devrites 3.2.14 → 3.2.16

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [3.2.16](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.15...v3.2.16) (2026-07-27)
+
+### Fixed
+
+* **rite:** run root-owned artifact gates ([7614022](https://github.com/ViktorsBaikers/DevRites/commit/7614022b36cf8c887f148e4d12777e20ee2ea3d4))
+
+## [3.2.15](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.14...v3.2.15) (2026-07-27)
+
+### Fixed
+
+* **agents:** verify hidden V2 child roles ([e80b62b](https://github.com/ViktorsBaikers/DevRites/commit/e80b62bf53cec440cfad54a3d23d8d3cf5b120f3))
+
 ## [3.2.14](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.13...v3.2.14) (2026-07-26)
 
 ### Fixed

package/README.md

@@ -25,7 +25,7 @@ final commit, push, and tag, and it requires a typed `GO` confirmation.
 Unattended runs may create local WIP checkpoint commits along the way, but only
 Ship collapses and pushes them.
 
-**Status:** [`v3.2.14`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.2.14): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v3.2.16`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.2.16): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 ## Quick start
 

package/engine/hooks_agent_dispatch.go

@@ -495,39 +495,54 @@ func durableCodexV2DispatchAttempts(
 	}
 	var attempts []*agentDispatchAttempt
 	for _, spawn := range spawns {
-		if !devritesAgentNameRe.MatchString(spawn.Role) || spawn.Role == agentDispatchSkillGuard {
+		role := spawn.Role
+		var childPath string
+		var childMeta codexRolloutRecord
+		if strings.TrimSpace(spawn.Result) != "" {
+			childPath, childMeta, err = findCodexV2ChildRollout(
+				sessionsDir, parentPath, projectRoot, sessionID, spawn.AgentPath,
+			)
+			if err != nil {
+				return nil, err
+			}
+			if childPath != "" {
+				role = childMeta.Payload.AgentRole
+			}
+		}
+		if !devritesAgentNameRe.MatchString(role) || role == agentDispatchSkillGuard {
 			if strings.TrimSpace(spawn.Result) != "" {
 				return nil, fmt.Errorf("codex V2 completed a default or non-DevRites child during a DevRites skill turn; %s", conditionalDispatchInstruction())
 			}
 			continue
 		}
-		armed[spawn.Role] = struct{}{}
+		armed[role] = struct{}{}
 		attempt := &agentDispatchAttempt{
-			Role:      spawn.Role,
-			AgentType: spawn.Role,
+			Role:      role,
+			AgentType: role,
 			Started:   true,
 		}
 		attempts = append(attempts, attempt)
 		if strings.TrimSpace(spawn.Result) == "" || !lineBetween(waitLines, spawn.SpawnLine, spawn.ResultLine) {
 			continue
 		}
-		instructions, err := agentRoleDeveloperInstructions(root, spawn.Role)
+		if childPath == "" || childMeta.Payload.AgentRole != role {
+			continue
+		}
+		instructions, err := agentRoleDeveloperInstructions(root, role)
 		if err != nil {
-			return nil, fmt.Errorf("named role %s is not loadable: %w", spawn.Role, err)
+			return nil, fmt.Errorf("named role %s is not loadable: %w", role, err)
 		}
-		childID, childResult, err := findCodexV2ChildResult(
-			sessionsDir, parentPath, projectRoot, sessionID, spawn.AgentPath, spawn.Role, instructions,
-		)
+		childResult, err := codexChildResult(childPath, instructions)
 		if err != nil {
 			return nil, err
 		}
-		if childID == "" || strings.TrimSpace(childResult) == "" {
+		if childMeta.Payload.ID == "" || strings.TrimSpace(childResult) == "" {
 			continue
 		}
-		attempt.AgentID = childID
+		attempt.AgentID = childMeta.Payload.ID
 		attempt.Stopped = true
 		attempt.Waited = true
-		if spawn.Role == "devrites-slice-wright" {
+		if role == "devrites-slice-wright" {
 			attempt.WindowID = currentReconcileWindowID()
 			if attempt.WindowID == "" || !reconcileWindowPredates(spawn.SpawnedAt) {
 				continue
@@ -654,10 +669,11 @@ func readCodexV2ParentRollout(
 	return spawns, waitLines, nil
 }
 
-func findCodexV2ChildResult(
-	sessionsDir, parentPath, projectRoot, sessionID, agentPath, role, instructions string,
-) (string, string, error) {
-	var childID, result string
+func findCodexV2ChildRollout(
+	sessionsDir, parentPath, projectRoot, sessionID, agentPath string,
+) (string, codexRolloutRecord, error) {
+	var childPath string
+	var childMeta codexRolloutRecord
 	err := filepath.WalkDir(sessionsDir, func(path string, entry fs.DirEntry, walkErr error) error {
 		if walkErr != nil {
 			if os.IsNotExist(walkErr) {
@@ -675,18 +691,17 @@ func findCodexV2ChildResult(
 		if record.Type != "session_meta" ||
 			record.Payload.ParentThreadID != sessionID ||
 			record.Payload.AgentPath != agentPath ||
-			record.Payload.AgentRole != role ||
 			!sameResolvedPath(record.Payload.CWD, projectRoot) {
 			return nil
 		}
-		if childID != "" {
+		if childPath != "" {
 			return fmt.Errorf("multiple Codex child rollouts match %s", agentPath)
 		}
-		childID = record.Payload.ID
-		result, err = codexChildResult(path, instructions)
-		return err
+		childPath = path
+		childMeta = record
+		return nil
 	})
-	return childID, result, err
+	return childPath, childMeta, err
 }
 
 func firstCodexRolloutRecord(path string) (codexRolloutRecord, bool, error) {

package/engine/tests/hook_test.go

@@ -7,6 +7,7 @@ package main_test
 import (
 	"bytes"
 	"encoding/json"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -379,6 +380,40 @@ func TestCodexGenericCompatibilityDoesNotShadowRoot(t *testing.T) {
 	}
 }
 
+func TestCodexRootRunsArtifactGatesInsideActiveWindow(t *testing.T) {
+	root := newWorkspace(t)
+	writeActive(t, root, "auth-tokens")
+	workspace := filepath.Join(root, "features", "auth-tokens")
+	if err := os.WriteFile(filepath.Join(workspace, ".reconcile-base"), []byte("snapshot\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	env := []string{
+		"DEVRITES_CODEX_GENERIC_AGENT_COMPAT=1",
+		"DEVRITES_HOOK_PROFILE=strict",
+	}
+	for _, command := range []string{
+		"npm run build",
+		"npm run test:e2e -- tests/admin-locations.e2e.spec.ts",
+	} {
+		in := fmt.Sprintf(`{"tool_name":"Bash","tool_input":{"command":%q}}`, command)
+		out, errOut, code := runDevritesIO(t, root, in, env,
+			"hook", "wright-scope", "--harness=codex")
+		if code != 0 || strings.TrimSpace(out) != "" {
+			t.Fatalf("%q should be root-owned: exit=%d out=%q stderr=%q", command, code, out, errOut)
+		}
+	}
+
+	in := `{"tool_name":"Bash","tool_input":{"command":"printf x > src/app.go"}}`
+	out, errOut, code := runDevritesIO(t, root, in, env,
+		"hook", "wright-scope", "--harness=codex")
+	if code != 0 {
+		t.Fatalf("source write guard exit=%d stderr=%q", code, errOut)
+	}
+	if decision, _ := parsePermissionDecision(t, out); decision != "deny" {
+		t.Fatalf("root source mutation was not denied: %q", out)
+	}
+}
+
 func TestHookReviewerReadonlyActiveLeafDeniesEveryMutationSurface(t *testing.T) {
 	root := newWorkspace(t)
 	env := []string{
@@ -1667,6 +1702,50 @@ func TestCodexAgentDispatchConfirmsDurableV2NamedRole(t *testing.T) {
 	}
 }
 
+func TestCodexAgentDispatchConfirmsDurableV2ChildRoleWhenParentOmitsAgentType(t *testing.T) {
+	root := newWorkspace(t)
+	codeHome := t.TempDir()
+	sessionID, turnID := "session-v2-hidden-role", "turn-v2-hidden-role"
+	role := "devrites-plan-drafter"
+	writeCodexAgentContract(t, root, role)
+	writeCodexSkillContract(t, root, "rite-plan", role)
+
+	runDevritesIO(t, root, hookPayload(t, map[string]any{
+		"hook_event_name": "UserPromptSubmit",
+		"session_id":      sessionID,
+		"turn_id":         turnID,
+		"prompt":          "$rite-plan unblock",
+	}), nil, "hook", "agent-dispatch", "--harness=codex")
+
+	taskName := "devrites_plan_drafter_hidden_role"
+	writeCodexV2Rollouts(
+		t, codeHome, filepath.Dir(root), sessionID, turnID, role,
+		taskName, true, true, true,
+	)
+	parentPath := filepath.Join(codeHome, "sessions", "2026", "07", "25", "rollout-parent-"+sessionID+".jsonl")
+	parent, err := os.ReadFile(parentPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	hiddenParentRole := bytes.ReplaceAll(parent, []byte(`\"agent_type\":\"`+role+`\"`), []byte(`\"agent_type\":\"\"`))
+	if bytes.Equal(parent, hiddenParentRole) {
+		t.Fatal("fixture did not hide the parent agent_type")
+	}
+	if err := os.WriteFile(parentPath, hiddenParentRole, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	stop := hookPayload(t, map[string]any{
+		"hook_event_name": "Stop",
+		"session_id":      sessionID,
+		"turn_id":         turnID,
+	})
+	if out, stderr, code := runDevritesIO(t, root, stop,
+		[]string{"CODEX_HOME=" + codeHome},
+		"hook", "agent-dispatch", "--harness=codex"); code != 0 || strings.TrimSpace(out) != "" {
+		t.Fatalf("hidden parent role stop exit=%d out=%s stderr=%s", code, out, stderr)
+	}
+}
+
 func TestCodexAgentDispatchConfirmsConditionalDurableV2NamedRole(t *testing.T) {
 	root := newWorkspace(t)
 	codeHome := t.TempDir()

package/pack/.claude/agents/devrites-slice-wright.md

@@ -105,9 +105,9 @@ an escalation and do not proceed.**
      `$devrites-source-driven` on Codex. Verify the fact in installed source,
      official documentation, or context7 for current upstream behavior, then include
      that source in the result. Never invent an API.
-4. **VERIFY (fail-on-red).** Run the slice's targeted tests and the project's type
-   check, lint, and build where applicable. Capture the exact command and its real
-   output. If a gate is red, fix the root cause in your code. **Never weaken a test
+4. **VERIFY (fail-on-red).** Run writer-safe tests/types/lint. Report required
+   build/browser/E2E as `not-run`: `root-owned artifact-producing gate`; root
+   runs them after reconciliation. Fix red gates in your code. **Never weaken a test
    to go green** by deleting it, skipping it with `skip`, `xfail`, or `.only`, or
    loosening an assertion. A test that genuinely must change is an **Escalation**,
    not a quiet edit. The orchestrator runs `devrites-engine test-integrity` on the
@@ -117,8 +117,7 @@ an escalation and do not proceed.**
    `devrites-engine recovery` **three-attempt budget per root cause**. At the limit,
    return the failed gate and reproduction. Reserve `Escalation` for a
    product-contract or irreversible-risk choice, or a user-only credential or
-   action. A technical failure is a blocker for the orchestrator, not a permission
-   question.
+   action. Technical failure is a blocker, not a permission question.
 5. **RETURN** the structured artifact (below) and stop. Do not start the next slice.
 
 ## Code quality: consume the rules, don't reinvent them

package/pack/.claude/skills/rite-build/reference/one-slice-cycle.md

@@ -15,9 +15,9 @@ DISPATCH  → hand the slice contract to devrites-slice-wright (fresh context).
    ORIENT    → load only the files this slice touches; learn the project's idiom; reuse-first
    (RED)     → if behavior change: write the failing test first
    IMPLEMENT → smallest complete version; match conventions; devrites-frontend-craft for UI
-   VERIFY    → targeted tests (+ types/lint/build); fail-on-red; return artifact — code + tests only
+   VERIFY    → writer-safe tests/types/lint; return code + tests
 (DOUBT)   → orchestrator, on return: devrites-doubt each non-trivial decision the wright stood up
-PROVE     → orchestrator: fail-on-red check on the wright's gates; browser proof for UI
+PROVE     → root: exact required production build/browser/E2E, then final reconcile; fail-on-red
 RECORD    → orchestrator: after green verification, Forge cleanup/report if used; then
             state.md, evidence.md, touched-files.md (the canonical writer)
 (CHECKPOINT) → orchestrator: if .devrites/CHECKPOINT is set, commit the proven slice

package/pack/.claude/skills/rite-build/reference/phase-contract.md

@@ -73,13 +73,22 @@ See also [`one-slice-cycle.md`](one-slice-cycle.md).
    (reported in its `Principles` field, or that you detect against `.devrites/principles.md`) is
    handled here like an irreversible-risk item: block, route to a human-approved scoped
    exception in the register or stop; never doubt-and-accept a principle violation into the slice.
-5. **Run the retained-baseline integrity gate, then recover any objective red.**
+5. **Run retained-baseline integrity and every root-owned proof gate, then recover
+   any objective red.**
    ```bash
    devrites-engine test-integrity; echo "test-integrity rc=$?"
    ```
+   Run every exact command reported as `not-run`: `root-owned artifact-producing gate`
+   in the wright result. These are root proof commands, not source-edit authority.
+   Do not omit, rewrite, or substitute them; a missing command is unverifiable proof.
+   After they pass, run `devrites-engine reconcile check` again after the root-owned gates
+   and before close, proving their child processes did not change tracked source:
+   ```bash
+   devrites-engine reconcile check; echo "reconcile rc=$?"
+   ```
    If the wright's `Gates` were red (targeted tests / types / lint), `test-integrity`
-   failed, or proof could not be verified: do **not** mark the slice `built`, and **do not
-   fix the code yourself**.
+   failed, a root-owned gate failed, the final reconcile failed, or proof could not be
+   verified: do **not** mark the slice `built`, and **do not fix the code yourself**.
    Classify each causal fingerprint through
    [`cleanup-and-classify.md`](../../devrites-debug-recovery/reference/cleanup-and-classify.md),
    run `devrites-engine recovery route <class>`, and follow the `recovery-route/v1`
@@ -105,7 +114,8 @@ See also [`one-slice-cycle.md`](one-slice-cycle.md).
    - exhausted objective failure → preserve reproduction/dead ends, set `Status: blocked` and
      `Next step: /rite-plan unblock`, then STOP without a question or `/rite-resolve`.
 6. **Close the retained baseline, then record. You are the canonical writer.**
-   Reconciliation ran immediately on return and `test-integrity` ran in step 5.
+   Reconciliation ran immediately on return; step 5 ran integrity, root-owned proof,
+   and a final clean reconciliation.
    **Exit 3 → hard STOP:** a test was deleted, skipped, or de-asserted since the slice base: the
    slice went green by weakening its tests, a Critical protocol violation. Revert the weakening and
    re-dispatch the wright; do **not** mark the slice `built`.

package/pack/.claude/skills/rite-build/reference/wright-dispatch.md

@@ -1,9 +1,9 @@
 # Slice-wright dispatch
 
-`/rite-build` delegates one settled slice or correction set to
-`devrites-slice-wright`. The root orchestrator owns scope, human questions,
-`.devrites/**`, gates, reconciliation, and routing. The wright is the only source/test
-writer and never invokes another agent.
+`/rite-build` delegates one slice or correction to `devrites-slice-wright`.
+The root owns scope, questions, `.devrites/**`, reconciliation, and routing.
+Production builds and browser/E2E runs are root-owned gates.
+The wright only writes source/tests, runs writer-safe proof, and never invokes agents.
 
 The universal packet, result, budget, await, retry, and host fallback contract is
 [`standards/agents.md`](../../devrites-lib/reference/standards/agents.md). This file adds
@@ -108,7 +108,7 @@ failure becomes a technical blocker with its reproduction, not a `rite-resolve`
 
 ## Close and record
 
-When reconciliation, integrity, proof, and doubt gates all pass:
+Run the root gates and final reconciliation from `phase-contract.md` step 5. Then:
 
 ```bash
 devrites-engine reconcile close

package/pack/generated/claude/agents/devrites-slice-wright.md

@@ -105,9 +105,9 @@ an escalation and do not proceed.**
      `$devrites-source-driven` on Codex. Verify the fact in installed source,
      official documentation, or context7 for current upstream behavior, then include
      that source in the result. Never invent an API.
-4. **VERIFY (fail-on-red).** Run the slice's targeted tests and the project's type
-   check, lint, and build where applicable. Capture the exact command and its real
-   output. If a gate is red, fix the root cause in your code. **Never weaken a test
+4. **VERIFY (fail-on-red).** Run writer-safe tests/types/lint. Report required
+   build/browser/E2E as `not-run`: `root-owned artifact-producing gate`; root
+   runs them after reconciliation. Fix red gates in your code. **Never weaken a test
    to go green** by deleting it, skipping it with `skip`, `xfail`, or `.only`, or
    loosening an assertion. A test that genuinely must change is an **Escalation**,
    not a quiet edit. The orchestrator runs `devrites-engine test-integrity` on the
@@ -117,8 +117,7 @@ an escalation and do not proceed.**
    `devrites-engine recovery` **three-attempt budget per root cause**. At the limit,
    return the failed gate and reproduction. Reserve `Escalation` for a
    product-contract or irreversible-risk choice, or a user-only credential or
-   action. A technical failure is a blocker for the orchestrator, not a permission
-   question.
+   action. Technical failure is a blocker, not a permission question.
 5. **RETURN** the structured artifact (below) and stop. Do not start the next slice.
 
 ## Code quality: consume the rules, don't reinvent them

package/pack/generated/claude/skills/rite-build/reference/one-slice-cycle.md

@@ -15,9 +15,9 @@ DISPATCH  → hand the slice contract to devrites-slice-wright (fresh context).
    ORIENT    → load only the files this slice touches; learn the project's idiom; reuse-first
    (RED)     → if behavior change: write the failing test first
    IMPLEMENT → smallest complete version; match conventions; devrites-frontend-craft for UI
-   VERIFY    → targeted tests (+ types/lint/build); fail-on-red; return artifact — code + tests only
+   VERIFY    → writer-safe tests/types/lint; return code + tests
 (DOUBT)   → orchestrator, on return: devrites-doubt each non-trivial decision the wright stood up
-PROVE     → orchestrator: fail-on-red check on the wright's gates; browser proof for UI
+PROVE     → root: exact required production build/browser/E2E, then final reconcile; fail-on-red
 RECORD    → orchestrator: after green verification, Forge cleanup/report if used; then
             state.md, evidence.md, touched-files.md (the canonical writer)
 (CHECKPOINT) → orchestrator: if .devrites/CHECKPOINT is set, commit the proven slice

package/pack/generated/claude/skills/rite-build/reference/phase-contract.md

@@ -73,13 +73,22 @@ See also [`one-slice-cycle.md`](one-slice-cycle.md).
    (reported in its `Principles` field, or that you detect against `.devrites/principles.md`) is
    handled here like an irreversible-risk item: block, route to a human-approved scoped
    exception in the register or stop; never doubt-and-accept a principle violation into the slice.
-5. **Run the retained-baseline integrity gate, then recover any objective red.**
+5. **Run retained-baseline integrity and every root-owned proof gate, then recover
+   any objective red.**
    ```bash
    devrites-engine test-integrity; echo "test-integrity rc=$?"
    ```
+   Run every exact command reported as `not-run`: `root-owned artifact-producing gate`
+   in the wright result. These are root proof commands, not source-edit authority.
+   Do not omit, rewrite, or substitute them; a missing command is unverifiable proof.
+   After they pass, run `devrites-engine reconcile check` again after the root-owned gates
+   and before close, proving their child processes did not change tracked source:
+   ```bash
+   devrites-engine reconcile check; echo "reconcile rc=$?"
+   ```
    If the wright's `Gates` were red (targeted tests / types / lint), `test-integrity`
-   failed, or proof could not be verified: do **not** mark the slice `built`, and **do not
-   fix the code yourself**.
+   failed, a root-owned gate failed, the final reconcile failed, or proof could not be
+   verified: do **not** mark the slice `built`, and **do not fix the code yourself**.
    Classify each causal fingerprint through
    [`cleanup-and-classify.md`](../../devrites-debug-recovery/reference/cleanup-and-classify.md),
    run `devrites-engine recovery route <class>`, and follow the `recovery-route/v1`
@@ -105,7 +114,8 @@ See also [`one-slice-cycle.md`](one-slice-cycle.md).
    - exhausted objective failure → preserve reproduction/dead ends, set `Status: blocked` and
      `Next step: /rite-plan unblock`, then STOP without a question or `/rite-resolve`.
 6. **Close the retained baseline, then record. You are the canonical writer.**
-   Reconciliation ran immediately on return and `test-integrity` ran in step 5.
+   Reconciliation ran immediately on return; step 5 ran integrity, root-owned proof,
+   and a final clean reconciliation.
    **Exit 3 → hard STOP:** a test was deleted, skipped, or de-asserted since the slice base: the
    slice went green by weakening its tests, a Critical protocol violation. Revert the weakening and
    re-dispatch the wright; do **not** mark the slice `built`.

package/pack/generated/claude/skills/rite-build/reference/wright-dispatch.md

@@ -1,9 +1,9 @@
 # Slice-wright dispatch
 
-`/rite-build` delegates one settled slice or correction set to
-`devrites-slice-wright`. The root orchestrator owns scope, human questions,
-`.devrites/**`, gates, reconciliation, and routing. The wright is the only source/test
-writer and never invokes another agent.
+`/rite-build` delegates one slice or correction to `devrites-slice-wright`.
+The root owns scope, questions, `.devrites/**`, reconciliation, and routing.
+Production builds and browser/E2E runs are root-owned gates.
+The wright only writes source/tests, runs writer-safe proof, and never invokes agents.
 
 The universal packet, result, budget, await, retry, and host fallback contract is
 [`standards/agents.md`](../../devrites-lib/reference/standards/agents.md). This file adds
@@ -108,7 +108,7 @@ failure becomes a technical blocker with its reproduction, not a `rite-resolve`
 
 ## Close and record
 
-When reconciliation, integrity, proof, and doubt gates all pass:
+Run the root gates and final reconciliation from `phase-contract.md` step 5. Then:
 
 ```bash
 devrites-engine reconcile close

package/pack/generated/codex/agents/devrites-slice-wright.toml

@@ -100,9 +100,9 @@ an escalation and do not proceed.**
      `$devrites-source-driven` on Codex. Verify the fact in installed source,
      official documentation, or context7 for current upstream behavior, then include
      that source in the result. Never invent an API.
-4. **VERIFY (fail-on-red).** Run the slice's targeted tests and the project's type
-   check, lint, and build where applicable. Capture the exact command and its real
-   output. If a gate is red, fix the root cause in your code. **Never weaken a test
+4. **VERIFY (fail-on-red).** Run writer-safe tests/types/lint. Report required
+   build/browser/E2E as `not-run`: `root-owned artifact-producing gate`; root
+   runs them after reconciliation. Fix red gates in your code. **Never weaken a test
    to go green** by deleting it, skipping it with `skip`, `xfail`, or `.only`, or
    loosening an assertion. A test that genuinely must change is an **Escalation**,
    not a quiet edit. The orchestrator runs `devrites-engine test-integrity` on the
@@ -112,8 +112,7 @@ an escalation and do not proceed.**
    `devrites-engine recovery` **three-attempt budget per root cause**. At the limit,
    return the failed gate and reproduction. Reserve `Escalation` for a
    product-contract or irreversible-risk choice, or a user-only credential or
-   action. A technical failure is a blocker for the orchestrator, not a permission
-   question.
+   action. Technical failure is a blocker, not a permission question.
 5. **RETURN** the structured artifact (below) and stop. Do not start the next slice.
 
 ## Code quality: consume the rules, don't reinvent them

package/pack/generated/codex/skills/rite-build/reference/one-slice-cycle.md

@@ -15,9 +15,9 @@ DISPATCH  → hand the slice contract to devrites-slice-wright (fresh context).
    ORIENT    → load only the files this slice touches; learn the project's idiom; reuse-first
    (RED)     → if behavior change: write the failing test first
    IMPLEMENT → smallest complete version; match conventions; devrites-frontend-craft for UI
-   VERIFY    → targeted tests (+ types/lint/build); fail-on-red; return artifact — code + tests only
+   VERIFY    → writer-safe tests/types/lint; return code + tests
 (DOUBT)   → orchestrator, on return: devrites-doubt each non-trivial decision the wright stood up
-PROVE     → orchestrator: fail-on-red check on the wright's gates; browser proof for UI
+PROVE     → root: exact required production build/browser/E2E, then final reconcile; fail-on-red
 RECORD    → orchestrator: after green verification, Forge cleanup/report if used; then
             state.md, evidence.md, touched-files.md (the canonical writer)
 (CHECKPOINT) → orchestrator: if .devrites/CHECKPOINT is set, commit the proven slice

package/pack/generated/codex/skills/rite-build/reference/phase-contract.md

@@ -73,13 +73,22 @@ See also [`one-slice-cycle.md`](one-slice-cycle.md).
    (reported in its `Principles` field, or that you detect against `.devrites/principles.md`) is
    handled here like an irreversible-risk item: block, route to a human-approved scoped
    exception in the register or stop; never doubt-and-accept a principle violation into the slice.
-5. **Run the retained-baseline integrity gate, then recover any objective red.**
+5. **Run retained-baseline integrity and every root-owned proof gate, then recover
+   any objective red.**
    ```bash
    devrites-engine test-integrity; echo "test-integrity rc=$?"
    ```
+   Run every exact command reported as `not-run`: `root-owned artifact-producing gate`
+   in the wright result. These are root proof commands, not source-edit authority.
+   Do not omit, rewrite, or substitute them; a missing command is unverifiable proof.
+   After they pass, run `devrites-engine reconcile check` again after the root-owned gates
+   and before close, proving their child processes did not change tracked source:
+   ```bash
+   devrites-engine reconcile check; echo "reconcile rc=$?"
+   ```
    If the wright's `Gates` were red (targeted tests / types / lint), `test-integrity`
-   failed, or proof could not be verified: do **not** mark the slice `built`, and **do not
-   fix the code yourself**.
+   failed, a root-owned gate failed, the final reconcile failed, or proof could not be
+   verified: do **not** mark the slice `built`, and **do not fix the code yourself**.
    Classify each causal fingerprint through
    [`cleanup-and-classify.md`](../../devrites-debug-recovery/reference/cleanup-and-classify.md),
    run `devrites-engine recovery route <class>`, and follow the `recovery-route/v1`
@@ -105,7 +114,8 @@ See also [`one-slice-cycle.md`](one-slice-cycle.md).
    - exhausted objective failure → preserve reproduction/dead ends, set `Status: blocked` and
      `Next step: $rite-plan unblock`, then STOP without a question or `$rite-resolve`.
 6. **Close the retained baseline, then record. You are the canonical writer.**
-   Reconciliation ran immediately on return and `test-integrity` ran in step 5.
+   Reconciliation ran immediately on return; step 5 ran integrity, root-owned proof,
+   and a final clean reconciliation.
    **Exit 3 → hard STOP:** a test was deleted, skipped, or de-asserted since the slice base: the
    slice went green by weakening its tests, a Critical protocol violation. Revert the weakening and
    re-dispatch the wright; do **not** mark the slice `built`.

package/pack/generated/codex/skills/rite-build/reference/wright-dispatch.md

@@ -1,9 +1,9 @@
 # Slice-wright dispatch
 
-`$rite-build` delegates one settled slice or correction set to
-`devrites-slice-wright`. The root orchestrator owns scope, human questions,
-`.devrites/**`, gates, reconciliation, and routing. The wright is the only source/test
-writer and never invokes another agent.
+`$rite-build` delegates one slice or correction to `devrites-slice-wright`.
+The root owns scope, questions, `.devrites/**`, reconciliation, and routing.
+Production builds and browser/E2E runs are root-owned gates.
+The wright only writes source/tests, runs writer-safe proof, and never invokes agents.
 
 The universal packet, result, budget, await, retry, and host fallback contract is
 [`standards/agents.md`](../../devrites-lib/reference/standards/agents.md). This file adds
@@ -108,7 +108,7 @@ failure becomes a technical blocker with its reproduction, not a `rite-resolve`
 
 ## Close and record
 
-When reconciliation, integrity, proof, and doubt gates all pass:
+Run the root gates and final reconciliation from `phase-contract.md` step 5. Then:
 
 ```bash
 devrites-engine reconcile close

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "3.2.14",
+  "version": "3.2.16",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",