devrites 4.0.5 → 4.0.6

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [4.0.6](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.5...v4.0.6) (2026-08-07)
+
+### Fixed
+
+* **rite:** gate one-shot evidence retention ([621a549](https://github.com/ViktorsBaikers/DevRites/commit/621a549acdf9ec2a0d427b829b0df8852502380d))
+
 ## [4.0.5](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.4...v4.0.5) (2026-08-07)
 
 ### Fixed

package/README.md

@@ -28,7 +28,7 @@ project-conventional push, tag, or PR action, and archive the workspace.
 Unattended runs may create local WIP checkpoint commits along the way, but they
 remain local unless Ship's disclosed plan includes an approved remote action.
 
-**Status:** [`v4.0.5`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.0.5): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v4.0.6`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.0.6): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 

package/pack/.claude/agents/devrites-plan-reviewer.md

@@ -55,7 +55,11 @@ line, and then assign the band. Do not choose a score and justify it afterward:
    model changes conservatively. Every destructive step needs a rollback.
 7. **Failure-mode coverage:** for each new codepath, find a realistic failure such
    as a timeout, nil value, race, or stale state. A silent failure with **no test AND
-   no error handling** is a critical gap.
+   no error handling** is a critical gap. For every consumptive action under
+   `one-shot-actions.md`, require durable bounded trust-safe evidence for every
+   terminal path plus unknown-well-formed, malformed/hostile, and cleanup-survival
+   fixtures. Missing evidence completeness is `broken`: the plan must not consume
+   the action to discover diagnostics that cleanup can erase.
 
 ## Confidence calibration + verification gate (mandatory)
 Give every finding a **confidence score from 1 to 10** and a quoted source:
@@ -73,7 +77,8 @@ Band each dimension `strong` / `adequate` / `thin` / `broken` (`broken` means
 Critical; `thin` means Important). For a borderline dimension, sample twice and
 take the **lower** band. The verdict uses the weakest dimension, not an average.
 Pass only when every dimension is at least `adequate`, no critical failure-mode gap
-remains, the shared-contract check passes, and the ID-and-meaning map contains no orphaned
+remains, every consumptive action passes one-shot evidence completeness, the
+shared-contract check passes, and the ID-and-meaning map contains no orphaned
 criterion, slice, or proof.
 
 ## Rules

package/pack/.claude/skills/devrites-debug-recovery/SKILL.md

@@ -18,10 +18,14 @@ has no clear next move.
 1. **Build the feedback loop:** create a fast, deterministic, agent-runnable pass/fail
    signal. Spend most of the investigation here.
    See [build-the-loop.md](reference/build-the-loop.md).
-2. **Reproduce:** run the loop. Confirm the failure matches the user's report
-   (not a nearby failure); capture the **exact error text**; confirm
-   reproducibility (or a high enough repro rate for flaky bugs). Do not proceed
-   without reproduction.
+2. **Reproduce:** run the loop for a repeatable action. Confirm the failure matches
+   the user's report (not a nearby failure); capture the **exact error text**;
+   confirm reproducibility (or a high enough repro rate for flaky bugs). For a
+   consumptive action under
+   [`one-shot-actions.md`](../devrites-lib/reference/standards/one-shot-actions.md),
+   the retained bounded artifact
+   is the reproduction input and the action MUST NOT be rerun during diagnosis.
+   Do not proceed without one of those reproduction inputs.
 3. **Ranked hypotheses (3-5, falsifiable):** generate the list before testing
    any of them. Each must state a prediction.
    **Completion:** 3-5 distinct hypotheses each state an observable prediction.
@@ -51,8 +55,10 @@ has no clear next move.
 - **Do NOT loosen / delete a failing assertion** to get green: check whether
   it's drift first (route via `/rite-plan repair`).
 - **Do NOT hide flakiness** with sleeps / retries: characterize it.
-- **Re-run the original loop after the fix.** The minimized regression test is not
-  enough; prove the user-visible failure no longer reproduces.
+- **Re-run the original loop after the fix when it is repeatable.** For a
+  consumptive action, first re-vet evidence completeness and obtain any required
+  fresh authorization; offline fixtures remain mandatory but cannot authorize the
+  real attempt.
 - **Classify before routing** with
   [cleanup-and-classify.md](reference/cleanup-and-classify.md).
 - **Durably record class and rationale** in `decisions.md` and the applicable

package/pack/.claude/skills/devrites-debug-recovery/reference/cleanup-and-classify.md

@@ -14,7 +14,8 @@ record the dead end and classify anew. Failure alone never resets the budget.
 - `preexisting`: the same failure exists outside the candidate delta. Record the baseline and fix it only when it blocks acceptance.
 - `not_a_defect`: the observation matches current accepted authority. Record that authority and continue.
 
-Only human credentials/quotas/actions or irreversible work pause; never ask to retry.
+Only human credentials/quotas/actions, irreversible work, or fresh authorization
+required by a consumptive action pause; never ask for a blind retry.
 
 Record class/routing in `decisions.md` and each failed attempt in `evidence.md`
 or `## Dead ends`. Use one stable causal fingerprint shaped as `<affected
@@ -30,7 +31,8 @@ file or command.
 
 ## Cleanup checklist: required before declaring done
 
-- [ ] Original repro no longer reproduces (re-run the Phase 1 loop).
+- [ ] Original repeatable repro no longer reproduces, or the consumptive action's
+      offline regression and evidence-completeness fixtures pass without a rerun.
 - [ ] Regression test passes (or absence of seam is documented).
 - [ ] All `[DEBUG-...]` instrumentation removed (`grep` the prefix).
 - [ ] Throwaway harnesses deleted (or moved to a clearly marked debug location).

package/pack/.claude/skills/devrites-lib/reference/standards/README.md

@@ -36,6 +36,7 @@ topic's owner.
 | `context-hygiene.md` | Choosing `/clear`, `/compact`, or a handoff. |
 | `anti-patterns.md` | A pack-wide rationalization or red flag appears. |
 | `afk-hitl.md` | A pause, question, resume, or AFK decision is possible. |
+| `one-shot-actions.md` | A proof/action may be attempted once, needs fresh retry authorization, consumes external state/quota, or can delete its own failure evidence. |
 | `tooling.md` | Structural lookup, current external facts, or architecture memory is needed. |
 | `skill-authoring.md` | Creating, editing, routing, evaluating, or pruning a DevRites skill. |
 | `definition-of-done.md` | Prove, Seal, Ship, or Quick must decide whether work is finished. |

package/pack/.claude/skills/devrites-lib/reference/standards/one-shot-actions.md

@@ -0,0 +1,46 @@
+# One-shot evidence completeness
+
+An action is **consumptive** when a failed attempt is not safely equivalent to a
+normal rerun. This includes commands limited to one attempt, commands whose retry
+needs fresh human authorization, actions that spend external quota or mutate
+privileged/external state so a rerun is not equivalent, and actions whose cleanup
+can destroy the failure state needed for diagnosis. Successful cleanup does not
+make a consumptive action repeatable.
+
+## Pre-attempt gate
+
+Before Vet can emit READY, and again immediately before Prove executes the action,
+the approved `test-plan.md` must bind all of the following:
+
+1. **Durable retention:** an operator-controlled evidence artifact outside the
+   disposable runtime/cleanup tree, created before the first side effect, written
+   durably before cleanup, least-privilege, and bounded by schema, size, and
+   cardinality.
+2. **Trust-safe diagnostics:** known semantic values use the normal validator;
+   unknown but lexically well-formed non-secret values survive in bounded sanitized
+   fields; malformed, hostile, or secret-bearing values become fixed reason codes
+   rather than retained raw input.
+3. **Terminal completeness:** every success, nonzero exit, rejection, timeout,
+   signal, and cleanup failure either names the retained artifact or proves that
+   no diagnostic state exists. Failure retention preserves the original safe
+   failure family and cause through clean convergence.
+4. **Discriminating proof:** fixtures cover success, a known failure, an unknown
+   well-formed failure, malformed/hostile input, and cleanup after failure. They
+   prove cleanup cannot delete or overwrite the retained failure evidence.
+5. **Recovery sufficiency:** the retained bounded evidence is enough to choose an
+   offline correction or a truthful terminal classification without consuming
+   another attempt.
+
+Missing or stale evidence is an agent-owned technical plan gap: Vet returns
+`NEEDS REPLAN`, and Prove returns to Vet inline without executing the action. Never
+weaken the trust validator or spend the attempt merely to discover what the
+retention design should have preserved.
+
+## Failure handling
+
+After a consumptive action fails, its retained artifact is the reproduction input.
+Do not rerun the action during triage. A new attempt is admissible only after the
+evidence identifies a changed invariant or external condition, the affected plan
+and fixtures are re-vetted, and any required fresh authorization is obtained. If
+the attempt ran without complete retention, stop with the observed technical
+blocker; a blind retry cannot manufacture the destroyed evidence.

package/pack/.claude/skills/rite-prove/SKILL.md

@@ -38,6 +38,8 @@ Pull these via `Read` when relevant:
   webhook / config / error messages / getting-started): **measure** the DX scorecard (run the flow,
   measure time-to-hello-world, and capture verbatim error text), rather than asserting it.
 - `definition-of-done.md`: acceptance, proof, gates, scope, rollback/docs.
+- `one-shot-actions.md`: pre-attempt evidence completeness and no-rerun handling for
+  consumptive proof actions.
 
 
 ## Operating rules
@@ -107,6 +109,13 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
    substituted commands, malformed manifests, zero-test/skipped/filtered results used as
    behavioral proof, success inferred only from exit status, and any source drift. Static
    gates prove only their named static criterion.
+   Immediately before any consumptive action, apply `one-shot-actions.md` to the
+   live candidate: require the vetted retained-artifact identity, bounds,
+   sanitization, terminal-path fixtures, and cleanup-survival proof. A missing,
+   stale, or disposable-only evidence surface returns to Vet inline and consumes
+   no attempt. Record the admitted artifact identity before execution. After a
+   failed consumptive action, triage from that artifact; never reproduce it by
+   rerunning the action.
 4. **UI feature?** The root applies the browser proof ladder with
    `design-brief.md`, `references.md`, the requested routes, browser harness, and
    allowed scratch path:

package/pack/.claude/skills/rite-prove/reference/failure-triage.md

@@ -4,7 +4,10 @@ When a test/build/runtime/browser check fails, triage before fixing. Delegates t
 loop to `devrites-debug-recovery`.
 
 ## Triage ladder
-1. **Reproduce:** run the failing command again; capture the exact error (quote it).
+1. **Reproduce:** for a repeatable command, run it again and capture the exact
+   error (quote it). For a consumptive action under
+   [`one-shot-actions.md`](../../devrites-lib/reference/standards/one-shot-actions.md),
+   never rerun it: use the retained bounded artifact as the reproduction input.
 2. **Classify** the failure:
    - test is right, code is wrong → fix the code (in scope).
    - test is wrong/outdated → that may be **spec drift** (acceptance criteria wrong).
@@ -14,7 +17,9 @@ loop to `devrites-debug-recovery`.
 3. **Isolate:** minimize to the smallest failing case; bisect the diff if needed.
 4. **Fix within scope:** the current slice/feature only. If the fix reaches outside
    scope, stop and record a blocker in `state.md` (then `/rite-plan unblock`).
-5. **Re-run** the same command; confirm green; record both attempts in `evidence.md`.
+5. **Re-run** the same command when it is repeatable; confirm green and record both
+   attempts in `evidence.md`. A consumptive action needs re-vetted evidence
+   completeness and any fresh authorization before a new attempt.
 
 ## Rules
 - Quote the real error text; don't paraphrase it away.

package/pack/.claude/skills/rite-vet/SKILL.md

@@ -20,7 +20,8 @@ but every profile keeps the exact plan-reviewer gate.
 Pull the standard named by the active axis: `principles.md`, `patterns.md`,
 `coding-style.md`, `testing.md`, `spec-grammar.md`, `performance.md`,
 `error-handling.md`, `development-workflow.md`, `afk-hitl.md`,
-`developer-experience.md`, `elicitation.md`, and `definition-of-done.md`.
+`one-shot-actions.md`, `developer-experience.md`, `elicitation.md`, and
+`definition-of-done.md`.
 
 
 ## Operating rules
@@ -97,6 +98,11 @@ Pull the standard named by the active axis: `principles.md`, `patterns.md`,
    unmeasurable conflict = gap. Record complete SHA-256 provenance inputs. Require
    every behavioral mapping to name a positive,
    discriminating assertion and decisive signal, not merely a command or expected exit zero.
+   Identify every consumptive action under `one-shot-actions.md`. Before admitting
+   it, require the exact durable retention surface, trust-safe diagnostic schema,
+   cleanup ordering, terminal-path coverage, and discriminating fixtures in
+   `test-plan.md`. Missing or stale one-shot evidence completeness is a technical
+   preflight gap; do not spend the action to learn what cleanup would erase.
    Preflight observes; it need not make future behavior pass.
 2c. **Implementation-readiness audit.** Goal-backward map every REQ/AC/NFR, interaction,
    edge/prohibition, and decision-coverage row to a slice and executable proof. Verify

package/pack/.claude/skills/rite-vet/reference/artifacts.md

@@ -35,6 +35,7 @@ Inventory/currentness: <pass/gaps> · slice order/independence: <pass/gaps> ·
 UX/spec/architecture: <pass/n-a/gaps> · operations/rollout/rollback: <pass/n-a/gaps>
 
 Shared contract proof: <pass | gap: missing/one-sided/duplicated-contract/vague/non-consuming>
+One-shot evidence completeness: <n/a | pass: action + retained artifact + bounds/sanitization + cleanup-survival fixtures | gap: exact missing proof>
 
 ## 3. Axis findings (floor-gated)
 | Axis | Floor band | Findings (sev · confidence) |
@@ -94,6 +95,11 @@ Commands in this durable artifact are portable repository commands: no RTK or lo
 aliases, user-specific absolute paths, or temporary proof trees. Evidence records
 the command actually executed.
 
+## Consumptive action gates
+| Action | Why one-shot/consumptive | Retained artifact | Bounds + sanitization | Terminal-path fixtures | Cleanup survival | Retry authority |
+|---|---|---|---|---|---|---|
+| <exact approved action or n/a> | <one attempt/quota/state/evidence deletion> | <durable operator-controlled path/schema> | <size/cardinality + known/unknown/malformed handling> | <success/known/unknown/hostile> | <assertion> | <none/fresh human authorization> |
+
 Every behavioral row names a positive, discriminating assertion and the decisive output it
 produces. A command or expected exit zero alone is not a behavioral assertion; static gates
 prove only their named static criterion.

package/pack/generated/claude/agents/devrites-plan-reviewer.md

@@ -55,7 +55,11 @@ line, and then assign the band. Do not choose a score and justify it afterward:
    model changes conservatively. Every destructive step needs a rollback.
 7. **Failure-mode coverage:** for each new codepath, find a realistic failure such
    as a timeout, nil value, race, or stale state. A silent failure with **no test AND
-   no error handling** is a critical gap.
+   no error handling** is a critical gap. For every consumptive action under
+   `one-shot-actions.md`, require durable bounded trust-safe evidence for every
+   terminal path plus unknown-well-formed, malformed/hostile, and cleanup-survival
+   fixtures. Missing evidence completeness is `broken`: the plan must not consume
+   the action to discover diagnostics that cleanup can erase.
 
 ## Confidence calibration + verification gate (mandatory)
 Give every finding a **confidence score from 1 to 10** and a quoted source:
@@ -73,7 +77,8 @@ Band each dimension `strong` / `adequate` / `thin` / `broken` (`broken` means
 Critical; `thin` means Important). For a borderline dimension, sample twice and
 take the **lower** band. The verdict uses the weakest dimension, not an average.
 Pass only when every dimension is at least `adequate`, no critical failure-mode gap
-remains, the shared-contract check passes, and the ID-and-meaning map contains no orphaned
+remains, every consumptive action passes one-shot evidence completeness, the
+shared-contract check passes, and the ID-and-meaning map contains no orphaned
 criterion, slice, or proof.
 
 ## Rules

package/pack/generated/claude/skills/devrites-debug-recovery/SKILL.md

@@ -18,10 +18,14 @@ has no clear next move.
 1. **Build the feedback loop:** create a fast, deterministic, agent-runnable pass/fail
    signal. Spend most of the investigation here.
    See [build-the-loop.md](reference/build-the-loop.md).
-2. **Reproduce:** run the loop. Confirm the failure matches the user's report
-   (not a nearby failure); capture the **exact error text**; confirm
-   reproducibility (or a high enough repro rate for flaky bugs). Do not proceed
-   without reproduction.
+2. **Reproduce:** run the loop for a repeatable action. Confirm the failure matches
+   the user's report (not a nearby failure); capture the **exact error text**;
+   confirm reproducibility (or a high enough repro rate for flaky bugs). For a
+   consumptive action under
+   [`one-shot-actions.md`](../devrites-lib/reference/standards/one-shot-actions.md),
+   the retained bounded artifact
+   is the reproduction input and the action MUST NOT be rerun during diagnosis.
+   Do not proceed without one of those reproduction inputs.
 3. **Ranked hypotheses (3-5, falsifiable):** generate the list before testing
    any of them. Each must state a prediction.
    **Completion:** 3-5 distinct hypotheses each state an observable prediction.
@@ -51,8 +55,10 @@ has no clear next move.
 - **Do NOT loosen / delete a failing assertion** to get green: check whether
   it's drift first (route via `/rite-plan repair`).
 - **Do NOT hide flakiness** with sleeps / retries: characterize it.
-- **Re-run the original loop after the fix.** The minimized regression test is not
-  enough; prove the user-visible failure no longer reproduces.
+- **Re-run the original loop after the fix when it is repeatable.** For a
+  consumptive action, first re-vet evidence completeness and obtain any required
+  fresh authorization; offline fixtures remain mandatory but cannot authorize the
+  real attempt.
 - **Classify before routing** with
   [cleanup-and-classify.md](reference/cleanup-and-classify.md).
 - **Durably record class and rationale** in `decisions.md` and the applicable

package/pack/generated/claude/skills/devrites-debug-recovery/reference/cleanup-and-classify.md

@@ -14,7 +14,8 @@ record the dead end and classify anew. Failure alone never resets the budget.
 - `preexisting`: the same failure exists outside the candidate delta. Record the baseline and fix it only when it blocks acceptance.
 - `not_a_defect`: the observation matches current accepted authority. Record that authority and continue.
 
-Only human credentials/quotas/actions or irreversible work pause; never ask to retry.
+Only human credentials/quotas/actions, irreversible work, or fresh authorization
+required by a consumptive action pause; never ask for a blind retry.
 
 Record class/routing in `decisions.md` and each failed attempt in `evidence.md`
 or `## Dead ends`. Use one stable causal fingerprint shaped as `<affected
@@ -30,7 +31,8 @@ file or command.
 
 ## Cleanup checklist: required before declaring done
 
-- [ ] Original repro no longer reproduces (re-run the Phase 1 loop).
+- [ ] Original repeatable repro no longer reproduces, or the consumptive action's
+      offline regression and evidence-completeness fixtures pass without a rerun.
 - [ ] Regression test passes (or absence of seam is documented).
 - [ ] All `[DEBUG-...]` instrumentation removed (`grep` the prefix).
 - [ ] Throwaway harnesses deleted (or moved to a clearly marked debug location).

package/pack/generated/claude/skills/devrites-lib/reference/standards/README.md

@@ -36,6 +36,7 @@ topic's owner.
 | `context-hygiene.md` | Choosing `/clear`, `/compact`, or a handoff. |
 | `anti-patterns.md` | A pack-wide rationalization or red flag appears. |
 | `afk-hitl.md` | A pause, question, resume, or AFK decision is possible. |
+| `one-shot-actions.md` | A proof/action may be attempted once, needs fresh retry authorization, consumes external state/quota, or can delete its own failure evidence. |
 | `tooling.md` | Structural lookup, current external facts, or architecture memory is needed. |
 | `skill-authoring.md` | Creating, editing, routing, evaluating, or pruning a DevRites skill. |
 | `definition-of-done.md` | Prove, Seal, Ship, or Quick must decide whether work is finished. |

package/pack/generated/claude/skills/devrites-lib/reference/standards/one-shot-actions.md

@@ -0,0 +1,46 @@
+# One-shot evidence completeness
+
+An action is **consumptive** when a failed attempt is not safely equivalent to a
+normal rerun. This includes commands limited to one attempt, commands whose retry
+needs fresh human authorization, actions that spend external quota or mutate
+privileged/external state so a rerun is not equivalent, and actions whose cleanup
+can destroy the failure state needed for diagnosis. Successful cleanup does not
+make a consumptive action repeatable.
+
+## Pre-attempt gate
+
+Before Vet can emit READY, and again immediately before Prove executes the action,
+the approved `test-plan.md` must bind all of the following:
+
+1. **Durable retention:** an operator-controlled evidence artifact outside the
+   disposable runtime/cleanup tree, created before the first side effect, written
+   durably before cleanup, least-privilege, and bounded by schema, size, and
+   cardinality.
+2. **Trust-safe diagnostics:** known semantic values use the normal validator;
+   unknown but lexically well-formed non-secret values survive in bounded sanitized
+   fields; malformed, hostile, or secret-bearing values become fixed reason codes
+   rather than retained raw input.
+3. **Terminal completeness:** every success, nonzero exit, rejection, timeout,
+   signal, and cleanup failure either names the retained artifact or proves that
+   no diagnostic state exists. Failure retention preserves the original safe
+   failure family and cause through clean convergence.
+4. **Discriminating proof:** fixtures cover success, a known failure, an unknown
+   well-formed failure, malformed/hostile input, and cleanup after failure. They
+   prove cleanup cannot delete or overwrite the retained failure evidence.
+5. **Recovery sufficiency:** the retained bounded evidence is enough to choose an
+   offline correction or a truthful terminal classification without consuming
+   another attempt.
+
+Missing or stale evidence is an agent-owned technical plan gap: Vet returns
+`NEEDS REPLAN`, and Prove returns to Vet inline without executing the action. Never
+weaken the trust validator or spend the attempt merely to discover what the
+retention design should have preserved.
+
+## Failure handling
+
+After a consumptive action fails, its retained artifact is the reproduction input.
+Do not rerun the action during triage. A new attempt is admissible only after the
+evidence identifies a changed invariant or external condition, the affected plan
+and fixtures are re-vetted, and any required fresh authorization is obtained. If
+the attempt ran without complete retention, stop with the observed technical
+blocker; a blind retry cannot manufacture the destroyed evidence.

package/pack/generated/claude/skills/rite-prove/SKILL.md

@@ -38,6 +38,8 @@ Pull these via `Read` when relevant:
   webhook / config / error messages / getting-started): **measure** the DX scorecard (run the flow,
   measure time-to-hello-world, and capture verbatim error text), rather than asserting it.
 - `definition-of-done.md`: acceptance, proof, gates, scope, rollback/docs.
+- `one-shot-actions.md`: pre-attempt evidence completeness and no-rerun handling for
+  consumptive proof actions.
 
 
 ## Operating rules
@@ -107,6 +109,13 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
    substituted commands, malformed manifests, zero-test/skipped/filtered results used as
    behavioral proof, success inferred only from exit status, and any source drift. Static
    gates prove only their named static criterion.
+   Immediately before any consumptive action, apply `one-shot-actions.md` to the
+   live candidate: require the vetted retained-artifact identity, bounds,
+   sanitization, terminal-path fixtures, and cleanup-survival proof. A missing,
+   stale, or disposable-only evidence surface returns to Vet inline and consumes
+   no attempt. Record the admitted artifact identity before execution. After a
+   failed consumptive action, triage from that artifact; never reproduce it by
+   rerunning the action.
 4. **UI feature?** The root applies the browser proof ladder with
    `design-brief.md`, `references.md`, the requested routes, browser harness, and
    allowed scratch path:

package/pack/generated/claude/skills/rite-prove/reference/failure-triage.md

@@ -4,7 +4,10 @@ When a test/build/runtime/browser check fails, triage before fixing. Delegates t
 loop to `devrites-debug-recovery`.
 
 ## Triage ladder
-1. **Reproduce:** run the failing command again; capture the exact error (quote it).
+1. **Reproduce:** for a repeatable command, run it again and capture the exact
+   error (quote it). For a consumptive action under
+   [`one-shot-actions.md`](../../devrites-lib/reference/standards/one-shot-actions.md),
+   never rerun it: use the retained bounded artifact as the reproduction input.
 2. **Classify** the failure:
    - test is right, code is wrong → fix the code (in scope).
    - test is wrong/outdated → that may be **spec drift** (acceptance criteria wrong).
@@ -14,7 +17,9 @@ loop to `devrites-debug-recovery`.
 3. **Isolate:** minimize to the smallest failing case; bisect the diff if needed.
 4. **Fix within scope:** the current slice/feature only. If the fix reaches outside
    scope, stop and record a blocker in `state.md` (then `/rite-plan unblock`).
-5. **Re-run** the same command; confirm green; record both attempts in `evidence.md`.
+5. **Re-run** the same command when it is repeatable; confirm green and record both
+   attempts in `evidence.md`. A consumptive action needs re-vetted evidence
+   completeness and any fresh authorization before a new attempt.
 
 ## Rules
 - Quote the real error text; don't paraphrase it away.

package/pack/generated/claude/skills/rite-vet/SKILL.md

@@ -20,7 +20,8 @@ but every profile keeps the exact plan-reviewer gate.
 Pull the standard named by the active axis: `principles.md`, `patterns.md`,
 `coding-style.md`, `testing.md`, `spec-grammar.md`, `performance.md`,
 `error-handling.md`, `development-workflow.md`, `afk-hitl.md`,
-`developer-experience.md`, `elicitation.md`, and `definition-of-done.md`.
+`one-shot-actions.md`, `developer-experience.md`, `elicitation.md`, and
+`definition-of-done.md`.
 
 
 ## Operating rules
@@ -97,6 +98,11 @@ Pull the standard named by the active axis: `principles.md`, `patterns.md`,
    unmeasurable conflict = gap. Record complete SHA-256 provenance inputs. Require
    every behavioral mapping to name a positive,
    discriminating assertion and decisive signal, not merely a command or expected exit zero.
+   Identify every consumptive action under `one-shot-actions.md`. Before admitting
+   it, require the exact durable retention surface, trust-safe diagnostic schema,
+   cleanup ordering, terminal-path coverage, and discriminating fixtures in
+   `test-plan.md`. Missing or stale one-shot evidence completeness is a technical
+   preflight gap; do not spend the action to learn what cleanup would erase.
    Preflight observes; it need not make future behavior pass.
 2c. **Implementation-readiness audit.** Goal-backward map every REQ/AC/NFR, interaction,
    edge/prohibition, and decision-coverage row to a slice and executable proof. Verify

package/pack/generated/claude/skills/rite-vet/reference/artifacts.md

@@ -35,6 +35,7 @@ Inventory/currentness: <pass/gaps> · slice order/independence: <pass/gaps> ·
 UX/spec/architecture: <pass/n-a/gaps> · operations/rollout/rollback: <pass/n-a/gaps>
 
 Shared contract proof: <pass | gap: missing/one-sided/duplicated-contract/vague/non-consuming>
+One-shot evidence completeness: <n/a | pass: action + retained artifact + bounds/sanitization + cleanup-survival fixtures | gap: exact missing proof>
 
 ## 3. Axis findings (floor-gated)
 | Axis | Floor band | Findings (sev · confidence) |
@@ -94,6 +95,11 @@ Commands in this durable artifact are portable repository commands: no RTK or lo
 aliases, user-specific absolute paths, or temporary proof trees. Evidence records
 the command actually executed.
 
+## Consumptive action gates
+| Action | Why one-shot/consumptive | Retained artifact | Bounds + sanitization | Terminal-path fixtures | Cleanup survival | Retry authority |
+|---|---|---|---|---|---|---|
+| <exact approved action or n/a> | <one attempt/quota/state/evidence deletion> | <durable operator-controlled path/schema> | <size/cardinality + known/unknown/malformed handling> | <success/known/unknown/hostile> | <assertion> | <none/fresh human authorization> |
+
 Every behavioral row names a positive, discriminating assertion and the decisive output it
 produces. A command or expected exit zero alone is not a behavioral assertion; static gates
 prove only their named static criterion.

package/pack/generated/codex/agents/devrites-plan-reviewer.toml

@@ -53,7 +53,11 @@ line, and then assign the band. Do not choose a score and justify it afterward:
    model changes conservatively. Every destructive step needs a rollback.
 7. **Failure-mode coverage:** for each new codepath, find a realistic failure such
    as a timeout, nil value, race, or stale state. A silent failure with **no test AND
-   no error handling** is a critical gap.
+   no error handling** is a critical gap. For every consumptive action under
+   `one-shot-actions.md`, require durable bounded trust-safe evidence for every
+   terminal path plus unknown-well-formed, malformed/hostile, and cleanup-survival
+   fixtures. Missing evidence completeness is `broken`: the plan must not consume
+   the action to discover diagnostics that cleanup can erase.
 
 ## Confidence calibration + verification gate (mandatory)
 Give every finding a **confidence score from 1 to 10** and a quoted source:
@@ -71,7 +75,8 @@ Band each dimension `strong` / `adequate` / `thin` / `broken` (`broken` means
 Critical; `thin` means Important). For a borderline dimension, sample twice and
 take the **lower** band. The verdict uses the weakest dimension, not an average.
 Pass only when every dimension is at least `adequate`, no critical failure-mode gap
-remains, the shared-contract check passes, and the ID-and-meaning map contains no orphaned
+remains, every consumptive action passes one-shot evidence completeness, the
+shared-contract check passes, and the ID-and-meaning map contains no orphaned
 criterion, slice, or proof.
 
 ## Rules

package/pack/generated/codex/skills/devrites-debug-recovery/SKILL.md

@@ -18,10 +18,14 @@ has no clear next move.
 1. **Build the feedback loop:** create a fast, deterministic, agent-runnable pass/fail
    signal. Spend most of the investigation here.
    See [build-the-loop.md](reference/build-the-loop.md).
-2. **Reproduce:** run the loop. Confirm the failure matches the user's report
-   (not a nearby failure); capture the **exact error text**; confirm
-   reproducibility (or a high enough repro rate for flaky bugs). Do not proceed
-   without reproduction.
+2. **Reproduce:** run the loop for a repeatable action. Confirm the failure matches
+   the user's report (not a nearby failure); capture the **exact error text**;
+   confirm reproducibility (or a high enough repro rate for flaky bugs). For a
+   consumptive action under
+   [`one-shot-actions.md`](../devrites-lib/reference/standards/one-shot-actions.md),
+   the retained bounded artifact
+   is the reproduction input and the action MUST NOT be rerun during diagnosis.
+   Do not proceed without one of those reproduction inputs.
 3. **Ranked hypotheses (3-5, falsifiable):** generate the list before testing
    any of them. Each must state a prediction.
    **Completion:** 3-5 distinct hypotheses each state an observable prediction.
@@ -51,8 +55,10 @@ has no clear next move.
 - **Do NOT loosen / delete a failing assertion** to get green: check whether
   it's drift first (route via `$rite-plan repair`).
 - **Do NOT hide flakiness** with sleeps / retries: characterize it.
-- **Re-run the original loop after the fix.** The minimized regression test is not
-  enough; prove the user-visible failure no longer reproduces.
+- **Re-run the original loop after the fix when it is repeatable.** For a
+  consumptive action, first re-vet evidence completeness and obtain any required
+  fresh authorization; offline fixtures remain mandatory but cannot authorize the
+  real attempt.
 - **Classify before routing** with
   [cleanup-and-classify.md](reference/cleanup-and-classify.md).
 - **Durably record class and rationale** in `decisions.md` and the applicable

package/pack/generated/codex/skills/devrites-debug-recovery/reference/cleanup-and-classify.md

@@ -14,7 +14,8 @@ record the dead end and classify anew. Failure alone never resets the budget.
 - `preexisting`: the same failure exists outside the candidate delta. Record the baseline and fix it only when it blocks acceptance.
 - `not_a_defect`: the observation matches current accepted authority. Record that authority and continue.
 
-Only human credentials/quotas/actions or irreversible work pause; never ask to retry.
+Only human credentials/quotas/actions, irreversible work, or fresh authorization
+required by a consumptive action pause; never ask for a blind retry.
 
 Record class/routing in `decisions.md` and each failed attempt in `evidence.md`
 or `## Dead ends`. Use one stable causal fingerprint shaped as `<affected
@@ -30,7 +31,8 @@ file or command.
 
 ## Cleanup checklist: required before declaring done
 
-- [ ] Original repro no longer reproduces (re-run the Phase 1 loop).
+- [ ] Original repeatable repro no longer reproduces, or the consumptive action's
+      offline regression and evidence-completeness fixtures pass without a rerun.
 - [ ] Regression test passes (or absence of seam is documented).
 - [ ] All `[DEBUG-...]` instrumentation removed (`grep` the prefix).
 - [ ] Throwaway harnesses deleted (or moved to a clearly marked debug location).

package/pack/generated/codex/skills/devrites-lib/reference/standards/README.md

@@ -36,6 +36,7 @@ topic's owner.
 | `context-hygiene.md` | Choosing `/clear`, `/compact`, or a handoff. |
 | `anti-patterns.md` | A pack-wide rationalization or red flag appears. |
 | `afk-hitl.md` | A pause, question, resume, or AFK decision is possible. |
+| `one-shot-actions.md` | A proof/action may be attempted once, needs fresh retry authorization, consumes external state/quota, or can delete its own failure evidence. |
 | `tooling.md` | Structural lookup, current external facts, or architecture memory is needed. |
 | `skill-authoring.md` | Creating, editing, routing, evaluating, or pruning a DevRites skill. |
 | `definition-of-done.md` | Prove, Seal, Ship, or Quick must decide whether work is finished. |

package/pack/generated/codex/skills/devrites-lib/reference/standards/one-shot-actions.md

@@ -0,0 +1,46 @@
+# One-shot evidence completeness
+
+An action is **consumptive** when a failed attempt is not safely equivalent to a
+normal rerun. This includes commands limited to one attempt, commands whose retry
+needs fresh human authorization, actions that spend external quota or mutate
+privileged/external state so a rerun is not equivalent, and actions whose cleanup
+can destroy the failure state needed for diagnosis. Successful cleanup does not
+make a consumptive action repeatable.
+
+## Pre-attempt gate
+
+Before Vet can emit READY, and again immediately before Prove executes the action,
+the approved `test-plan.md` must bind all of the following:
+
+1. **Durable retention:** an operator-controlled evidence artifact outside the
+   disposable runtime/cleanup tree, created before the first side effect, written
+   durably before cleanup, least-privilege, and bounded by schema, size, and
+   cardinality.
+2. **Trust-safe diagnostics:** known semantic values use the normal validator;
+   unknown but lexically well-formed non-secret values survive in bounded sanitized
+   fields; malformed, hostile, or secret-bearing values become fixed reason codes
+   rather than retained raw input.
+3. **Terminal completeness:** every success, nonzero exit, rejection, timeout,
+   signal, and cleanup failure either names the retained artifact or proves that
+   no diagnostic state exists. Failure retention preserves the original safe
+   failure family and cause through clean convergence.
+4. **Discriminating proof:** fixtures cover success, a known failure, an unknown
+   well-formed failure, malformed/hostile input, and cleanup after failure. They
+   prove cleanup cannot delete or overwrite the retained failure evidence.
+5. **Recovery sufficiency:** the retained bounded evidence is enough to choose an
+   offline correction or a truthful terminal classification without consuming
+   another attempt.
+
+Missing or stale evidence is an agent-owned technical plan gap: Vet returns
+`NEEDS REPLAN`, and Prove returns to Vet inline without executing the action. Never
+weaken the trust validator or spend the attempt merely to discover what the
+retention design should have preserved.
+
+## Failure handling
+
+After a consumptive action fails, its retained artifact is the reproduction input.
+Do not rerun the action during triage. A new attempt is admissible only after the
+evidence identifies a changed invariant or external condition, the affected plan
+and fixtures are re-vetted, and any required fresh authorization is obtained. If
+the attempt ran without complete retention, stop with the observed technical
+blocker; a blind retry cannot manufacture the destroyed evidence.

package/pack/generated/codex/skills/rite-prove/SKILL.md

@@ -38,6 +38,8 @@ Pull these via `Read` when relevant:
   webhook / config / error messages / getting-started): **measure** the DX scorecard (run the flow,
   measure time-to-hello-world, and capture verbatim error text), rather than asserting it.
 - `definition-of-done.md`: acceptance, proof, gates, scope, rollback/docs.
+- `one-shot-actions.md`: pre-attempt evidence completeness and no-rerun handling for
+  consumptive proof actions.
 
 
 ## Operating rules
@@ -107,6 +109,13 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
    substituted commands, malformed manifests, zero-test/skipped/filtered results used as
    behavioral proof, success inferred only from exit status, and any source drift. Static
    gates prove only their named static criterion.
+   Immediately before any consumptive action, apply `one-shot-actions.md` to the
+   live candidate: require the vetted retained-artifact identity, bounds,
+   sanitization, terminal-path fixtures, and cleanup-survival proof. A missing,
+   stale, or disposable-only evidence surface returns to Vet inline and consumes
+   no attempt. Record the admitted artifact identity before execution. After a
+   failed consumptive action, triage from that artifact; never reproduce it by
+   rerunning the action.
 4. **UI feature?** The root applies the browser proof ladder with
    `design-brief.md`, `references.md`, the requested routes, browser harness, and
    allowed scratch path:

package/pack/generated/codex/skills/rite-prove/reference/failure-triage.md

@@ -4,7 +4,10 @@ When a test/build/runtime/browser check fails, triage before fixing. Delegates t
 loop to `devrites-debug-recovery`.
 
 ## Triage ladder
-1. **Reproduce:** run the failing command again; capture the exact error (quote it).
+1. **Reproduce:** for a repeatable command, run it again and capture the exact
+   error (quote it). For a consumptive action under
+   [`one-shot-actions.md`](../../devrites-lib/reference/standards/one-shot-actions.md),
+   never rerun it: use the retained bounded artifact as the reproduction input.
 2. **Classify** the failure:
    - test is right, code is wrong → fix the code (in scope).
    - test is wrong/outdated → that may be **spec drift** (acceptance criteria wrong).
@@ -14,7 +17,9 @@ loop to `devrites-debug-recovery`.
 3. **Isolate:** minimize to the smallest failing case; bisect the diff if needed.
 4. **Fix within scope:** the current slice/feature only. If the fix reaches outside
    scope, stop and record a blocker in `state.md` (then `$rite-plan unblock`).
-5. **Re-run** the same command; confirm green; record both attempts in `evidence.md`.
+5. **Re-run** the same command when it is repeatable; confirm green and record both
+   attempts in `evidence.md`. A consumptive action needs re-vetted evidence
+   completeness and any fresh authorization before a new attempt.
 
 ## Rules
 - Quote the real error text; don't paraphrase it away.

package/pack/generated/codex/skills/rite-vet/SKILL.md

@@ -20,7 +20,8 @@ but every profile keeps the exact plan-reviewer gate.
 Pull the standard named by the active axis: `principles.md`, `patterns.md`,
 `coding-style.md`, `testing.md`, `spec-grammar.md`, `performance.md`,
 `error-handling.md`, `development-workflow.md`, `afk-hitl.md`,
-`developer-experience.md`, `elicitation.md`, and `definition-of-done.md`.
+`one-shot-actions.md`, `developer-experience.md`, `elicitation.md`, and
+`definition-of-done.md`.
 
 
 ## Operating rules
@@ -97,6 +98,11 @@ Pull the standard named by the active axis: `principles.md`, `patterns.md`,
    unmeasurable conflict = gap. Record complete SHA-256 provenance inputs. Require
    every behavioral mapping to name a positive,
    discriminating assertion and decisive signal, not merely a command or expected exit zero.
+   Identify every consumptive action under `one-shot-actions.md`. Before admitting
+   it, require the exact durable retention surface, trust-safe diagnostic schema,
+   cleanup ordering, terminal-path coverage, and discriminating fixtures in
+   `test-plan.md`. Missing or stale one-shot evidence completeness is a technical
+   preflight gap; do not spend the action to learn what cleanup would erase.
    Preflight observes; it need not make future behavior pass.
 2c. **Implementation-readiness audit.** Goal-backward map every REQ/AC/NFR, interaction,
    edge/prohibition, and decision-coverage row to a slice and executable proof. Verify

package/pack/generated/codex/skills/rite-vet/reference/artifacts.md

@@ -35,6 +35,7 @@ Inventory/currentness: <pass/gaps> · slice order/independence: <pass/gaps> ·
 UX/spec/architecture: <pass/n-a/gaps> · operations/rollout/rollback: <pass/n-a/gaps>
 
 Shared contract proof: <pass | gap: missing/one-sided/duplicated-contract/vague/non-consuming>
+One-shot evidence completeness: <n/a | pass: action + retained artifact + bounds/sanitization + cleanup-survival fixtures | gap: exact missing proof>
 
 ## 3. Axis findings (floor-gated)
 | Axis | Floor band | Findings (sev · confidence) |
@@ -94,6 +95,11 @@ Commands in this durable artifact are portable repository commands: no RTK or lo
 aliases, user-specific absolute paths, or temporary proof trees. Evidence records
 the command actually executed.
 
+## Consumptive action gates
+| Action | Why one-shot/consumptive | Retained artifact | Bounds + sanitization | Terminal-path fixtures | Cleanup survival | Retry authority |
+|---|---|---|---|---|---|---|
+| <exact approved action or n/a> | <one attempt/quota/state/evidence deletion> | <durable operator-controlled path/schema> | <size/cardinality + known/unknown/malformed handling> | <success/known/unknown/hostile> | <assertion> | <none/fresh human authorization> |
+
 Every behavioral row names a positive, discriminating assertion and the decisive output it
 produces. A command or expected exit zero alone is not a behavioral assertion; static gates
 prove only their named static criterion.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "4.0.5",
+  "version": "4.0.6",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",