devrites 4.0.11 → 4.1.0

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [4.1.0](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.12...v4.1.0) (2026-08-12)
+
+### Added
+
+* **rite:** add bounded host-native loop operations ([af8f50e](https://github.com/ViktorsBaikers/DevRites/commit/af8f50e434160a7ab33d7e4c8b5b387c4097bfdc))
+* **rite:** deepen engineering risk guidance ([a109d35](https://github.com/ViktorsBaikers/DevRites/commit/a109d35788d831f037361cbc5c491d0b2cb2dd64))
+* **rite:** govern decision horizons and learnings ([af48088](https://github.com/ViktorsBaikers/DevRites/commit/af48088157107e08f60a82659d7e445180ed1e96))
+
+## [4.0.12](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.11...v4.0.12) (2026-08-09)
+
+### Fixed
+
+* **rite:** keep internal replans in autocomplete ([9dbbd30](https://github.com/ViktorsBaikers/DevRites/commit/9dbbd30d6fbb088f2b175b6c4af06a9d7e5e9114))
+
 ## [4.0.11](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.10...v4.0.11) (2026-08-08)
 
 ### Fixed

package/README.md

@@ -28,7 +28,7 @@ project-conventional push, tag, or PR action, and archive the workspace.
 Unattended runs may create local WIP checkpoint commits along the way, but they
 remain local unless Ship's disclosed plan includes an approved remote action.
 
-**Status:** [`v4.0.11`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.0.11): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v4.1.0`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.1.0): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -107,6 +107,8 @@ Some work needs a different route:
   Autocomplete reopens a stale missing-writer stop once instead of preserving the
   obsolete recovery count. The first real root-materializer failure then counts as
   attempt one under normal fingerprint recovery; it is not terminal by itself.
+  Likewise, an internal `NEEDS_REPLAN` result stays inside Autocomplete: it runs
+  the next Plan repair and narrow Vet without returning a command to the user.
 - [`/rite-upgrade [slug]`](pack/.claude/skills/rite-upgrade/SKILL.md) is a
   compatibility route for an older active workspace that cannot resume. Age or
   cursor form alone never triggers repair; it is not a lifecycle phase.
@@ -379,8 +381,8 @@ through Claude Code or Codex plugin stores.
 
 ## Skills and agents
 
-The pack ships 43 skills: 32 public and 11 internal. The public surface contains
-the `rite` menu and 31 `rite-*` workflows and utilities. Ten `devrites-*`
+The pack ships 44 skills: 33 public and 11 internal. The public surface contains
+the `rite` menu and 32 `rite-*` workflows and utilities. Ten `devrites-*`
 specialists load when a matching task needs them; `devrites-lib` carries the
 shared contracts and engineering standards.
 

package/docs/architecture.md

@@ -33,8 +33,8 @@ cursor readers, traceability rules, and phase-relative completeness model, see
 2. **Public utility and on-ramp skills**: `rite-adopt`, `rite-quick`,
    `rite-frame`, `rite-status`, `rite-doctor`, `rite-upgrade`, `rite-learn`, `rite-explain`,
    `rite-customize`, `rite-zoom-out`, `rite-prototype`, `rite-handoff`,
-   `rite-pressure-test`, `rite-pov`, `rite-dogfood`, `rite-pr-feedback`, and
-   `rite-autocomplete`. These are public commands. `rite-autocomplete` is the
+   `rite-pressure-test`, `rite-pov`, `rite-dogfood`, `rite-pr-feedback`,
+   `rite-watch-pr`, and `rite-autocomplete`. These are public commands. `rite-autocomplete` is the
    unattended orchestrator. By default it drives the reversible lifecycle
    through Seal GO and stops. Explicit `--ship` enters Ship preflight but still
    waits for a fresh literal `GO` and native approval before mutation. It
@@ -381,8 +381,8 @@ contract.
 
 ## Design choices at a glance
 
-- **Surface**: 31 public `rite-*` skills (43 total), plus the thin `/rite`
-  menu: 32 public and 11 internal. The lifecycle
+- **Surface**: 32 public `rite-*` skills (44 total), plus the thin `/rite`
+  menu: 33 public and 11 internal. The lifecycle
   includes mandatory adaptive Clarify, optional Temper, mandatory Vet, and
   Converge recovery; Seal **decides** and Ship **executes + closes**. Ten
   `devrites-*` specialist skills are model-invoked; `devrites-lib` is the

package/docs/command-map.md

@@ -19,8 +19,8 @@ mean that a skill is internal; each `SKILL.md` uses `user-invocable:` to set
 visibility. Public utilities use the `rite-*` prefix: `rite-quick`,
 `rite-frame`, `rite-adopt`, `rite-learn`, `rite-doctor`, `rite-customize`,
 `rite-zoom-out`, `rite-prototype`, `rite-handoff`, `rite-pressure-test`,
-`rite-autocomplete`, `rite-explain`, `rite-pov`, `rite-dogfood`, and
-`rite-pr-feedback`, plus the evidence-gated workspace compatibility command
+`rite-autocomplete`, `rite-explain`, `rite-pov`, `rite-dogfood`,
+`rite-pr-feedback`, and `rite-watch-pr`, plus the evidence-gated workspace compatibility command
 `rite-upgrade`. The host may invoke `devrites-*` specialists through the model.
 `devrites-lib` is the non-workflow library exception.
 
@@ -113,6 +113,7 @@ See [`cli.md`](cli.md).
 | [`/rite-pov`](../pack/.claude/skills/rite-pov/SKILL.md) | utility | `[candidate/link/question]` | Project-grounded verdict on one outside option after live repository and primary-source evidence. | live code/docs + external sources | `decisions.md` or ADR only on request |
 | [`/rite-dogfood`](../pack/.claude/skills/rite-dogfood/SKILL.md) | utility | `[feature-slug\|branch] [--port N]` | Diff-scoped browser QA: map changed user journeys, run scenario matrix, fix small obvious breakages, write dogfood report. Explicit-only. | diff + app routes + browser | `.devrites/work/<slug>/dogfood.md` + safe fixes |
 | [`/rite-pr-feedback`](../pack/.claude/skills/rite-pr-feedback/SKILL.md) | utility | `[PR number\|thread URL\|blank for current branch]` | Resolve GitHub PR review feedback: fetch unresolved threads, judge centrally, fix valid items, reply, resolve. Explicit-only. | PR threads + code | code/tests + PR replies/resolutions |
+| [`/rite-watch-pr`](../pack/.claude/skills/rite-watch-pr/SKILL.md) | utility | `[PR number\|PR URL\|blank for current branch]` | Observe one GitHub PR/CI/review snapshot, classify one next action, and stop. Safe for capability-admitted native schedules/events; never mutates code, Git, checks, threads, or PR state. | PR/check/review metadata + bounded failed-log excerpts | none |
 | [`/rite-pressure-test`](../pack/.claude/skills/rite-pressure-test/SKILL.md) | utility | `[idea]` | Pressure-test a rough idea: 3 to 5 genuinely different options → converge on one with trade-off + hinge. | spec / surrounding code | `decisions.md` (optional) |
 | [`/rite-doctor`](../pack/.claude/skills/rite-doctor/SKILL.md) | diagnostic | none | Diagnose the DevRites binary, pack, schema, and native host permission/profile configuration. | install + host config | none |
 
@@ -183,7 +184,7 @@ index is in
 [`pack/.claude/skills/devrites-lib/reference/standards/README.md`](../pack/.claude/skills/devrites-lib/reference/standards/README.md).
 
 - `core.md` (always-on): operating rules + universal anti-rationalizations + 1-line craft disciplines + persistence-before-stopping summary.
-- On-demand rules and checklists (read by the phase that needs them): `coding-style.md` · `prose-style.md` · `error-handling.md` · `testing.md` · `spec-grammar.md` · `code-review.md` · `edge-case-trace.md` · `principles.md` · `security.md` · `performance.md` · `observability.md` · `developer-experience.md` · `patterns.md` · `git-workflow.md` · `ci-cd.md` · `hooks.md` · `documentation.md` · `development-workflow.md` · `deprecation.md` · `elicitation.md` · `agents.md` · `context-hygiene.md` · `anti-patterns.md` · `afk-hitl.md` · `tooling.md` · `skill-authoring.md` · `definition-of-done.md` · `review-checklist.md` · `test-proof-checklist.md` · `browser-proof-checklist.md` · `security-checklist.md`
+- On-demand rules and checklists (read by the phase that needs them): `coding-style.md` · `prose-style.md` · `error-handling.md` · `testing.md` · `spec-grammar.md` · `code-review.md` · `edge-case-trace.md` · `principles.md` · `security.md` · `repository-topology.md` · `data-integrity.md` · `integration-reliability.md` · `performance.md` · `observability.md` · `developer-experience.md` · `patterns.md` · `git-workflow.md` · `ci-cd.md` · `hooks.md` · `documentation.md` · `development-workflow.md` · `deprecation.md` · `elicitation.md` · `agents.md` · `context-hygiene.md` · `anti-patterns.md` · `afk-hitl.md` · `loop-operations.md` · `tooling.md` · `skill-authoring.md` · `definition-of-done.md` · `review-checklist.md` · `test-proof-checklist.md` · `browser-proof-checklist.md` · `security-checklist.md`
 - `anti-patterns.md`: pack-wide rationalizations + red flags. Loaded by each per-phase `rite-*/reference/anti-patterns.md`; can be loaded directly for cross-phase reluctance.
 
 ## Trigger conditions (auto-selection)

package/docs/flow.md

@@ -375,7 +375,7 @@ separately by `disable-model-invocation`.
 
 ```mermaid
 flowchart TB
-    subgraph Public["Public (user-invocable: true): 32 skills"]
+    subgraph Public["Public (user-invocable: true): 33 skills"]
         direction TB
         R1[/rite/]
         R2[/rite-spec/]
@@ -405,6 +405,7 @@ flowchart TB
         RDO[/rite-dogfood/]
         RPOV[/rite-pov/]
         RPF[/rite-pr-feedback/]
+        RWP[/rite-watch-pr/]
         IPT[/rite-pressure-test/]
         D1[/rite-zoom-out/]
         D2[/rite-prototype/]

package/docs/orchestration.md

@@ -28,8 +28,9 @@ root reconciles semantics; engine checks deterministic structure/state/safety
   workspace-capable for its writer child to execute.
 - The role catalog has one source/test writer, `devrites-slice-wright`. Claude
   and Codex make only that exact specialist writable.
-- Leaves never invoke leaves, ask the human, change phase, commit, push, deploy,
-  migrate live data, or write canonical workflow state.
+- Leaves never invoke leaves, ask the human, change phase, push, deploy, migrate live
+  data, or write canonical workflow state. Only an eligible isolated-worktree wright
+  may create one local unpushed transfer commit; same-worktree leaves never commit.
 
 Skills name the exact role and bounded task in normal language. The host owns
 internal spawn fields, scheduling, waiting, follow-ups, and result delivery.
@@ -65,6 +66,35 @@ sibling cannot erase it.
 An evidenced clean result is valid. Reviewers must account for their rubric and
 inspected scope, but they never manufacture a finding to fill a quota.
 
+## Read-only Claude workflow pilot
+
+Claude installs `.claude/workflows/devrites-readonly-review.js` as an optional
+adapter for immutable-candidate discovery, four independent reviewer roles, one
+adversarial verification pass, and a completeness check. Its script owns only
+transient fan-out and intermediate results. It cannot write source, tests,
+`.devrites/**`, Git, proof, lifecycle state, or shared services; it never invokes
+`devrites-slice-wright`.
+
+The caller still admits every returned role result under the normal result-closure
+contract and performs final reconciliation. A workflow timeout, missing role,
+malformed result, unread input, or incomplete verification is a gap. The adapter does
+not replace `/rite-review`, alter required rosters, or create another durable state
+plane.
+
+Codex keeps the same portable skill/agent semantics through native agent dispatch and
+has no fake workflow mirror. Provider parity applies to review meaning and evidence,
+not to this optional Claude orchestration optimization. Use the pilot only when an
+immutable candidate already exists; lifecycle writes, proof execution, human gates,
+and final decisions remain with the rite root.
+
+Host capabilities are admitted independently. Codex CLI agent threads and inherited
+sandboxes establish context/permission separation, not filesystem worktree isolation;
+without an explicit named-agent worktree and reconciliation interface, Codex uses the
+serial same-worktree writer. Likewise, goals or hooks do not prove native time/event
+activation. Unsupported activation remains `unavailable` rather than being emulated by
+a DevRites scheduler or shell loop. The claim-bounded acceptance rows live in
+[`codex-acceptance.json`](../evals/native-host/codex-acceptance.json).
+
 ## Slice-wright lifecycle
 
 For Claude or Codex, the root states the smallest exact project-relative source
@@ -86,8 +116,19 @@ symlink escapes, duplicates, and `.devrites/**` are invalid.
 Exact-path scope is instruction-backed on both hosts; native sandboxes provide
 the broader writer/read-only split. An unauthorized delta is rejected and the
 same bounded writer must restore it before work continues. The root never
-widens the contract or rewrites source. Parallel source writers in one worktree
-are forbidden.
+widens the contract or rewrites source.
+
+A serial native-worktree pilot may isolate `devrites-slice-wright` when the candidate
+baseline is committed and clean, the repository is not a submodule child, baseline
+proof is green, and the host exposes explicit result reconciliation. The wright
+returns one local unpushed transfer commit; root proves its exact paths and unchanged
+base before native transfer, then re-proves the reconciled candidate. Missing transfer,
+conflict, extra paths, moved base, or cleanup failure stops with worktree evidence
+preserved. No ad hoc copy/cherry-pick/merge occurs from the read-only root.
+
+Isolation does not authorize throughput. At most one writer runs across all linked
+worktrees for the workspace; parallel writers remain forbidden until serial transfer,
+conflict, proof, and review measurements justify a separate design.
 
 ## Engine boundary
 

package/docs/skills.md

@@ -1,6 +1,6 @@
-# All 43 skills
+# All 44 skills
 
-The pack contains 43 skills: the `rite` menu, 31 user-invocable `rite-*`
+The pack contains 44 skills: the `rite` menu, 32 user-invocable `rite-*`
 workflow and utility skills, 10 model-invoked `devrites-*` specialists, and the
 internal `devrites-lib` library. `devrites-lib` is not a command. It holds shared
 references and the few explicit script exceptions.
@@ -37,7 +37,7 @@ contract when a rite names parallel reviewers.
 
 `rite-*` is the namespace for lifecycle and utility commands. Its utilities are
 `rite-quick`, `rite-frame`, `rite-adopt`, `rite-learn`, `rite-customize`,
-`rite-explain`, `rite-pov`, `rite-dogfood`, `rite-pr-feedback`, `rite-doctor`,
+`rite-explain`, `rite-pov`, `rite-dogfood`, `rite-pr-feedback`, `rite-watch-pr`, `rite-doctor`,
 `rite-upgrade`, `rite-prototype`, `rite-handoff`, `rite-zoom-out`, and
 `rite-pressure-test`.
 Some specialized utilities set `disable-model-invocation: true` and run only
@@ -222,7 +222,7 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 
 | Skill | What It Does | Use When |
 |---|---|---|
-| [`rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | Runs the whole lifecycle unattended (spec → clarify → … → seal → ship), choosing the recommended option at each soft gate and recording the rationale in `decisions.md`. A vague prompt triggers one up-front spec/clarify window; after decision coverage is CLEAR it runs without per-phase iteration, pausing only for genuine product/scope/policy decisions, irreversible risk, human-only access/actions, NO-GO, or budget exhaustion. Objective red checks use bounded technical recovery, including cold-resume recovery from retained one-shot evidence and one-time migration of stale missing-writer stops when an upgraded contract supplies the first supported workflow-artifact writer. That migration applies once, but the first real materializer failure is only attempt one under normal bounded recovery. Spending an action authorization blocks only another real execution, not offline repair. Default stops at Seal GO; `--ship` (alias `--yolo`) reaches Ship preflight but still requires a fresh literal `GO` and native approval. | "Autocomplete", "do the whole thing", "run the full cycle", "one-shot this feature". |
+| [`rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | Runs the whole lifecycle unattended (spec → clarify → … → seal → ship), choosing the recommended option at each soft gate and recording the rationale in `decisions.md`. A vague prompt triggers one up-front spec/clarify window; after decision coverage is CLEAR it runs without per-phase iteration, pausing only for genuine product/scope/policy decisions, irreversible risk, human-only access/actions, NO-GO, or budget exhaustion. Objective red checks use bounded technical recovery, including cold-resume recovery from retained one-shot evidence and one-time migration of stale missing-writer stops when an upgraded contract supplies the first supported workflow-artifact writer. That migration applies once, but the first real materializer failure is only attempt one under normal bounded recovery. Internal `NEEDS_REPLAN` and newly discovered agent-owned review findings remain caller-owned backward edges rather than user-facing stops. Spending an action authorization blocks only another real execution, not offline repair. Default stops at Seal GO; `--ship` (alias `--yolo`) reaches Ship preflight but still requires a fresh literal `GO` and native approval. | "Autocomplete", "do the whole thing", "run the full cycle", "one-shot this feature". |
 | [`rite-zoom-out`](../pack/.claude/skills/rite-zoom-out/SKILL.md) | Map the modules, callers, callees, and decisions in an unfamiliar area using the project's domain glossary. | Explicit-only: `/rite-zoom-out` / `/rite zoom-out`. |
 | [`rite-prototype`](../pack/.claude/skills/rite-prototype/SKILL.md) | Throwaway code answering ONE design question: logic harness OR 2 to 4 UI variations on one route. | Explicit-only: `/rite-prototype` / `/rite prototype`. |
 | [`rite-handoff`](../pack/.claude/skills/rite-handoff/SKILL.md) | Compact chat session → handoff doc. References existing `.devrites/work/<slug>/` artifacts by path. | Explicit-only: `/rite-handoff` / `/rite handoff`. |
@@ -231,6 +231,7 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 | [`rite-pov`](../pack/.claude/skills/rite-pov/SKILL.md) | Project-grounded verdict on a named external option: adopt / trial / hold / reject / not-our-problem after project + external floors clear. | "should we adopt X", "switch to Y", CVE/deprecation relevance, bounded external comparisons. |
 | [`rite-dogfood`](../pack/.claude/skills/rite-dogfood/SKILL.md) | Diff-scoped browser QA: map changed user journeys, run scenario matrix, fix small obvious breakages, write `dogfood.md`. | Explicit-only after prove/polish/review when browser UX confidence matters. |
 | [`rite-pr-feedback`](../pack/.claude/skills/rite-pr-feedback/SKILL.md) | Resolve PR review feedback: fetch unresolved threads, judge centrally, fix valid items, reply, resolve. | Explicit-only: `/rite-pr-feedback` / `/rite pr-feedback`. |
+| [`rite-watch-pr`](../pack/.claude/skills/rite-watch-pr/SKILL.md) | Observe one PR/CI/review snapshot and report one next action without mutation. | Read-only capability-admitted native schedule/event observation or `/rite-watch-pr`. |
 
 ### Foundation: engineering rules
 

package/engine/internal/devritespaths/paths.go

@@ -13,10 +13,11 @@ import (
 const (
 	DevritesRootName = ".devrites"
 
-	ClaudeSkillsTarget = ".claude/skills"
-	CodexSkillsTarget  = ".agents/skills"
-	ClaudeAgentsTarget = ".claude/agents"
-	CodexAgentsTarget  = ".codex/agents"
+	ClaudeSkillsTarget    = ".claude/skills"
+	CodexSkillsTarget     = ".agents/skills"
+	ClaudeAgentsTarget    = ".claude/agents"
+	CodexAgentsTarget     = ".codex/agents"
+	ClaudeWorkflowsTarget = ".claude/workflows"
 
 	ManifestName = ".claude/devrites.manifest"
 )

package/engine/internal/hostpack/hostpack.go

@@ -14,10 +14,11 @@ import (
 )
 
 const (
-	ClaudeSkillsTarget = devritespaths.ClaudeSkillsTarget
-	CodexSkillsTarget  = devritespaths.CodexSkillsTarget
-	ClaudeAgentsTarget = devritespaths.ClaudeAgentsTarget
-	CodexAgentsTarget  = devritespaths.CodexAgentsTarget
+	ClaudeSkillsTarget    = devritespaths.ClaudeSkillsTarget
+	CodexSkillsTarget     = devritespaths.CodexSkillsTarget
+	ClaudeAgentsTarget    = devritespaths.ClaudeAgentsTarget
+	CodexAgentsTarget     = devritespaths.CodexAgentsTarget
+	ClaudeWorkflowsTarget = devritespaths.ClaudeWorkflowsTarget
 )
 
 //go:embed templates/*.tmpl
@@ -126,6 +127,7 @@ func RequiredPayload(withCodex bool) []string {
 	required := []string{
 		"claude/skills",
 		"claude/agents",
+		"claude/workflows",
 		"claude/settings.json",
 	}
 	if withCodex {
@@ -162,6 +164,9 @@ func InstallTrees(withSkills, withAgents, withCodex bool) []Tree {
 			trees = append(trees, Tree{PayloadPrefix: "codex/agents", TargetPrefix: CodexAgentsTarget})
 		}
 	}
+	if withSkills && withAgents {
+		trees = append(trees, Tree{PayloadPrefix: "claude/workflows", TargetPrefix: ClaudeWorkflowsTarget})
+	}
 	return trees
 }
 

package/engine/internal/hostpack/hostpack_test.go

@@ -10,13 +10,14 @@ import (
 
 func TestValidatePayloadRequiresClaudeAndCodexFiles(t *testing.T) {
 	payload := fstest.MapFS{
-		"claude/skills/rite/SKILL.md":              {},
-		"claude/agents/devrites-code-reviewer.md":  {},
-		"claude/settings.json":                     {},
-		"codex/skills/rite/SKILL.md":               {},
-		"codex/agents/devrites-code-reviewer.toml": {},
-		"codex/AGENTS.md":                          {},
-		"codex/config.toml":                        {},
+		"claude/skills/rite/SKILL.md":                  {},
+		"claude/agents/devrites-code-reviewer.md":      {},
+		"claude/workflows/devrites-readonly-review.js": {},
+		"claude/settings.json":                         {},
+		"codex/skills/rite/SKILL.md":                   {},
+		"codex/agents/devrites-code-reviewer.toml":     {},
+		"codex/AGENTS.md":                              {},
+		"codex/config.toml":                            {},
 	}
 	if err := ValidatePayload(payload, true); err != nil {
 		t.Fatal(err)
@@ -38,10 +39,18 @@ func TestInstallTreesMapPayloadsToTargets(t *testing.T) {
 		{PayloadPrefix: "codex/skills", TargetPrefix: ".agents/skills"},
 		{PayloadPrefix: "claude/agents", TargetPrefix: ".claude/agents"},
 		{PayloadPrefix: "codex/agents", TargetPrefix: ".codex/agents"},
+		{PayloadPrefix: "claude/workflows", TargetPrefix: ".claude/workflows"},
 	}
 	if !reflect.DeepEqual(got, want) {
 		t.Fatalf("InstallTrees() = %#v, want %#v", got, want)
 	}
+	for _, trees := range [][]Tree{InstallTrees(true, false, true), InstallTrees(false, true, true)} {
+		for _, tree := range trees {
+			if tree.PayloadPrefix == "claude/workflows" {
+				t.Fatal("Claude workflow installed without both skills and agents")
+			}
+		}
+	}
 }
 
 func TestAliasTemplateOutput(t *testing.T) {

package/engine/internal/install/install_test.go

@@ -313,11 +313,15 @@ func TestGeneratedPayloadInstallsVerbatim(t *testing.T) {
 	target := t.TempDir()
 	sentinel := "generated sentinel"
 	testutil.WriteFile(t, filepath.Join(payload, "codex", "skills", "rite", "SKILL.md"), sentinel+"\n")
+	testutil.WriteFile(t, filepath.Join(payload, "claude", "workflows", "devrites-readonly-review.js"), sentinel+"\n")
 
 	runInstall(t, target, payload, func(o *Options) {})
 	if got := testutil.ReadFile(t, filepath.Join(target, ".agents", "skills", "rite", "SKILL.md")); got != sentinel+"\n" {
 		t.Fatalf("codex payload was not installed verbatim: %q", got)
 	}
+	if got := testutil.ReadFile(t, filepath.Join(target, ".claude", "workflows", "devrites-readonly-review.js")); got != sentinel+"\n" {
+		t.Fatalf("Claude workflow payload was not installed verbatim: %q", got)
+	}
 }
 
 func TestInstallBinaryUsesEngineHandoff(t *testing.T) {
@@ -1220,6 +1224,7 @@ func writeTestPayload(t *testing.T, root string) {
 	t.Helper()
 	testutil.WriteFile(t, filepath.Join(root, "claude", "skills", "rite", "SKILL.md"), "claude rite\n")
 	testutil.WriteFile(t, filepath.Join(root, "claude", "agents", "devrites-code-reviewer.md"), "agent\n")
+	testutil.WriteFile(t, filepath.Join(root, "claude", "workflows", "devrites-readonly-review.js"), "return { read_only: true }\n")
 	testutil.WriteFile(t, filepath.Join(root, "claude", "settings.json"), `{
   "permissions": {
     "defaultMode": "plan",

package/pack/.claude/agents/devrites-code-reviewer.md

@@ -20,6 +20,8 @@ change.
 `coding-style.md`, `patterns.md`, and `edge-case-trace.md`. On Codex, use the
 mirrors under `.agents/skills/devrites-lib/reference/standards/`. Apply the current
 files, not a summary you remember.
+From `spec.md`'s applicability map, load only triggered `repository-topology.md`,
+`data-integrity.md`, or `integration-reliability.md`; their cases remain feature-scoped.
 
 ## Inputs
 You receive a feature slug or workspace path (`.devrites/work/<slug>/`) and the
@@ -38,7 +40,8 @@ feature scope and read the touched files.
     `file:line` and the test that misses it. See `testing.md` § The verification gap.
 - **Correctness:** check logic, null, empty, and boundary values, error paths, races,
   and assumptions. For branching or boundary changes, run the edge-case trace over
-  explicit paths, fixed-set siblings, and deletion contracts.
+  relevant probe classes, fixed-set siblings, real wiring, negative intent, and deletion
+  contracts. Verify the accepted failure/recovery disposition rather than re-listing cases.
 - **Readability:** check naming, function size, nesting, and comments that explain
   *why*. A new conditional **bolted onto an unrelated flow** is a design smell, not a
   nit; it may need its own helper, state, or policy. Repeated conditionals with the
@@ -52,6 +55,8 @@ feature scope and read the touched files.
     owning layer?
   - Has a type boundary been left implicit through an unnecessary `any`, `unknown`,
     cast, or silent fallback that hides an unclear invariant?
+  - Are repository/deployable roots, canonical contract and mutable-state ownership,
+    shared resources, and sync/async consistency boundaries preserved without a cycle?
 - **Maintainability:** dead code, leftover TODOs or logs, and convention drift. Check
   **file size as well as diff size**. If a small diff pushes an already-large file
   past a healthy boundary, flag decompose-then-add and recommend extracting helpers

package/pack/.claude/agents/devrites-plan-drafter.md

@@ -25,6 +25,10 @@ slices in dependency order. Map every REQ and AC to a slice and executable proof
 name rollback and failure paths; keep acceptance-changing proposals separate. Durable
 proof commands must be portable repository commands, never host-local wrappers,
 user-specific absolute paths, or temporary proof trees.
+Reconcile `spec.md`'s applicability map against live evidence. When triggered, apply
+`repository-topology.md`, `data-integrity.md`, or `integration-reliability.md` and include
+its required plan output with owner, partial-failure/recovery path, deployment order, slice,
+and proof. Do not copy a standard or turn a false `not applicable` into a planning shortcut.
 For every consumptive action, apply `one-shot-actions.md`: draft a durable bounded
 artifact, a finite injective map from every failure emit seam to a stable non-secret
 boundary ID and offline decision, per-seam fault fixtures, cleanup-survival proof,
@@ -65,6 +69,7 @@ dependency_order: []
 technical_decisions: []
 human_owned_choices: []
 validation_commands: []
+applicability_disposition: []
 ```
 
 The root validates the cross-file bundle and persists accepted content.

package/pack/.claude/agents/devrites-plan-reviewer.md

@@ -36,6 +36,10 @@ line, and then assign the band. Do not choose a score and justify it afterward:
    table: one reused artifact plus provider- and consumer-side asserting tests that consume
    it. Missing, one-sided, duplicated-contract, vague, or non-consuming proof is `broken`; when no
    boundary changes, require the specific no-impact statement.
+   Compare the spec applicability map with live roots, deployables, data ownership,
+   integrations, and delivery units. Apply the triggered topology/data/integration standard;
+   a missing owner, intermediate deployment state, partial-failure recovery, or required
+   plan/proof row is `broken`.
 2. **Scope discipline & reuse:** ask whether this is the minimum diff that meets
    acceptance and whether existing code solves any sub-problem. More than eight
    files or two new services or modules is a complexity smell unless the complexity
@@ -48,6 +52,8 @@ line, and then assign the band. Do not choose a score and justify it afterward:
    Changed behavior without a regression test is critical. Select unit, integration/E2E,
    or eval by path. Shared-contract provider and consumer tests must both consume the
    artifact named in `Shared contract proof`.
+   Applicable data/integration/topology risks require discriminating cases; reject a mock
+   that cannot reproduce the risk or one member's tests offered as cross-root proof.
 5. **Performance:** check N+1 or unbounded queries, repeated hot-path work, and
    oversized payloads. The plan must measure them or name the measurement, not
    speculate about micro-optimizations.

package/pack/.claude/agents/devrites-proof-runner.md

@@ -32,7 +32,13 @@ and only the orchestrator-supplied changed paths.
    evidence surface>` and a `failures` gap route Spec Drift.
 5. For UI scope, inspect only supplied browser artifacts and route-scoped root
    results. Missing browser proof is `cannot_verify`.
-6. Recheck supplied before/after candidate identities. A mismatch or unexpected
+6. Reconcile the spec applicability map with the final diff. For triggered topology,
+   data, or integration rows, require the focused standard's relevant discriminating
+   failure/recovery proof or an evidence-backed dismissal. A generic suite, source
+   inspection, one-root result for another root, or risk-erasing mock cannot pass.
+7. Accept `pre-existing`/environment-only only with a supplied dated baseline for the
+   same command/cwd/prerequisites/material environment; otherwise use `cannot_verify`.
+8. Recheck supplied before/after candidate identities. A mismatch or unexpected
    repository mutation fails the side-effect boundary.
 
 ## Rules

package/pack/.claude/agents/devrites-retrospector.md

@@ -1,6 +1,6 @@
 ---
 name: devrites-retrospector
-description: Read-only cross-feature analyst that identifies specific recurring lessons in reviewed Markdown.
+description: Read-only analyst of recurring cross-feature lessons in reviewed Markdown.
 tools: Read, Grep, Glob, Bash
 permissionMode: plan
 ---
@@ -9,48 +9,44 @@ permissionMode: plan
 
 ## Role / scope
 
-Inspect the bounded `.devrites/archive/` paths supplied by the orchestrator.
-Use native file search; do not invoke engine miners, indexes, telemetry, or other
-agents.
+Inspect only supplied archive paths and necessary live authoritative repository sources.
+Use native file search; do not use engine miners, indexes, telemetry, or agents.
 
 ## Analyze
 
-- A recurring correction or drift pattern must appear in at least two distinct
-  features.
-- A single explicit architecture or product decision may qualify when its
-  rationale is durable.
-- Cite the exact archived files for every claim.
-- Drop generic advice that could apply unchanged to any project.
-- Compare candidates with existing `AGENTS.md`, `CLAUDE.md`, scoped standards,
-  and accepted ADRs so guidance is stated once.
+- Keep two-feature corrections or one rationale-backed durable product/architecture decision.
+- Verify live claims; cite currentness. Unverifiable = `unknown`, not false.
+- Name trigger/non-trigger; drop generic, stale, one-off, unbounded advice.
+- Search instructions/standards/ADRs for duplicate, contrary, or superseded guidance;
+  choose one canonical home + discovery route.
+- Update/narrow/replace/retire at its owner; no rival rule or learning ledger/index/queue.
 
 ## Classify
 
-- **project instruction** — operating guidance for the nearest instruction or
-  standards file;
-- **architecture decision** — significant durable choice suitable for an ADR;
-- **feature decision** — belongs only in that feature's `decisions.md`;
-- **drop** — one-off, stale, duplicate, or unsupported.
+- **project instruction** — instruction/standard;
+- **architecture decision** — ADR;
+- **feature decision** — `decisions.md`;
+- **drop** — unsupported/duplicate/stale/one-off/unknown-currentness.
 
-Return findings only. Do not write files, promote rules, ask the user, invoke
-another agent, or manufacture scores and trends.
+Return findings only; do not write, promote, ask, or score.
 
 ## Output
 
 ```text
 Retrospective scope: <features inspected>
 Candidates:
-- [project instruction | architecture decision | feature decision] <specific lesson>
-  Evidence: <file references>
-  Existing authority: <none | path>
-  Proposed home: <path>
-Dropped: <count and short reasons>
+- [project instruction | architecture decision | feature decision] <lesson>
+  Evidence/currentness: <archive refs>; <live source + signal | unknown>
+  Scope: applies <trigger>; does not apply <boundary>
+  Authority: existing <path|none>; canonical <path>; consumers/discovery <route>
+  Disposition: <no conflict | update/narrow/replace/retire path + reason>
+Dropped: <count + reasons>
 No durable candidate: <yes | no>
 ```
 
 ## Tools / read-write mode
 
-Read-only; do not edit files or write patches.
+Read-only.
 
 ## Composition
 

package/pack/.claude/agents/devrites-security-auditor.md

@@ -47,10 +47,11 @@ Apply the OWASP LLM Top 10 (`.claude/skills/devrites-lib/reference/standards/sec
   prompts and context. Enforce authorization server-side rather than in a prompt,
   and never transmit or log PII or secrets.
 - **Supply chain & poisoning (LLM03 / LLM04 / LLM08):** pin and vet models,
-  weights, datasets, and RAG or embedding sources. Treat them as untrusted.
+  weights, datasets, and RAG or embedding sources. Treat them as untrusted; check
+  provenance, tenant/ACL retrieval filters, poisoning, freshness, and deletion.
 - **Overreliance (LLM09)** / **unbounded consumption (LLM10):** ground
-  consequential calls and keep a human in the loop. Limit request rate, tokens,
-  cost, and time.
+  consequential calls, cite only supporting retrieved sources, define insufficient-context
+  behavior, and keep a human in the loop. Limit request rate, tokens, cost, and time.
 
 When the diff changes a DevRites agent, hook, or tool grant, apply the same checks
 to the pack. Confirm least agency, including read-only tools where required, no
@@ -60,6 +61,9 @@ secrets in prompts, and no trust in model or tool output as instructions.
 Apply the three-tier discipline from
 `.claude/skills/devrites-lib/reference/standards/security.md`. Flag any value that
 reaches the trusted tier without crossing the required boundary.
+Explicitly trace authn versus per-resource authz, tenant scope across storage/cache/search/
+jobs/model context, privilege-changing actions, resolved filesystem/archive paths, request
+forgery control, unsafe deserialization, and fail-closed environment defaults when relevant.
 
 ## Rules
 - Don't edit. Findings only, labeled Critical / Important / Suggestion / Nit / FYI with

package/pack/.claude/agents/devrites-slice-wright.md

@@ -33,12 +33,20 @@ with one objective and exact permitted source/test paths.
    target/relevant call path, local implementation/error conventions, reuse seam,
    test seam, and in-scope principles/rules. Do not read for reassurance. If an
    essential item is missing from permitted context, return `Escalation`; never guess.
+8. **Isolated worktree transfer is explicit.** Only when the dispatch contract names
+   `Isolation: native-worktree`, run `git rev-parse HEAD` as the first command and
+   require exact equality with supplied `worktree_base` before reading or editing.
+   Mismatch returns a gap with no write. After green proof, create one local, unpushed
+   transfer commit. Never push, merge, rebase, or remove the worktree. Without that
+   exact mode, do not commit.
 
 ## The contract you receive
 The orchestrator supplies each item inline or by path. All workspace paths are
 relative to the **Workspace root** named in the contract:
 - **Slice:** id/name, goal, acceptance criteria, **scope boundary** (what it will and will
   **not** touch), mode (HITL/AFK + any budget).
+- **Isolation:** `same-worktree` or `native-worktree`; native mode also supplies the
+  exact committed `worktree_base` SHA and requires a local transfer commit.
 - **Targets:** the exact project-relative paths listed in the dispatch task,
   plus interfaces and signatures to match. Your return cannot widen this set.
 - **Context to read yourself:** `spec.md`, `plan.md`, `decisions.md`, `assumptions.md`,
@@ -46,7 +54,9 @@ relative to the **Workspace root** named in the contract:
   `rite-polish/reference/anti-ai-slop.md`, and `design-brief.md` when the slice is UI.
 - **Rules in scope** (`.claude/skills/devrites-lib/reference/standards/`): `coding-style.md`, `error-handling.md`, `testing.md`,
   `patterns.md`; `security.md` when input/auth/data/integrations are touched; `performance.md`
-  when the slice touches a hot path, a query, or a large payload. These files are authoritative:
+  when the slice touches a hot path, a query, or a large payload; and only when named by
+  the vetted applicability contract, `repository-topology.md`, `data-integrity.md`, or
+  `integration-reliability.md`. These files are authoritative:
   read the in-scope one rather than guessing the standard.
 
 **Before ORIENT, restate** the slice goal, acceptance criteria, and scope boundary
@@ -73,6 +83,10 @@ an escalation and do not proceed.**
    Confirm that it fails for the expected reason. Use the project's existing test
    runner rather than adding one.
 3. **IMPLEMENT the smallest complete version**, in the project's style.
+   Preserve every applicable invariant and implement the plan's named partial-failure,
+   duplicate/retry/concurrency/interruption/tenant/timeout/order/rollback behavior. If
+   the live seam disproves the applicability or recovery plan, stop with evidence; do
+   not invent a local fallback or broaden the slice.
    - **For a UI slice, invoke `devrites-frontend-craft` first.** Build from
      `design-brief.md` under the full skill rules. Cover empty, loading, error, and
      success states; use project tokens and existing components; meet WCAG 2.2 AA;
@@ -103,7 +117,12 @@ an escalation and do not proceed.**
    `dead_ends`. Resolution is progress, while a different cause returns to the caller as a
    new fingerprint. At the limit return the gate and repro. `Escalation` is only for product/irreversible choices
    or human-only access; technical failure is a blocker.
-5. **RETURN** the structured artifact (below) and stop. Do not start the next slice.
+5. **TRANSFER when isolated.** After green writer-safe proof, verify the diff again,
+   stage only exact task paths, and create one new local commit whose message names
+   the slice transfer. Record its SHA. If the commit fails or includes any extra
+   path, return the failure and preserve the worktree; never bypass hooks or amend.
+   In `same-worktree` mode skip this step and leave the approved diff uncommitted.
+6. **RETURN** the structured artifact (below) and stop. Do not start the next slice.
 
 ## Code quality: consume the rules, don't reinvent them
 Apply the authoritative rule files and canonical anti-slop list named in the contract.
@@ -143,6 +162,9 @@ never authorizes a path:
 ```yaml
 slice: <id — name>
 restated_scope: <goal · acceptance · boundary>
+isolation: same-worktree | native-worktree
+worktree_base: <commit sha | none>
+transfer_commit: <commit sha | none>
 files_changed:
   - path: <project-relative path>
     line: <line|n/a>
@@ -170,13 +192,17 @@ Every key is required; use an empty array when there is nothing to report.
 the smallest complete implementation; green gates backed by **real command output**;
 the project's idiom and existing code reused first; **no code or UI slop**; nothing
 beyond the spec; bookkeeping returned instead of written; irreversible-risk items in
-`Escalation`; and every declared principle honored or the conflict escalated. Fix any
+`Escalation`; every triggered topology/data/integration behavior implemented and its
+writer-safe proof run (or exact vetted root-owned proof reported `not-run`); and every
+declared principle honored or the conflict escalated. Fix any
 failure or move it to `Escalation` instead of shipping it quietly.
 
 ## Tools / read-write mode
 
 Write-capable for code and tests only at the exact paths in the current slice
-contract; do not write `.devrites/` bookkeeping.
+contract; do not write `.devrites/` bookkeeping. In exact `native-worktree` mode,
+Git staging and one local transfer commit are permitted only for those paths; all
+other Git mutation and every remote action remain forbidden.
 
 ## Composition