devrites 3.2.11 → 3.2.13

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [3.2.13](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.12...v3.2.13) (2026-07-26)
+
+### Fixed
+
+* **agents:** retain canonical boundary before spawn ([b290aa9](https://github.com/ViktorsBaikers/DevRites/commit/b290aa97851915afcddd85ff43855fc8e07b6860))
+
+## [3.2.12](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.11...v3.2.12) (2026-07-26)
+
+### Fixed
+
+* **agents:** capture wright boundary before spawn ([4eb95f3](https://github.com/ViktorsBaikers/DevRites/commit/4eb95f3f75c150b9c535972db6d84fadf97f1a87))
+
 ## [3.2.11](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.10...v3.2.11) (2026-07-26)
 
 ### Fixed

package/README.md

@@ -25,7 +25,7 @@ final commit, push, and tag, and it requires a typed `GO` confirmation.
 Unattended runs may create local WIP checkpoint commits along the way, but only
 Ship collapses and pushes them.
 
-**Status:** [`v3.2.11`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.2.11): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v3.2.13`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.2.13): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 ## Quick start
 

package/engine/hooks_agent_dispatch.go

@@ -17,6 +17,7 @@ import (
 	"time"
 
 	"github.com/devrites/devrites/internal/harness"
+	"github.com/devrites/devrites/internal/lib"
 	"github.com/devrites/devrites/internal/orient"
 	"github.com/devrites/devrites/internal/safepath"
 )
@@ -400,8 +401,9 @@ func currentReconcileWindowID() string {
 	if !ok {
 		return ""
 	}
-	// The wright-start canonical fingerprint is captured after the pending
-	// receipt. It narrows the delta but does not change source authorization.
+	// The wright-start canonical fingerprint is captured by the spawn hook
+	// before the child starts. It narrows the delta but does not change source
+	// authorization.
 	names := []string{".reconcile-base", ".reconcile-allowlist", ".reconcile-devrites"}
 	h := sha256.New()
 	for _, name := range names {
@@ -895,6 +897,41 @@ func stopDispatchFailure(reason string, stdout, stderr io.Writer) int {
 	return exitOK
 }
 
+func refreshPendingWrightBoundary(
+	root string,
+	in agentDispatchHookInput,
+	armed map[string]struct{},
+	attempts []*agentDispatchAttempt,
+) error {
+	if in.AgentID != "" || in.AgentType != "" || currentReconcileWindowID() == "" {
+		return nil
+	}
+	_, wrightRequired := armed["devrites-slice-wright"]
+	_, conditional := armed[agentDispatchSkillGuard]
+	if !wrightRequired && !conditional {
+		return nil
+	}
+	for _, attempt := range attempts {
+		if attempt.Role == "devrites-slice-wright" {
+			return nil
+		}
+	}
+	durable, err := durableCodexV2DispatchAttempts(root, in.SessionID, in.TurnID, armed)
+	if err != nil {
+		return err
+	}
+	for _, attempt := range durable {
+		if attempt.Role == "devrites-slice-wright" {
+			return nil
+		}
+	}
+	workspaceRoot, slug, _, ok := resolveWorkspace()
+	if !ok || !sameResolvedPath(workspaceRoot, root) {
+		return fmt.Errorf("active reconcile window is unavailable")
+	}
+	return lib.CaptureReconcileWrightBoundary(root, slug)
+}
+
 func hookAgentDispatch(h harness.Harness, stdin io.Reader, stdout, stderr io.Writer) int {
 	if h != harness.Codex {
 		_, _ = io.Copy(io.Discard, stdin)
@@ -940,6 +977,13 @@ func hookAgentDispatch(h harness.Harness, stdin io.Reader, stdout, stderr io.Wri
 				return stopDispatchBlock(h, "DevRites could not arm the required agent dispatch: "+err.Error(), stdout, stderr)
 			}
 		}
+		events, stateErr := readAgentDispatchEvents(root, in.SessionID)
+		if stateErr == nil {
+			armed, attempts := dispatchTurnState(events, in.TurnID)
+			if err := refreshPendingWrightBoundary(root, in, armed, attempts); err != nil {
+				debugf(stderr, "agent-dispatch pending wright boundary: %v", err)
+			}
+		}
 		if len(roles) > 0 {
 			instructions := make([]string, 0, len(roles))
 			for _, role := range roles {
@@ -962,6 +1006,18 @@ func hookAgentDispatch(h harness.Harness, stdin io.Reader, stdout, stderr io.Wri
 	case "PreToolUse":
 		return hookAgentDispatchPreTool(h, root, in, stdout, stderr)
 
+	case "PostToolUse":
+		events, err := readAgentDispatchEvents(root, in.SessionID)
+		if err != nil {
+			debugf(stderr, "agent-dispatch post-tool state: %v", err)
+			return exitOK
+		}
+		armed, attempts := dispatchTurnState(events, in.TurnID)
+		if err := refreshPendingWrightBoundary(root, in, armed, attempts); err != nil {
+			debugf(stderr, "agent-dispatch post-tool wright boundary: %v", err)
+		}
+		return exitOK
+
 	case "SubagentStop":
 		if in.AgentID == "" {
 			return exitOK
@@ -1088,6 +1144,15 @@ func hookAgentDispatchPreTool(h harness.Harness, root string, in agentDispatchHo
 		if role == "devrites-slice-wright" && windowID == "" {
 			return preToolDeny(h, "devrites-slice-wright requires an active reconcile snapshot before spawn_agent.", stdout, stderr)
 		}
+		if role == "devrites-slice-wright" {
+			workspaceRoot, slug, _, ok := resolveWorkspace()
+			if !ok || !sameResolvedPath(workspaceRoot, root) {
+				return preToolDeny(h, "DevRites could not resolve the active wright reconcile window before spawn_agent.", stdout, stderr)
+			}
+			if err := lib.CaptureReconcileWrightBoundary(root, slug); err != nil {
+				return preToolDeny(h, "DevRites could not capture the wright canonical boundary before spawn_agent: "+err.Error(), stdout, stderr)
+			}
+		}
 		if err := appendAgentDispatchEvent(root, in.SessionID, agentDispatchEvent{
 			Event:     "pending",
 			TurnID:    in.TurnID,

package/engine/tests/hook_test.go

@@ -5,6 +5,7 @@ package main_test
 // check stdout and exit status. parity_test.go owns the parity oracle.
 
 import (
+	"bytes"
 	"encoding/json"
 	"os"
 	"path/filepath"
@@ -1900,6 +1901,174 @@ func TestCodexAgentDispatchGatesReconcileCloseOnBoundWrightResult(t *testing.T)
 	}
 }
 
+func TestCodexAgentDispatchCapturesWrightBoundaryBeforeSpawn(t *testing.T) {
+	root := newWorkspace(t)
+	writeActive(t, root, "auth-tokens")
+	workspace := filepath.Join(root, "features", "auth-tokens")
+	for name, body := range map[string]string{
+		".reconcile-base":      ".reconcile-base\n",
+		".reconcile-allowlist": ".reconcile-allowlist\n",
+		".reconcile-devrites":  "[]\n",
+		"action.log":           "Prior root action\n",
+		"browser-evidence.md":  "Prior root evidence\n",
+		"decisions.md":         "Prior root decision\n",
+		"evidence.md":          "Prior root evidence\n",
+		"footprint.log":        "Prior root footprint\n",
+		"state.md":             "Phase: build\n",
+		"touched-files.md":     "Prior root manifest\n",
+	} {
+		if err := os.WriteFile(filepath.Join(workspace, name), []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := os.MkdirAll(filepath.Join(workspace, ".reconcile-objects"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+
+	sessionID, turnID := "session-wright-spawn", "turn-wright-spawn"
+	writeCodexAgentContract(t, root, "devrites-slice-wright")
+	writeCodexSkillContract(t, root, "rite-build", "devrites-slice-wright")
+	runDevritesIO(t, root, hookPayload(t, map[string]any{
+		"hook_event_name": "UserPromptSubmit",
+		"session_id":      sessionID,
+		"turn_id":         turnID,
+		"prompt":          "$rite-build",
+	}), nil, "hook", "agent-dispatch", "--harness=codex")
+
+	spawn := hookPayload(t, map[string]any{
+		"hook_event_name": "PreToolUse",
+		"session_id":      sessionID,
+		"turn_id":         turnID,
+		"tool_name":       "spawn_agent",
+		"tool_use_id":     "spawn-wright",
+		"tool_input": map[string]any{
+			"agent_type": "devrites-slice-wright",
+			"fork_turns": "none",
+			"message":    "Read .codex/agents/devrites-slice-wright.toml.",
+		},
+	})
+	if out, stderr, code := runDevritesIO(t, root, spawn, nil,
+		"hook", "agent-dispatch", "--harness=codex"); code != 0 || strings.TrimSpace(out) != "" {
+		t.Fatalf("spawn exit=%d out=%s stderr=%s", code, out, stderr)
+	}
+
+	raw, err := os.ReadFile(filepath.Join(workspace, ".reconcile-wright-devrites"))
+	if err != nil {
+		t.Fatalf("read wright boundary: %v", err)
+	}
+	for _, path := range []string{
+		"features/auth-tokens/action.log",
+		"features/auth-tokens/browser-evidence.md",
+		"features/auth-tokens/decisions.md",
+		"features/auth-tokens/evidence.md",
+		"features/auth-tokens/footprint.log",
+		"features/auth-tokens/state.md",
+		"features/auth-tokens/touched-files.md",
+	} {
+		if !strings.Contains(string(raw), path) {
+			t.Errorf("wright boundary omitted %s: %s", path, raw)
+		}
+	}
+}
+
+func TestCodexAgentDispatchRefreshesWrightBoundaryUntilDurableSpawn(t *testing.T) {
+	root := newWorkspace(t)
+	codeHome := t.TempDir()
+	writeActive(t, root, "auth-tokens")
+	workspace := filepath.Join(root, "features", "auth-tokens")
+	for name, body := range map[string]string{
+		".reconcile-base":      ".reconcile-base\n",
+		".reconcile-allowlist": ".reconcile-allowlist\n",
+		".reconcile-devrites":  "[]\n",
+		"action.log":           "Prior root action\n",
+		"browser-evidence.md":  "Prior root evidence\n",
+		"decisions.md":         "Prior root decision\n",
+		"evidence.md":          "Prior root evidence\n",
+		"footprint.log":        "Prior root footprint\n",
+		"state.md":             "Phase: ready\n",
+		"touched-files.md":     "Prior root manifest\n",
+	} {
+		if err := os.WriteFile(filepath.Join(workspace, name), []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := os.MkdirAll(filepath.Join(workspace, ".reconcile-objects"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+
+	sessionID, turnID := "session-wright-durable", "turn-wright-durable"
+	role := "devrites-slice-wright"
+	writeCodexAgentContract(t, root, role)
+	writeCodexSkillContract(t, root, "rite-build", role)
+	env := []string{"CODEX_HOME=" + codeHome}
+	runDevritesIO(t, root, hookPayload(t, map[string]any{
+		"hook_event_name": "UserPromptSubmit",
+		"session_id":      sessionID,
+		"turn_id":         turnID,
+		"prompt":          "$rite-build",
+	}), env, "hook", "agent-dispatch", "--harness=codex")
+
+	wrightState := filepath.Join(workspace, ".reconcile-wright-devrites")
+	initial, err := os.ReadFile(wrightState)
+	if err != nil {
+		t.Fatalf("read initial wright boundary: %v", err)
+	}
+	for _, path := range []string{
+		"features/auth-tokens/action.log",
+		"features/auth-tokens/browser-evidence.md",
+		"features/auth-tokens/decisions.md",
+		"features/auth-tokens/evidence.md",
+		"features/auth-tokens/footprint.log",
+		"features/auth-tokens/state.md",
+		"features/auth-tokens/touched-files.md",
+	} {
+		if !strings.Contains(string(initial), path) {
+			t.Errorf("pending wright boundary omitted %s: %s", path, initial)
+		}
+	}
+	if err := os.WriteFile(filepath.Join(workspace, "state.md"), []byte("Phase: build\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	postTool := hookPayload(t, map[string]any{
+		"hook_event_name": "PostToolUse",
+		"session_id":      sessionID,
+		"turn_id":         turnID,
+		"tool_name":       "apply_patch",
+		"tool_use_id":     "root-state-edit",
+		"tool_input":      map[string]any{"file_path": "state.md"},
+	})
+	if out, stderr, code := runDevritesIO(t, root, postTool, env,
+		"hook", "agent-dispatch", "--harness=codex"); code != 0 || strings.TrimSpace(out) != "" {
+		t.Fatalf("root post-tool refresh exit=%d out=%s stderr=%s", code, out, stderr)
+	}
+	beforeSpawn, err := os.ReadFile(wrightState)
+	if err != nil {
+		t.Fatalf("read refreshed wright boundary: %v", err)
+	}
+	if bytes.Equal(initial, beforeSpawn) {
+		t.Fatal("root PostToolUse did not refresh the pending wright boundary")
+	}
+
+	writeCodexV2Rollouts(
+		t, codeHome, filepath.Dir(root), sessionID, turnID, role,
+		"devrites_slice_wright_unhooked", true, true, true,
+	)
+	if err := os.WriteFile(filepath.Join(workspace, "state.md"), []byte("Writer mutation\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if out, stderr, code := runDevritesIO(t, root, postTool, env,
+		"hook", "agent-dispatch", "--harness=codex"); code != 0 || strings.TrimSpace(out) != "" {
+		t.Fatalf("post-spawn PostToolUse exit=%d out=%s stderr=%s", code, out, stderr)
+	}
+	afterSpawn, err := os.ReadFile(wrightState)
+	if err != nil {
+		t.Fatalf("read frozen wright boundary: %v", err)
+	}
+	if !bytes.Equal(beforeSpawn, afterSpawn) {
+		t.Fatal("durable V2 spawn did not freeze the pre-writer canonical boundary")
+	}
+}
+
 func TestCodexAgentDispatchBindsDurableV2WrightToReconcileWindow(t *testing.T) {
 	for _, tc := range []struct {
 		name          string

package/pack/.claude/skills/rite-build/reference/wright-dispatch.md

@@ -123,8 +123,9 @@ resume the same slice. Close it before abandoning the slice for a scope/plan tra
 Use named wright → enforced V1 generic worker from `standards/agents.md`. Codex V2
 dispatches the exact named `devrites-slice-wright` with a unique `task_name` and
 `fork_turns="none"`; its durable rollout proves the native role, wait, and non-empty
-result in the current window. The confirmed start fingerprints canonical state apart
-from the retained source baseline: pre-start root recovery records are excluded, while
+result in the current window. Root lifecycle hooks keep the pending canonical
+boundary current until the accepted or durable spawn, then freeze it apart from the
+retained source baseline: pre-start root recovery records are excluded, while
 post-start canonical changes fail.
 Any generic worker still needs the exact allowlist or an isolated checkout;
 reconciliation alone is insufficient. If no safe fresh-agent rung is available, stop

package/pack/generated/claude/skills/rite-build/reference/wright-dispatch.md

@@ -123,8 +123,9 @@ resume the same slice. Close it before abandoning the slice for a scope/plan tra
 Use named wright → enforced V1 generic worker from `standards/agents.md`. Codex V2
 dispatches the exact named `devrites-slice-wright` with a unique `task_name` and
 `fork_turns="none"`; its durable rollout proves the native role, wait, and non-empty
-result in the current window. The confirmed start fingerprints canonical state apart
-from the retained source baseline: pre-start root recovery records are excluded, while
+result in the current window. Root lifecycle hooks keep the pending canonical
+boundary current until the accepted or durable spawn, then freeze it apart from the
+retained source baseline: pre-start root recovery records are excluded, while
 post-start canonical changes fail.
 Any generic worker still needs the exact allowlist or an isolated checkout;
 reconciliation alone is insufficient. If no safe fresh-agent rung is available, stop

package/pack/generated/codex/hooks.json

@@ -57,6 +57,16 @@
             "statusMessage": "DevRites: checking test/build result"
           }
         ]
+      },
+      {
+        "matcher": "Bash|Shell|sh|exec_command|run_command|Edit|Write|MultiEdit|NotebookEdit|apply_patch|exec|js|python|computer|computer_use|write_stdin|run_code|Agent|Task|spawn_agent|delegate|dispatch_agent|create_agent|wait|wait_agent",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook agent-dispatch --harness=codex",
+            "statusMessage": "DevRites: retaining the pre-writer canonical boundary"
+          }
+        ]
       }
     ],
     "PreCompact": [

package/pack/generated/codex/skills/rite-build/reference/wright-dispatch.md

@@ -123,8 +123,9 @@ resume the same slice. Close it before abandoning the slice for a scope/plan tra
 Use named wright → enforced V1 generic worker from `standards/agents.md`. Codex V2
 dispatches the exact named `devrites-slice-wright` with a unique `task_name` and
 `fork_turns="none"`; its durable rollout proves the native role, wait, and non-empty
-result in the current window. The confirmed start fingerprints canonical state apart
-from the retained source baseline: pre-start root recovery records are excluded, while
+result in the current window. Root lifecycle hooks keep the pending canonical
+boundary current until the accepted or durable spawn, then freeze it apart from the
+retained source baseline: pre-start root recovery records are excluded, while
 post-start canonical changes fail.
 Any generic worker still needs the exact allowlist or an isolated checkout;
 reconciliation alone is insufficient. If no safe fresh-agent rung is available, stop

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "3.2.11",
+  "version": "3.2.13",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",

package/scripts/codex-generate.sh

@@ -246,6 +246,16 @@ gen_codex_hooks_json() {
             "statusMessage": "DevRites: checking test/build result"
           }
         ]
+      },
+      {
+        "matcher": "Bash|Shell|sh|exec_command|run_command|Edit|Write|MultiEdit|NotebookEdit|apply_patch|exec|js|python|computer|computer_use|write_stdin|run_code|Agent|Task|spawn_agent|delegate|dispatch_agent|create_agent|wait|wait_agent",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook agent-dispatch --harness=codex",
+            "statusMessage": "DevRites: retaining the pre-writer canonical boundary"
+          }
+        ]
       }
     ],
     "PreCompact": [