devrites 3.2.16 → 3.2.18

package/pack/generated/codex/skills/rite-build/reference/phase-contract.md

@@ -78,14 +78,28 @@ See also [`one-slice-cycle.md`](one-slice-cycle.md).
    ```bash
    devrites-engine test-integrity; echo "test-integrity rc=$?"
    ```
-   Run every exact command reported as `not-run`: `root-owned artifact-producing gate`
-   in the wright result. These are root proof commands, not source-edit authority.
-   Do not omit, rewrite, or substitute them; a missing command is unverifiable proof.
+   Run only root-owned gates already authorized byte-for-byte by the vetted
+   `test-plan.md` and unchanged `agent-packet/v1`, including exact command, cwd,
+   prerequisites, and expected artifact boundary. A wright result may report one
+   of those commands as `not-run`; it cannot invent, rewrite, widen, or authorize a
+   command. Reject any reported command that does not exactly match the frozen
+   plan/packet. Opaque wrapper, build, Playwright, and browser commands are root-owned
+   only when pre-authorized there; this transfers no source/test write authority.
+   A missing approved command is unverifiable proof.
    After they pass, run `devrites-engine reconcile check` again after the root-owned gates
    and before close, proving their child processes did not change tracked source:
    ```bash
    devrites-engine reconcile check; echo "reconcile rc=$?"
    ```
+   If a root-owned gate changes source after the clean pre-gate check, run the exact
+   engine-owned rollback and verify the retained tree before recovery:
+   ```bash
+   devrites-engine reconcile restore-check
+   devrites-engine reconcile check; echo "reconcile rc=$?"
+   ```
+   Never manually restore, truncate, resnapshot, or widen an allowlist to hide
+   post-check drift.
+
    If the wright's `Gates` were red (targeted tests / types / lint), `test-integrity`
    failed, a root-owned gate failed, the final reconcile failed, or proof could not be
    verified: do **not** mark the slice `built`, and **do not fix the code yourself**.

package/pack/generated/codex/skills/rite-build/reference/wright-dispatch.md

@@ -2,7 +2,9 @@
 
 `$rite-build` delegates one slice or correction to `devrites-slice-wright`.
 The root owns scope, questions, `.devrites/**`, reconciliation, and routing.
-Production builds and browser/E2E runs are root-owned gates.
+Production builds and browser/E2E runs are root-owned gates only when their exact
+command, cwd, prerequisites, and artifact boundary are already frozen in
+`test-plan.md` and the unchanged packet.
 The wright only writes source/tests, runs writer-safe proof, and never invokes agents.
 
 The universal packet, result, budget, await, retry, and host fallback contract is

package/pack/generated/codex/skills/rite-prove/SKILL.md

@@ -70,10 +70,13 @@ Pull these via `Read` when relevant:
   blocker; don't refactor unrelated code.
 - Spec Drift Guard applies: if tests/evidence reveal the spec is wrong, stop and handle
   drift (`rite-build/reference/spec-drift-guard.md`).
-- **Runner observes; root records; wright fixes.** Use the file-backed fresh-context
-  contract in [`agents.md`](../devrites-lib/reference/standards/agents.md). The root owns
-  the evidence verdict and canonical writes. Every accepted source/test correction is one
-  bounded `devrites-slice-wright` packet, never an inline edit.
+- **Root executes; runner validates; root records; wright fixes.** Use the file-backed
+  fresh-context contract in
+  [`agents.md`](../devrites-lib/reference/standards/agents.md). The root owns exact
+  vetted gate execution, browser capability, the evidence verdict, and canonical
+  writes. The proof runner is read-only and validates immutable logs/artifacts.
+  Every accepted source/test correction is one bounded `devrites-slice-wright`
+  packet, never an inline edit.
 
 ## Workflow
 0. Read `.agents/skills/devrites-lib/reference/standards/core.md` first (the always-on operating rules); pull the
@@ -86,28 +89,36 @@ Pull these via `Read` when relevant:
    [test-command-discovery](reference/test-command-discovery.md): README, package
    scripts, Makefile, CI configs, Gemfile/Rakefile, pyproject, go.mod, Cargo.toml.
    **Completion:** exact runnable test/build/typecheck/lint commands are recorded or explicitly unavailable.
-3. **Run proof in fresh context.** Freeze the candidate and dispatch
-   `devrites-proof-runner` with the exact commands, cwd, prerequisites, acceptance map,
-   and scratch boundary. Await and validate its observed full relevant test suite plus
-   **build / typecheck / lint** report. The runner writes no canonical evidence.
-4. **UI feature?** Include `design-brief.md`, `references.md`, routes, browser harness, and
-   allowed scratch path in the proof packet, then have the runner apply the browser proof ladder:
+3. **Execute proof against a frozen candidate.** Freeze and hash the candidate.
+   The root runs only commands authorized byte-for-byte by `test-plan.md` and the
+   immutable proof packet, with exact cwd and prerequisites, capturing exit code,
+   decisive output, artifact hashes, and before/after candidate identity in secure
+   external scratch. Run the full relevant test suite plus **build / typecheck /
+   lint**. Reject synthesized or substituted commands and any source drift.
+4. **UI feature?** The root applies the browser proof ladder with
+   `design-brief.md`, `references.md`, packet-listed routes, browser harness, and
+   allowed scratch path:
    [proof-ladder](reference/proof-ladder.md) + [browser-proof](reference/browser-proof.md)
    (`devrites-browser-proof`): routes, viewports, screenshots (opened + described),
    console, network, interaction paths, and the brief's proof targets. Compare screenshots
    with target references and record deltas. An unresolved material mismatch is a failed
-   result; the root handles any accepted correction at step 6 before re-rendering.
-5. **Map proof completely.** Follow
+   result; the root handles any accepted correction at step 7 before re-rendering.
+5. **Validate proof in fresh context.** Dispatch `devrites-proof-runner` with the
+   frozen candidate identity, exact approved command list, immutable root-produced
+   logs/screenshots/traces, acceptance map, and hashes. Await its non-empty
+   `agent-result/v1`; reject mismatched, missing, stale, or self-attested evidence.
+   The runner executes no command and writes no canonical evidence.
+6. **Map proof completely.** Follow
    [`reference/acceptance-proof.md`](reference/acceptance-proof.md) for acceptance/scenario
    coverage and the conditional critical-path, observability, developer-surface, and wiring
    branches. Completion: every criterion, planned interaction, and declared key link has a
    proof class plus passing evidence, or is recorded as a blocker.
-6. **On failure** → [failure-triage](reference/failure-triage.md) +
+7. **On failure** → [failure-triage](reference/failure-triage.md) +
    `devrites-debug-recovery`. The root reconciles the reproduction. Send an accepted,
    in-scope correction to the sole writer, `devrites-slice-wright`; then freeze the new
    candidate and dispatch a fresh proof runner for affected checks. If a fix would exceed
    scope, record a blocker.
-7. The root updates `evidence.md`, `browser-evidence.md` (if UI), `traceability.md`, and
+8. The root updates `evidence.md`, `browser-evidence.md` (if UI), `traceability.md`, and
    `state.md`. New proof goes to `evidence.md` (`proof.md` is a read-only alias:
    see `devrites-lib/reference/workspace-artifact-schema.md`).
 

package/pack/generated/codex/skills/rite-temper/SKILL.md

@@ -3,7 +3,7 @@ name: rite-temper
 description: Temper a readied spec before planning. Use when the user says "temper this", "strategy review", "pre-mortem the spec", or asks if we are over/under-building. Not for code review or final seal.
 argument-hint: "[feature-slug] [--mode expand|selective|hold|reduce]"
 user-invocable: true
-required-agent-roles: devrites-strategy-reviewer
+required-agent-roles: none
 ---
 
 ## Codex compatibility

package/pack/generated/codex/skills/rite-upgrade/SKILL.md

@@ -4,7 +4,7 @@ description: User-invoked semantic upgrade for an active legacy DevRites workspa
 argument-hint: "[feature-slug]"
 user-invocable: true
 disable-model-invocation: true
-required-agent-roles: devrites-upgrade-planner
+required-agent-roles: none
 ---
 
 ## Codex compatibility

package/pack/generated/codex/skills/rite-vet/SKILL.md

@@ -144,29 +144,32 @@ Pull the standard named by the active axis: `principles.md`, `patterns.md`,
    `brief.md`, `spec.md`, `decisions.md`, `assumptions.md`, or `questions.md`, re-scan the
    affected coverage rows, assumption audit, residual uncertainty, and closed gates.
    Partial/Missing, an unowned material assumption, or an open blocking/escalating question is
-   `NEEDS CLARIFICATION` → `$rite-clarify`/HITL; never refresh past it. Only after the matrix is
-   re-closed, run `devrites-engine readiness-digest coverage <slug>` and replace the complete
-   `Coverage inputs SHA-256` line in `decision-coverage.md`. This coverage refresh must precede
-   `devrites-engine readiness-digest engineering <slug>`.
+   `NEEDS CLARIFICATION` → `$rite-clarify`/HITL; never refresh past it.
    Re-run the gate after every fold-back so a task edit cannot invalidate the earlier pass:
    ```bash
    devrites-engine analyze; echo "final analyze rc=$?"
    ```
-   Any non-zero result blocks the handoff. Then update `state.md`:
-   write exactly one `DevRites contract: devrites.readiness-artifacts.v2` field to both
-   `test-plan.md` and `eng-review.md`, plus one typed field to `eng-review.md`:
-   `Implementation readiness: READY`,
-   `NEEDS CLARIFICATION`, or `NEEDS REPLAN`. Only READY sets `Phase: vet` and
-   `Next step: $rite-build`, after a final sweep leaves no foreseeable human choice except a
-   justified action-time checkpoint. Technical failure records its reproduction and
-   `$rite-plan repair` without a qid; a human-owned contract gap routes `$rite-clarify` and
-   uses the normal awaiting-human block.
+   Any non-zero result blocks the handoff. Keep `state.md` non-READY and do not
+   generate the engineering digest yet; this is the frozen candidate for step 6,
+   not the final handoff.
 6. **One narrow recheck after accepted edits.** If steps 2 through 5 changed the frozen candidate,
    dispatch `devrites-plan-reviewer` once more with only the accepted initial findings,
    changed planning paths, affected criteria, and the new immutable identity. Do not repeat
    the full review or start a third loop. If nothing changed, the initial report is final.
-   If the recheck causes an accepted edit, repeat step 5, including coverage refresh and analyze,
-   before generating the engineering digest.
+   If the recheck causes an accepted edit, repeat step 5. After the recheck is
+   complete and all accepted edits are folded back, re-close the matrix, rerun
+   `analyze`, run `devrites-engine readiness-digest coverage <slug>`, replace the
+   complete `Coverage inputs SHA-256` line, and only then run
+   `devrites-engine readiness-digest engineering <slug>`.
+
+   Now write exactly one `DevRites contract: devrites.readiness-artifacts.v2`
+   field to both `test-plan.md` and `eng-review.md`, plus one typed field to
+   `eng-review.md`: `Implementation readiness: READY`, `NEEDS CLARIFICATION`, or
+   `NEEDS REPLAN`. Only READY sets `Phase: vet` and `Next step: $rite-build`,
+   after a final sweep leaves no foreseeable human choice except a justified
+   action-time checkpoint. Technical failure records its reproduction and
+   `$rite-plan repair` without a qid; a human-owned contract gap routes
+   `$rite-clarify` and uses the normal awaiting-human block.
    [`reference/cross-model.md`](reference/cross-model.md) owns the optional outside voice.
    Completion: the final axis floor clears, an objective technical blocker is recorded, or a
    genuine human-owned gate is recorded.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "3.2.16",
+  "version": "3.2.18",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",

package/scripts/codex-generate.sh

@@ -238,7 +238,7 @@ gen_codex_hooks_json() {
     ],
     "PostToolUse": [
       {
-        "matcher": "Bash",
+        "matcher": "Bash|Shell|sh|exec_command|run_command",
         "hooks": [
           {
             "type": "command",