devrites 4.0.2 → 4.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (33) hide show
  1. package/CHANGELOG.md +7 -0
  2. package/README.md +1 -1
  3. package/pack/.claude/skills/devrites-lib/reference/standards/core.md +14 -0
  4. package/pack/.claude/skills/rite-autocomplete/SKILL.md +10 -2
  5. package/pack/.claude/skills/rite-autocomplete/reference/loop.md +19 -0
  6. package/pack/.claude/skills/rite-autocomplete/reference/stop-conditions.md +9 -0
  7. package/pack/.claude/skills/rite-build/reference/spec-drift-guard.md +12 -2
  8. package/pack/.claude/skills/rite-plan/SKILL.md +11 -1
  9. package/pack/.claude/skills/rite-prove/SKILL.md +12 -2
  10. package/pack/.claude/skills/rite-prove/reference/failure-triage.md +3 -2
  11. package/pack/.claude/skills/rite-spec/reference/state-workspace.md +12 -5
  12. package/pack/.claude/skills/rite-vet/SKILL.md +8 -0
  13. package/pack/generated/claude/skills/devrites-lib/reference/standards/core.md +14 -0
  14. package/pack/generated/claude/skills/rite-autocomplete/SKILL.md +10 -2
  15. package/pack/generated/claude/skills/rite-autocomplete/reference/loop.md +19 -0
  16. package/pack/generated/claude/skills/rite-autocomplete/reference/stop-conditions.md +9 -0
  17. package/pack/generated/claude/skills/rite-build/reference/spec-drift-guard.md +12 -2
  18. package/pack/generated/claude/skills/rite-plan/SKILL.md +11 -1
  19. package/pack/generated/claude/skills/rite-prove/SKILL.md +12 -2
  20. package/pack/generated/claude/skills/rite-prove/reference/failure-triage.md +3 -2
  21. package/pack/generated/claude/skills/rite-spec/reference/state-workspace.md +12 -5
  22. package/pack/generated/claude/skills/rite-vet/SKILL.md +8 -0
  23. package/pack/generated/codex/skills/devrites-lib/reference/standards/core.md +14 -0
  24. package/pack/generated/codex/skills/rite-autocomplete/SKILL.md +10 -2
  25. package/pack/generated/codex/skills/rite-autocomplete/reference/loop.md +19 -0
  26. package/pack/generated/codex/skills/rite-autocomplete/reference/stop-conditions.md +9 -0
  27. package/pack/generated/codex/skills/rite-build/reference/spec-drift-guard.md +12 -2
  28. package/pack/generated/codex/skills/rite-plan/SKILL.md +11 -1
  29. package/pack/generated/codex/skills/rite-prove/SKILL.md +12 -2
  30. package/pack/generated/codex/skills/rite-prove/reference/failure-triage.md +3 -2
  31. package/pack/generated/codex/skills/rite-spec/reference/state-workspace.md +12 -5
  32. package/pack/generated/codex/skills/rite-vet/SKILL.md +8 -0
  33. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -2,6 +2,13 @@
2
2
 
3
3
  All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
4
4
 
5
+ ## [4.0.3](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.2...v4.0.3) (2026-08-07)
6
+
7
+ ### Fixed
8
+
9
+ * **deps:** update js-yaml security patch ([d0b066a](https://github.com/ViktorsBaikers/DevRites/commit/d0b066aed4ff4544567fae14eb1fd90a08ef9e6d))
10
+ * **rite:** keep technical backtracking autonomous ([45b17af](https://github.com/ViktorsBaikers/DevRites/commit/45b17af86e18930b983ec49ae399dd9f91f37a52))
11
+
5
12
  ## [4.0.2](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.1...v4.0.2) (2026-08-05)
6
13
 
7
14
  ### Fixed
package/README.md CHANGED
@@ -28,7 +28,7 @@ project-conventional push, tag, or PR action, and archive the workspace.
28
28
  Unattended runs may create local WIP checkpoint commits along the way, but they
29
29
  remain local unless Ship's disclosed plan includes an approved remote action.
30
30
 
31
- **Status:** [`v4.0.2`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.0.2): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
31
+ **Status:** [`v4.0.3`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.0.3): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
32
32
 
33
33
  This is the latest published release; `main` may contain unreleased work.
34
34
 
@@ -45,6 +45,20 @@ After native proof/review, `/rite-seal` runs `devrites-engine check seal <slug>`
45
45
  for structure/freshness, not prose. HITL/blocked stops follow
46
46
  [Persistence before stopping](#persistence-before-stopping-handoff-discipline).
47
47
 
48
+ ## Caller-owned technical backtracking
49
+
50
+ When an active rite invokes an earlier rite inline to repair an agent-owned
51
+ technical gap, the original rite remains the controlling caller. A nested
52
+ rite's `STOP` is a nested phase boundary, not a user-facing handoff. The caller
53
+ re-reads `state.md`, follows the durable return cursor and intermediate
54
+ `next_action`, and resumes its originating phase while no human-owned, safety,
55
+ access, budget, or exhausted-recovery stop is active.
56
+
57
+ An intermediate `Next step` is cold-resume metadata. Do not ask the human to
58
+ copy routine `/rite-plan repair`, `/rite-vet`, `/rite-build`, or proof-rerun
59
+ commands during the active recovery chain. Only the controlling caller emits
60
+ the final response; standalone phase invocations still stop normally.
61
+
48
62
  ## Final response
49
63
 
50
64
  Immediately before its final response, each rite loads
@@ -25,6 +25,10 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
25
25
  `--yolo` never authorizes Git; it reaches only the exact-plan literal-GO and
26
26
  native-approval boundary. Red checks run bounded recovery, then block unless
27
27
  the remaining decision is human-owned.
28
+ - **Keep routine backtracking internal.** Always follow agent-owned backward edges
29
+ through repair, Vet, bounded implementation correction, and re-proof inside
30
+ the active run. A nested phase `STOP` or intermediate `Next step` is not a
31
+ user handoff; pause only on the shared real stop conditions.
28
32
  - **Budget from the post-vet slice count.** Vet may split/add slices.
29
33
  `--max-slices N` may lower the cap for a partial run; otherwise build all.
30
34
  - **Parse flags only from this invocation.** `--ship`, `--yolo`, `--max-slices`,
@@ -44,8 +48,9 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
44
48
  run `/rite-vet` on **every** feature (depth scales: a light pass on simple plans, full rigor on
45
49
  big/risky; never skipped). Unattended it auto-applies only *hardening* findings: added test
46
50
  requirements, error-handling / failure-mode coverage, tightened scope, reuse-over-rebuild,
47
- dependency-order fixes (these never grow acceptance); **any finding that grows scope,
48
- adds a slice, or changes acceptance is a blocking pause**, and irreversible-risk findings always
51
+ dependency-order fixes (these never grow acceptance); acceptance-preserving
52
+ reslicing or remediation remains agent-owned. **Any finding that grows product
53
+ scope or changes acceptance is a blocking pause**, and irreversible-risk findings always
49
54
  pause. Cross-model is off unless `--cross-model` was armed.
50
55
 
51
56
  ## Workflow
@@ -76,6 +81,9 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
76
81
  built; root charges the AFK budget once per green built slice) → `/rite-prove`
77
82
  → `/rite-polish` → `/rite-review` → `/rite-seal`.
78
83
  Read each `SKILL.md` and execute it; workspace files carry state, not chat.
84
+ Follow the loop's backward-edge contract whenever a later phase discovers an
85
+ agent-owned earlier-phase gap; keep the original return cursor until that
86
+ phase resumes.
79
87
  Immediately after `/rite-vet` and before the first Build dispatch, apply the loop's
80
88
  [mutable post-vet budget](reference/loop.md#derive-the-mutable-post-vet-budget)
81
89
  contract. **Completion:** the loop reaches Seal GO, or a stop condition is persisted
@@ -52,6 +52,25 @@ Read each phase's `SKILL.md` and execute that workflow. Workspace files such as
52
52
  | 10 | `/rite-seal` | GO/NO-GO decision (no git here) |
53
53
  | 11 | `/rite-ship` | only if seal GO; `--ship` / `--yolo` never authorizes Git and only continues to the exact-plan literal-GO/native-approval boundary |
54
54
 
55
+ ## Backtrack without handing off
56
+
57
+ When a later phase finds an agent-owned technical gap in an earlier phase, the
58
+ Autocomplete root remains the caller:
59
+
60
+ 1. Save the originating phase/action in the native return cursor unless a valid
61
+ one already exists.
62
+ 2. Invoke the required repair, Vet, remediation, and proof skills inline. Their
63
+ `STOP` instructions end only those nested phases.
64
+ 3. Re-read `state.md` after each nested phase and follow its intermediate
65
+ `next_action`; do not hand the intermediate command to the user.
66
+ 4. When the prerequisite chain is green, restore and consume the return cursor,
67
+ resume the originating phase, and continue the forward table.
68
+
69
+ Count failed corrections by causal fingerprint under `afk-hitl.md`. Ask only
70
+ for a human-owned decision or mandatory safety/access action. Exhausted
71
+ agent-owned recovery stops once with its reproduction and dead ends, never with
72
+ another routine Plan/Vet command.
73
+
55
74
  ## Between phases
56
75
 
57
76
  - Re-read the active workspace before each phase (don't trust chat memory).
@@ -16,6 +16,15 @@ Regardless of `allow_gates` or `--ship`:
16
16
  Red checks are hard non-advance gates. Run bounded `devrites-debug-recovery`;
17
17
  on exhaustion, stop as a technical blocker unless human-owned.
18
18
 
19
+ ## Not a stop: agent-owned backtracking
20
+
21
+ Agent-owned backtracking is not a stop condition while its causal-fingerprint
22
+ budget remains. The active caller invokes the earlier phase inline, follows Vet
23
+ and any bounded remediation, then resumes the originating phase. Persist
24
+ `Next step` for crash recovery, but do not surface it as a command the human must
25
+ submit. Stop only when recovery is exhausted or the remaining choice is a real
26
+ human/safety/access gate.
27
+
19
28
  ## Stop on gate severity
20
29
 
21
30
  - `blocking` gate fires → synchronous pause.
@@ -24,8 +24,8 @@ other phases reference it here.
24
24
  YES, active-slice technical/tool failure → log it and use Build's bounded debug
25
25
  recovery. Do not ask for retry authorization and do not re-plan unless the
26
26
  durable remaining-work instructions are wrong.
27
- YES, durable plan is wrong → log it, run /rite-plan repair without a question,
28
- re-vet, then resume.
27
+ YES, durable plan is wrong → log it, save the caller's return cursor, then
28
+ invoke `/rite-plan repair` and `/rite-vet` inline without a question and resume.
29
29
  NO, product/policy/irreversible-risk decision → ask the user (format below).
30
30
  5. Never continue on a known-wrong durable plan. A repaired active-slice implementation
31
31
  may continue only after bounded recovery, returned-diff review, and proof gates pass.
@@ -47,3 +47,13 @@ Which direction should DevRites take?
47
47
 
48
48
  Never turn an objective defect, environment repair, tool bug, or proof rerun into a
49
49
  human permission question. Re-plan only when the durable plan changed.
50
+
51
+ ## Inline return contract
52
+
53
+ The phase that detected agent-owned drift owns the whole backtrack. Preserve it
54
+ as `return_phase`/`return_next_action`; consume Plan and Vet's nested `STOP`
55
+ boundaries internally; follow any vetted remediation required by the settled
56
+ acceptance; then restore the cursor and resume the failed step. Do not hand an
57
+ intermediate command to the human. The shared three-attempt causal-fingerprint
58
+ cap still applies: exhaustion produces one technical blocker, while a genuinely
59
+ human-owned decision uses the question format below.
@@ -35,6 +35,10 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
35
35
  - **Root writes; drafter proposes.** Follow
36
36
  [`agents.md`](../devrites-lib/reference/standards/agents.md). The controlling chat owns
37
37
  human questions, decisions, reconciliation, and all planning-artifact writes.
38
+ - **Nested repair preserves its caller.** When `state.md` contains a valid
39
+ technical-backtracking return cursor, preserve any valid return cursor
40
+ byte-for-byte. `/rite-vet` is the next internal prerequisite, not a command to
41
+ hand back to the human.
38
42
 
39
43
  ## Workflow
40
44
  0. Read `.claude/skills/devrites-lib/reference/standards/core.md` (operating rules) before reshaping anything.
@@ -93,7 +97,8 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
93
97
  `eng-review.md` exists, set `Implementation readiness: NEEDS REPLAN`. Never retain READY
94
98
  across changed planning inputs. Preserve `Plan approved` only for behavior/acceptance-neutral
95
99
  technical repair; clear and reconfirm it when the contract changed. If you stopped for drift,
96
- mark the `drift.md` entry resolved.
100
+ mark the `drift.md` entry resolved. Never remove or overwrite a valid caller
101
+ return cursor while writing the Plan checkpoint.
97
102
  6. If product behavior/acceptance criteria change, confirm through `/rite-clarify` before
98
103
  writing, re-close `decision-coverage.md`, then reconcile the plan. After any edit to
99
104
  `brief.md`, `spec.md`, `decisions.md`, `assumptions.md`, or `questions.md`, including a
@@ -111,5 +116,10 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
111
116
  table or justified no-impact statement must still match the revised boundary set.
112
117
  If any check fails, loop back: don't hand off a half-reshaped plan.
113
118
 
119
+ When invoked inline by a controlling rite, return the completed Plan checkpoint
120
+ to that caller so it can invoke Vet immediately. The phase boundary is not a
121
+ user-facing stop unless a genuine HITL, safety/access, or exhausted-recovery
122
+ condition was recorded.
123
+
114
124
  > **Mid-flight discipline.** Do not change product behavior without confirmation or
115
125
  > absorb drift silently. See [`anti-patterns`](reference/anti-patterns.md).
@@ -57,6 +57,10 @@ Pull these via `Read` when relevant:
57
57
  writes. The proof runner is read-only and validates immutable logs/artifacts.
58
58
  Every accepted source/test correction is one bounded
59
59
  `devrites-slice-wright` task, never an inline edit.
60
+ - **Prove remains the controlling caller during technical backtracking.** Save
61
+ its return cursor, invoke Plan/Vet or bounded remediation inline, consume each
62
+ nested phase boundary, then resume the failed Prove step. Never make the human
63
+ submit an agent-owned repair, re-vet, or proof-rerun command.
60
64
 
61
65
  ## Released-workspace refresh entry
62
66
 
@@ -80,14 +84,15 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
80
84
  require its `state.md`, and read the cursor directly.
81
85
  1. **Confirm all slices built.** Read `spec.md`, `tasks.md`, `state.md`,
82
86
  `test-plan.md`, and the full diff.
83
- A missing `test-plan.md` returns to Vet; it never authorizes ad hoc proof.
87
+ A missing `test-plan.md` enters caller-owned Vet backtracking; invoke Vet
88
+ inline and resume this step. It never authorizes ad hoc proof.
84
89
  2. **Discover commands** if not recorded:
85
90
  [test-command-discovery](reference/test-command-discovery.md): README, package
86
91
  scripts, Makefile, CI configs, Gemfile/Rakefile, pyproject, go.mod, Cargo.toml.
87
92
  Discovery only supplies evidence. `test-plan.md` is the sole approved runtime
88
93
  command list. If a discovered command is absent from it, do not run or
89
94
  silently approve the command: return to the current Vet contract to add and
90
- vet it, refresh readiness, then return to Prove.
95
+ vet it inline, refresh readiness, then return to Prove without a user handoff.
91
96
  **Completion:** exact commands are approved in `test-plan.md` or unavailable.
92
97
  3. **Execute proof against a frozen candidate.** Run
93
98
  `devrites-engine check candidate <slug>` before any approved proof and retain
@@ -123,6 +128,11 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
123
128
  manifest from its actual scoped diff, rerun affected real proof and both
124
129
  candidate checks, then dispatch a fresh proof runner. If a fix would exceed
125
130
  scope, record a blocker.
131
+ If triage shows an agent-owned durable-plan error, apply the Spec Drift
132
+ Guard's inline return contract: preserve Prove as the origin, run repair and
133
+ Vet inside this invocation, and resume the exact failed proof rung. Ask only
134
+ for a human-owned decision; causal-fingerprint exhaustion stops once with a
135
+ technical blocker rather than another phase command.
126
136
  8. The root updates `evidence.md`, `browser-evidence.md` (when present),
127
137
  `traceability.md`, and `state.md`. Record exactly one binding for the observed
128
138
  digest in evidence and browser evidence. New proof goes to canonical
@@ -20,6 +20,7 @@ loop to `devrites-debug-recovery`.
20
20
  - Quote the real error text; don't paraphrase it away.
21
21
  - Don't loosen/delete a failing assertion to get green: investigate whether it's drift.
22
22
  - Don't add blanket retries/sleeps to hide flakiness.
23
- - Three failed fix attempts on the same root cause escalate: `devrites-debug-recovery`
24
- for a hypothesis-driven pass, or ask the user.
23
+ - Three failed fix attempts on the same root cause consume the shared recovery
24
+ cap: preserve the reproduction and dead ends, then stop once as a technical
25
+ blocker. Ask only when the remaining decision is human-owned.
25
26
  - A failure you can't fix in scope is a recorded **blocker**, not a silent skip.
@@ -105,8 +105,8 @@ None.
105
105
  | slice_mode | none |
106
106
  | risk | none |
107
107
  | next_action | <single command + reason> |
108
- | return_phase | <later phase; retrofit clarification only> |
109
- | return_next_action | <saved command; retrofit clarification only> |
108
+ | return_phase | <originating later phase; clarification or agent-owned technical backtracking only> |
109
+ | return_next_action | <saved originating command> |
110
110
 
111
111
  ## Awaiting human
112
112
  Only present when status is awaiting_human.
@@ -120,9 +120,16 @@ Only present when status is awaiting_human.
120
120
  `state.md` is a compact cursor, not a history file. Put proof in `evidence.md`,
121
121
  decisions in `decisions.md`, assumptions in `assumptions.md`, and drift in
122
122
  `drift.md`. Omit both `return_*` rows outside a later-phase `/rite-clarify`
123
- retrofit. The controlling root follows `/rite-clarify`'s native cursor protocol:
124
- save both fields before later-phase entry, restore and remove both only after a
125
- contract-neutral CLEAR verdict, and preserve every unrelated Markdown byte.
123
+ retrofit or agent-owned technical backtracking chain.
124
+
125
+ Before an active caller moves backward, it copies its current phase and
126
+ non-empty action into the two return rows. Nested Plan, Vet, Build, and proof
127
+ work preserves that valid cursor. Once the prerequisite chain is green, the
128
+ controlling caller restores the saved phase/action and removes both rows in one
129
+ rewrite. A real HITL or exhausted-recovery stop retains the cursor for cold
130
+ resume. Never overwrite an existing valid return cursor, and preserve every
131
+ unrelated Markdown byte. `/rite-clarify` applies its stricter native cursor
132
+ protocol below.
126
133
 
127
134
  `afk_slices_remaining` is mutable runtime state, not `.devrites/AFK`
128
135
  configuration. Only the controlling root writes it under the shared
@@ -40,6 +40,9 @@ Pull the standard named by the active axis: `principles.md`, `patterns.md`,
40
40
  - **Search before asking.** Verify facts and fold reversible technical hardening into the
41
41
  plan; ask only human-owned choices under `afk-hitl.md`. Dispatch uses the bounded
42
42
  [`agents.md`](../devrites-lib/reference/standards/agents.md) contract.
43
+ - **Honor a recovery origin.** Preserve a valid technical-backtracking return
44
+ cursor throughout review. Agent-owned `NEEDS REPLAN` returns internally to the
45
+ controlling caller; it never becomes a request for the human to invoke Plan.
43
46
 
44
47
  ## Workflow
45
48
  0. **Read `.claude/skills/devrites-lib/reference/standards/core.md`** first.
@@ -146,6 +149,11 @@ Pull the standard named by the active axis: `principles.md`, `patterns.md`,
146
149
  cross-model integration.
147
150
  Completion: the final axis floor clears, an objective technical blocker is recorded, or a
148
151
  genuine human-owned gate is recorded.
152
+ When READY has no pending remediation slice and a valid technical return
153
+ cursor exists, restore and consume the return cursor instead of defaulting to
154
+ `/rite-build`, then return the nested result to the controlling caller. If
155
+ vetted remediation remains, preserve the cursor while the caller follows it;
156
+ only a real stop condition reaches the human.
149
157
  7. **STOP.** Show the Build readback, scope verdict, lowest axis band, closed coverage
150
158
  gaps, preflight, action-time checkpoints, and failure-mode criticals; recommend
151
159
  `/rite-build` only when the entry contract is ready.
@@ -45,6 +45,20 @@ After native proof/review, `/rite-seal` runs `devrites-engine check seal <slug>`
45
45
  for structure/freshness, not prose. HITL/blocked stops follow
46
46
  [Persistence before stopping](#persistence-before-stopping-handoff-discipline).
47
47
 
48
+ ## Caller-owned technical backtracking
49
+
50
+ When an active rite invokes an earlier rite inline to repair an agent-owned
51
+ technical gap, the original rite remains the controlling caller. A nested
52
+ rite's `STOP` is a nested phase boundary, not a user-facing handoff. The caller
53
+ re-reads `state.md`, follows the durable return cursor and intermediate
54
+ `next_action`, and resumes its originating phase while no human-owned, safety,
55
+ access, budget, or exhausted-recovery stop is active.
56
+
57
+ An intermediate `Next step` is cold-resume metadata. Do not ask the human to
58
+ copy routine `/rite-plan repair`, `/rite-vet`, `/rite-build`, or proof-rerun
59
+ commands during the active recovery chain. Only the controlling caller emits
60
+ the final response; standalone phase invocations still stop normally.
61
+
48
62
  ## Final response
49
63
 
50
64
  Immediately before its final response, each rite loads
@@ -25,6 +25,10 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
25
25
  `--yolo` never authorizes Git; it reaches only the exact-plan literal-GO and
26
26
  native-approval boundary. Red checks run bounded recovery, then block unless
27
27
  the remaining decision is human-owned.
28
+ - **Keep routine backtracking internal.** Always follow agent-owned backward edges
29
+ through repair, Vet, bounded implementation correction, and re-proof inside
30
+ the active run. A nested phase `STOP` or intermediate `Next step` is not a
31
+ user handoff; pause only on the shared real stop conditions.
28
32
  - **Budget from the post-vet slice count.** Vet may split/add slices.
29
33
  `--max-slices N` may lower the cap for a partial run; otherwise build all.
30
34
  - **Parse flags only from this invocation.** `--ship`, `--yolo`, `--max-slices`,
@@ -44,8 +48,9 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
44
48
  run `/rite-vet` on **every** feature (depth scales: a light pass on simple plans, full rigor on
45
49
  big/risky; never skipped). Unattended it auto-applies only *hardening* findings: added test
46
50
  requirements, error-handling / failure-mode coverage, tightened scope, reuse-over-rebuild,
47
- dependency-order fixes (these never grow acceptance); **any finding that grows scope,
48
- adds a slice, or changes acceptance is a blocking pause**, and irreversible-risk findings always
51
+ dependency-order fixes (these never grow acceptance); acceptance-preserving
52
+ reslicing or remediation remains agent-owned. **Any finding that grows product
53
+ scope or changes acceptance is a blocking pause**, and irreversible-risk findings always
49
54
  pause. Cross-model is off unless `--cross-model` was armed.
50
55
 
51
56
  ## Workflow
@@ -76,6 +81,9 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
76
81
  built; root charges the AFK budget once per green built slice) → `/rite-prove`
77
82
  → `/rite-polish` → `/rite-review` → `/rite-seal`.
78
83
  Read each `SKILL.md` and execute it; workspace files carry state, not chat.
84
+ Follow the loop's backward-edge contract whenever a later phase discovers an
85
+ agent-owned earlier-phase gap; keep the original return cursor until that
86
+ phase resumes.
79
87
  Immediately after `/rite-vet` and before the first Build dispatch, apply the loop's
80
88
  [mutable post-vet budget](reference/loop.md#derive-the-mutable-post-vet-budget)
81
89
  contract. **Completion:** the loop reaches Seal GO, or a stop condition is persisted
@@ -52,6 +52,25 @@ Read each phase's `SKILL.md` and execute that workflow. Workspace files such as
52
52
  | 10 | `/rite-seal` | GO/NO-GO decision (no git here) |
53
53
  | 11 | `/rite-ship` | only if seal GO; `--ship` / `--yolo` never authorizes Git and only continues to the exact-plan literal-GO/native-approval boundary |
54
54
 
55
+ ## Backtrack without handing off
56
+
57
+ When a later phase finds an agent-owned technical gap in an earlier phase, the
58
+ Autocomplete root remains the caller:
59
+
60
+ 1. Save the originating phase/action in the native return cursor unless a valid
61
+ one already exists.
62
+ 2. Invoke the required repair, Vet, remediation, and proof skills inline. Their
63
+ `STOP` instructions end only those nested phases.
64
+ 3. Re-read `state.md` after each nested phase and follow its intermediate
65
+ `next_action`; do not hand the intermediate command to the user.
66
+ 4. When the prerequisite chain is green, restore and consume the return cursor,
67
+ resume the originating phase, and continue the forward table.
68
+
69
+ Count failed corrections by causal fingerprint under `afk-hitl.md`. Ask only
70
+ for a human-owned decision or mandatory safety/access action. Exhausted
71
+ agent-owned recovery stops once with its reproduction and dead ends, never with
72
+ another routine Plan/Vet command.
73
+
55
74
  ## Between phases
56
75
 
57
76
  - Re-read the active workspace before each phase (don't trust chat memory).
@@ -16,6 +16,15 @@ Regardless of `allow_gates` or `--ship`:
16
16
  Red checks are hard non-advance gates. Run bounded `devrites-debug-recovery`;
17
17
  on exhaustion, stop as a technical blocker unless human-owned.
18
18
 
19
+ ## Not a stop: agent-owned backtracking
20
+
21
+ Agent-owned backtracking is not a stop condition while its causal-fingerprint
22
+ budget remains. The active caller invokes the earlier phase inline, follows Vet
23
+ and any bounded remediation, then resumes the originating phase. Persist
24
+ `Next step` for crash recovery, but do not surface it as a command the human must
25
+ submit. Stop only when recovery is exhausted or the remaining choice is a real
26
+ human/safety/access gate.
27
+
19
28
  ## Stop on gate severity
20
29
 
21
30
  - `blocking` gate fires → synchronous pause.
@@ -24,8 +24,8 @@ other phases reference it here.
24
24
  YES, active-slice technical/tool failure → log it and use Build's bounded debug
25
25
  recovery. Do not ask for retry authorization and do not re-plan unless the
26
26
  durable remaining-work instructions are wrong.
27
- YES, durable plan is wrong → log it, run /rite-plan repair without a question,
28
- re-vet, then resume.
27
+ YES, durable plan is wrong → log it, save the caller's return cursor, then
28
+ invoke `/rite-plan repair` and `/rite-vet` inline without a question and resume.
29
29
  NO, product/policy/irreversible-risk decision → ask the user (format below).
30
30
  5. Never continue on a known-wrong durable plan. A repaired active-slice implementation
31
31
  may continue only after bounded recovery, returned-diff review, and proof gates pass.
@@ -47,3 +47,13 @@ Which direction should DevRites take?
47
47
 
48
48
  Never turn an objective defect, environment repair, tool bug, or proof rerun into a
49
49
  human permission question. Re-plan only when the durable plan changed.
50
+
51
+ ## Inline return contract
52
+
53
+ The phase that detected agent-owned drift owns the whole backtrack. Preserve it
54
+ as `return_phase`/`return_next_action`; consume Plan and Vet's nested `STOP`
55
+ boundaries internally; follow any vetted remediation required by the settled
56
+ acceptance; then restore the cursor and resume the failed step. Do not hand an
57
+ intermediate command to the human. The shared three-attempt causal-fingerprint
58
+ cap still applies: exhaustion produces one technical blocker, while a genuinely
59
+ human-owned decision uses the question format below.
@@ -35,6 +35,10 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
35
35
  - **Root writes; drafter proposes.** Follow
36
36
  [`agents.md`](../devrites-lib/reference/standards/agents.md). The controlling chat owns
37
37
  human questions, decisions, reconciliation, and all planning-artifact writes.
38
+ - **Nested repair preserves its caller.** When `state.md` contains a valid
39
+ technical-backtracking return cursor, preserve any valid return cursor
40
+ byte-for-byte. `/rite-vet` is the next internal prerequisite, not a command to
41
+ hand back to the human.
38
42
 
39
43
  ## Workflow
40
44
  0. Read `.claude/skills/devrites-lib/reference/standards/core.md` (operating rules) before reshaping anything.
@@ -93,7 +97,8 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
93
97
  `eng-review.md` exists, set `Implementation readiness: NEEDS REPLAN`. Never retain READY
94
98
  across changed planning inputs. Preserve `Plan approved` only for behavior/acceptance-neutral
95
99
  technical repair; clear and reconfirm it when the contract changed. If you stopped for drift,
96
- mark the `drift.md` entry resolved.
100
+ mark the `drift.md` entry resolved. Never remove or overwrite a valid caller
101
+ return cursor while writing the Plan checkpoint.
97
102
  6. If product behavior/acceptance criteria change, confirm through `/rite-clarify` before
98
103
  writing, re-close `decision-coverage.md`, then reconcile the plan. After any edit to
99
104
  `brief.md`, `spec.md`, `decisions.md`, `assumptions.md`, or `questions.md`, including a
@@ -111,5 +116,10 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
111
116
  table or justified no-impact statement must still match the revised boundary set.
112
117
  If any check fails, loop back: don't hand off a half-reshaped plan.
113
118
 
119
+ When invoked inline by a controlling rite, return the completed Plan checkpoint
120
+ to that caller so it can invoke Vet immediately. The phase boundary is not a
121
+ user-facing stop unless a genuine HITL, safety/access, or exhausted-recovery
122
+ condition was recorded.
123
+
114
124
  > **Mid-flight discipline.** Do not change product behavior without confirmation or
115
125
  > absorb drift silently. See [`anti-patterns`](reference/anti-patterns.md).
@@ -57,6 +57,10 @@ Pull these via `Read` when relevant:
57
57
  writes. The proof runner is read-only and validates immutable logs/artifacts.
58
58
  Every accepted source/test correction is one bounded
59
59
  `devrites-slice-wright` task, never an inline edit.
60
+ - **Prove remains the controlling caller during technical backtracking.** Save
61
+ its return cursor, invoke Plan/Vet or bounded remediation inline, consume each
62
+ nested phase boundary, then resume the failed Prove step. Never make the human
63
+ submit an agent-owned repair, re-vet, or proof-rerun command.
60
64
 
61
65
  ## Released-workspace refresh entry
62
66
 
@@ -80,14 +84,15 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
80
84
  require its `state.md`, and read the cursor directly.
81
85
  1. **Confirm all slices built.** Read `spec.md`, `tasks.md`, `state.md`,
82
86
  `test-plan.md`, and the full diff.
83
- A missing `test-plan.md` returns to Vet; it never authorizes ad hoc proof.
87
+ A missing `test-plan.md` enters caller-owned Vet backtracking; invoke Vet
88
+ inline and resume this step. It never authorizes ad hoc proof.
84
89
  2. **Discover commands** if not recorded:
85
90
  [test-command-discovery](reference/test-command-discovery.md): README, package
86
91
  scripts, Makefile, CI configs, Gemfile/Rakefile, pyproject, go.mod, Cargo.toml.
87
92
  Discovery only supplies evidence. `test-plan.md` is the sole approved runtime
88
93
  command list. If a discovered command is absent from it, do not run or
89
94
  silently approve the command: return to the current Vet contract to add and
90
- vet it, refresh readiness, then return to Prove.
95
+ vet it inline, refresh readiness, then return to Prove without a user handoff.
91
96
  **Completion:** exact commands are approved in `test-plan.md` or unavailable.
92
97
  3. **Execute proof against a frozen candidate.** Run
93
98
  `devrites-engine check candidate <slug>` before any approved proof and retain
@@ -123,6 +128,11 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
123
128
  manifest from its actual scoped diff, rerun affected real proof and both
124
129
  candidate checks, then dispatch a fresh proof runner. If a fix would exceed
125
130
  scope, record a blocker.
131
+ If triage shows an agent-owned durable-plan error, apply the Spec Drift
132
+ Guard's inline return contract: preserve Prove as the origin, run repair and
133
+ Vet inside this invocation, and resume the exact failed proof rung. Ask only
134
+ for a human-owned decision; causal-fingerprint exhaustion stops once with a
135
+ technical blocker rather than another phase command.
126
136
  8. The root updates `evidence.md`, `browser-evidence.md` (when present),
127
137
  `traceability.md`, and `state.md`. Record exactly one binding for the observed
128
138
  digest in evidence and browser evidence. New proof goes to canonical
@@ -20,6 +20,7 @@ loop to `devrites-debug-recovery`.
20
20
  - Quote the real error text; don't paraphrase it away.
21
21
  - Don't loosen/delete a failing assertion to get green: investigate whether it's drift.
22
22
  - Don't add blanket retries/sleeps to hide flakiness.
23
- - Three failed fix attempts on the same root cause escalate: `devrites-debug-recovery`
24
- for a hypothesis-driven pass, or ask the user.
23
+ - Three failed fix attempts on the same root cause consume the shared recovery
24
+ cap: preserve the reproduction and dead ends, then stop once as a technical
25
+ blocker. Ask only when the remaining decision is human-owned.
25
26
  - A failure you can't fix in scope is a recorded **blocker**, not a silent skip.
@@ -105,8 +105,8 @@ None.
105
105
  | slice_mode | none |
106
106
  | risk | none |
107
107
  | next_action | <single command + reason> |
108
- | return_phase | <later phase; retrofit clarification only> |
109
- | return_next_action | <saved command; retrofit clarification only> |
108
+ | return_phase | <originating later phase; clarification or agent-owned technical backtracking only> |
109
+ | return_next_action | <saved originating command> |
110
110
 
111
111
  ## Awaiting human
112
112
  Only present when status is awaiting_human.
@@ -120,9 +120,16 @@ Only present when status is awaiting_human.
120
120
  `state.md` is a compact cursor, not a history file. Put proof in `evidence.md`,
121
121
  decisions in `decisions.md`, assumptions in `assumptions.md`, and drift in
122
122
  `drift.md`. Omit both `return_*` rows outside a later-phase `/rite-clarify`
123
- retrofit. The controlling root follows `/rite-clarify`'s native cursor protocol:
124
- save both fields before later-phase entry, restore and remove both only after a
125
- contract-neutral CLEAR verdict, and preserve every unrelated Markdown byte.
123
+ retrofit or agent-owned technical backtracking chain.
124
+
125
+ Before an active caller moves backward, it copies its current phase and
126
+ non-empty action into the two return rows. Nested Plan, Vet, Build, and proof
127
+ work preserves that valid cursor. Once the prerequisite chain is green, the
128
+ controlling caller restores the saved phase/action and removes both rows in one
129
+ rewrite. A real HITL or exhausted-recovery stop retains the cursor for cold
130
+ resume. Never overwrite an existing valid return cursor, and preserve every
131
+ unrelated Markdown byte. `/rite-clarify` applies its stricter native cursor
132
+ protocol below.
126
133
 
127
134
  `afk_slices_remaining` is mutable runtime state, not `.devrites/AFK`
128
135
  configuration. Only the controlling root writes it under the shared
@@ -40,6 +40,9 @@ Pull the standard named by the active axis: `principles.md`, `patterns.md`,
40
40
  - **Search before asking.** Verify facts and fold reversible technical hardening into the
41
41
  plan; ask only human-owned choices under `afk-hitl.md`. Dispatch uses the bounded
42
42
  [`agents.md`](../devrites-lib/reference/standards/agents.md) contract.
43
+ - **Honor a recovery origin.** Preserve a valid technical-backtracking return
44
+ cursor throughout review. Agent-owned `NEEDS REPLAN` returns internally to the
45
+ controlling caller; it never becomes a request for the human to invoke Plan.
43
46
 
44
47
  ## Workflow
45
48
  0. **Read `.claude/skills/devrites-lib/reference/standards/core.md`** first.
@@ -146,6 +149,11 @@ Pull the standard named by the active axis: `principles.md`, `patterns.md`,
146
149
  cross-model integration.
147
150
  Completion: the final axis floor clears, an objective technical blocker is recorded, or a
148
151
  genuine human-owned gate is recorded.
152
+ When READY has no pending remediation slice and a valid technical return
153
+ cursor exists, restore and consume the return cursor instead of defaulting to
154
+ `/rite-build`, then return the nested result to the controlling caller. If
155
+ vetted remediation remains, preserve the cursor while the caller follows it;
156
+ only a real stop condition reaches the human.
149
157
  7. **STOP.** Show the Build readback, scope verdict, lowest axis band, closed coverage
150
158
  gaps, preflight, action-time checkpoints, and failure-mode criticals; recommend
151
159
  `/rite-build` only when the entry contract is ready.
@@ -45,6 +45,20 @@ After native proof/review, `$rite-seal` runs `devrites-engine check seal <slug>`
45
45
  for structure/freshness, not prose. HITL/blocked stops follow
46
46
  [Persistence before stopping](#persistence-before-stopping-handoff-discipline).
47
47
 
48
+ ## Caller-owned technical backtracking
49
+
50
+ When an active rite invokes an earlier rite inline to repair an agent-owned
51
+ technical gap, the original rite remains the controlling caller. A nested
52
+ rite's `STOP` is a nested phase boundary, not a user-facing handoff. The caller
53
+ re-reads `state.md`, follows the durable return cursor and intermediate
54
+ `next_action`, and resumes its originating phase while no human-owned, safety,
55
+ access, budget, or exhausted-recovery stop is active.
56
+
57
+ An intermediate `Next step` is cold-resume metadata. Do not ask the human to
58
+ copy routine `$rite-plan repair`, `$rite-vet`, `$rite-build`, or proof-rerun
59
+ commands during the active recovery chain. Only the controlling caller emits
60
+ the final response; standalone phase invocations still stop normally.
61
+
48
62
  ## Final response
49
63
 
50
64
  Immediately before its final response, each rite loads
@@ -25,6 +25,10 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
25
25
  `--yolo` never authorizes Git; it reaches only the exact-plan literal-GO and
26
26
  native-approval boundary. Red checks run bounded recovery, then block unless
27
27
  the remaining decision is human-owned.
28
+ - **Keep routine backtracking internal.** Always follow agent-owned backward edges
29
+ through repair, Vet, bounded implementation correction, and re-proof inside
30
+ the active run. A nested phase `STOP` or intermediate `Next step` is not a
31
+ user handoff; pause only on the shared real stop conditions.
28
32
  - **Budget from the post-vet slice count.** Vet may split/add slices.
29
33
  `--max-slices N` may lower the cap for a partial run; otherwise build all.
30
34
  - **Parse flags only from this invocation.** `--ship`, `--yolo`, `--max-slices`,
@@ -44,8 +48,9 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
44
48
  run `$rite-vet` on **every** feature (depth scales: a light pass on simple plans, full rigor on
45
49
  big/risky; never skipped). Unattended it auto-applies only *hardening* findings: added test
46
50
  requirements, error-handling / failure-mode coverage, tightened scope, reuse-over-rebuild,
47
- dependency-order fixes (these never grow acceptance); **any finding that grows scope,
48
- adds a slice, or changes acceptance is a blocking pause**, and irreversible-risk findings always
51
+ dependency-order fixes (these never grow acceptance); acceptance-preserving
52
+ reslicing or remediation remains agent-owned. **Any finding that grows product
53
+ scope or changes acceptance is a blocking pause**, and irreversible-risk findings always
49
54
  pause. Cross-model is off unless `--cross-model` was armed.
50
55
 
51
56
  ## Workflow
@@ -76,6 +81,9 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
76
81
  built; root charges the AFK budget once per green built slice) → `$rite-prove`
77
82
  → `$rite-polish` → `$rite-review` → `$rite-seal`.
78
83
  Read each `SKILL.md` and execute it; workspace files carry state, not chat.
84
+ Follow the loop's backward-edge contract whenever a later phase discovers an
85
+ agent-owned earlier-phase gap; keep the original return cursor until that
86
+ phase resumes.
79
87
  Immediately after `$rite-vet` and before the first Build dispatch, apply the loop's
80
88
  [mutable post-vet budget](reference/loop.md#derive-the-mutable-post-vet-budget)
81
89
  contract. **Completion:** the loop reaches Seal GO, or a stop condition is persisted
@@ -52,6 +52,25 @@ Read each phase's `SKILL.md` and execute that workflow. Workspace files such as
52
52
  | 10 | `$rite-seal` | GO/NO-GO decision (no git here) |
53
53
  | 11 | `$rite-ship` | only if seal GO; `--ship` / `--yolo` never authorizes Git and only continues to the exact-plan literal-GO/native-approval boundary |
54
54
 
55
+ ## Backtrack without handing off
56
+
57
+ When a later phase finds an agent-owned technical gap in an earlier phase, the
58
+ Autocomplete root remains the caller:
59
+
60
+ 1. Save the originating phase/action in the native return cursor unless a valid
61
+ one already exists.
62
+ 2. Invoke the required repair, Vet, remediation, and proof skills inline. Their
63
+ `STOP` instructions end only those nested phases.
64
+ 3. Re-read `state.md` after each nested phase and follow its intermediate
65
+ `next_action`; do not hand the intermediate command to the user.
66
+ 4. When the prerequisite chain is green, restore and consume the return cursor,
67
+ resume the originating phase, and continue the forward table.
68
+
69
+ Count failed corrections by causal fingerprint under `afk-hitl.md`. Ask only
70
+ for a human-owned decision or mandatory safety/access action. Exhausted
71
+ agent-owned recovery stops once with its reproduction and dead ends, never with
72
+ another routine Plan/Vet command.
73
+
55
74
  ## Between phases
56
75
 
57
76
  - Re-read the active workspace before each phase (don't trust chat memory).
@@ -16,6 +16,15 @@ Regardless of `allow_gates` or `--ship`:
16
16
  Red checks are hard non-advance gates. Run bounded `devrites-debug-recovery`;
17
17
  on exhaustion, stop as a technical blocker unless human-owned.
18
18
 
19
+ ## Not a stop: agent-owned backtracking
20
+
21
+ Agent-owned backtracking is not a stop condition while its causal-fingerprint
22
+ budget remains. The active caller invokes the earlier phase inline, follows Vet
23
+ and any bounded remediation, then resumes the originating phase. Persist
24
+ `Next step` for crash recovery, but do not surface it as a command the human must
25
+ submit. Stop only when recovery is exhausted or the remaining choice is a real
26
+ human/safety/access gate.
27
+
19
28
  ## Stop on gate severity
20
29
 
21
30
  - `blocking` gate fires → synchronous pause.
@@ -24,8 +24,8 @@ other phases reference it here.
24
24
  YES, active-slice technical/tool failure → log it and use Build's bounded debug
25
25
  recovery. Do not ask for retry authorization and do not re-plan unless the
26
26
  durable remaining-work instructions are wrong.
27
- YES, durable plan is wrong → log it, run $rite-plan repair without a question,
28
- re-vet, then resume.
27
+ YES, durable plan is wrong → log it, save the caller's return cursor, then
28
+ invoke `$rite-plan repair` and `$rite-vet` inline without a question and resume.
29
29
  NO, product/policy/irreversible-risk decision → ask the user (format below).
30
30
  5. Never continue on a known-wrong durable plan. A repaired active-slice implementation
31
31
  may continue only after bounded recovery, returned-diff review, and proof gates pass.
@@ -47,3 +47,13 @@ Which direction should DevRites take?
47
47
 
48
48
  Never turn an objective defect, environment repair, tool bug, or proof rerun into a
49
49
  human permission question. Re-plan only when the durable plan changed.
50
+
51
+ ## Inline return contract
52
+
53
+ The phase that detected agent-owned drift owns the whole backtrack. Preserve it
54
+ as `return_phase`/`return_next_action`; consume Plan and Vet's nested `STOP`
55
+ boundaries internally; follow any vetted remediation required by the settled
56
+ acceptance; then restore the cursor and resume the failed step. Do not hand an
57
+ intermediate command to the human. The shared three-attempt causal-fingerprint
58
+ cap still applies: exhaustion produces one technical blocker, while a genuinely
59
+ human-owned decision uses the question format below.
@@ -35,6 +35,10 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
35
35
  - **Root writes; drafter proposes.** Follow
36
36
  [`agents.md`](../devrites-lib/reference/standards/agents.md). The controlling chat owns
37
37
  human questions, decisions, reconciliation, and all planning-artifact writes.
38
+ - **Nested repair preserves its caller.** When `state.md` contains a valid
39
+ technical-backtracking return cursor, preserve any valid return cursor
40
+ byte-for-byte. `$rite-vet` is the next internal prerequisite, not a command to
41
+ hand back to the human.
38
42
 
39
43
  ## Workflow
40
44
  0. Read `.agents/skills/devrites-lib/reference/standards/core.md` (operating rules) before reshaping anything.
@@ -93,7 +97,8 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
93
97
  `eng-review.md` exists, set `Implementation readiness: NEEDS REPLAN`. Never retain READY
94
98
  across changed planning inputs. Preserve `Plan approved` only for behavior/acceptance-neutral
95
99
  technical repair; clear and reconfirm it when the contract changed. If you stopped for drift,
96
- mark the `drift.md` entry resolved.
100
+ mark the `drift.md` entry resolved. Never remove or overwrite a valid caller
101
+ return cursor while writing the Plan checkpoint.
97
102
  6. If product behavior/acceptance criteria change, confirm through `$rite-clarify` before
98
103
  writing, re-close `decision-coverage.md`, then reconcile the plan. After any edit to
99
104
  `brief.md`, `spec.md`, `decisions.md`, `assumptions.md`, or `questions.md`, including a
@@ -111,5 +116,10 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
111
116
  table or justified no-impact statement must still match the revised boundary set.
112
117
  If any check fails, loop back: don't hand off a half-reshaped plan.
113
118
 
119
+ When invoked inline by a controlling rite, return the completed Plan checkpoint
120
+ to that caller so it can invoke Vet immediately. The phase boundary is not a
121
+ user-facing stop unless a genuine HITL, safety/access, or exhausted-recovery
122
+ condition was recorded.
123
+
114
124
  > **Mid-flight discipline.** Do not change product behavior without confirmation or
115
125
  > absorb drift silently. See [`anti-patterns`](reference/anti-patterns.md).
@@ -57,6 +57,10 @@ Pull these via `Read` when relevant:
57
57
  writes. The proof runner is read-only and validates immutable logs/artifacts.
58
58
  Every accepted source/test correction is one bounded
59
59
  `devrites-slice-wright` task, never an inline edit.
60
+ - **Prove remains the controlling caller during technical backtracking.** Save
61
+ its return cursor, invoke Plan/Vet or bounded remediation inline, consume each
62
+ nested phase boundary, then resume the failed Prove step. Never make the human
63
+ submit an agent-owned repair, re-vet, or proof-rerun command.
60
64
 
61
65
  ## Released-workspace refresh entry
62
66
 
@@ -80,14 +84,15 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
80
84
  require its `state.md`, and read the cursor directly.
81
85
  1. **Confirm all slices built.** Read `spec.md`, `tasks.md`, `state.md`,
82
86
  `test-plan.md`, and the full diff.
83
- A missing `test-plan.md` returns to Vet; it never authorizes ad hoc proof.
87
+ A missing `test-plan.md` enters caller-owned Vet backtracking; invoke Vet
88
+ inline and resume this step. It never authorizes ad hoc proof.
84
89
  2. **Discover commands** if not recorded:
85
90
  [test-command-discovery](reference/test-command-discovery.md): README, package
86
91
  scripts, Makefile, CI configs, Gemfile/Rakefile, pyproject, go.mod, Cargo.toml.
87
92
  Discovery only supplies evidence. `test-plan.md` is the sole approved runtime
88
93
  command list. If a discovered command is absent from it, do not run or
89
94
  silently approve the command: return to the current Vet contract to add and
90
- vet it, refresh readiness, then return to Prove.
95
+ vet it inline, refresh readiness, then return to Prove without a user handoff.
91
96
  **Completion:** exact commands are approved in `test-plan.md` or unavailable.
92
97
  3. **Execute proof against a frozen candidate.** Run
93
98
  `devrites-engine check candidate <slug>` before any approved proof and retain
@@ -123,6 +128,11 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
123
128
  manifest from its actual scoped diff, rerun affected real proof and both
124
129
  candidate checks, then dispatch a fresh proof runner. If a fix would exceed
125
130
  scope, record a blocker.
131
+ If triage shows an agent-owned durable-plan error, apply the Spec Drift
132
+ Guard's inline return contract: preserve Prove as the origin, run repair and
133
+ Vet inside this invocation, and resume the exact failed proof rung. Ask only
134
+ for a human-owned decision; causal-fingerprint exhaustion stops once with a
135
+ technical blocker rather than another phase command.
126
136
  8. The root updates `evidence.md`, `browser-evidence.md` (when present),
127
137
  `traceability.md`, and `state.md`. Record exactly one binding for the observed
128
138
  digest in evidence and browser evidence. New proof goes to canonical
@@ -20,6 +20,7 @@ loop to `devrites-debug-recovery`.
20
20
  - Quote the real error text; don't paraphrase it away.
21
21
  - Don't loosen/delete a failing assertion to get green: investigate whether it's drift.
22
22
  - Don't add blanket retries/sleeps to hide flakiness.
23
- - Three failed fix attempts on the same root cause escalate: `devrites-debug-recovery`
24
- for a hypothesis-driven pass, or ask the user.
23
+ - Three failed fix attempts on the same root cause consume the shared recovery
24
+ cap: preserve the reproduction and dead ends, then stop once as a technical
25
+ blocker. Ask only when the remaining decision is human-owned.
25
26
  - A failure you can't fix in scope is a recorded **blocker**, not a silent skip.
@@ -105,8 +105,8 @@ None.
105
105
  | slice_mode | none |
106
106
  | risk | none |
107
107
  | next_action | <single command + reason> |
108
- | return_phase | <later phase; retrofit clarification only> |
109
- | return_next_action | <saved command; retrofit clarification only> |
108
+ | return_phase | <originating later phase; clarification or agent-owned technical backtracking only> |
109
+ | return_next_action | <saved originating command> |
110
110
 
111
111
  ## Awaiting human
112
112
  Only present when status is awaiting_human.
@@ -120,9 +120,16 @@ Only present when status is awaiting_human.
120
120
  `state.md` is a compact cursor, not a history file. Put proof in `evidence.md`,
121
121
  decisions in `decisions.md`, assumptions in `assumptions.md`, and drift in
122
122
  `drift.md`. Omit both `return_*` rows outside a later-phase `$rite-clarify`
123
- retrofit. The controlling root follows `$rite-clarify`'s native cursor protocol:
124
- save both fields before later-phase entry, restore and remove both only after a
125
- contract-neutral CLEAR verdict, and preserve every unrelated Markdown byte.
123
+ retrofit or agent-owned technical backtracking chain.
124
+
125
+ Before an active caller moves backward, it copies its current phase and
126
+ non-empty action into the two return rows. Nested Plan, Vet, Build, and proof
127
+ work preserves that valid cursor. Once the prerequisite chain is green, the
128
+ controlling caller restores the saved phase/action and removes both rows in one
129
+ rewrite. A real HITL or exhausted-recovery stop retains the cursor for cold
130
+ resume. Never overwrite an existing valid return cursor, and preserve every
131
+ unrelated Markdown byte. `$rite-clarify` applies its stricter native cursor
132
+ protocol below.
126
133
 
127
134
  `afk_slices_remaining` is mutable runtime state, not `.devrites/AFK`
128
135
  configuration. Only the controlling root writes it under the shared
@@ -40,6 +40,9 @@ Pull the standard named by the active axis: `principles.md`, `patterns.md`,
40
40
  - **Search before asking.** Verify facts and fold reversible technical hardening into the
41
41
  plan; ask only human-owned choices under `afk-hitl.md`. Dispatch uses the bounded
42
42
  [`agents.md`](../devrites-lib/reference/standards/agents.md) contract.
43
+ - **Honor a recovery origin.** Preserve a valid technical-backtracking return
44
+ cursor throughout review. Agent-owned `NEEDS REPLAN` returns internally to the
45
+ controlling caller; it never becomes a request for the human to invoke Plan.
43
46
 
44
47
  ## Workflow
45
48
  0. **Read `.agents/skills/devrites-lib/reference/standards/core.md`** first.
@@ -146,6 +149,11 @@ Pull the standard named by the active axis: `principles.md`, `patterns.md`,
146
149
  cross-model integration.
147
150
  Completion: the final axis floor clears, an objective technical blocker is recorded, or a
148
151
  genuine human-owned gate is recorded.
152
+ When READY has no pending remediation slice and a valid technical return
153
+ cursor exists, restore and consume the return cursor instead of defaulting to
154
+ `$rite-build`, then return the nested result to the controlling caller. If
155
+ vetted remediation remains, preserve the cursor while the caller follows it;
156
+ only a real stop condition reaches the human.
149
157
  7. **STOP.** Show the Build readback, scope verdict, lowest axis band, closed coverage
150
158
  gaps, preflight, action-time checkpoints, and failure-mode criticals; recommend
151
159
  `$rite-build` only when the entry contract is ready.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "devrites",
3
- "version": "4.0.2",
3
+ "version": "4.0.3",
4
4
  "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
5
5
  "license": "SEE LICENSE IN LICENSE",
6
6
  "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",