devrites 3.2.10 → 3.2.11

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [3.2.11](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.10...v3.2.11) (2026-07-26)
+
+### Fixed
+
+* **devrites:** bind canonical state at wright start ([b58a531](https://github.com/ViktorsBaikers/DevRites/commit/b58a531749b94f734b7abf7469656ad543a0cfa0))
+
 ## [3.2.10](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.9...v3.2.10) (2026-07-26)
 
 ### Fixed

package/README.md

@@ -25,7 +25,7 @@ final commit, push, and tag, and it requires a typed `GO` confirmation.
 Unattended runs may create local WIP checkpoint commits along the way, but only
 Ship collapses and pushes them.
 
-**Status:** [`v3.2.10`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.2.10): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v3.2.11`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.2.11): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 ## Quick start
 

package/docs/orchestration.md

@@ -62,11 +62,16 @@ Each dispatch follows the retained-baseline sequence:
 
 1. `reconcile snapshot` captures the original dirty-tree baseline, private Git
    objects, exact allowlist, and canonical-state fingerprint.
-2. The sole wright returns code/tests; the root validates its typed identity and
+2. The confirmed wright start captures a second canonical-state fingerprint.
+   This preserves the original source baseline while separating root-owned
+   recovery records that predate the writer from canonical mutations made while
+   the writer is active.
+3. The sole wright returns code/tests; the root validates its typed identity and
    exact changed-file set.
-3. `reconcile check` rejects anything outside the root allowlist.
-4. `test-integrity` runs against the retained baseline.
-5. After proof and decision checks pass, `reconcile close` retires the private
+4. `reconcile check` rejects anything outside the root allowlist and any
+   canonical-state change after the wright start.
+5. `test-integrity` runs against the retained baseline.
+6. After proof and decision checks pass, `reconcile close` retires the private
    window; only then does the root write canonical records.
 
 An ordinary `reconcile check` may revalidate an existing retained window

package/engine/hooks.go

@@ -546,6 +546,7 @@ func hookSubagentOrient(h harness.Harness, stdin io.Reader, stdout, stderr io.Wr
 	}
 	agentType := h.SubagentAgentType(bytes.NewReader(data))
 	context := strings.ReplaceAll(subagentOrientContext, "\r\n", "\n")
+	confirmedRole := ""
 	if h == harness.Codex {
 		in, parseErr := parseAgentDispatchHookInput(bytes.NewReader(data))
 		root, ok := agentDispatchRoot()
@@ -559,6 +560,7 @@ func hookSubagentOrient(h harness.Harness, stdin io.Reader, stdout, stderr io.Wr
 			if bindErr != nil {
 				context += "\n\n- **Dispatch binding failed.** Return blocked without doing specialist work; the parent must repair the agent-start receipt."
 			} else if bound {
+				confirmedRole = role
 				if in.AgentType == role {
 					context += fmt.Sprintf(
 						"\n\n- **Confirmed role.** Your named Codex profile is `%s`; follow its loaded `developer_instructions` and execute only the unchanged packet from the parent.",
@@ -578,6 +580,17 @@ func hookSubagentOrient(h harness.Harness, stdin io.Reader, stdout, stderr io.Wr
 		}
 	} else if !strings.HasPrefix(agentType, "devrites-") {
 		return exitOK // Stay silent without a DevRites agent identity.
+	} else {
+		confirmedRole = agentType
+	}
+	if confirmedRole == "devrites-slice-wright" {
+		root, slug, _, ok := resolveWorkspace()
+		if !ok {
+			context += "\n\n- **Wright boundary unavailable.** Return blocked without writing; the parent must restore the active reconcile window."
+		} else if err := lib.CaptureReconcileWrightBoundary(root, slug); err != nil {
+			debugf(stderr, "subagent-orient wright boundary: %v", err)
+			context += "\n\n- **Wright boundary unavailable.** Return blocked without writing; the parent must repair the retained reconcile window."
+		}
 	}
 	out, err := h.SubagentStartContext(context)
 	if err != nil {

package/engine/hooks_agent_dispatch.go

@@ -400,6 +400,8 @@ func currentReconcileWindowID() string {
 	if !ok {
 		return ""
 	}
+	// The wright-start canonical fingerprint is captured after the pending
+	// receipt. It narrows the delta but does not change source authorization.
 	names := []string{".reconcile-base", ".reconcile-allowlist", ".reconcile-devrites"}
 	h := sha256.New()
 	for _, name := range names {

package/engine/internal/lib/reconcile.go

@@ -23,6 +23,7 @@ const (
 	reconcileCheckedName        = ".reconcile-checked"
 	reconcileDevritesName       = ".reconcile-devrites"
 	reconcileObjectsName        = ".reconcile-objects"
+	reconcileWrightStateName    = ".reconcile-wright-devrites"
 	defaultWrightAllowlistName  = ".wright-allowlist"
 	wrightAllowlistFileEnv      = "DEVRITES_WRIGHT_ALLOWLIST_FILE"
 	reconcileDevritesPathPrefix = ".devrites/"
@@ -30,9 +31,11 @@ const (
 
 // Reconcile enforces the source-write boundary around one dispatched
 // slice-wright. The first `snapshot` captures the dirty worktree, private object
-// database, exact orchestrator-authored allowlist, and .devrites state. After a
-// clean check, another snapshot re-arms only the dispatch state for a retry while
-// retaining the original source baseline.
+// database, exact orchestrator-authored allowlist, and .devrites state. A
+// confirmed wright start captures the current canonical state separately, so
+// retained-window recovery records are not attributed to the writer. After a
+// clean check, another snapshot re-arms only the dispatch state for a retry
+// while retaining the original source baseline.
 // `check` compares the captured state with the current state and retains the
 // immutable baseline for the later test-integrity gate.
 // `close` explicitly ends the window and removes its private artifacts.
@@ -62,10 +65,11 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 	devritesSnapshot := filepath.Join(d, reconcileDevritesName)
 	objects := filepath.Join(d, reconcileObjectsName)
 	checked := filepath.Join(d, reconcileCheckedName)
+	wrightState := filepath.Join(d, reconcileWrightStateName)
 
 	closeWindow := func() error {
 		var failures []string
-		for _, privateFile := range []string{base, capturedAllowlist, devritesSnapshot, checked} {
+		for _, privateFile := range []string{base, capturedAllowlist, devritesSnapshot, checked, wrightState} {
 			if err := os.Remove(privateFile); err != nil && !os.IsNotExist(err) {
 				failures = append(failures, fmt.Sprintf("%s: %v", filepath.Base(privateFile), err))
 			}
@@ -131,7 +135,7 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 				fmt.Fprintf(stderr, "reconcile: cannot refresh wright allowlist: %v\n", err)
 				return 6
 			}
-			state, err := captureReconcileDevritesState(root, devritesSnapshot, activeObjects, checked)
+			state, err := captureReconcileDevritesState(root, devritesSnapshot, activeObjects, checked, wrightState)
 			if err != nil {
 				fmt.Fprintf(stderr, "reconcile: cannot refresh .devrites snapshot: %v\n", err)
 				return 6
@@ -140,9 +144,11 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 				fmt.Fprintf(stderr, "reconcile: cannot write refreshed .devrites snapshot: %v\n", err)
 				return 6
 			}
-			if err := os.Remove(checked); err != nil {
-				fmt.Fprintf(stderr, "reconcile: cannot arm refreshed slice window: %v\n", err)
-				return 6
+			for _, privateFile := range []string{checked, wrightState} {
+				if err := os.Remove(privateFile); err != nil && !os.IsNotExist(err) {
+					fmt.Fprintf(stderr, "reconcile: cannot arm refreshed slice window: %v\n", err)
+					return 6
+				}
 			}
 			fmt.Fprintf(stdout, "reconcile: dispatch snapshot refreshed for %s; original slice baseline retained.\n", slug)
 			return 0
@@ -180,7 +186,7 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 			fmt.Fprintf(stderr, "reconcile: cannot capture wright allowlist: %v\n", err)
 			return 6
 		}
-		state, err := captureReconcileDevritesState(root, devritesSnapshot, objects, checked)
+		state, err := captureReconcileDevritesState(root, devritesSnapshot, objects, checked, wrightState)
 		if err != nil {
 			_ = closeWindow()
 			fmt.Fprintf(stderr, "reconcile: cannot snapshot .devrites: %v\n", err)
@@ -210,13 +216,20 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 			fmt.Fprintf(stderr, "reconcile: invalid captured allowlist: %v\n", err)
 			return 6
 		}
-		beforeDevrites, err := readDevritesState(devritesSnapshot)
+		beforeDevritesPath := devritesSnapshot
+		if _, err := os.Lstat(wrightState); err == nil {
+			beforeDevritesPath = wrightState
+		} else if !os.IsNotExist(err) {
+			fmt.Fprintf(stderr, "reconcile: invalid wright-start .devrites snapshot: %v\n", err)
+			return 6
+		}
+		beforeDevrites, err := readDevritesState(beforeDevritesPath)
 		if err != nil {
 			fmt.Fprintf(stderr, "reconcile: invalid .devrites snapshot: %v\n", err)
 			return 6
 		}
 		beforeDevrites = withoutRootOwnedOperationalState(beforeDevrites)
-		afterDevrites, err := captureReconcileDevritesState(root, devritesSnapshot, objects, checked)
+		afterDevrites, err := captureReconcileDevritesState(root, devritesSnapshot, objects, checked, wrightState)
 		if err != nil {
 			fmt.Fprintf(stderr, "reconcile: cannot compare .devrites: %v\n", err)
 			return 6
@@ -274,6 +287,50 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 	}
 }
 
+// CaptureReconcileWrightBoundary records canonical state at the confirmed
+// wright start. The original source baseline remains untouched; reconciliation
+// can therefore distinguish root recovery records that predate the writer from
+// canonical mutations made while the writer is active.
+func CaptureReconcileWrightBoundary(root, slug string) error {
+	d := featureDir(root, slug)
+	if slug == "" || !isDir(d) {
+		return fmt.Errorf("no active workspace")
+	}
+	base := filepath.Join(d, reconcileBaseName)
+	capturedAllowlist := filepath.Join(d, reconcileAllowlistName)
+	devritesSnapshot := filepath.Join(d, reconcileDevritesName)
+	objects := filepath.Join(d, reconcileObjectsName)
+	checked := filepath.Join(d, reconcileCheckedName)
+	wrightState := filepath.Join(d, reconcileWrightStateName)
+
+	for _, filename := range []string{base, capturedAllowlist} {
+		info, err := os.Lstat(filename)
+		if err != nil || !info.Mode().IsRegular() {
+			if err == nil {
+				err = fmt.Errorf("not a regular file")
+			}
+			return fmt.Errorf("invalid reconcile window %s: %w", filepath.Base(filename), err)
+		}
+	}
+	if !isDir(objects) {
+		return fmt.Errorf("invalid reconcile window %s: not a directory", filepath.Base(objects))
+	}
+	if _, err := readDevritesState(devritesSnapshot); err != nil {
+		return fmt.Errorf("invalid reconcile window %s: %w", filepath.Base(devritesSnapshot), err)
+	}
+	state, err := captureReconcileDevritesState(
+		root,
+		devritesSnapshot,
+		objects,
+		checked,
+		wrightState,
+	)
+	if err != nil {
+		return err
+	}
+	return writeDevritesState(wrightState, state)
+}
+
 func wrightAllowlistPath(gitRoot, workspace string) (string, error) {
 	configured := os.Getenv(wrightAllowlistFileEnv)
 	var filename string

package/engine/internal/lib/reconcile_test.go

@@ -361,6 +361,49 @@ func TestReconcileRejectsDevritesMutation(t *testing.T) {
 	}
 }
 
+func TestReconcileUsesWrightStartAsCanonicalStateBoundary(t *testing.T) {
+	gitRoot := newGitRepo(t)
+	root := workspace(t, "feat")
+	dir := featureDir(root, "feat")
+	writeWrightAllowlist(t, root, "feat", "seed.go")
+	if code, out := runReconcile(t, root, "snapshot", "feat"); code != 0 {
+		t.Fatalf("snapshot = %d, want 0\n%s", code, out)
+	}
+
+	// Root-owned canonical records may legitimately change while a retained
+	// source baseline survives technical recovery. The next wright start is the
+	// boundary that separates those changes from the writer's delta.
+	for _, name := range []string{
+		"action.log",
+		"browser-evidence.md",
+		"decisions.md",
+		"evidence.md",
+		"footprint.log",
+		"state.md",
+		"touched-files.md",
+	} {
+		writeFile(t, filepath.Join(dir, name), "Root-owned recovery record\n")
+	}
+	if err := CaptureReconcileWrightBoundary(root, "feat"); err != nil {
+		t.Fatalf("capture wright boundary: %v", err)
+	}
+	writeFile(t, filepath.Join(gitRoot, "seed.go"), "package main\n\nfunc repaired() {}\n")
+
+	if code, out := runReconcile(t, root, "check", "feat"); code != 0 {
+		t.Fatalf("check = %d, want 0\n%s", code, out)
+	}
+
+	// A canonical mutation after the wright starts is still a violation.
+	writeFile(t, filepath.Join(dir, "state.md"), "Phase: prove\n")
+	code, out := runReconcile(t, root, "check", "feat")
+	if code != 5 {
+		t.Fatalf("check after writer-time canonical mutation = %d, want 5\n%s", code, out)
+	}
+	if !strings.Contains(out, ".devrites/work/feat/state.md") {
+		t.Fatalf("writer-time canonical mutation missing from output:\n%s", out)
+	}
+}
+
 func TestReconcileAllowsRootOwnedOperationalFiles(t *testing.T) {
 	newGitRepo(t)
 	root := workspace(t, "feat")
@@ -613,6 +656,7 @@ func TestReconcileRefreshPreservesOriginalBaselineAcrossRetry(t *testing.T) {
 	// between attempts. Refresh must re-arm those boundaries without replacing
 	// the original pre-slice source baseline.
 	writeFile(t, filepath.Join(featureDir(root, "feat"), "recovery-attempts.json"), "{}\n")
+	writeFile(t, filepath.Join(featureDir(root, "feat"), reconcileWrightStateName), "stale\n")
 	writeWrightAllowlist(t, root, "feat", "seed.go", "retry.go")
 	if code, out := runReconcile(t, root, "snapshot", "feat"); code != 0 {
 		t.Fatalf("refresh snapshot = %d, want 0\n%s", code, out)
@@ -626,6 +670,9 @@ func TestReconcileRefreshPreservesOriginalBaselineAcrossRetry(t *testing.T) {
 	if !bytes.Equal(originalBase, refreshedBase) {
 		t.Fatalf("refresh replaced original baseline: before=%q after=%q", originalBase, refreshedBase)
 	}
+	if isFile(filepath.Join(featureDir(root, "feat"), reconcileWrightStateName)) {
+		t.Fatal("refresh retained the prior wright-start boundary")
+	}
 
 	writeFile(t, filepath.Join(gitRoot, "retry.go"), "package main\n")
 	if code, out := runReconcile(t, root, "check", "feat"); code != 0 {
@@ -655,6 +702,7 @@ func TestReconcileCloseClearsPrivateWindowState(t *testing.T) {
 	newGitRepo(t)
 	root := workspace(t, "feat")
 	writeFile(t, filepath.Join(root, "work", "feat", reconcileBaseName), "stale\n")
+	writeFile(t, filepath.Join(root, "work", "feat", reconcileWrightStateName), "stale\n")
 	if err := os.MkdirAll(filepath.Join(root, "work", "feat", reconcileObjectsName), 0o755); err != nil {
 		t.Fatal(err)
 	}
@@ -666,7 +714,9 @@ func TestReconcileCloseClearsPrivateWindowState(t *testing.T) {
 	if !strings.Contains(out, "closed slice window") {
 		t.Errorf("expected close message:\n%s", out)
 	}
-	if isFile(filepath.Join(featureDir(root, "feat"), reconcileBaseName)) || isDir(filepath.Join(featureDir(root, "feat"), reconcileObjectsName)) {
+	if isFile(filepath.Join(featureDir(root, "feat"), reconcileBaseName)) ||
+		isFile(filepath.Join(featureDir(root, "feat"), reconcileWrightStateName)) ||
+		isDir(filepath.Join(featureDir(root, "feat"), reconcileObjectsName)) {
 		t.Fatal("close retained private baseline state")
 	}
 }

package/engine/tests/hook_test.go

@@ -926,6 +926,44 @@ func TestHookSubagentOrientSilentForNonDevritesAgent(t *testing.T) {
 	}
 }
 
+func TestHookSubagentOrientCapturesWrightCanonicalBoundary(t *testing.T) {
+	root := newWorkspace(t)
+	writeActive(t, root, "auth-tokens")
+	workspace := filepath.Join(root, "features", "auth-tokens")
+	if err := os.MkdirAll(filepath.Join(workspace, ".reconcile-objects"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	for name, body := range map[string]string{
+		".reconcile-base":      "base\n",
+		".reconcile-allowlist": "",
+		".reconcile-devrites":  "[]\n",
+		"state.md":             "Phase: build\n",
+		"browser-evidence.md":  "Prior root evidence\n",
+	} {
+		if err := os.WriteFile(filepath.Join(workspace, name), []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	in := `{"agent_type":"devrites-slice-wright"}`
+	out, errOut, code := runDevritesIO(t, root, in, nil, "hook", "subagent-orient", "--harness=claude")
+	if code != 0 {
+		t.Fatalf("exit = %d, want 0 (stderr: %s)", code, errOut)
+	}
+	if strings.Contains(out, "Wright boundary unavailable") {
+		t.Fatalf("wright start was blocked: %s", out)
+	}
+	raw, err := os.ReadFile(filepath.Join(workspace, ".reconcile-wright-devrites"))
+	if err != nil {
+		t.Fatalf("read wright boundary: %v", err)
+	}
+	for _, path := range []string{"features/auth-tokens/state.md", "features/auth-tokens/browser-evidence.md"} {
+		if !strings.Contains(string(raw), path) {
+			t.Errorf("wright boundary omitted %s: %s", path, raw)
+		}
+	}
+}
+
 func hookPayload(t *testing.T, value map[string]any) string {
 	t.Helper()
 	raw, err := json.Marshal(value)
@@ -1759,11 +1797,18 @@ func TestCodexAgentDispatchGatesReconcileCloseOnBoundWrightResult(t *testing.T)
 	root := newWorkspace(t)
 	writeActive(t, root, "auth-tokens")
 	workspace := filepath.Join(root, "features", "auth-tokens")
-	for _, name := range []string{".reconcile-base", ".reconcile-allowlist", ".reconcile-devrites"} {
-		if err := os.WriteFile(filepath.Join(workspace, name), []byte(name+"\n"), 0o600); err != nil {
+	for name, body := range map[string]string{
+		".reconcile-base":      ".reconcile-base\n",
+		".reconcile-allowlist": ".reconcile-allowlist\n",
+		".reconcile-devrites":  "[]\n",
+	} {
+		if err := os.WriteFile(filepath.Join(workspace, name), []byte(body), 0o600); err != nil {
 			t.Fatal(err)
 		}
 	}
+	if err := os.MkdirAll(filepath.Join(workspace, ".reconcile-objects"), 0o700); err != nil {
+		t.Fatal(err)
+	}
 	sessionID, turnID := "session-wright", "turn-wright"
 	writeCodexAgentContract(t, root, "devrites-slice-wright")
 	writeCodexSkillContract(t, root, "rite-build", "devrites-slice-wright")
@@ -1808,7 +1853,7 @@ func TestCodexAgentDispatchGatesReconcileCloseOnBoundWrightResult(t *testing.T)
 			"tool_name":       "spawn_agent",
 			"tool_use_id":     "spawn-wright",
 			"tool_input": map[string]any{
-				"agent_type": "worker",
+				"agent_type": "devrites-slice-wright",
 				"fork_turns": "none",
 				"message":    "Read .codex/agents/devrites-slice-wright.toml.",
 			},
@@ -1818,14 +1863,14 @@ func TestCodexAgentDispatchGatesReconcileCloseOnBoundWrightResult(t *testing.T)
 			"session_id":      sessionID,
 			"turn_id":         "child-wright",
 			"agent_id":        "agent-wright",
-			"agent_type":      "worker",
+			"agent_type":      "devrites-slice-wright",
 		},
 		{
 			"hook_event_name":        "SubagentStop",
 			"session_id":             sessionID,
 			"turn_id":                "child-wright",
 			"agent_id":               "agent-wright",
-			"agent_type":             "worker",
+			"agent_type":             "devrites-slice-wright",
 			"last_assistant_message": "agent-result/v1 complete",
 		},
 		{
@@ -1845,6 +1890,9 @@ func TestCodexAgentDispatchGatesReconcileCloseOnBoundWrightResult(t *testing.T)
 			t.Fatalf("%s exit=%d stderr=%s", hook, code, stderr)
 		}
 	}
+	if _, err := os.Stat(filepath.Join(workspace, ".reconcile-wright-devrites")); err != nil {
+		t.Fatalf("wright start did not capture canonical boundary: %v", err)
+	}
 
 	if out, stderr, code := runDevritesIO(t, root, closeWindow, nil,
 		"hook", "agent-dispatch", "--harness=codex"); code != 0 || strings.TrimSpace(out) != "" {

package/pack/.claude/skills/rite-build/reference/wright-dispatch.md

@@ -120,10 +120,12 @@ resume the same slice. Close it before abandoning the slice for a scope/plan tra
 
 ## Host dispatch
 
-Use named wright → enforced V1 generic worker from `standards/agents.md`. On Codex
-MultiAgent V2, dispatch the exact named `devrites-slice-wright` with a unique
-`task_name` and `fork_turns="none"`; its durable child rollout must prove the native
-wright role, wait, completion, and non-empty result from the current reconcile window.
+Use named wright → enforced V1 generic worker from `standards/agents.md`. Codex V2
+dispatches the exact named `devrites-slice-wright` with a unique `task_name` and
+`fork_turns="none"`; its durable rollout proves the native role, wait, and non-empty
+result in the current window. The confirmed start fingerprints canonical state apart
+from the retained source baseline: pre-start root recovery records are excluded, while
+post-start canonical changes fail.
 Any generic worker still needs the exact allowlist or an isolated checkout;
 reconciliation alone is insufficient. If no safe fresh-agent rung is available, stop
 for HITL. On Codex, `reconcile check` and `reconcile close` require the completed

package/pack/generated/claude/skills/rite-build/reference/wright-dispatch.md

@@ -120,10 +120,12 @@ resume the same slice. Close it before abandoning the slice for a scope/plan tra
 
 ## Host dispatch
 
-Use named wright → enforced V1 generic worker from `standards/agents.md`. On Codex
-MultiAgent V2, dispatch the exact named `devrites-slice-wright` with a unique
-`task_name` and `fork_turns="none"`; its durable child rollout must prove the native
-wright role, wait, completion, and non-empty result from the current reconcile window.
+Use named wright → enforced V1 generic worker from `standards/agents.md`. Codex V2
+dispatches the exact named `devrites-slice-wright` with a unique `task_name` and
+`fork_turns="none"`; its durable rollout proves the native role, wait, and non-empty
+result in the current window. The confirmed start fingerprints canonical state apart
+from the retained source baseline: pre-start root recovery records are excluded, while
+post-start canonical changes fail.
 Any generic worker still needs the exact allowlist or an isolated checkout;
 reconciliation alone is insufficient. If no safe fresh-agent rung is available, stop
 for HITL. On Codex, `reconcile check` and `reconcile close` require the completed

package/pack/generated/codex/skills/rite-build/reference/wright-dispatch.md

@@ -120,10 +120,12 @@ resume the same slice. Close it before abandoning the slice for a scope/plan tra
 
 ## Host dispatch
 
-Use named wright → enforced V1 generic worker from `standards/agents.md`. On Codex
-MultiAgent V2, dispatch the exact named `devrites-slice-wright` with a unique
-`task_name` and `fork_turns="none"`; its durable child rollout must prove the native
-wright role, wait, completion, and non-empty result from the current reconcile window.
+Use named wright → enforced V1 generic worker from `standards/agents.md`. Codex V2
+dispatches the exact named `devrites-slice-wright` with a unique `task_name` and
+`fork_turns="none"`; its durable rollout proves the native role, wait, and non-empty
+result in the current window. The confirmed start fingerprints canonical state apart
+from the retained source baseline: pre-start root recovery records are excluded, while
+post-start canonical changes fail.
 Any generic worker still needs the exact allowlist or an isolated checkout;
 reconciliation alone is insufficient. If no safe fresh-agent rung is available, stop
 for HITL. On Codex, `reconcile check` and `reconcile close` require the completed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "3.2.10",
+  "version": "3.2.11",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",