lane", key, str(c, "domain"))
 			}
 		}
 	}
@@ -169,18 +187,26 @@ func consistency(run, genDir string, R map[string]map[string]any, add func(strin
 	return nil
 }
 
-// checkedBy reports whether any admitted, non-gap receipt records domain in
-// domains_checked.
-func checkedBy(run, domain string, receipts []any, admitted map[string]bool) bool {
+// checkedBy requires the receipt's domain and lane to match the cell and its
+// identity to match the admitted dispatch attempt.
+func checkedBy(run, domain, lane string, receipts []any, admitted map[string]map[string]any) bool {
 	for _, r := range receipts {
 		p := ovio.Str(r)
-		if !admitted[p] || !inside(run, p) || !isFile(join(run, p)) {
+		attempt := admitted[p]
+		if attempt == nil || str(attempt, "lane") != lane || !inside(run, p) || !isFile(join(run, p)) {
 			continue
 		}
 		rc, err := ovio.LoadObject(join(run, p))
 		if err != nil || str(rc, "outcome") == "gap" {
 			continue
 		}
+		matches := true
+		for _, k := range []string{"task_id", "attempt_id", "role", "lane", "snapshot"} {
+			matches = matches && str(attempt, k) != "" && eq(rc[k], attempt[k])
+		}
+		if !matches {
+			continue
+		}
 		if slices.ContainsFunc(ovio.List(rc["domains_checked"]), func(d any) bool { return d == any(domain) }) {
 			return true
 		}

package/engine/internal/overhaul/records/run.go

@@ -111,15 +111,24 @@ func manifestOK(run, genDir string) ([]string, map[string]any, error) {
 		return nil, nil, err
 	}
 	var errs []string
-	files, revs := ovio.Obj(m["files"]), ovio.Obj(m["revisions"])
-	check := func(src map[string]any) error {
+	files, revs, receipts := ovio.Obj(m["files"]), ovio.Obj(m["revisions"]), ovio.Obj(m["receipts"])
+	if receipts == nil {
+		errs = append(errs, "manifest: receipts must record admitted receipt digests")
+	}
+	dispatch, err := ovio.LoadObject(join(genDir, "dispatch.json"))
+	if err != nil {
+		return nil, nil, err
+	}
+	for _, it := range ovio.List(dispatch["attempts"]) {
+		attempt := ovio.Obj(it)
+		if str(attempt, "status") == "admitted" && str(receipts, str(attempt, "receipt")) == "" {
+			errs = append(errs, "manifest: admitted receipt digest missing: "+str(attempt, "receipt"))
+		}
+	}
+	check := func(src map[string]any, base string) error {
 		for _, rel := range sortedKeys(src) {
-			base := run
-			if _, ok := files[rel]; ok {
-				base = genDir
-			}
 			p := join(base, rel)
-			ok := isFile(p)
+			ok := inside(base, rel) && isFile(p)
 			if ok {
 				d, err := sha(p)
 				if err != nil {
@@ -133,10 +142,13 @@ func manifestOK(run, genDir string) ([]string, map[string]any, error) {
 		}
 		return nil
 	}
-	if err := check(files); err != nil {
+	if err := check(files, genDir); err != nil {
+		return nil, nil, err
+	}
+	if err := check(revs, run); err != nil {
 		return nil, nil, err
 	}
-	if err := check(revs); err != nil {
+	if err := check(receipts, run); err != nil {
 		return nil, nil, err
 	}
 	return errs, m, nil
@@ -273,13 +285,22 @@ func publish(run string, stdout, stderr io.Writer) (int, error) {
 	if err != nil {
 		return 0, err
 	}
-	revs := map[string]any{}
+	revs, receipts := map[string]any{}, map[string]any{}
+	settledReceipts := map[string]string{}
 	if prevDir != "" {
 		pmErrs, pm, err := manifestOK(run, prevDir)
 		if err != nil {
 			return 0, err
 		}
 		errs = append(errs, pmErrs...)
+		for rel, digest := range ovio.Obj(pm["receipts"]) {
+			receipts[rel] = digest
+			rc, err := ovio.LoadObject(join(run, rel))
+			if err != nil {
+				return 0, err
+			}
+			settledReceipts[Repr([]any{rc["task_id"], rc["attempt_id"]})] = rel
+		}
 		prevRevs := ovio.Obj(pm["revisions"])
 		for _, rel := range sortedKeys(prevRevs) {
 			p := join(run, rel)
@@ -308,6 +329,29 @@ func publish(run string, stdout, stderr io.Writer) (int, error) {
 		}
 		revs["revisions/"+e.Name()] = d
 	}
+	dispatch, err := ovio.LoadObject(join(tmp, "dispatch.json"))
+	if err != nil {
+		return 0, err
+	}
+	for _, it := range ovio.List(dispatch["attempts"]) {
+		attempt := ovio.Obj(it)
+		rel := str(attempt, "receipt")
+		if str(attempt, "status") != "admitted" || !inside(run, rel) || !isFile(join(run, rel)) {
+			continue
+		}
+		if prior, settled := settledReceipts[Repr([]any{attempt["task_id"], attempt["attempt_id"]})]; settled && prior != rel {
+			errs = append(errs, "settled admitted attempt changed receipt: "+PyStr(attempt["task_id"])+"#"+PyStr(attempt["attempt_id"]))
+			continue
+		}
+		if _, settled := receipts[rel]; settled {
+			continue
+		}
+		digest, err := sha(join(run, rel))
+		if err != nil {
+			return 0, err
+		}
+		receipts[rel] = digest
+	}
 	if len(errs) > 0 {
 		for _, e := range errs {
 			fmt.Fprintln(stdout, "VIOLATION: "+e)
@@ -342,7 +386,7 @@ func publish(run string, stdout, stderr io.Writer) (int, error) {
 		previous = prev
 	}
 	manifest := map[string]any{"schema": "overhaul.manifest/1", "generation": gen, "previous": previous,
-		"files": files, "revisions": revs}
+		"files": files, "revisions": revs, "receipts": receipts}
 	if err := ovio.WriteJSON(join(tmp, "manifest.json"), manifest, 0o644); err != nil {
 		return 0, err
 	}

package/engine/internal/parallel/landing.go

@@ -199,6 +199,23 @@ func acceptedRetry(root string, lease *Lease, selector string) (string, error) {
 }
 
 func protectRawLease(current, next *Lease) error {
+	for _, candidate := range next.Slices {
+		if candidate.WrightStatus != WrightIntegrated {
+			continue
+		}
+		found := false
+		if current != nil {
+			for _, sl := range current.Slices {
+				if sl.WrightStatus == WrightIntegrated && reflect.DeepEqual(sl, candidate) {
+					found = true
+					break
+				}
+			}
+		}
+		if !found {
+			return fmt.Errorf("lease-write cannot introduce integrated slice %s; use integrate", SliceKey(candidate.Workspace, candidate.ID))
+		}
+	}
 	if current == nil {
 		if next.PendingLanding != nil || next.LastLanding != nil {
 			return fmt.Errorf("lease-write cannot fabricate landing evidence")

package/engine/internal/rootfacts/facts.go

@@ -257,6 +257,17 @@ func inspectWorkspaceState(facts *Facts) {
 	if root == "" {
 		return
 	}
+	work := filepath.Join(root, "work")
+	if info, err := os.Lstat(work); err == nil && info.Mode()&os.ModeSymlink != 0 && !safepath.WithinResolved(work, root) {
+		facts.Hazards = append(facts.Hazards, Hazard{
+			ID:          "DRV-WORKSPACE-SYMLINK-ESCAPE",
+			Severity:    "error",
+			Message:     fmt.Sprintf("workspace path %q resolves outside the selected root", work),
+			Remediation: fmt.Sprintf("rm %s", shellQuote(work)),
+			Refuse:      true,
+		})
+		return
+	}
 	entries, err := os.ReadDir(filepath.Join(root, "work"))
 	if err == nil {
 		for _, entry := range entries {

package/engine/internal/state/acceptance.go

@@ -11,7 +11,8 @@ import (
 var (
 	acceptanceHeadingRE = regexp.MustCompile(`(?i)^##\s+Acceptance criteria\s*$`)
 	canonicalACRE       = regexp.MustCompile(`\bAC-\d{3}\b`)
-	h2HeadingRE         = regexp.MustCompile(`^##\s+`)
+	acceptanceEndRE     = regexp.MustCompile(`^#{1,2}\s+`)
+	acDeclarationRE     = regexp.MustCompile("^\\s*(?:#{1,6}\\s+|[-+*]\\s+(?:\\[[ xX]\\]\\s+)?|\\d+[.)]\\s+|\\|\\s*)?(?:\\*\\*|__|`)?(AC-\\d{3})(?:\\*\\*|__|`)?(?:\\s*[:|]|[ \\t]+[-–—])")
 )
 
 // AcceptanceMapResult is the deterministic ID-presence check from spec.md
@@ -50,11 +51,40 @@ func ParseAcceptanceMap(spec, tasks, testPlan []byte, requireTasks, requireTestP
 }
 
 func acceptanceSection(spec []byte) string {
-	structural, err := markdowntext.Structural(spec)
+	structural, err := markdowntext.Prose(spec)
 	if err != nil {
 		return ""
 	}
 	lines := strings.Split(strings.ReplaceAll(string(structural), "\r\n", "\n"), "\n")
+	start, end := acceptanceSectionBounds(lines)
+	if start < 0 {
+		return ""
+	}
+	return strings.Join(lines[start:end], "\n")
+}
+
+// AcceptanceDeclarationsOutsideSection identifies definitions, not prose
+// references, that the canonical section parser would otherwise silently skip.
+func AcceptanceDeclarationsOutsideSection(spec []byte) []string {
+	structural, err := markdowntext.Prose(spec)
+	if err != nil {
+		return nil
+	}
+	lines := strings.Split(strings.ReplaceAll(string(structural), "\r\n", "\n"), "\n")
+	start, end := acceptanceSectionBounds(lines)
+	var ids []string
+	for i, line := range lines {
+		if start >= 0 && i >= start && i < end {
+			continue
+		}
+		if match := acDeclarationRE.FindStringSubmatch(line); match != nil {
+			ids = append(ids, match[1])
+		}
+	}
+	return ids
+}
+
+func acceptanceSectionBounds(lines []string) (int, int) {
 	start := -1
 	for i, line := range lines {
 		if acceptanceHeadingRE.MatchString(strings.TrimSpace(line)) {
@@ -63,16 +93,16 @@ func acceptanceSection(spec []byte) string {
 		}
 	}
 	if start < 0 {
-		return ""
+		return -1, -1
 	}
 	end := len(lines)
 	for i := start; i < len(lines); i++ {
-		if h2HeadingRE.MatchString(lines[i]) {
+		if acceptanceEndRE.MatchString(strings.TrimSpace(lines[i])) {
 			end = i
 			break
 		}
 	}
-	return strings.Join(lines[start:end], "\n")
+	return start, end
 }
 
 func uniqueCanonicalACs(text string) []string {

package/engine/internal/state/feature.go

@@ -63,12 +63,13 @@ func regularFileExists(path string) bool {
 	return err == nil && info.Mode().IsRegular()
 }
 
-func firstPhaseWord(value string) string {
+// CanonicalPhase reads the leading phase name, ignoring case and trailing annotations.
+func CanonicalPhase(value string) Phase {
 	word := strings.ToLower(strings.TrimSpace(value))
 	if i := strings.IndexAny(word, " 	"); i > 0 {
 		word = word[:i]
 	}
-	return word
+	return Phase(word)
 }
 
 // blankOrHash reports whether a trimmed line carries no meaningful content: it

package/engine/internal/state/lock_other.go

@@ -18,6 +18,10 @@ func acquireLock(path string) (*fileLock, error) {
 	if err != nil {
 		return nil, fmt.Errorf("acquire lock: %w", err)
 	}
+	return lockOpened(f, path)
+}
+
+func lockOpened(f *os.File, path string) (*fileLock, error) {
 	return &fileLock{f: f}, nil
 }
 

package/engine/internal/state/observation.go

@@ -148,7 +148,7 @@ func (o *WorkspaceObservation) DeclaredPhase() (Phase, error) {
 	if !ok {
 		return "", fmt.Errorf("feature %q: no phase in %s ledger; record phase in state.md and retry", o.slug, LedgerFile)
 	}
-	phase := Phase(firstPhaseWord(value))
+	phase := CanonicalPhase(value)
 	policy, ok := PolicyFor(phase)
 	if !ok {
 		return "", fmt.Errorf("feature %q: unknown phase %q; record a known phase in state.md and retry", o.slug, phase)

package/engine/internal/state/write.go

@@ -7,7 +7,6 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
-	"sync"
 
 	"github.com/devrites/devrites/internal/devritespaths"
 	"github.com/devrites/devrites/internal/fsutil"
@@ -77,57 +76,75 @@ func AppendLog(path, record string) error {
 // is released automatically even if the process dies mid-operation (crash-safe);
 // see lock_unix.go / lock_other.go.
 func WithFeatureLock(root, slug string, fn func() error) error {
-	lockPath, err := featureLockPath(root, slug)
-	if err != nil {
-		return err
+	if !devritespaths.ValidSlug(slug) {
+		return fmt.Errorf("lock feature %q: not a feature slug", slug)
 	}
-	return WithLock(lockPath, fn)
-}
-
-// WithLock runs fn while holding the same exclusive advisory lock as
-// WithFeatureLock, keyed on lockPath, for shared ledgers outside one feature.
-func WithLock(lockPath string, fn func() error) error {
-	return withLock(lockPath, func(func()) error { return fn() })
-}
-
-// WithFeatureLockRelease is WithFeatureLock for a caller that must drop the lock
-// before fn returns, for example because the platform refuses to rename the
-// directory that holds the open lock file. fn receives release, which is safe to
-// call more than once; the lock is also released when fn returns.
-func WithFeatureLockRelease(root, slug string, fn func(release func()) error) error {
-	lockPath, err := featureLockPath(root, slug)
+	// The caller-selected root may be new; descendants are created through it.
+	if err := os.MkdirAll(root, 0o755); err != nil {
+		return fmt.Errorf("lock feature %q: %w", slug, err)
+	}
+	selected, err := os.OpenRoot(root)
 	if err != nil {
-		return err
+		return fmt.Errorf("lock feature %q: %w", slug, err)
 	}
-	return withLock(lockPath, fn)
+	defer func() { _ = selected.Close() }()
+	return WithFeatureLockIn(selected, slug, fn)
 }
 
-// featureLockPath validates slug and creates the feature directory, returning
-// the lock file path inside it. A closed workspace (work/<slug> gone, archive/<slug>
-// present) is refused rather than resurrected by a late lock.
-func featureLockPath(root, slug string) (string, error) {
+// WithFeatureLockIn locks a feature within root without following escaping
+// symlinks. The caller retains ownership of root.
+func WithFeatureLockIn(root *os.Root, slug string, fn func() error) error {
 	if !devritespaths.ValidSlug(slug) {
-		return "", fmt.Errorf("lock feature %q: not a feature slug", slug)
+		return fmt.Errorf("lock feature %q: not a feature slug", slug)
 	}
-	dir := featureDir(root, slug)
-	if _, err := os.Lstat(dir); errors.Is(err, fs.ErrNotExist) {
-		if _, archErr := os.Lstat(filepath.Join(root, "archive", slug)); archErr == nil {
-			return "", fmt.Errorf("lock feature %q: workspace is closed (archived)", slug)
-		}
+	// Keep the lock outside the movable workspace; never unlink it on release.
+	lockDir := filepath.Join(".locks", "features", slug)
+	if err := root.MkdirAll(lockDir, 0o755); err != nil {
+		return fmt.Errorf("lock feature %q: %w", slug, err)
+	}
+	lockPath := filepath.Join(lockDir, ".lock")
+	// Separate atomic creation from opening a concurrent creator's lock.
+	f, err := root.OpenFile(lockPath, os.O_CREATE|os.O_EXCL|os.O_RDWR, 0o644)
+	if errors.Is(err, fs.ErrExist) {
+		f, err = root.OpenFile(lockPath, os.O_RDWR, 0)
 	}
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		return "", fmt.Errorf("lock feature %q: %w", slug, err)
+	if err != nil {
+		return fmt.Errorf("lock feature %q: %w", slug, err)
 	}
-	return filepath.Join(dir, ".lock"), nil
+	l, err := lockOpened(f, filepath.Join(root.Name(), lockPath))
+	if err != nil {
+		return fmt.Errorf("lock feature %q: %w", slug, err)
+	}
+	defer func() { _ = l.release() }()
+	held, err := f.Stat()
+	if err != nil {
+		return fmt.Errorf("lock feature %q: %w", slug, err)
+	}
+	current, err := root.Lstat(lockPath)
+	if errors.Is(err, fs.ErrNotExist) || (err == nil && !os.SameFile(held, current)) {
+		return fmt.Errorf("lock feature %q: %w", slug, ErrWorkspaceMoved)
+	}
+	if err != nil {
+		return fmt.Errorf("lock feature %q: %w", slug, err)
+	}
+	if _, err := root.Lstat(filepath.Join("archive", slug)); err == nil {
+		return fmt.Errorf("lock feature %q: workspace is closed (archived)", slug)
+	} else if !errors.Is(err, fs.ErrNotExist) {
+		return fmt.Errorf("lock feature %q: %w", slug, err)
+	}
+	if err := root.MkdirAll(filepath.Join("work", slug), 0o755); err != nil {
+		return fmt.Errorf("lock feature %q: %w", slug, err)
+	}
+	return fn()
 }
 
-func withLock(lockPath string, fn func(release func()) error) error {
+// WithLock runs fn while holding the same exclusive advisory lock as
+// WithFeatureLock, keyed on lockPath, for shared ledgers outside one feature.
+func WithLock(lockPath string, fn func() error) error {
 	l, err := acquireLock(lockPath)
 	if err != nil {
 		return fmt.Errorf("lock %s: %w", lockPath, err)
 	}
-	var once sync.Once
-	release := func() { once.Do(func() { _ = l.release() }) }
-	defer release()
-	return fn(release)
+	defer func() { _ = l.release() }()
+	return fn()
 }

package/engine/internal/workflow/commands.go

@@ -10,18 +10,20 @@ type Command struct {
 	Verb   string
 	Claude string
 	Codex  string
+	Skill  string
 }
 
-// ForVerb returns the Claude and Codex forms for a public rite verb. The empty
+// ForVerb returns native invocation forms for a public rite verb. The empty
 // verb returns an empty command so callers can omit suggestions safely.
 func ForVerb(verb string) Command {
 	verb = strings.TrimSpace(strings.TrimPrefix(strings.TrimPrefix(verb, "/"), "$"))
+	verb = strings.TrimPrefix(verb, "skill:")
 	verb = strings.TrimPrefix(verb, "rite-")
 	if verb == "" {
 		return Command{}
 	}
 	name := "rite-" + verb
-	return Command{Verb: verb, Claude: "/" + name, Codex: "$" + name}
+	return Command{Verb: verb, Claude: "/" + name, Codex: "$" + name, Skill: "/skill:" + name}
 }
 
 // ForAction extracts the first explicit rite invocation from a cursor action.
@@ -29,13 +31,33 @@ func ForVerb(verb string) Command {
 func ForAction(action string) Command {
 	for _, field := range strings.Fields(action) {
 		field = strings.Trim(field, "`'\"()[]{}<>,.;:")
-		if strings.HasPrefix(field, "/rite-") || strings.HasPrefix(field, "$rite-") {
+		if strings.HasPrefix(field, "/rite-") || strings.HasPrefix(field, "$rite-") || strings.HasPrefix(field, "/skill:rite-") {
 			return ForVerb(field)
 		}
 	}
 	return Command{}
 }
 
+// SourceIsFirstArgument distinguishes workspace slugs from phase-local
+// slice/mode/scope/target arguments. Plan's optional source follows its mode.
+func (c Command) SourceIsFirstArgument() bool {
+	switch c.Verb {
+	case "", "build", "plan", "review", "polish":
+		return false
+	default:
+		return true
+	}
+}
+
+// SourceInvocation renders an executable cursor command, never display prose.
+// Commands without a slug argument retain the caller's selected SOURCE.
+func (c Command) SourceInvocation(source string) string {
+	if source != "" && c.SourceIsFirstArgument() {
+		return c.Claude + " " + source
+	}
+	return c.Claude
+}
+
 // Both renders a command in host-neutral prose for engine stderr/stdout messages.
 func (c Command) Both() string {
 	if c.Verb == "" {

package/engine/main.go

@@ -76,10 +76,10 @@ Usage:
                                          Resolve test/lint/vet/build commands from the repository's own wiring
   devrites-engine parallel <subcommand>   Deterministic parallel worktree lease/create/integrate/prune/cleanup
   devrites-engine gates <subcommand> <slug>  Machine-checked gates.md ledger: scaffold/status/run/reverify/lint/precheck/attest/abandon
-  devrites-engine state resolve <qid> "<ans>"  Resolve an open question and update state atomically
+  devrites-engine state resolve <qid> "<ans>"  Resolve an open question with locked, rollback-protected state updates
   devrites-engine state merge-manifest <slug> [pred...]  Fold the recorded predecessor chain's manifests into the release candidate manifest
   devrites-engine state apply-bundle <slug> <bundle.json>... [--dry-run]
-                                         Validate and apply plan-drafter hunk bundles atomically
+                                         Validate and apply plan-drafter hunk bundles with locked, rollback-protected updates
   devrites-engine state set <slug> <key>=<value>... [--unset <key>]
                                          Write state.md cursor fields atomically (known phase, no return-cursor overwrite)
   devrites-engine state append <slug> <ledger.md> --heading "<text>" --body-file <path|->
@@ -334,6 +334,21 @@ func cmdGate(root string, kind gate.Kind, args []string, stdout, stderr io.Write
 		fmt.Fprintln(stdout, binding)
 		return exitOK
 	}
+	if kind == gate.Seal {
+		code := exitBlocked
+		if err := state.WithFeatureLock(root, args[0], func() error {
+			code = cmdGateLocked(root, kind, args, stdout, stderr)
+			return nil
+		}); err != nil {
+			fmt.Fprintf(stderr, "seal: BLOCKED: %v\n", err)
+			return exitBlocked
+		}
+		return code
+	}
+	return cmdGateLocked(root, kind, args, stdout, stderr)
+}
+
+func cmdGateLocked(root string, kind gate.Kind, args []string, stdout, stderr io.Writer) int {
 	result, err := gate.Check(kind, root, args[0])
 	if err != nil {
 		fmt.Fprintf(stderr, "devrites: %v\n", err)
@@ -369,6 +384,10 @@ func cmdGate(root string, kind gate.Kind, args []string, stdout, stderr io.Write
 			fmt.Fprintf(stdout, "release-union: BLOCKED: %v\n", err)
 			return sealBlocked()
 		}
+		if err := lib.CheckFinalPrerequisites(root, args[0]); err != nil {
+			fmt.Fprintf(stdout, "final-prerequisites: BLOCKED: %v\n", err)
+			return sealBlocked()
+		}
 		code := lib.EvidenceFresh(root, []string{args[0]}, stdout, stderr)
 		if code == exitUsage {
 			return exitUsage