devrites 3.2.7 → 3.2.8

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [3.2.8](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.7...v3.2.8) (2026-07-26)
+
+### Fixed
+
+* **devrites:** prevent reconcile self-invalidation ([161ed18](https://github.com/ViktorsBaikers/DevRites/commit/161ed187e600dfc92623b22db5cd7f0824408d1a))
+
 ## [3.2.7](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.6...v3.2.7) (2026-07-26)
 
 ### Fixed

package/README.md

@@ -25,7 +25,7 @@ final commit, push, and tag, and it requires a typed `GO` confirmation.
 Unattended runs may create local WIP checkpoint commits along the way, but only
 Ship collapses and pushes them.
 
-**Status:** [`v3.2.7`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.2.7): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v3.2.8`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.2.8): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 ## Quick start
 

package/docs/orchestration.md

@@ -69,6 +69,16 @@ Each dispatch follows the retained-baseline sequence:
 5. After proof and decision checks pass, `reconcile close` retires the private
    window; only then does the root write canonical records.
 
+The canonical-state fingerprint excludes root-owned operational records:
+`timeline.jsonl`, feature `events.jsonl`, a valid `recovery-attempts.jsonl`,
+the redwatch sentinel, automatic handoff snapshots, and hidden hook observation
+logs. Those records cannot grant source authority or invalidate a writer result
+merely because the engine or a hook wrote them. Unknown or canonical
+`.devrites` paths remain fail-closed, and recovery ledgers must still parse
+before reconciliation can pass. Gate-authoritative operational state such as
+recovery attempts and `.red` remains enforced by its owning gate. Checks also
+normalize these paths out of retained snapshots created by older engines.
+
 On retry, the root may add only an accepted still-in-slice path, then runs
 `reconcile snapshot` again. This refreshes the dispatch boundary while
 preserving the original slice baseline. The same objective root cause has a

package/engine/internal/lib/reconcile.go

@@ -215,6 +215,7 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 			fmt.Fprintf(stderr, "reconcile: invalid .devrites snapshot: %v\n", err)
 			return 6
 		}
+		beforeDevrites = withoutRootOwnedOperationalState(beforeDevrites)
 		afterDevrites, err := captureReconcileDevritesState(root, devritesSnapshot, objects, checked)
 		if err != nil {
 			fmt.Fprintf(stderr, "reconcile: cannot compare .devrites: %v\n", err)
@@ -465,6 +466,13 @@ func captureDevritesState(root string, ignoredPaths ...string) ([]devritesStateE
 			}
 			return nil
 		}
+		operational, err := reconcileRootOwnedOperationalFile(filename, rel, entry)
+		if err != nil {
+			return err
+		}
+		if operational {
+			return nil
+		}
 
 		fingerprint, err := devritesFingerprint(filename, entry)
 		if err != nil {
@@ -483,6 +491,61 @@ func captureDevritesState(root string, ignoredPaths ...string) ([]devritesStateE
 	return state, nil
 }
 
+// reconcileRootOwnedOperationalFile excludes engine/root-owned operational
+// records from the writer delta. Their owning hooks/gates validate them where
+// needed; root activity must not be attributed to the slice writer.
+func reconcileRootOwnedOperationalFile(filename, rel string, entry os.DirEntry) (bool, error) {
+	if !entry.Type().IsRegular() || !reconcileRootOwnedOperationalPath(rel) {
+		return false, nil
+	}
+	rel = filepath.ToSlash(filepath.Clean(rel))
+	parts := strings.Split(rel, "/")
+	if len(parts) == 3 && parts[2] == recoveryAttemptsFile {
+		if _, err := readRecoveryAttempts(filename); err != nil {
+			return false, fmt.Errorf("validate root-owned recovery ledger %s: %w", rel, err)
+		}
+	}
+	return true, nil
+}
+
+func reconcileRootOwnedOperationalPath(rel string) bool {
+	rel = filepath.ToSlash(filepath.Clean(rel))
+	if rel == "timeline.jsonl" {
+		return true
+	}
+	parts := strings.Split(rel, "/")
+	if len(parts) != 3 ||
+		(parts[0] != "work" && parts[0] != "features") ||
+		!slugToken.MatchString(parts[1]) {
+		return false
+	}
+	switch parts[2] {
+	case "events.jsonl",
+		recoveryAttemptsFile,
+		".red",
+		"handoff.md",
+		".a1-guard.log",
+		".reviewer-ro.log",
+		".stop-gate.log",
+		".wright-scope.log":
+		return true
+	default:
+		return false
+	}
+}
+
+func withoutRootOwnedOperationalState(state []devritesStateEntry) []devritesStateEntry {
+	filtered := state[:0]
+	for _, item := range state {
+		if strings.HasPrefix(item.Fingerprint, "file:") &&
+			reconcileRootOwnedOperationalPath(item.Path) {
+			continue
+		}
+		filtered = append(filtered, item)
+	}
+	return filtered
+}
+
 func devritesFingerprint(filename string, entry os.DirEntry) (string, error) {
 	info, err := entry.Info()
 	if err != nil {

package/engine/internal/lib/reconcile_test.go

@@ -361,6 +361,158 @@ func TestReconcileRejectsDevritesMutation(t *testing.T) {
 	}
 }
 
+func TestReconcileAllowsRootOwnedOperationalFiles(t *testing.T) {
+	newGitRepo(t)
+	root := workspace(t, "feat")
+	dir := featureDir(root, "feat")
+	writeWrightAllowlist(t, root, "feat", "seed.go")
+	if code := Stuck(root, []string{"log", "feat", "dispatch", "SLICE-010"}, &bytes.Buffer{}, &bytes.Buffer{}); code != 0 {
+		t.Fatalf("stuck log = %d, want 0", code)
+	}
+	if code, out := runReconcile(t, root, "snapshot", "feat"); code != 0 {
+		t.Fatalf("snapshot = %d, want 0\n%s", code, out)
+	}
+
+	writeFile(t, filepath.Join(root, "timeline.jsonl"), "telemetry\n")
+	writeFile(t, filepath.Join(dir, "events.jsonl"), "telemetry\n")
+	writeFile(t, filepath.Join(dir, ".a1-guard.log"), "WOULD-BLOCK\n")
+	writeFile(t, filepath.Join(dir, ".reviewer-ro.log"), "WOULD-BLOCK\n")
+	writeFile(t, filepath.Join(dir, ".stop-gate.log"), "WOULD-BLOCK\n")
+	writeFile(t, filepath.Join(dir, ".wright-scope.log"), "WOULD-BLOCK\n")
+	writeFile(t, filepath.Join(dir, ".red"), "npm test\n")
+	writeFile(t, filepath.Join(dir, "handoff.md"), "## Handoff snapshot\n")
+	if code := RecoveryAttempts(
+		root,
+		[]string{"record", "--class", "proof_tool_defect", "reconcile telemetry", "changed logs", "feat"},
+		&bytes.Buffer{},
+		&bytes.Buffer{},
+	); code != 0 {
+		t.Fatalf("recovery record = %d, want 0", code)
+	}
+
+	if code, out := runReconcile(t, root, "check", "feat"); code != 0 {
+		t.Fatalf("check = %d, want 0\n%s", code, out)
+	}
+	if code, out := runReconcile(t, root, "snapshot", "feat"); code != 0 {
+		t.Fatalf("refresh = %d, want 0\n%s", code, out)
+	}
+
+	writeFile(t, filepath.Join(dir, ".unknown.log"), "not engine-owned\n")
+	code, out := runReconcile(t, root, "check", "feat")
+	if code != 5 {
+		t.Fatalf("check after canonical mutation = %d, want 5\n%s", code, out)
+	}
+	if !strings.Contains(out, ".devrites/work/feat/.unknown.log") {
+		t.Fatalf("canonical mutation missing from output:\n%s", out)
+	}
+}
+
+func TestReconcileAcceptsLegacyOperationalFingerprints(t *testing.T) {
+	newGitRepo(t)
+	root := workspace(t, "feat")
+	dir := featureDir(root, "feat")
+	writeWrightAllowlist(t, root, "feat", "seed.go")
+	writeFile(t, filepath.Join(root, "timeline.jsonl"), "before\n")
+	writeFile(t, filepath.Join(dir, "events.jsonl"), "before\n")
+	writeFile(t, filepath.Join(dir, ".a1-guard.log"), "before\n")
+	writeFile(t, filepath.Join(dir, ".red"), "before\n")
+	writeFile(t, filepath.Join(dir, "handoff.md"), "before\n")
+	if code := RecoveryAttempts(
+		root,
+		[]string{"record", "--class", "proof_tool_defect", "reconcile telemetry", "first failure", "feat"},
+		&bytes.Buffer{},
+		&bytes.Buffer{},
+	); code != 0 {
+		t.Fatalf("initial recovery record = %d, want 0", code)
+	}
+	if code, out := runReconcile(t, root, "snapshot", "feat"); code != 0 {
+		t.Fatalf("snapshot = %d, want 0\n%s", code, out)
+	}
+
+	snapshotPath := filepath.Join(dir, reconcileDevritesName)
+	state, err := readDevritesState(snapshotPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	have := make(map[string]bool, len(state))
+	for _, item := range state {
+		have[item.Path] = true
+	}
+	for _, path := range []string{
+		"timeline.jsonl",
+		"work/feat/events.jsonl",
+		"work/feat/.a1-guard.log",
+		"work/feat/.red",
+		"work/feat/handoff.md",
+		"work/feat/recovery-attempts.jsonl",
+	} {
+		if !have[path] {
+			state = append(state, devritesStateEntry{Path: path, Fingerprint: "file:0600:legacy"})
+		}
+	}
+	if err := writeDevritesState(snapshotPath, state); err != nil {
+		t.Fatal(err)
+	}
+
+	writeFile(t, filepath.Join(root, "timeline.jsonl"), "after\n")
+	writeFile(t, filepath.Join(dir, "events.jsonl"), "after\n")
+	writeFile(t, filepath.Join(dir, ".a1-guard.log"), "after\n")
+	writeFile(t, filepath.Join(dir, ".red"), "after\n")
+	writeFile(t, filepath.Join(dir, "handoff.md"), "after\n")
+	if code := RecoveryAttempts(
+		root,
+		[]string{"record", "--class", "proof_tool_defect", "reconcile telemetry", "second failure", "feat"},
+		&bytes.Buffer{},
+		&bytes.Buffer{},
+	); code != 0 {
+		t.Fatalf("second recovery record = %d, want 0", code)
+	}
+
+	if code, out := runReconcile(t, root, "check", "feat"); code != 0 {
+		t.Fatalf("check = %d, want 0\n%s", code, out)
+	}
+}
+
+func TestReconcileRejectsCorruptRootOwnedRecoveryLedger(t *testing.T) {
+	newGitRepo(t)
+	root := workspace(t, "feat")
+	writeWrightAllowlist(t, root, "feat", "seed.go")
+	if code, out := runReconcile(t, root, "snapshot", "feat"); code != 0 {
+		t.Fatalf("snapshot = %d, want 0\n%s", code, out)
+	}
+	writeFile(t, filepath.Join(featureDir(root, "feat"), recoveryAttemptsFile), "{not-json}\n")
+
+	code, out := runReconcile(t, root, "check", "feat")
+	if code != 6 {
+		t.Fatalf("check = %d, want 6\n%s", code, out)
+	}
+	if !strings.Contains(out, "validate root-owned recovery ledger") {
+		t.Fatalf("corrupt recovery ledger missing from output:\n%s", out)
+	}
+}
+
+func TestReconcileRootOwnedOperationalPathsAreExact(t *testing.T) {
+	for _, path := range []string{
+		"timeline.jsonl",
+		"work/feat/.red",
+		"features/feat/events.jsonl",
+	} {
+		if !reconcileRootOwnedOperationalPath(path) {
+			t.Errorf("%q should be root-owned operational state", path)
+		}
+	}
+	for _, path := range []string{
+		"work/feat/.unknown.log",
+		"work/feat/action.log",
+		"work/feat/footprint.log",
+		"work/feat/state.md",
+	} {
+		if reconcileRootOwnedOperationalPath(path) {
+			t.Errorf("%q must remain fingerprinted", path)
+		}
+	}
+}
+
 func TestReconcileCheckFailsClosedWhenObjectDatabaseIsMissing(t *testing.T) {
 	newGitRepo(t)
 	root := workspace(t, "feat")

package/pack/.claude/skills/rite-build/reference/wright-dispatch.md

@@ -26,8 +26,8 @@ only the source-write lifecycle.
 4. Immediately before a serial dispatch:
 
    ```bash
-   devrites-engine reconcile snapshot
    devrites-engine stuck log "$(cat .devrites/ACTIVE 2>/dev/null)" dispatch "<slice id>"
+   devrites-engine reconcile snapshot
    ```
 
    A Forge slice runs `forge plan` first, then takes this same snapshot; see

package/pack/generated/claude/skills/rite-build/reference/wright-dispatch.md

@@ -26,8 +26,8 @@ only the source-write lifecycle.
 4. Immediately before a serial dispatch:
 
    ```bash
-   devrites-engine reconcile snapshot
    devrites-engine stuck log "$(cat .devrites/ACTIVE 2>/dev/null)" dispatch "<slice id>"
+   devrites-engine reconcile snapshot
    ```
 
    A Forge slice runs `forge plan` first, then takes this same snapshot; see

package/pack/generated/codex/skills/rite-build/reference/wright-dispatch.md

@@ -26,8 +26,8 @@ only the source-write lifecycle.
 4. Immediately before a serial dispatch:
 
    ```bash
-   devrites-engine reconcile snapshot
    devrites-engine stuck log "$(cat .devrites/ACTIVE 2>/dev/null)" dispatch "<slice id>"
+   devrites-engine reconcile snapshot
    ```
 
    A Forge slice runs `forge plan` first, then takes this same snapshot; see

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "3.2.7",
+  "version": "3.2.8",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",