devrites 3.2.9 → 3.2.11

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [3.2.11](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.10...v3.2.11) (2026-07-26)
+
+### Fixed
+
+* **devrites:** bind canonical state at wright start ([b58a531](https://github.com/ViktorsBaikers/DevRites/commit/b58a531749b94f734b7abf7469656ad543a0cfa0))
+
+## [3.2.10](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.9...v3.2.10) (2026-07-26)
+
+### Fixed
+
+* **devrites:** allow external dispatch scratch ([fdaac3f](https://github.com/ViktorsBaikers/DevRites/commit/fdaac3f9aaf19af897c6d3d70ce01fc046a60d3e))
+
 ## [3.2.9](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.8...v3.2.9) (2026-07-26)
 
 ### Fixed

package/README.md

@@ -25,7 +25,7 @@ final commit, push, and tag, and it requires a typed `GO` confirmation.
 Unattended runs may create local WIP checkpoint commits along the way, but only
 Ship collapses and pushes them.
 
-**Status:** [`v3.2.9`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.2.9): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v3.2.11`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.2.11): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 ## Quick start
 

package/docs/orchestration.md

@@ -62,11 +62,16 @@ Each dispatch follows the retained-baseline sequence:
 
 1. `reconcile snapshot` captures the original dirty-tree baseline, private Git
    objects, exact allowlist, and canonical-state fingerprint.
-2. The sole wright returns code/tests; the root validates its typed identity and
+2. The confirmed wright start captures a second canonical-state fingerprint.
+   This preserves the original source baseline while separating root-owned
+   recovery records that predate the writer from canonical mutations made while
+   the writer is active.
+3. The sole wright returns code/tests; the root validates its typed identity and
    exact changed-file set.
-3. `reconcile check` rejects anything outside the root allowlist.
-4. `test-integrity` runs against the retained baseline.
-5. After proof and decision checks pass, `reconcile close` retires the private
+4. `reconcile check` rejects anything outside the root allowlist and any
+   canonical-state change after the wright start.
+5. `test-integrity` runs against the retained baseline.
+6. After proof and decision checks pass, `reconcile close` retires the private
    window; only then does the root write canonical records.
 
 An ordinary `reconcile check` may revalidate an existing retained window
@@ -75,7 +80,9 @@ window. `reconcile close` still requires the confirmed, awaited wright result
 bound to the active snapshot. While the window is armed, the root guard permits
 inspectable writes only under `.devrites` or at an absolute scratch path outside
 the project; source-tree writes, relative escapes, and opaque execution remain
-blocked.
+blocked. The standalone A1 hook and wright-scope hook share this classification;
+Codex `cmd` and Claude `command` payloads may create a literal external packet
+with a patch, heredoc, or copy and may hash it without gaining source authority.
 
 The canonical-state fingerprint excludes root-owned operational records:
 `timeline.jsonl`, feature `events.jsonl`, a valid `recovery-attempts.jsonl`,

package/engine/hooks.go

@@ -377,7 +377,7 @@ func safeReadonlyShellSegment(segment string) bool {
 		"grep", "rg", "wc", "sort", "uniq", "cut", "tr", "stat", "file",
 		"readlink", "realpath", "basename", "dirname", "cmp", "diff", "jq", "yq",
 		"tree", "du", "df", "printenv", "which", "date", "uname", "id", "whoami",
-		"ps", "echo", "printf", "test", "[", "cd":
+		"ps", "echo", "printf", "test", "[", "cd", "sha256sum", "shasum":
 		return true
 	case "find":
 		return !hasAnyArg(args, "-delete", "-exec", "-execdir", "-ok", "-okdir", "-fprint", "-fprintf")
@@ -546,6 +546,7 @@ func hookSubagentOrient(h harness.Harness, stdin io.Reader, stdout, stderr io.Wr
 	}
 	agentType := h.SubagentAgentType(bytes.NewReader(data))
 	context := strings.ReplaceAll(subagentOrientContext, "\r\n", "\n")
+	confirmedRole := ""
 	if h == harness.Codex {
 		in, parseErr := parseAgentDispatchHookInput(bytes.NewReader(data))
 		root, ok := agentDispatchRoot()
@@ -559,6 +560,7 @@ func hookSubagentOrient(h harness.Harness, stdin io.Reader, stdout, stderr io.Wr
 			if bindErr != nil {
 				context += "\n\n- **Dispatch binding failed.** Return blocked without doing specialist work; the parent must repair the agent-start receipt."
 			} else if bound {
+				confirmedRole = role
 				if in.AgentType == role {
 					context += fmt.Sprintf(
 						"\n\n- **Confirmed role.** Your named Codex profile is `%s`; follow its loaded `developer_instructions` and execute only the unchanged packet from the parent.",
@@ -578,6 +580,17 @@ func hookSubagentOrient(h harness.Harness, stdin io.Reader, stdout, stderr io.Wr
 		}
 	} else if !strings.HasPrefix(agentType, "devrites-") {
 		return exitOK // Stay silent without a DevRites agent identity.
+	} else {
+		confirmedRole = agentType
+	}
+	if confirmedRole == "devrites-slice-wright" {
+		root, slug, _, ok := resolveWorkspace()
+		if !ok {
+			context += "\n\n- **Wright boundary unavailable.** Return blocked without writing; the parent must restore the active reconcile window."
+		} else if err := lib.CaptureReconcileWrightBoundary(root, slug); err != nil {
+			debugf(stderr, "subagent-orient wright boundary: %v", err)
+			context += "\n\n- **Wright boundary unavailable.** Return blocked without writing; the parent must repair the retained reconcile window."
+		}
 	}
 	out, err := h.SubagentStartContext(context)
 	if err != nil {

package/engine/hooks_agent_dispatch.go

@@ -400,6 +400,8 @@ func currentReconcileWindowID() string {
 	if !ok {
 		return ""
 	}
+	// The wright-start canonical fingerprint is captured after the pending
+	// receipt. It narrows the delta but does not change source authorization.
 	names := []string{".reconcile-base", ".reconcile-allowlist", ".reconcile-devrites"}
 	h := sha256.New()
 	for _, name := range names {

package/engine/hooks_workspace.go

@@ -325,6 +325,8 @@ func redwatchSafe(cmd string) string {
 // node regex the shell guards use.
 var patchPathRe = regexp.MustCompile(`(?m)^\*\*\* (?:(?:Add|Update|Delete) File|Move to): (.+)$`)
 
+var shellHeredocStartRe = regexp.MustCompile(`<<(-?)[ \t]*(?:'([A-Za-z_][A-Za-z0-9_]*)'|"([A-Za-z_][A-Za-z0-9_]*)"|([A-Za-z_][A-Za-z0-9_]*))`)
+
 // isEditTool reports whether a tool can write source. toolBaseName also handles
 // host-qualified names such as functions.apply_patch and MCP symbol editors.
 func isEditTool(tool string) bool {
@@ -346,6 +348,39 @@ func patchPaths(command string) []string {
 	return paths
 }
 
+func stripShellHeredocBodies(command string) (string, bool) {
+	lines := strings.Split(strings.ReplaceAll(command, "\r\n", "\n"), "\n")
+	out := make([]string, 0, len(lines))
+	for i := 0; i < len(lines); i++ {
+		line := lines[i]
+		out = append(out, line)
+		for _, match := range shellHeredocStartRe.FindAllStringSubmatch(line, -1) {
+			delimiter := match[2]
+			if delimiter == "" {
+				delimiter = match[3]
+			}
+			if delimiter == "" {
+				return "", false
+			}
+			found := false
+			for i++; i < len(lines); i++ {
+				candidate := lines[i]
+				if match[1] == "-" {
+					candidate = strings.TrimLeft(candidate, "\t")
+				}
+				if candidate == delimiter {
+					found = true
+					break
+				}
+			}
+			if !found {
+				return "", false
+			}
+		}
+	}
+	return strings.Join(out, "\n"), true
+}
+
 // shellOutputRedirections removes harmless fd redirects and returns every file
 // target of >, >>, or >|. Dynamic targets are opaque and therefore unsafe.
 func shellOutputRedirections(command string) (sanitized string, paths []string, opaque bool) {
@@ -471,44 +506,13 @@ func hookA1Guard(h harness.Harness, stdin io.Reader, stdout, stderr io.Writer) i
 	}
 
 	in := h.ParseGuardInput(bytes.NewReader(data))
-	if !isEditTool(in.ToolName) {
-		return exitOK
-	}
 	// The wright may edit. Claude sends agent_id; Codex sends agent_type.
 	if in.AgentID != "" || in.AgentType != "" {
 		return exitOK
 	}
-
-	projectDir := filepath.Dir(root)
-	target := ""
-	if in.ToolName == "apply_patch" {
-		sourcePatch := false
-		for _, p := range patchPaths(in.Command) {
-			abs := p
-			if !filepath.IsAbs(abs) {
-				abs = filepath.Join(projectDir, abs)
-			}
-			if !underDevrites(abs, root) {
-				sourcePatch = true
-				break
-			}
-		}
-		if !sourcePatch {
-			return exitOK
-		}
-		target = "apply_patch"
-	} else {
-		if in.FilePath == "" {
-			return exitOK
-		}
-		abs := in.FilePath
-		if !filepath.IsAbs(abs) {
-			abs = filepath.Join(projectDir, abs)
-		}
-		if underDevrites(abs, root) {
-			return exitOK // orchestrator editing its own .devrites bookkeeping
-		}
-		target = abs
+	handled, violation, target := classifyRootBuildWindowOperation(root, data, in)
+	if !handled || !violation {
+		return exitOK
 	}
 
 	mode := os.Getenv("DEVRITES_A1_HOOK")
@@ -842,7 +846,11 @@ func uniqueStrings(values []string) []string {
 }
 
 func wrightShellWritePaths(command string) ([]string, bool) {
-	if strings.TrimSpace(command) == "" || wrightForbiddenShellRe.MatchString(command) {
+	patches := patchPaths(command)
+	var ok bool
+	command, ok = stripShellHeredocBodies(command)
+	if !ok || strings.TrimSpace(command) == "" || strings.Contains(command, "$(") ||
+		strings.ContainsRune(command, '`') || wrightForbiddenShellRe.MatchString(command) {
 		return nil, true
 	}
 	sanitized, paths, opaque := shellOutputRedirections(command)
@@ -850,7 +858,6 @@ func wrightShellWritePaths(command string) ([]string, bool) {
 		return nil, true
 	}
 
-	patches := patchPaths(command)
 	if strings.Contains(command, "apply_patch") {
 		if len(patches) == 0 {
 			return nil, true
@@ -896,6 +903,15 @@ func wrightShellWritePaths(command string) ([]string, bool) {
 			found = nonFlagArgs(args)
 		case "rm", "unlink", "touch", "mkdir", "rmdir", "truncate":
 			found = nonFlagArgs(args)
+		case "cp":
+			if hasAnyArg(args, "-t", "--target-directory") || hasArgPrefix(args, "--target-directory=") {
+				return nil, true
+			}
+			operands := nonFlagArgs(args)
+			if len(operands) < 2 {
+				return nil, true
+			}
+			found = operands[len(operands)-1:]
 		default:
 			return nil, true
 		}
@@ -1014,14 +1030,22 @@ func guardRootBuildWindow(h harness.Harness, data []byte, in harness.GuardInput,
 		return exitOK, false
 	}
 
-	if isAgentDispatchTool(in.ToolName) {
-		return exitOK, true
+	handled, violation, _ := classifyRootBuildWindowOperation(root, data, in)
+	if violation {
+		return denyWright(h, stdout, stderr, a1DenyReason, drvreason.HookA1Denied), true
 	}
+	return exitOK, handled
+}
 
-	projectDir := filepath.Dir(root)
+func classifyRootBuildWindowOperation(root string, data []byte, in harness.GuardInput) (handled, violation bool, target string) {
+	if isAgentDispatchTool(in.ToolName) {
+		return true, false, ""
+	}
 	if isOpaqueExecutionTool(in.ToolName) {
-		return denyWright(h, stdout, stderr, a1DenyReason, drvreason.HookA1Denied), true
+		return true, true, in.ToolName
 	}
+
+	projectDir := filepath.Dir(root)
 	targets, suspicious := rootMutationTargets(data, in)
 	for _, target := range targets {
 		absoluteTarget := filepath.IsAbs(target)
@@ -1032,21 +1056,24 @@ func guardRootBuildWindow(h harness.Harness, data []byte, in harness.GuardInput,
 		abs = filepath.Clean(abs)
 		resolved, err := resolveRootMutationTarget(abs)
 		if err != nil {
-			return denyWright(h, stdout, stderr, a1DenyReason, drvreason.HookA1Denied), true
+			return true, true, target
 		}
 		insideProject := pathWithin(resolved, projectDir)
 		if (insideProject && !underDevrites(resolved, root)) ||
 			(!insideProject && !absoluteTarget) {
-			return denyWright(h, stdout, stderr, a1DenyReason, drvreason.HookA1Denied), true
+			return true, true, target
 		}
 	}
 	if suspicious {
-		return denyWright(h, stdout, stderr, a1DenyReason, drvreason.HookA1Denied), true
+		return true, true, in.ToolName
 	}
 	if len(targets) > 0 {
-		return exitOK, true
+		return true, false, strings.Join(targets, ",")
+	}
+	if isShellTool(in.ToolName) && safeReadonlyShellCommand(in.Command) {
+		return true, false, ""
 	}
-	return exitOK, false
+	return false, false, ""
 }
 
 func resolveRootMutationTarget(filename string) (string, error) {
@@ -1074,7 +1101,8 @@ func rootMutationTargets(data []byte, in harness.GuardInput) ([]string, bool) {
 		if len(targets) > 0 {
 			return targets, false
 		}
-		return nil, opaque && (reviewerMutateRe.MatchString(in.Command) || opaqueInterpreterRe.MatchString(in.Command))
+		_, completeHeredoc := stripShellHeredocBodies(in.Command)
+		return nil, opaque && (!completeHeredoc || reviewerMutateRe.MatchString(in.Command) || opaqueInterpreterRe.MatchString(in.Command))
 	default:
 		return nil, false
 	}

package/engine/internal/harness/harness.go

@@ -214,6 +214,7 @@ func (h Harness) ParseGuardInput(r io.Reader) GuardInput {
 		ToolName  string `json:"tool_name"`
 		ToolInput struct {
 			Command  string `json:"command"`
+			Cmd      string `json:"cmd"`
 			FilePath string `json:"file_path"`
 			Path     string `json:"path"`
 		} `json:"tool_input"`
@@ -237,7 +238,7 @@ func (h Harness) ParseGuardInput(r io.Reader) GuardInput {
 	}
 	return GuardInput{
 		ToolName:     raw.ToolName,
-		Command:      raw.ToolInput.Command,
+		Command:      firstNonEmpty(raw.ToolInput.Command, raw.ToolInput.Cmd),
 		FilePath:     firstNonEmpty(raw.ToolInput.FilePath, raw.ToolInput.Path),
 		SessionID:    raw.SessionID,
 		AgentType:    raw.AgentType,

package/engine/internal/harness/harness_test.go

@@ -113,6 +113,10 @@ func TestHarnessParsersFailOpenAndFallbacks(t *testing.T) {
 	if guard.ToolName != "Edit" || guard.FilePath != "src/app.go" || guard.AgentID != "a1" || guard.ToolResponse != `{"ok":true}` {
 		t.Fatalf("ParseGuardInput = %#v", guard)
 	}
+	guard = Codex.ParseGuardInput(strings.NewReader(`{"tool_name":"functions.exec_command","tool_input":{"cmd":"sha256sum /tmp/agent-packet.yaml"}}`))
+	if guard.ToolName != "functions.exec_command" || guard.Command != "sha256sum /tmp/agent-packet.yaml" {
+		t.Fatalf("ParseGuardInput Codex cmd = %#v", guard)
+	}
 
 	if got := Codex.SubagentAgentType(strings.NewReader(`{"agentType":"executor"}`)); got != "executor" {
 		t.Fatalf("SubagentAgentType fallback = %q, want executor", got)

package/engine/internal/lib/reconcile.go

@@ -23,6 +23,7 @@ const (
 	reconcileCheckedName        = ".reconcile-checked"
 	reconcileDevritesName       = ".reconcile-devrites"
 	reconcileObjectsName        = ".reconcile-objects"
+	reconcileWrightStateName    = ".reconcile-wright-devrites"
 	defaultWrightAllowlistName  = ".wright-allowlist"
 	wrightAllowlistFileEnv      = "DEVRITES_WRIGHT_ALLOWLIST_FILE"
 	reconcileDevritesPathPrefix = ".devrites/"
@@ -30,9 +31,11 @@ const (
 
 // Reconcile enforces the source-write boundary around one dispatched
 // slice-wright. The first `snapshot` captures the dirty worktree, private object
-// database, exact orchestrator-authored allowlist, and .devrites state. After a
-// clean check, another snapshot re-arms only the dispatch state for a retry while
-// retaining the original source baseline.
+// database, exact orchestrator-authored allowlist, and .devrites state. A
+// confirmed wright start captures the current canonical state separately, so
+// retained-window recovery records are not attributed to the writer. After a
+// clean check, another snapshot re-arms only the dispatch state for a retry
+// while retaining the original source baseline.
 // `check` compares the captured state with the current state and retains the
 // immutable baseline for the later test-integrity gate.
 // `close` explicitly ends the window and removes its private artifacts.
@@ -62,10 +65,11 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 	devritesSnapshot := filepath.Join(d, reconcileDevritesName)
 	objects := filepath.Join(d, reconcileObjectsName)
 	checked := filepath.Join(d, reconcileCheckedName)
+	wrightState := filepath.Join(d, reconcileWrightStateName)
 
 	closeWindow := func() error {
 		var failures []string
-		for _, privateFile := range []string{base, capturedAllowlist, devritesSnapshot, checked} {
+		for _, privateFile := range []string{base, capturedAllowlist, devritesSnapshot, checked, wrightState} {
 			if err := os.Remove(privateFile); err != nil && !os.IsNotExist(err) {
 				failures = append(failures, fmt.Sprintf("%s: %v", filepath.Base(privateFile), err))
 			}
@@ -131,7 +135,7 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 				fmt.Fprintf(stderr, "reconcile: cannot refresh wright allowlist: %v\n", err)
 				return 6
 			}
-			state, err := captureReconcileDevritesState(root, devritesSnapshot, activeObjects, checked)
+			state, err := captureReconcileDevritesState(root, devritesSnapshot, activeObjects, checked, wrightState)
 			if err != nil {
 				fmt.Fprintf(stderr, "reconcile: cannot refresh .devrites snapshot: %v\n", err)
 				return 6
@@ -140,9 +144,11 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 				fmt.Fprintf(stderr, "reconcile: cannot write refreshed .devrites snapshot: %v\n", err)
 				return 6
 			}
-			if err := os.Remove(checked); err != nil {
-				fmt.Fprintf(stderr, "reconcile: cannot arm refreshed slice window: %v\n", err)
-				return 6
+			for _, privateFile := range []string{checked, wrightState} {
+				if err := os.Remove(privateFile); err != nil && !os.IsNotExist(err) {
+					fmt.Fprintf(stderr, "reconcile: cannot arm refreshed slice window: %v\n", err)
+					return 6
+				}
 			}
 			fmt.Fprintf(stdout, "reconcile: dispatch snapshot refreshed for %s; original slice baseline retained.\n", slug)
 			return 0
@@ -180,7 +186,7 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 			fmt.Fprintf(stderr, "reconcile: cannot capture wright allowlist: %v\n", err)
 			return 6
 		}
-		state, err := captureReconcileDevritesState(root, devritesSnapshot, objects, checked)
+		state, err := captureReconcileDevritesState(root, devritesSnapshot, objects, checked, wrightState)
 		if err != nil {
 			_ = closeWindow()
 			fmt.Fprintf(stderr, "reconcile: cannot snapshot .devrites: %v\n", err)
@@ -210,13 +216,20 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 			fmt.Fprintf(stderr, "reconcile: invalid captured allowlist: %v\n", err)
 			return 6
 		}
-		beforeDevrites, err := readDevritesState(devritesSnapshot)
+		beforeDevritesPath := devritesSnapshot
+		if _, err := os.Lstat(wrightState); err == nil {
+			beforeDevritesPath = wrightState
+		} else if !os.IsNotExist(err) {
+			fmt.Fprintf(stderr, "reconcile: invalid wright-start .devrites snapshot: %v\n", err)
+			return 6
+		}
+		beforeDevrites, err := readDevritesState(beforeDevritesPath)
 		if err != nil {
 			fmt.Fprintf(stderr, "reconcile: invalid .devrites snapshot: %v\n", err)
 			return 6
 		}
 		beforeDevrites = withoutRootOwnedOperationalState(beforeDevrites)
-		afterDevrites, err := captureReconcileDevritesState(root, devritesSnapshot, objects, checked)
+		afterDevrites, err := captureReconcileDevritesState(root, devritesSnapshot, objects, checked, wrightState)
 		if err != nil {
 			fmt.Fprintf(stderr, "reconcile: cannot compare .devrites: %v\n", err)
 			return 6
@@ -274,6 +287,50 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 	}
 }
 
+// CaptureReconcileWrightBoundary records canonical state at the confirmed
+// wright start. The original source baseline remains untouched; reconciliation
+// can therefore distinguish root recovery records that predate the writer from
+// canonical mutations made while the writer is active.
+func CaptureReconcileWrightBoundary(root, slug string) error {
+	d := featureDir(root, slug)
+	if slug == "" || !isDir(d) {
+		return fmt.Errorf("no active workspace")
+	}
+	base := filepath.Join(d, reconcileBaseName)
+	capturedAllowlist := filepath.Join(d, reconcileAllowlistName)
+	devritesSnapshot := filepath.Join(d, reconcileDevritesName)
+	objects := filepath.Join(d, reconcileObjectsName)
+	checked := filepath.Join(d, reconcileCheckedName)
+	wrightState := filepath.Join(d, reconcileWrightStateName)
+
+	for _, filename := range []string{base, capturedAllowlist} {
+		info, err := os.Lstat(filename)
+		if err != nil || !info.Mode().IsRegular() {
+			if err == nil {
+				err = fmt.Errorf("not a regular file")
+			}
+			return fmt.Errorf("invalid reconcile window %s: %w", filepath.Base(filename), err)
+		}
+	}
+	if !isDir(objects) {
+		return fmt.Errorf("invalid reconcile window %s: not a directory", filepath.Base(objects))
+	}
+	if _, err := readDevritesState(devritesSnapshot); err != nil {
+		return fmt.Errorf("invalid reconcile window %s: %w", filepath.Base(devritesSnapshot), err)
+	}
+	state, err := captureReconcileDevritesState(
+		root,
+		devritesSnapshot,
+		objects,
+		checked,
+		wrightState,
+	)
+	if err != nil {
+		return err
+	}
+	return writeDevritesState(wrightState, state)
+}
+
 func wrightAllowlistPath(gitRoot, workspace string) (string, error) {
 	configured := os.Getenv(wrightAllowlistFileEnv)
 	var filename string

package/engine/internal/lib/reconcile_test.go

@@ -361,6 +361,49 @@ func TestReconcileRejectsDevritesMutation(t *testing.T) {
 	}
 }
 
+func TestReconcileUsesWrightStartAsCanonicalStateBoundary(t *testing.T) {
+	gitRoot := newGitRepo(t)
+	root := workspace(t, "feat")
+	dir := featureDir(root, "feat")
+	writeWrightAllowlist(t, root, "feat", "seed.go")
+	if code, out := runReconcile(t, root, "snapshot", "feat"); code != 0 {
+		t.Fatalf("snapshot = %d, want 0\n%s", code, out)
+	}
+
+	// Root-owned canonical records may legitimately change while a retained
+	// source baseline survives technical recovery. The next wright start is the
+	// boundary that separates those changes from the writer's delta.
+	for _, name := range []string{
+		"action.log",
+		"browser-evidence.md",
+		"decisions.md",
+		"evidence.md",
+		"footprint.log",
+		"state.md",
+		"touched-files.md",
+	} {
+		writeFile(t, filepath.Join(dir, name), "Root-owned recovery record\n")
+	}
+	if err := CaptureReconcileWrightBoundary(root, "feat"); err != nil {
+		t.Fatalf("capture wright boundary: %v", err)
+	}
+	writeFile(t, filepath.Join(gitRoot, "seed.go"), "package main\n\nfunc repaired() {}\n")
+
+	if code, out := runReconcile(t, root, "check", "feat"); code != 0 {
+		t.Fatalf("check = %d, want 0\n%s", code, out)
+	}
+
+	// A canonical mutation after the wright starts is still a violation.
+	writeFile(t, filepath.Join(dir, "state.md"), "Phase: prove\n")
+	code, out := runReconcile(t, root, "check", "feat")
+	if code != 5 {
+		t.Fatalf("check after writer-time canonical mutation = %d, want 5\n%s", code, out)
+	}
+	if !strings.Contains(out, ".devrites/work/feat/state.md") {
+		t.Fatalf("writer-time canonical mutation missing from output:\n%s", out)
+	}
+}
+
 func TestReconcileAllowsRootOwnedOperationalFiles(t *testing.T) {
 	newGitRepo(t)
 	root := workspace(t, "feat")
@@ -613,6 +656,7 @@ func TestReconcileRefreshPreservesOriginalBaselineAcrossRetry(t *testing.T) {
 	// between attempts. Refresh must re-arm those boundaries without replacing
 	// the original pre-slice source baseline.
 	writeFile(t, filepath.Join(featureDir(root, "feat"), "recovery-attempts.json"), "{}\n")
+	writeFile(t, filepath.Join(featureDir(root, "feat"), reconcileWrightStateName), "stale\n")
 	writeWrightAllowlist(t, root, "feat", "seed.go", "retry.go")
 	if code, out := runReconcile(t, root, "snapshot", "feat"); code != 0 {
 		t.Fatalf("refresh snapshot = %d, want 0\n%s", code, out)
@@ -626,6 +670,9 @@ func TestReconcileRefreshPreservesOriginalBaselineAcrossRetry(t *testing.T) {
 	if !bytes.Equal(originalBase, refreshedBase) {
 		t.Fatalf("refresh replaced original baseline: before=%q after=%q", originalBase, refreshedBase)
 	}
+	if isFile(filepath.Join(featureDir(root, "feat"), reconcileWrightStateName)) {
+		t.Fatal("refresh retained the prior wright-start boundary")
+	}
 
 	writeFile(t, filepath.Join(gitRoot, "retry.go"), "package main\n")
 	if code, out := runReconcile(t, root, "check", "feat"); code != 0 {
@@ -655,6 +702,7 @@ func TestReconcileCloseClearsPrivateWindowState(t *testing.T) {
 	newGitRepo(t)
 	root := workspace(t, "feat")
 	writeFile(t, filepath.Join(root, "work", "feat", reconcileBaseName), "stale\n")
+	writeFile(t, filepath.Join(root, "work", "feat", reconcileWrightStateName), "stale\n")
 	if err := os.MkdirAll(filepath.Join(root, "work", "feat", reconcileObjectsName), 0o755); err != nil {
 		t.Fatal(err)
 	}
@@ -666,7 +714,9 @@ func TestReconcileCloseClearsPrivateWindowState(t *testing.T) {
 	if !strings.Contains(out, "closed slice window") {
 		t.Errorf("expected close message:\n%s", out)
 	}
-	if isFile(filepath.Join(featureDir(root, "feat"), reconcileBaseName)) || isDir(filepath.Join(featureDir(root, "feat"), reconcileObjectsName)) {
+	if isFile(filepath.Join(featureDir(root, "feat"), reconcileBaseName)) ||
+		isFile(filepath.Join(featureDir(root, "feat"), reconcileWrightStateName)) ||
+		isDir(filepath.Join(featureDir(root, "feat"), reconcileObjectsName)) {
 		t.Fatal("close retained private baseline state")
 	}
 }

package/engine/tests/hook_test.go

@@ -583,9 +583,11 @@ func TestHookWrightScopeRequiresSpawnedCodexWorkerForSourceWrites(t *testing.T)
 	runGuard(`{"tool_name":"spawn_agent","tool_input":{"agent_type":"worker"}}`, false)
 	runGuard(`{"tool_name":"spawn_agent","tool_input":{"agent_type":"explorer"}}`, false)
 	runGuard(`{"tool_name":"Write","tool_input":{"file_path":".devrites/features/auth-tokens/state.md"}}`, false)
+	scratch := t.TempDir()
+	packet := filepath.Join(scratch, "agent-packet.yaml")
 	runGuard(hookPayload(t, map[string]any{
 		"tool_name":  "Write",
-		"tool_input": map[string]any{"file_path": filepath.Join(t.TempDir(), "agent-packet.yaml")},
+		"tool_input": map[string]any{"file_path": packet},
 	}), false)
 	runGuard(`{"tool_name":"Write","tool_input":{"file_path":"../outside.txt"}}`, true)
 	runGuard(`{"tool_name":"Write","tool_input":{"file_path":"src/app.go"}}`, true)
@@ -649,6 +651,59 @@ func TestHookA1GuardIgnoresLegacyInlineMarker(t *testing.T) {
 	}
 }
 
+func TestHookA1GuardAllowsExternalDispatchScratchOnly(t *testing.T) {
+	root := newWorkspace(t)
+	writeActive(t, root, "auth-tokens")
+	workspace := filepath.Join(root, "features", "auth-tokens")
+	if err := os.WriteFile(filepath.Join(workspace, ".reconcile-base"), []byte("snapshot\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	scratch := t.TempDir()
+	packet := filepath.Join(scratch, "agent-packet.yaml")
+	env := []string{"DEVRITES_A1_HOOK=enforce"}
+	patch := func(tool, path string, freeform bool) string {
+		body := "*** Begin Patch\n*** Add File: " + path + "\n+x\n*** End Patch\n"
+		if freeform {
+			return hookPayload(t, map[string]any{"tool_name": tool, "tool_input": body})
+		}
+		return hookPayload(t, map[string]any{"tool_name": tool, "tool_input": map[string]any{"patch": body}})
+	}
+	shell := func(command string) string {
+		return hookPayload(t, map[string]any{
+			"tool_name":  "functions.exec_command",
+			"tool_input": map[string]any{"cmd": command},
+		})
+	}
+
+	runGuard := func(input string, deny bool) {
+		t.Helper()
+		out, errOut, code := runDevritesIO(t, root, input, env,
+			"hook", "a1-guard", "--harness=codex")
+		if code != 0 {
+			t.Fatalf("exit=%d out=%q stderr=%q", code, out, errOut)
+		}
+		if deny {
+			if decision, _ := parsePermissionDecision(t, out); decision != "deny" {
+				t.Fatalf("expected deny, got %q", out)
+			}
+		} else if strings.TrimSpace(out) != "" {
+			t.Fatalf("expected allow, got %q", out)
+		}
+	}
+
+	runGuard(patch("apply_patch", packet, false), false)
+	runGuard(patch("functions.apply_patch", packet, true), false)
+	runGuard(shell("cat <<'EOF' > "+packet+"\npacket_version: agent-packet/v1\nEOF"), false)
+	runGuard(shell("sha256sum "+packet), false)
+	runGuard(shell("cp "+packet+" "+filepath.Join(scratch, "agent-packet.copy.yaml")), false)
+	runGuard(patch("apply_patch", "src/app.go", false), true)
+	runGuard(patch("functions.apply_patch", "src/app.go", true), true)
+	runGuard(shell("cat <<'EOF' > src/app.go\npackage src\nEOF"), true)
+	runGuard(shell("cat <<'EOF' > "+packet+"\nunterminated"), true)
+	runGuard(shell("cat <<EOF > "+packet+"\n$(cp "+packet+" src/app.go)\nEOF"), true)
+	runGuard(shell("cp "+packet+" src/app.go"), true)
+}
+
 func TestHookWrightScopeFailsClosedWhenWorkspaceResolutionFails(t *testing.T) {
 	root := newWorkspace(t)
 	if err := os.Remove(filepath.Join(root, "ACTIVE")); err != nil && !os.IsNotExist(err) {
@@ -871,6 +926,44 @@ func TestHookSubagentOrientSilentForNonDevritesAgent(t *testing.T) {
 	}
 }
 
+func TestHookSubagentOrientCapturesWrightCanonicalBoundary(t *testing.T) {
+	root := newWorkspace(t)
+	writeActive(t, root, "auth-tokens")
+	workspace := filepath.Join(root, "features", "auth-tokens")
+	if err := os.MkdirAll(filepath.Join(workspace, ".reconcile-objects"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	for name, body := range map[string]string{
+		".reconcile-base":      "base\n",
+		".reconcile-allowlist": "",
+		".reconcile-devrites":  "[]\n",
+		"state.md":             "Phase: build\n",
+		"browser-evidence.md":  "Prior root evidence\n",
+	} {
+		if err := os.WriteFile(filepath.Join(workspace, name), []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	in := `{"agent_type":"devrites-slice-wright"}`
+	out, errOut, code := runDevritesIO(t, root, in, nil, "hook", "subagent-orient", "--harness=claude")
+	if code != 0 {
+		t.Fatalf("exit = %d, want 0 (stderr: %s)", code, errOut)
+	}
+	if strings.Contains(out, "Wright boundary unavailable") {
+		t.Fatalf("wright start was blocked: %s", out)
+	}
+	raw, err := os.ReadFile(filepath.Join(workspace, ".reconcile-wright-devrites"))
+	if err != nil {
+		t.Fatalf("read wright boundary: %v", err)
+	}
+	for _, path := range []string{"features/auth-tokens/state.md", "features/auth-tokens/browser-evidence.md"} {
+		if !strings.Contains(string(raw), path) {
+			t.Errorf("wright boundary omitted %s: %s", path, raw)
+		}
+	}
+}
+
 func hookPayload(t *testing.T, value map[string]any) string {
 	t.Helper()
 	raw, err := json.Marshal(value)
@@ -1704,11 +1797,18 @@ func TestCodexAgentDispatchGatesReconcileCloseOnBoundWrightResult(t *testing.T)
 	root := newWorkspace(t)
 	writeActive(t, root, "auth-tokens")
 	workspace := filepath.Join(root, "features", "auth-tokens")
-	for _, name := range []string{".reconcile-base", ".reconcile-allowlist", ".reconcile-devrites"} {
-		if err := os.WriteFile(filepath.Join(workspace, name), []byte(name+"\n"), 0o600); err != nil {
+	for name, body := range map[string]string{
+		".reconcile-base":      ".reconcile-base\n",
+		".reconcile-allowlist": ".reconcile-allowlist\n",
+		".reconcile-devrites":  "[]\n",
+	} {
+		if err := os.WriteFile(filepath.Join(workspace, name), []byte(body), 0o600); err != nil {
 			t.Fatal(err)
 		}
 	}
+	if err := os.MkdirAll(filepath.Join(workspace, ".reconcile-objects"), 0o700); err != nil {
+		t.Fatal(err)
+	}
 	sessionID, turnID := "session-wright", "turn-wright"
 	writeCodexAgentContract(t, root, "devrites-slice-wright")
 	writeCodexSkillContract(t, root, "rite-build", "devrites-slice-wright")
@@ -1753,7 +1853,7 @@ func TestCodexAgentDispatchGatesReconcileCloseOnBoundWrightResult(t *testing.T)
 			"tool_name":       "spawn_agent",
 			"tool_use_id":     "spawn-wright",
 			"tool_input": map[string]any{
-				"agent_type": "worker",
+				"agent_type": "devrites-slice-wright",
 				"fork_turns": "none",
 				"message":    "Read .codex/agents/devrites-slice-wright.toml.",
 			},
@@ -1763,14 +1863,14 @@ func TestCodexAgentDispatchGatesReconcileCloseOnBoundWrightResult(t *testing.T)
 			"session_id":      sessionID,
 			"turn_id":         "child-wright",
 			"agent_id":        "agent-wright",
-			"agent_type":      "worker",
+			"agent_type":      "devrites-slice-wright",
 		},
 		{
 			"hook_event_name":        "SubagentStop",
 			"session_id":             sessionID,
 			"turn_id":                "child-wright",
 			"agent_id":               "agent-wright",
-			"agent_type":             "worker",
+			"agent_type":             "devrites-slice-wright",
 			"last_assistant_message": "agent-result/v1 complete",
 		},
 		{
@@ -1790,6 +1890,9 @@ func TestCodexAgentDispatchGatesReconcileCloseOnBoundWrightResult(t *testing.T)
 			t.Fatalf("%s exit=%d stderr=%s", hook, code, stderr)
 		}
 	}
+	if _, err := os.Stat(filepath.Join(workspace, ".reconcile-wright-devrites")); err != nil {
+		t.Fatalf("wright start did not capture canonical boundary: %v", err)
+	}
 
 	if out, stderr, code := runDevritesIO(t, root, closeWindow, nil,
 		"hook", "agent-dispatch", "--harness=codex"); code != 0 || strings.TrimSpace(out) != "" {

package/pack/.claude/skills/rite-build/reference/wright-dispatch.md

@@ -120,10 +120,12 @@ resume the same slice. Close it before abandoning the slice for a scope/plan tra
 
 ## Host dispatch
 
-Use named wright → enforced V1 generic worker from `standards/agents.md`. On Codex
-MultiAgent V2, dispatch the exact named `devrites-slice-wright` with a unique
-`task_name` and `fork_turns="none"`; its durable child rollout must prove the native
-wright role, wait, completion, and non-empty result from the current reconcile window.
+Use named wright → enforced V1 generic worker from `standards/agents.md`. Codex V2
+dispatches the exact named `devrites-slice-wright` with a unique `task_name` and
+`fork_turns="none"`; its durable rollout proves the native role, wait, and non-empty
+result in the current window. The confirmed start fingerprints canonical state apart
+from the retained source baseline: pre-start root recovery records are excluded, while
+post-start canonical changes fail.
 Any generic worker still needs the exact allowlist or an isolated checkout;
 reconciliation alone is insufficient. If no safe fresh-agent rung is available, stop
 for HITL. On Codex, `reconcile check` and `reconcile close` require the completed

package/pack/generated/claude/skills/rite-build/reference/wright-dispatch.md

@@ -120,10 +120,12 @@ resume the same slice. Close it before abandoning the slice for a scope/plan tra
 
 ## Host dispatch
 
-Use named wright → enforced V1 generic worker from `standards/agents.md`. On Codex
-MultiAgent V2, dispatch the exact named `devrites-slice-wright` with a unique
-`task_name` and `fork_turns="none"`; its durable child rollout must prove the native
-wright role, wait, completion, and non-empty result from the current reconcile window.
+Use named wright → enforced V1 generic worker from `standards/agents.md`. Codex V2
+dispatches the exact named `devrites-slice-wright` with a unique `task_name` and
+`fork_turns="none"`; its durable rollout proves the native role, wait, and non-empty
+result in the current window. The confirmed start fingerprints canonical state apart
+from the retained source baseline: pre-start root recovery records are excluded, while
+post-start canonical changes fail.
 Any generic worker still needs the exact allowlist or an isolated checkout;
 reconciliation alone is insufficient. If no safe fresh-agent rung is available, stop
 for HITL. On Codex, `reconcile check` and `reconcile close` require the completed

package/pack/generated/codex/skills/rite-build/reference/wright-dispatch.md

@@ -120,10 +120,12 @@ resume the same slice. Close it before abandoning the slice for a scope/plan tra
 
 ## Host dispatch
 
-Use named wright → enforced V1 generic worker from `standards/agents.md`. On Codex
-MultiAgent V2, dispatch the exact named `devrites-slice-wright` with a unique
-`task_name` and `fork_turns="none"`; its durable child rollout must prove the native
-wright role, wait, completion, and non-empty result from the current reconcile window.
+Use named wright → enforced V1 generic worker from `standards/agents.md`. Codex V2
+dispatches the exact named `devrites-slice-wright` with a unique `task_name` and
+`fork_turns="none"`; its durable rollout proves the native role, wait, and non-empty
+result in the current window. The confirmed start fingerprints canonical state apart
+from the retained source baseline: pre-start root recovery records are excluded, while
+post-start canonical changes fail.
 Any generic worker still needs the exact allowlist or an isolated checkout;
 reconciliation alone is insufficient. If no safe fresh-agent rung is available, stop
 for HITL. On Codex, `reconcile check` and `reconcile close` require the completed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "3.2.9",
+  "version": "3.2.11",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",