devrites 3.2.0 → 3.2.2

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [3.2.2](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.1...v3.2.2) (2026-07-25)
+
+### Fixed
+
+* **agents:** restore guarded codex dispatch ([2d05e20](https://github.com/ViktorsBaikers/DevRites/commit/2d05e20f6196774827d1496275f4c3cb5c5e22e2))
+* **ci:** govern bundled brace expansion advisory ([d1d0786](https://github.com/ViktorsBaikers/DevRites/commit/d1d078667fa42b61d8bec823136c628ca53fc6d8))
+
+## [3.2.1](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.0...v3.2.1) (2026-07-24)
+
+### Fixed
+
+* **ci:** govern temporary npm audit exceptions ([c2219e0](https://github.com/ViktorsBaikers/DevRites/commit/c2219e0ff11f11ee3f2e2ffa7c5d35b480c5eb76))
+* **rite:** repair doctor compatibility ([811f339](https://github.com/ViktorsBaikers/DevRites/commit/811f339d22d3ec079549a5d50838d7596c72c7da))
+
 ## [3.2.0](https://github.com/ViktorsBaikers/DevRites/compare/v3.1.0...v3.2.0) (2026-07-24)
 
 ### Added

package/README.md

@@ -25,7 +25,7 @@ final commit, push, and tag, and it requires a typed `GO` confirmation.
 Unattended runs may create local WIP checkpoint commits along the way, but only
 Ship collapses and pushes them.
 
-**Status:** [`v3.2.0`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.2.0): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v3.2.2`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.2.2): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 ## Quick start
 

package/docs/engine/commands.md

@@ -77,11 +77,13 @@ hazards: ok
   `3`): the binary won't silently mis-parse newer state.
 - Additive schema changes (older state read by a newer binary) are always fine.
 
-The pack version is discovered from `.claude/devrites.version` or the project
-`package.json`; when neither exists the pack is reported `unknown` and no skew is
-asserted. Doctor also reports linked-worktree/submodule identity, merge/rebase
-state, host-artifact drift, and project extensions that have artifacts but no
-optional `provenance.json`.
+The pack version comes from the installer-owned
+`.claude/devrites.manifest`. The old `.claude/devrites.version` marker remains
+readable for compatibility; without either source the pack is reported
+`unknown` and no skew is asserted. The project's own `package.json` is never
+treated as DevRites provenance. Doctor also reports linked-worktree/submodule
+identity, merge/rebase state, host-artifact drift, and project extensions that
+have artifacts but no optional `provenance.json`.
 
 ### Root safety at command dispatch
 

package/engine/commands.go

@@ -218,8 +218,8 @@ func gitOperation(projectDir, resolvedGitDir string) string {
 // versions. It exits nonzero for an unsafe root or newer state schema. Missing
 // optional data and warnings remain diagnostic.
 func cmdDoctor(args []string, stdout, stderr io.Writer) int {
-	if len(args) != 0 {
-		fmt.Fprintln(stderr, "usage: devrites-engine doctor")
+	if len(args) > 1 || len(args) == 1 && args[0] != "--verbose" {
+		fmt.Fprintln(stderr, "usage: devrites-engine doctor [--verbose]")
 		return exitUsage
 	}
 	facts, resolveErr := rootfacts.Resolve(os.Getenv("DEVRITES_ROOT"))

package/engine/hooks.go

@@ -246,16 +246,21 @@ const (
 	devritesAgentNone devritesAgentKind = iota
 	devritesAgentReadonly
 	devritesAgentWright
+	devritesAgentGenericWright
 	devritesAgentInvalid
 )
 
 // devritesAgent identifies the one write-capable leaf without copying the agent
 // roster. DEVRITES_AGENT_RUN supplies identity when a hook payload cannot carry
-// agent_type.
+// agent_type; the generated Codex project hook explicitly opts built-in
+// explorer/worker identities into the same policies.
 func devritesAgent(payloadAgent string) devritesAgentKind {
 	payloadAgent = strings.TrimSpace(payloadAgent)
 	envAgent := strings.TrimSpace(os.Getenv("DEVRITES_ACTIVE_AGENT"))
-	declared := os.Getenv("DEVRITES_AGENT_RUN") == "1" || strings.HasPrefix(payloadAgent, "devrites-")
+	genericCompat := os.Getenv("DEVRITES_CODEX_GENERIC_AGENT_COMPAT") == "1"
+	declared := os.Getenv("DEVRITES_AGENT_RUN") == "1" ||
+		strings.HasPrefix(payloadAgent, "devrites-") ||
+		(genericCompat && (payloadAgent == "explorer" || payloadAgent == "worker"))
 	if !declared {
 		return devritesAgentNone
 	}
@@ -269,6 +274,10 @@ func devritesAgent(payloadAgent string) devritesAgentKind {
 	switch {
 	case agent == "devrites-slice-wright":
 		return devritesAgentWright
+	case genericCompat && agent == "worker":
+		return devritesAgentGenericWright
+	case genericCompat && agent == "explorer":
+		return devritesAgentReadonly
 	case strings.HasPrefix(agent, "devrites-") && len(agent) > len("devrites-"):
 		return devritesAgentReadonly
 	default:
@@ -459,13 +468,18 @@ func hookReviewerReadonly(h harness.Harness, stdin io.Reader, stdout, stderr io.
 	}
 	in := h.ParseGuardInput(bytes.NewReader(data))
 	kind := devritesAgent(in.AgentType)
+	if kind == devritesAgentNone &&
+		os.Getenv("DEVRITES_CODEX_GENERIC_AGENT_COMPAT") == "1" &&
+		in.AgentType == "" {
+		return exitOK
+	}
 
 	// Do not let a global hook interfere with the main thread or another
 	// product's agent when no DevRites run is declared.
 	if kind == devritesAgentNone && (in.AgentType != "" || os.Getenv("DEVRITES_REVIEWER_AGENT_REQUIRED") == "1") {
 		return exitOK
 	}
-	if kind == devritesAgentWright {
+	if kind == devritesAgentWright || kind == devritesAgentGenericWright {
 		if !isAgentDispatchTool(in.ToolName) {
 			return exitOK
 		}

package/engine/hooks_workspace.go

@@ -563,9 +563,15 @@ func hookWrightScope(h harness.Harness, stdin io.Reader, stdout, stderr io.Write
 	}
 	in := h.ParseGuardInput(bytes.NewReader(data))
 	kind := devritesAgent(in.AgentType)
+	if kind == devritesAgentNone &&
+		os.Getenv("DEVRITES_CODEX_GENERIC_AGENT_COMPAT") == "1" &&
+		in.AgentType == "" {
+		return exitOK
+	}
 	forgeDeclared := forgeWrightDeclared()
-	active := kind != devritesAgentNone
-	if forgeDeclared && kind != devritesAgentWright {
+	genericWright := kind == devritesAgentGenericWright
+	active := kind != devritesAgentNone && (!genericWright || forgeDeclared)
+	if forgeDeclared && kind != devritesAgentWright && !genericWright {
 		return denyWright(h, stdout, stderr, forgeWrightDenyReason, drvreason.HookForgeBindingDenied)
 	}
 	if kind == devritesAgentNone && (in.AgentType != "" || os.Getenv("DEVRITES_WRIGHT_AGENT_REQUIRED") == "1") {
@@ -607,6 +613,15 @@ func hookWrightScope(h harness.Harness, stdin io.Reader, stdout, stderr io.Write
 		}
 		return exitOK
 	}
+	if genericWright && !forgeDeclared {
+		if !wsIsFile(filepath.Join(dir, ".reconcile-base")) {
+			return exitOK
+		}
+		if wsIsFile(filepath.Join(dir, ".reconcile-inline")) {
+			return denyWright(h, stdout, stderr, wrightForbiddenReason, drvreason.HookWrightForbiddenDenied)
+		}
+		active = true
+	}
 
 	if wrightForbiddenShellRe.MatchString(in.Command) ||
 		(opaqueInterpreterRe.MatchString(in.Command) && !safeReadonlyShellCommand(in.Command)) {
@@ -617,7 +632,7 @@ func hookWrightScope(h harness.Harness, stdin io.Reader, stdout, stderr io.Write
 	}
 
 	projectDir := filepath.Dir(root)
-	if !forgeDeclared && kind == devritesAgentWright && insideForgeStaging(projectDir) {
+	if !forgeDeclared && (kind == devritesAgentWright || genericWright) && insideForgeStaging(projectDir) {
 		return denyOrObserveWright(h, stdout, stderr, dir, true, forgeWrightDenyReason, drvreason.HookForgeBindingDenied, []string{"missing Forge binding"})
 	}
 	if forgeDeclared {

package/engine/internal/doctor/doctor.go

@@ -5,13 +5,13 @@ package doctor
 
 import (
 	"crypto/sha256"
-	"encoding/json"
 	"fmt"
 	"io/fs"
 	"os"
 	"path/filepath"
 	"strings"
 
+	"github.com/devrites/devrites/internal/devritespaths"
 	"github.com/devrites/devrites/internal/rootfacts"
 	"github.com/devrites/devrites/internal/state"
 	"github.com/devrites/devrites/internal/version"
@@ -160,20 +160,32 @@ func (r *Report) Render() string {
 	return b.String()
 }
 
-// packVersion discovers the installed DevRites pack version. It prefers an
-// explicit marker (.claude/devrites.version) and falls back to the npm
-// package.json at the project root; either absent leaves the pack Unknown so no
-// false skew is asserted.
+// packVersion discovers the installed DevRites pack version from the install
+// manifest. The old standalone marker remains readable for compatibility.
 func packVersion(projectDir string) string {
-	if v := firstLine(filepath.Join(projectDir, ".claude", "devrites.version")); v != "" {
+	if v := manifestVersion(filepath.Join(projectDir, filepath.FromSlash(devritespaths.ManifestName))); v != "" {
 		return v
 	}
-	if v := packageJSONVersion(filepath.Join(projectDir, "package.json")); v != "" {
+	if v := firstLine(filepath.Join(projectDir, ".claude", "devrites.version")); v != "" {
 		return v
 	}
 	return Unknown
 }
 
+func manifestVersion(path string) string {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return ""
+	}
+	const prefix = "# devrites-version:"
+	for _, line := range strings.Split(string(raw), "\n") {
+		if strings.HasPrefix(line, prefix) {
+			return strings.TrimSpace(strings.TrimPrefix(line, prefix))
+		}
+	}
+	return ""
+}
+
 func firstLine(path string) string {
 	raw, err := os.ReadFile(path)
 	if err != nil {
@@ -200,8 +212,8 @@ func driftChecks(projectDir string) []string {
 	if isDir(filepath.Join(projectDir, ".claude", "agents")) && !isDir(filepath.Join(projectDir, ".codex", "agents")) {
 		checks = append(checks, "WARN: Claude agents installed but Codex agent mirror .codex/agents is missing")
 	}
-	if firstLine(filepath.Join(projectDir, ".claude", "devrites.version")) == "" && isDir(filepath.Join(projectDir, ".claude", "skills")) {
-		checks = append(checks, "WARN: installed skills have no .claude/devrites.version marker")
+	if packVersion(projectDir) == Unknown && isDir(filepath.Join(projectDir, ".claude", "skills")) {
+		checks = append(checks, "WARN: installed skills have no versioned .claude/devrites.manifest provenance")
 	}
 	if generatedClaudeDrift(projectDir) {
 		checks = append(checks, "[DRV-GENERATED-DRIFT] WARN: pack/generated/claude differs from canonical pack/.claude; run `bash scripts/build-host-artifacts.sh`")
@@ -292,17 +304,3 @@ func isDir(path string) bool {
 	info, err := os.Stat(path)
 	return err == nil && info.IsDir()
 }
-
-func packageJSONVersion(path string) string {
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		return ""
-	}
-	var pkg struct {
-		Version string `json:"version"`
-	}
-	if err := json.Unmarshal(raw, &pkg); err != nil {
-		return ""
-	}
-	return strings.TrimSpace(pkg.Version)
-}

package/engine/internal/doctor/doctor_test.go

@@ -64,12 +64,13 @@ func TestDiagnoseOKWhenAligned(t *testing.T) {
 func TestDiagnoseWarnsWhenBinaryOlderThanPack(t *testing.T) {
 	withBinaryVersion(t, "1.0.0")
 	projectDir := t.TempDir()
-	// Pack marker newer than the binary → warn, not refuse.
+	// Installed pack newer than the binary → warn, not refuse.
 	claude := filepath.Join(projectDir, ".claude")
 	if err := os.MkdirAll(claude, 0o755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(claude, "devrites.version"), []byte("2.0.0\n"), 0o644); err != nil {
+	manifest := "# devrites-version: 2.0.0\n.claude/skills/rite/SKILL.md\tabc\n"
+	if err := os.WriteFile(filepath.Join(claude, "devrites.manifest"), []byte(manifest), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	root := t.TempDir()
@@ -90,6 +91,33 @@ func TestDiagnoseWarnsWhenBinaryOlderThanPack(t *testing.T) {
 	}
 }
 
+func TestPackVersionUsesManifestBeforeLegacyMarker(t *testing.T) {
+	projectDir := t.TempDir()
+	claude := filepath.Join(projectDir, ".claude")
+	if err := os.MkdirAll(claude, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(claude, "devrites.manifest"), []byte("# devrites-version: 3.2.0\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(claude, "devrites.version"), []byte("2.9.0\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if got := packVersion(projectDir); got != "3.2.0" {
+		t.Fatalf("packVersion() = %q, want installer manifest version 3.2.0", got)
+	}
+}
+
+func TestPackVersionIgnoresProjectPackageJSON(t *testing.T) {
+	projectDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(projectDir, "package.json"), []byte(`{"version":"99.0.0"}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if got := packVersion(projectDir); got != Unknown {
+		t.Fatalf("packVersion() = %q, want %q without DevRites install provenance", got, Unknown)
+	}
+}
+
 func TestDiagnoseRefusesNewerStateSchema(t *testing.T) {
 	withBinaryVersion(t, "2.6.1")
 	root := t.TempDir()
@@ -143,7 +171,7 @@ func TestDiagnoseReportsHostArtifactDrift(t *testing.T) {
 		t.Fatal("expected drift checks")
 	}
 	out := r.Render()
-	for _, want := range []string{"devrites-engine hooks", "Codex skill mirror", "devrites.version marker"} {
+	for _, want := range []string{"devrites-engine hooks", "Codex skill mirror", "devrites.manifest provenance"} {
 		if !strings.Contains(out, want) {
 			t.Fatalf("doctor output missing %q:\n%s", want, out)
 		}

package/engine/tests/doctor_cli_test.go

@@ -25,6 +25,21 @@ func TestDoctorPrintsTriangle(t *testing.T) {
 	}
 }
 
+func TestDoctorVerboseMatchesPlainDoctor(t *testing.T) {
+	root := newWorkspace(t)
+	plainOut, plainErr, plainCode := runDevrites(t, root, "doctor")
+	verboseOut, verboseErr, verboseCode := runDevrites(t, root, "doctor", "--verbose")
+	if plainCode != 0 || verboseCode != 0 {
+		t.Fatalf("doctor exits: plain=%d verbose=%d", plainCode, verboseCode)
+	}
+	if verboseCode != plainCode || verboseOut != plainOut || verboseErr != plainErr {
+		t.Fatalf(
+			"doctor --verbose differs from doctor:\nplain: code=%d stdout=%q stderr=%q\nverbose: code=%d stdout=%q stderr=%q",
+			plainCode, plainOut, plainErr, verboseCode, verboseOut, verboseErr,
+		)
+	}
+}
+
 func TestDoctorReportsStaleActiveWithPasteableRepair(t *testing.T) {
 	root := newWorkspace(t)
 	if err := os.WriteFile(filepath.Join(root, "ACTIVE"), []byte("ghost\n"), 0o644); err != nil {

package/engine/tests/hook_test.go

@@ -347,6 +347,36 @@ func TestHookReviewerReadonlyAgentRequiredSkipsNonDevrites(t *testing.T) {
 	}
 }
 
+func TestHookReviewerReadonlyBindsCodexExplorerCompatibility(t *testing.T) {
+	root := newWorkspace(t)
+	in := `{"tool_name":"Edit","tool_input":{"file_path":"src/app.go"},"agent_type":"explorer"}`
+	out, errOut, code := runDevritesIO(t, root, in,
+		[]string{"DEVRITES_CODEX_GENERIC_AGENT_COMPAT=1"},
+		"hook", "reviewer-readonly", "--harness=codex")
+	if code != 0 {
+		t.Fatalf("exit=%d stderr=%q", code, errOut)
+	}
+	if decision, _ := parsePermissionDecision(t, out); decision != "deny" {
+		t.Fatalf("generic explorer mutation was not denied: %q", out)
+	}
+}
+
+func TestCodexGenericCompatibilityDoesNotShadowRoot(t *testing.T) {
+	root := newWorkspace(t)
+	in := `{"tool_name":"Edit","tool_input":{"file_path":"src/app.go"}}`
+	env := []string{
+		"DEVRITES_CODEX_GENERIC_AGENT_COMPAT=1",
+		"DEVRITES_HOOK_PROFILE=strict",
+	}
+	for _, guard := range []string{"reviewer-readonly", "wright-scope"} {
+		out, errOut, code := runDevritesIO(t, root, in, env,
+			"hook", guard, "--harness=codex")
+		if code != 0 || strings.TrimSpace(out) != "" {
+			t.Fatalf("%s shadowed root: exit=%d out=%q stderr=%q", guard, code, out, errOut)
+		}
+	}
+}
+
 func TestHookReviewerReadonlyActiveLeafDeniesEveryMutationSurface(t *testing.T) {
 	root := newWorkspace(t)
 	env := []string{
@@ -435,6 +465,53 @@ func TestHookWrightScopeUsesExactOrchestratorAllowlist(t *testing.T) {
 	}
 }
 
+func TestHookWrightScopeBindsCodexWorkerDuringReconcileWindow(t *testing.T) {
+	root := newWorkspace(t)
+	writeActive(t, root, "auth-tokens")
+	workspace := filepath.Join(root, "features", "auth-tokens")
+	if err := os.WriteFile(filepath.Join(workspace, ".wright-allowlist"), []byte("src/app.go\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(workspace, ".reconcile-base"), []byte("snapshot\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	env := []string{"DEVRITES_CODEX_GENERIC_AGENT_COMPAT=1"}
+
+	for _, test := range []struct {
+		name  string
+		input string
+		deny  bool
+	}{
+		{"listed edit", `{"tool_name":"Edit","tool_input":{"file_path":"src/app.go"},"agent_type":"worker"}`, false},
+		{"unlisted edit", `{"tool_name":"Edit","tool_input":{"file_path":"src/other.go"},"agent_type":"worker"}`, true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			out, errOut, code := runDevritesIO(t, root, test.input, env,
+				"hook", "wright-scope", "--harness=codex")
+			if code != 0 {
+				t.Fatalf("exit=%d stderr=%q", code, errOut)
+			}
+			if test.deny {
+				if decision, _ := parsePermissionDecision(t, out); decision != "deny" {
+					t.Fatalf("expected deny, got %q", out)
+				}
+			} else if strings.TrimSpace(out) != "" {
+				t.Fatalf("expected allow, got %q", out)
+			}
+		})
+	}
+
+	if err := os.Remove(filepath.Join(workspace, ".reconcile-base")); err != nil {
+		t.Fatal(err)
+	}
+	out, _, code := runDevritesIO(t, root,
+		`{"tool_name":"Edit","tool_input":{"file_path":"src/other.go"},"agent_type":"worker"}`,
+		env, "hook", "wright-scope", "--harness=codex")
+	if code != 0 || strings.TrimSpace(out) != "" {
+		t.Fatalf("generic worker outside a reconcile window was shadowed: exit=%d out=%q", code, out)
+	}
+}
+
 func TestHookWrightScopeFailsClosedWhenWorkspaceResolutionFails(t *testing.T) {
 	root := newWorkspace(t)
 	if err := os.Remove(filepath.Join(root, "ACTIVE")); err != nil && !os.IsNotExist(err) {
@@ -523,6 +600,22 @@ func TestHookWrightScopeBindsForgeCandidateManifestIdentity(t *testing.T) {
 	if code != 0 || strings.TrimSpace(out) != "" {
 		t.Fatalf("valid Forge candidate was denied: exit=%d stdout=%s stderr=%s", code, out, stderr)
 	}
+	genericEnv := append([]string{"DEVRITES_CODEX_GENERIC_AGENT_COMPAT=1"}, baseEnv[2:]...)
+	genericInput := `{"tool_name":"Edit","agent_id":"worker-a","agent_type":"worker","tool_input":{"file_path":"tracked.txt"}}`
+	out, stderr, code = runDevritesAt(t, repo, candidate.Worktree, genericInput, genericEnv,
+		"hook", "wright-scope", "--harness=codex")
+	if code != 0 || strings.TrimSpace(out) != "" {
+		t.Fatalf("valid generic Forge worker was denied: exit=%d stdout=%s stderr=%s", code, out, stderr)
+	}
+	out, _, code = runDevritesAt(t, repo, candidate.Worktree,
+		`{"tool_name":"Edit","agent_id":"worker-a","agent_type":"worker","tool_input":{"file_path":"outside.txt"}}`,
+		genericEnv, "hook", "wright-scope", "--harness=codex")
+	if code != 0 {
+		t.Fatalf("generic Forge worker hook exit=%d", code)
+	}
+	if decision, _ := parsePermissionDecision(t, out); decision != "deny" {
+		t.Fatalf("generic Forge worker escaped its allowlist: %s", out)
+	}
 
 	replaceEnv := func(name, value string) []string {
 		env := append([]string(nil), baseEnv...)

package/pack/.claude/skills/rite-doctor/SKILL.md

@@ -19,7 +19,7 @@ It is **read-only**: it never edits the workspace, never advances a phase, never
 ## Workflow
 1. Run the diagnose core verbosely (resolve across install layouts):
    ```bash
-   devrites-engine doctor --verbose; echo "doctor rc=$?"
+   devrites-engine doctor; echo "doctor rc=$?"
    ```
 1a. **Surface the learnings nudge**: point the user at `/rite-learn` when a pattern recurs across
    shipped features (read-only; silent when there's nothing to say):
@@ -68,7 +68,7 @@ progress`, but it follows the compact labels and one-next-action rule from
 ```
 Done: DevRites health checked; <OK | n issues>.
 Changed: workspace only
-Evidence: devrites-engine doctor --verbose rc=<0|1>; health <skipped|PASS|WARN|FAIL>; reindex <skipped|result>; learnings nudge <summary|none>; extensions/overrides <ok|n issues>
+Evidence: devrites-engine doctor rc=<0|1>; health <skipped|PASS|WARN|FAIL>; reindex <skipped|result>; learnings nudge <summary|none>; extensions/overrides <ok|n issues>
 Open: <none | issue count and top issue>
 Next: <single command for the most urgent issue>
 Record: not applicable

package/pack/.claude/skills/rite-upgrade/SKILL.md

@@ -42,7 +42,7 @@ Plan, Vet, Converge, and Build phase contracts needed by the assessment.
 
 0. **Orient and normalize structure.** Read the active slug or `$ARGUMENTS`. Run:
    ```bash
-   devrites-engine doctor --verbose; echo "doctor rc=$?"
+   devrites-engine doctor; echo "doctor rc=$?"
    ```
    A binary/pack integrity mismatch stops at `/rite-doctor`; do not run migration or
    mutate semantic artifacts. Once healthy, orient without writing:

package/pack/generated/claude/skills/rite-doctor/SKILL.md

@@ -19,7 +19,7 @@ It is **read-only**: it never edits the workspace, never advances a phase, never
 ## Workflow
 1. Run the diagnose core verbosely (resolve across install layouts):
    ```bash
-   devrites-engine doctor --verbose; echo "doctor rc=$?"
+   devrites-engine doctor; echo "doctor rc=$?"
    ```
 1a. **Surface the learnings nudge**: point the user at `/rite-learn` when a pattern recurs across
    shipped features (read-only; silent when there's nothing to say):
@@ -68,7 +68,7 @@ progress`, but it follows the compact labels and one-next-action rule from
 ```
 Done: DevRites health checked; <OK | n issues>.
 Changed: workspace only
-Evidence: devrites-engine doctor --verbose rc=<0|1>; health <skipped|PASS|WARN|FAIL>; reindex <skipped|result>; learnings nudge <summary|none>; extensions/overrides <ok|n issues>
+Evidence: devrites-engine doctor rc=<0|1>; health <skipped|PASS|WARN|FAIL>; reindex <skipped|result>; learnings nudge <summary|none>; extensions/overrides <ok|n issues>
 Open: <none | issue count and top issue>
 Next: <single command for the most urgent issue>
 Record: not applicable

package/pack/generated/claude/skills/rite-upgrade/SKILL.md

@@ -42,7 +42,7 @@ Plan, Vet, Converge, and Build phase contracts needed by the assessment.
 
 0. **Orient and normalize structure.** Read the active slug or `$ARGUMENTS`. Run:
    ```bash
-   devrites-engine doctor --verbose; echo "doctor rc=$?"
+   devrites-engine doctor; echo "doctor rc=$?"
    ```
    A binary/pack integrity mismatch stops at `/rite-doctor`; do not run migration or
    mutate semantic artifacts. Once healthy, orient without writing:

package/pack/generated/codex/AGENTS.md

@@ -13,9 +13,10 @@ This project has DevRites installed for both Claude Code and Codex.
 - Before using any DevRites workflow skill, read `.agents/skills/devrites-lib/reference/standards/core.md`. Load other `.agents/skills/devrites-lib/reference/standards/*.md` files when the skill or rule index asks for them. These are DevRites engineering standards, not Codex exec-policy `.rules` files.
 - Custom Codex subagents generated from the DevRites review agents live in `.codex/agents`.
 - In DevRites guidance, **invoke** means run a skill inline in the current context; **dispatch** means start a fresh agent with `spawn_agent`, wait for it, and reconcile its result.
-- For a DevRites dispatch, first use the named `devrites-<role>` custom role. If a read-only role is unavailable but `spawn_agent` still works, use generic `explorer` only when the host proves runtime-enforced read-only sandboxing; tell it to read `.codex/agents/devrites-<role>.toml` before executing the unchanged packet.
-- Do not use generic `worker` for the wright unless exact DevRites identity and `.wright-allowlist` enforcement are proven. Codex exposes that fallback as `agent_type=worker`, which the generated leaf hooks intentionally do not treat as a declared DevRites run. Reject the unsafe worker rung and use the documented labelled inline `.reconcile-inline` path with full reconciliation.
-- Other inline work is allowed only when no spawn primitive exists or higher-priority policy rejects a safe spawn; label it `independence: fallback`, never independent. A missing read-only custom role alone is not such a rejection, but an unconfined generic explorer is.
+- Inspect the current `spawn_agent` role list. Use an exposed named `devrites-<role>` with `fork_turns="none"`; full-history forks inherit the parent type.
+- If a named role is not exposed, use generic `explorer` for read-only work with `fork_turns="none"` and tell it to read `.codex/agents/devrites-<role>.toml`. Trusted `.codex/hooks.json` binds `agent_type=explorer` to the fail-closed reviewer guard.
+- For `devrites-slice-wright`, trusted `.codex/hooks.json` binds generic `worker` (`agent_type=worker`) to the active reconcile window and exact `.wright-allowlist`. Dispatch it with `fork_turns="none"`, the unchanged packet, and `.codex/agents/devrites-slice-wright.toml`.
+- A missing custom role is not evidence that spawning is unavailable. Use the labelled inline `.reconcile-inline` path only when project hooks are unavailable or untrusted, spawning is unavailable, or higher-priority policy rejects the safe rung.
 - Claude Code agent hook metadata is not active in Codex. The generated Codex agents preserve read-only intent with Codex sandbox settings where possible; still follow DevRites' scope and no-mutation rules explicitly.
 
 ## Workflow contract

package/pack/generated/codex/hooks.json

@@ -25,6 +25,21 @@
             "statusMessage": "DevRites: checking build write boundary"
           }
         ]
+      },
+      {
+        "matcher": "Bash|Shell|sh|exec_command|run_command|Edit|Write|MultiEdit|NotebookEdit|apply_patch|exec|js|python|computer|computer_use|write_stdin|run_code|Agent|Task|spawn_agent|delegate|dispatch_agent|create_agent",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "payload=\"$(cat)\"; if ! command -v devrites-engine >/dev/null 2>&1; then if printf '%s' \"$payload\" | grep -Eq '\"agent_type\"[[:space:]]*:[[:space:]]*\"(explorer|worker)\"'; then printf '%s\\n' 'DevRites: generic Codex leaf guard unavailable; install or repair devrites-engine. (devrites-codex-generic-guard)' >&2; exit 2; fi; exit 0; fi; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || { printf '%s\\n' 'DevRites: cannot resolve the project root for a generic Codex leaf. (devrites-codex-generic-guard)' >&2; exit 2; }; printf '%s' \"$payload\" | DEVRITES_CODEX_GENERIC_AGENT_COMPAT=1 devrites-engine hook reviewer-readonly --harness=codex; rc=$?; case \"$rc\" in 0) exit 0 ;; 2) exit 2 ;; *) printf '%s\\n' 'DevRites: generic Codex reviewer guard unavailable or crashed; install or repair devrites-engine. (devrites-codex-generic-guard)' >&2; exit 2 ;; esac",
+            "statusMessage": "DevRites: checking generic reviewer boundary"
+          },
+          {
+            "type": "command",
+            "command": "payload=\"$(cat)\"; if ! command -v devrites-engine >/dev/null 2>&1; then if printf '%s' \"$payload\" | grep -Eq '\"agent_type\"[[:space:]]*:[[:space:]]*\"(explorer|worker)\"'; then printf '%s\\n' 'DevRites: generic Codex leaf guard unavailable; install or repair devrites-engine. (devrites-codex-generic-guard)' >&2; exit 2; fi; exit 0; fi; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || { printf '%s\\n' 'DevRites: cannot resolve the project root for a generic Codex leaf. (devrites-codex-generic-guard)' >&2; exit 2; }; printf '%s' \"$payload\" | DEVRITES_CODEX_GENERIC_AGENT_COMPAT=1 devrites-engine hook wright-scope --harness=codex; rc=$?; case \"$rc\" in 0) exit 0 ;; 2) exit 2 ;; *) printf '%s\\n' 'DevRites: generic Codex wright guard unavailable or crashed; install or repair devrites-engine. (devrites-codex-generic-guard)' >&2; exit 2 ;; esac",
+            "statusMessage": "DevRites: checking generic wright boundary"
+          }
+        ]
       }
     ],
     "PostToolUse": [

package/pack/generated/codex/skills/devrites-api-interface/SKILL.md

@@ -11,10 +11,10 @@ This is the Codex mirror of a DevRites skill. In Codex:
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
 - **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- For every DevRites specialist or writer dispatch, first call `spawn_agent` with the named `devrites-<role>` custom role. The matching project contract is `.codex/agents/devrites-<role>.toml`.
-- If `spawn_agent` is callable but a named read-only role is unavailable, use generic `explorer` only when the host proves that run has a runtime-enforced read-only sandbox. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. A missing read-only custom role is not evidence that spawning is unavailable.
-- Never dispatch generic `worker` for `devrites-slice-wright` unless the host proves that worker run carries exact DevRites identity and the same `.wright-allowlist` enforcement as the named role. Codex reports a generic run as `agent_type=worker`, so the generated global hooks cannot prove that binding. Reject that unsafe rung and use the documented labelled inline wright path with `.reconcile-inline` plus the full reconcile gate.
-- If the host cannot prove the generic explorer is runtime read-only, reject that rung too. Only when no spawn primitive exists or a higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, and apply every fallback risk gate. An unbound generic wright or unconfined generic explorer is such a safety rejection, not evidence that no agents exist.
+- Inspect the current `spawn_agent` role list. When the named `devrites-<role>` is exposed, dispatch it with `fork_turns="none"`; full-history forks inherit the parent type. The matching project contract is `.codex/agents/devrites-<role>.toml`.
+- If a named role is not exposed, use generic `explorer` for every read-only role with `fork_turns="none"`. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. Trusted `.codex/hooks.json` binds `agent_type=explorer` to the fail-closed reviewer read-only guard.
+- For `devrites-slice-wright`, trusted `.codex/hooks.json` binds generic `worker` (`agent_type=worker`) to the active reconcile window and exact `.wright-allowlist`. Dispatch that worker with `fork_turns="none"`, tell it to read `.codex/agents/devrites-slice-wright.toml`, and execute the unchanged packet. Never create `.reconcile-inline` when this safe rung is available.
+- A missing custom role is not evidence that spawning is unavailable. Only when the project hooks are unavailable or untrusted, no spawn primitive exists, or higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, create `.reconcile-inline` only for that path, and apply every fallback risk gate.
 - Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
 - Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.

package/pack/generated/codex/skills/devrites-audit/SKILL.md

@@ -12,10 +12,10 @@ This is the Codex mirror of a DevRites skill. In Codex:
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
 - **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- For every DevRites specialist or writer dispatch, first call `spawn_agent` with the named `devrites-<role>` custom role. The matching project contract is `.codex/agents/devrites-<role>.toml`.
-- If `spawn_agent` is callable but a named read-only role is unavailable, use generic `explorer` only when the host proves that run has a runtime-enforced read-only sandbox. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. A missing read-only custom role is not evidence that spawning is unavailable.
-- Never dispatch generic `worker` for `devrites-slice-wright` unless the host proves that worker run carries exact DevRites identity and the same `.wright-allowlist` enforcement as the named role. Codex reports a generic run as `agent_type=worker`, so the generated global hooks cannot prove that binding. Reject that unsafe rung and use the documented labelled inline wright path with `.reconcile-inline` plus the full reconcile gate.
-- If the host cannot prove the generic explorer is runtime read-only, reject that rung too. Only when no spawn primitive exists or a higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, and apply every fallback risk gate. An unbound generic wright or unconfined generic explorer is such a safety rejection, not evidence that no agents exist.
+- Inspect the current `spawn_agent` role list. When the named `devrites-<role>` is exposed, dispatch it with `fork_turns="none"`; full-history forks inherit the parent type. The matching project contract is `.codex/agents/devrites-<role>.toml`.
+- If a named role is not exposed, use generic `explorer` for every read-only role with `fork_turns="none"`. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. Trusted `.codex/hooks.json` binds `agent_type=explorer` to the fail-closed reviewer read-only guard.
+- For `devrites-slice-wright`, trusted `.codex/hooks.json` binds generic `worker` (`agent_type=worker`) to the active reconcile window and exact `.wright-allowlist`. Dispatch that worker with `fork_turns="none"`, tell it to read `.codex/agents/devrites-slice-wright.toml`, and execute the unchanged packet. Never create `.reconcile-inline` when this safe rung is available.
+- A missing custom role is not evidence that spawning is unavailable. Only when the project hooks are unavailable or untrusted, no spawn primitive exists, or higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, create `.reconcile-inline` only for that path, and apply every fallback risk gate.
 - Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
 - Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.

package/pack/generated/codex/skills/devrites-browser-proof/SKILL.md

@@ -11,10 +11,10 @@ This is the Codex mirror of a DevRites skill. In Codex:
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
 - **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- For every DevRites specialist or writer dispatch, first call `spawn_agent` with the named `devrites-<role>` custom role. The matching project contract is `.codex/agents/devrites-<role>.toml`.
-- If `spawn_agent` is callable but a named read-only role is unavailable, use generic `explorer` only when the host proves that run has a runtime-enforced read-only sandbox. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. A missing read-only custom role is not evidence that spawning is unavailable.
-- Never dispatch generic `worker` for `devrites-slice-wright` unless the host proves that worker run carries exact DevRites identity and the same `.wright-allowlist` enforcement as the named role. Codex reports a generic run as `agent_type=worker`, so the generated global hooks cannot prove that binding. Reject that unsafe rung and use the documented labelled inline wright path with `.reconcile-inline` plus the full reconcile gate.
-- If the host cannot prove the generic explorer is runtime read-only, reject that rung too. Only when no spawn primitive exists or a higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, and apply every fallback risk gate. An unbound generic wright or unconfined generic explorer is such a safety rejection, not evidence that no agents exist.
+- Inspect the current `spawn_agent` role list. When the named `devrites-<role>` is exposed, dispatch it with `fork_turns="none"`; full-history forks inherit the parent type. The matching project contract is `.codex/agents/devrites-<role>.toml`.
+- If a named role is not exposed, use generic `explorer` for every read-only role with `fork_turns="none"`. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. Trusted `.codex/hooks.json` binds `agent_type=explorer` to the fail-closed reviewer read-only guard.
+- For `devrites-slice-wright`, trusted `.codex/hooks.json` binds generic `worker` (`agent_type=worker`) to the active reconcile window and exact `.wright-allowlist`. Dispatch that worker with `fork_turns="none"`, tell it to read `.codex/agents/devrites-slice-wright.toml`, and execute the unchanged packet. Never create `.reconcile-inline` when this safe rung is available.
+- A missing custom role is not evidence that spawning is unavailable. Only when the project hooks are unavailable or untrusted, no spawn primitive exists, or higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, create `.reconcile-inline` only for that path, and apply every fallback risk gate.
 - Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
 - Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.