devrites 4.0.7 → 4.0.9

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [4.0.9](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.8...v4.0.9) (2026-08-08)
+
+### Fixed
+
+* **rite:** materialize workflow proof artifacts ([95ec9d7](https://github.com/ViktorsBaikers/DevRites/commit/95ec9d7dfa2b0708566a66723a289eaeb0607ddf))
+
+## [4.0.8](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.7...v4.0.8) (2026-08-08)
+
+### Fixed
+
+* **rite:** require actionable one-shot evidence ([19d996c](https://github.com/ViktorsBaikers/DevRites/commit/19d996c9666febb33e44ecdd91d3254d3a562c8a))
+
 ## [4.0.7](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.6...v4.0.7) (2026-08-08)
 
 ### Fixed

package/README.md

@@ -28,7 +28,7 @@ project-conventional push, tag, or PR action, and archive the workspace.
 Unattended runs may create local WIP checkpoint commits along the way, but they
 remain local unless Ship's disclosed plan includes an approved remote action.
 
-**Status:** [`v4.0.7`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.0.7): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v4.0.9`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.0.9): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -83,7 +83,7 @@ the same skill.
 | 3 | Temper | [`/rite-temper`](pack/.claude/skills/rite-temper/SKILL.md) | Challenges scope and failure modes before Define. It is optional for small work and always runs in `/rite-autocomplete`. |
 | 4 | Define | [`/rite-define`](pack/.claude/skills/rite-define/SKILL.md) | Turns the approved spec into architecture, a plan, traceability, and vertical task slices; changed provider/consumer boundaries name one shared contract and consuming tests on both sides. |
 | 5 | Vet | [`/rite-vet`](pack/.claude/skills/rite-vet/SKILL.md) | Reviews every plan before implementation. The review depth scales with the risk. |
-| 6 | Build | [`/rite-build`](pack/.claude/skills/rite-build/SKILL.md) | In HITL, implements and verifies one slice, then stops. Run it again for each remaining slice. An explicit `.devrites/AFK` sentinel permits bounded low-risk slice chaining under its cap and pause rules. |
+| 6 | Build | [`/rite-build`](pack/.claude/skills/rite-build/SKILL.md) | In HITL, implements and verifies one product slice, then stops. Run it again for each remaining slice. An explicit `.devrites/AFK` sentinel permits bounded low-risk slice chaining under its cap and pause rules. Exact Vet-ready executable workflow artifacts under the active feature workspace are root-materialized and excluded from product slice accounting. |
 | 7 | Converge | [`/rite-converge`](pack/.claude/skills/rite-converge/SKILL.md) | Runs only when recovery is needed. It compares the code with the recorded intent, adds missing slices, and sends the changed plan back to Vet. |
 | 8 | Prove | [`/rite-prove`](pack/.claude/skills/rite-prove/SKILL.md) | Runs positive, discriminating tests, build/runtime checks, and UI proof, then binds the evidence to the exact candidate digest. |
 | 9 | Polish | [`/rite-polish`](pack/.claude/skills/rite-polish/SKILL.md) | Cleans up the candidate, normalizes UI when needed, performs durable capability/design/ADR rollups, and refreshes affected proof before closing it. |
@@ -101,7 +101,9 @@ Some work needs a different route:
   Ship preflight, discloses the exact Git plan, and waits for a fresh literal
   `GO` plus native approval; without that flag, it stops at Seal GO. A failed
   consumptive proof action never retries blindly: retained evidence drives
-  offline repair and re-vetting, and only the next real attempt needs a new GO.
+  offline repair and re-vetting. Ambiguous retained evidence first drives a vetted
+  boundary-discriminating diagnostic design; only its next real acquisition attempt
+  needs a new GO.
 - [`/rite-upgrade [slug]`](pack/.claude/skills/rite-upgrade/SKILL.md) is a
   compatibility route for an older active workspace that cannot resume. Age or
   cursor form alone never triggers repair; it is not a lifecycle phase.

package/docs/skills.md

@@ -178,7 +178,7 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 
 | Skill | What It Does | Use When |
 |---|---|---|
-| [`rite-build`](../pack/.claude/skills/rite-build/SKILL.md) | In HITL, orchestrates one vertical slice through the sole wright; an explicit `.devrites/AFK` sentinel may chain bounded low-risk slices. Every dispatch enforces exact paths/test integrity, runs repository proof, and maintains the strict project-candidate manifest. | A plan exists, native semantic `CLEAR` and `READY` review passes, `test-plan.md` is complete, and the content-bound engine check passes. |
+| [`rite-build`](../pack/.claude/skills/rite-build/SKILL.md) | In HITL, orchestrates one vertical product slice through the sole wright; an explicit `.devrites/AFK` sentinel may chain bounded low-risk slices. Exact Vet-ready executable proof artifacts under the active `.devrites/work/<slug>/` are instead materialized atomically by the controlling root and remain outside product candidate/slice accounting. | A plan exists, native semantic `CLEAR` and `READY` review passes, `test-plan.md` is complete, and the content-bound engine check passes. |
 | [`devrites-source-driven`](../pack/.claude/skills/devrites-source-driven/SKILL.md) | Consult official docs / source before relying on framework behavior; record the source. | API, config, or framework behavior is assumed rather than known. |
 | [`devrites-api-interface`](../pack/.claude/skills/devrites-api-interface/SKILL.md) | Design stable API / interface contracts: REST/GraphQL, module boundaries, type contracts, FE/BE split. | A slice crosses a boundary or defines a public interface. |
 | [`devrites-debug-recovery`](../pack/.claude/skills/devrites-debug-recovery/SKILL.md) | Reproduce → ranked hypotheses → instrument → fix in scope → regression-test. Caller and recovery count at most three failures per causal fingerprint from context and Dead ends/evidence. | Tests, builds, or runtime checks fail. |
@@ -187,7 +187,7 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 
 | Skill | What It Does | Use When |
 |---|---|---|
-| [`rite-prove`](../pack/.claude/skills/rite-prove/SKILL.md) | Positive, discriminating tests + build/runtime/browser evidence. Requires the same candidate digest before/after commands and records the exact binding. Consumptive actions must retain bounded diagnostics through cleanup; a failed action continues offline recovery from that artifact, while any next real execution waits for fresh authorization. | All slices built; ready for full verification. |
+| [`rite-prove`](../pack/.claude/skills/rite-prove/SKILL.md) | Positive, discriminating tests + build/runtime/browser evidence. Requires the same candidate digest before/after commands and records the exact binding. Consumptive actions must retain bounded, causally unique diagnostics through cleanup; ambiguous evidence triggers a vetted diagnostic-amplification design, while any next real execution waits for fresh authorization. | All slices built; ready for full verification. |
 | [`devrites-browser-proof`](../pack/.claude/skills/devrites-browser-proof/SKILL.md) | Browser proof ladder: Playwright MCP → Chrome DevTools MCP → `/run`+`/verify` → project E2E → manual. Auto-emits the structured **Visual Verdict** (per-criterion PASS/FAIL vs `design-brief.md`) for UI slices: consumed by `devrites-frontend-reviewer` and gated at `/rite-seal`. | Scope touches UI. |
 
 ### Polish: normalize, then check the details

package/pack/.claude/agents/devrites-plan-drafter.md

@@ -25,6 +25,13 @@ slices in dependency order. Map every REQ and AC to a slice and executable proof
 name rollback and failure paths; keep acceptance-changing proposals separate. Durable
 proof commands must be portable repository commands, never host-local wrappers,
 user-specific absolute paths, or temporary proof trees.
+For every consumptive action, apply `one-shot-actions.md`: draft a durable bounded
+artifact, a finite injective map from every failure emit seam to a stable non-secret
+boundary ID and offline decision, per-seam fault fixtures, cleanup-survival proof,
+and a collision mutant. If prior retained evidence is missing or ambiguous, draft a
+diagnostic-amplification repair and narrow-Vet proof rather than guessing the
+runtime correction or declaring the old evidence loss terminal. Keep the future
+evidence-acquisition attempt separately gated by fresh human authorization.
 For `plan.md`, include exactly one canonical `Shared contract proof` table when an API,
 event, schema, or other provider/consumer boundary changes. Name a reused canonical artifact
 and asserting provider/consumer tests that both consume it, ordered through slice dependencies.
@@ -36,6 +43,8 @@ principle-exception questions. List them for the root.
 ## Rules
 
 - Read-only. Do not edit source, tests, `.devrites/**`, Git state, or dependencies.
+- Design executable workflow artifacts completely, but never return implementation bodies
+  or materialize them; the later Vet-ready step follows `workflow-artifacts.md`.
 - Do not ask the user, approve the plan, set readiness, or advance a phase.
 - Do not invoke another agent.
 - Return candidate content only for requested paths. If unfinished, name the exact

package/pack/.claude/agents/devrites-plan-reviewer.md

@@ -58,7 +58,10 @@ line, and then assign the band. Do not choose a score and justify it afterward:
    no error handling** is a critical gap. For every consumptive action under
    `one-shot-actions.md`, require durable bounded trust-safe evidence for every
    terminal path plus unknown-well-formed, malformed/hostile, and cleanup-survival
-   fixtures. Missing evidence completeness is `broken`: the plan must not consume
+   fixtures. Require a finite injective map from every failure emit site to one
+   stable non-secret boundary ID and one actionable failure seam, per-seam fault
+   injection, and a negative collision mutant. A shared broad operation/cause is
+   not actionable evidence. Missing evidence completeness is `broken`: the plan must not consume
    the action to discover diagnostics that cleanup can erase.
 
 ## Confidence calibration + verification gate (mandatory)

package/pack/.claude/skills/devrites-debug-recovery/SKILL.md

@@ -63,6 +63,17 @@ has no clear next move.
   retained artifact supplies a new Critical/Important fingerprint, continue
   offline diagnosis, correction, fixtures, and narrow Vet under that fingerprint's
   no-progress budget. Stop for fresh authorization only before the next real action.
+- **Ambiguous retained evidence requires diagnostic amplification, not a guessed
+  runtime fix.** If a trusted in-scope seam can add a stable unique boundary ID,
+  repair its finite map and collision/fault fixtures offline, narrow-Vet it, and
+  stop for fresh authorization before the evidence-acquisition attempt. Missing
+  past evidence is terminal only when no safe amplification seam exists.
+- **Route by artifact ownership.** Product source/tests go to the exact bounded
+  wright. Exact Vet-ready executable proof artifacts under the active `.devrites/**`
+  workspace follow
+  [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
+  and are materialized by the controlling root. Never ask a read-only planner or
+  reviewer to return implementation bodies.
 - **Classify before routing** with
   [cleanup-and-classify.md](reference/cleanup-and-classify.md).
 - **Durably record class and rationale** in `decisions.md` and the applicable

package/pack/.claude/skills/devrites-lib/reference/reply-contract.md

@@ -60,7 +60,9 @@ output or an artifact. Use exactly one recommended next action except for
 terminal agent-owned technical exhaustion, which has no runnable action.
 
 Use that terminal case only after three recorded no-progress corrections of the
-exact fingerprint, or when required evidence was irretrievably absent. A spent
+exact fingerprint, or when required evidence was irretrievably absent **and** no safe in-scope diagnostic-amplification seam exists. Loss from the
+past attempt alone is not terminal: repair and Vet a boundary-discriminating
+evidence design, then request fresh authorization for its acquisition attempt. A spent
 consumptive-action authorization plus a retained new fingerprint is not terminal;
 it continues offline recovery and waits for fresh authorization only after repair.
 For a true terminal case use:

package/pack/.claude/skills/devrites-lib/reference/standards/README.md

@@ -33,6 +33,7 @@ topic's owner.
 | `principles.md` | Authoring or checking project invariants and approved exceptions. |
 | `deprecation.md` | Removing, replacing, or migrating behavior, code, APIs, or data. |
 | `agents.md` | Dispatching, awaiting, validating, or reconciling fresh-context agents. |
+| `workflow-artifacts.md` | Materializing executable proof/controller/harness files under the active `.devrites/work/<slug>/`. |
 | `context-hygiene.md` | Choosing `/clear`, `/compact`, or a handoff. |
 | `anti-patterns.md` | A pack-wide rationalization or red flag appears. |
 | `afk-hitl.md` | A pause, question, resume, or AFK decision is possible. |

package/pack/.claude/skills/devrites-lib/reference/standards/agents.md

@@ -5,8 +5,9 @@ Follow DevRites policy and [`depth profiles`](../orchestration-profiles.md).
 ## Authority
 
 - Root owns scope, questions/decisions/results, `.devrites/**`, and phase
-  transitions—not source/tests.
-- Only bounded wright writes source/tests; others inspect an immutable
+  transitions—not product source/tests. Exact vetted executable workflow artifacts
+  follow [`workflow-artifacts.md`](workflow-artifacts.md).
+- Only bounded wright writes product source/tests; others inspect an immutable
   candidate.
 - Every named role runs; unavailable → HITL, never skip/substitute.
 - Leaves never invoke agents, ask humans, change phase, commit/push,
@@ -48,11 +49,16 @@ Running/orphaned/unavailable = `gap`; no root/generic substitute.
 Claude grants only wright `acceptEdits`; Codex root is workspace-capable because
 children cannot elevate. Wright alone is `:workspace`; others are `:read-only`.
 
-Give wright the smallest exact project-relative file list—no directories/globs,
-traversal/`.devrites/**`. No scope widening. Root rejects
-`git diff --name-only` extras. Never patch in root, bypass/substitute wright,
+Give wright the smallest exact project-relative product source/test file list—no
+directories/globs, traversal/`.devrites/**`. No scope widening. Root rejects
+`git diff --name-only` extras. Never patch product source/tests in root, bypass/substitute wright,
 accept drift, or recreate a dispatch bridge.
 
+The controlling root may materialize only the exact Vet-ready executable workflow
+artifact paths under the active `.devrites/work/<slug>/` using
+[`workflow-artifacts.md`](workflow-artifacts.md). This is not a writer dispatch,
+product slice, candidate mutation, or exception to the source-writing boundary.
+
 ## Inputs and results
 
 Each job gets objective/exclusions, exact paths/immutable candidate, rubric/result

package/pack/.claude/skills/devrites-lib/reference/standards/one-shot-actions.md

@@ -27,7 +27,16 @@ the approved `test-plan.md` must bind all of the following:
 4. **Discriminating proof:** fixtures cover success, a known failure, an unknown
    well-formed failure, malformed/hostile input, and cleanup after failure. They
    prove cleanup cannot delete or overwrite the retained failure evidence.
-5. **Recovery sufficiency:** the retained bounded evidence is enough to choose an
+5. **Causal actionability:** every failure record includes a stable non-secret `boundary_id`
+   whose finite map is injective: one retained fingerprint identifies
+   one actionable failure seam and correction class. Broad operation/cause labels
+   are insufficient when multiple emit sites can produce them. `test-plan.md`
+   enumerates every emit site, its boundary ID, expected retained relation, and
+   offline decision.
+6. **Collision proof:** inject a failure at every mapped seam and require its exact
+   boundary ID. Execute a negative mutant that aliases two seams to one retained
+   fingerprint and prove the validator/reviewer rejects it.
+7. **Recovery sufficiency:** the retained bounded evidence is enough to choose an
    offline correction or a truthful terminal classification without consuming
    another attempt.
 
@@ -58,9 +67,29 @@ cap, resume recovery even if a prior writer stored `blocked` / `Next step: none`
 That terminal cursor is valid only for missing retention, a human/safety gate, or
 an actually exhausted fingerprint.
 
-A new real attempt is admissible only after the affected plan and fixtures are
-re-vetted, the failure condition is shown changed, and any required fresh
+A new real attempt is normally admissible only after the affected plan and fixtures
+are re-vetted, the failure condition is shown changed, and any required fresh
 authorization is obtained. Stop at that authorization boundary; never infer it
-from successful offline repair. If the attempt ran without complete retention,
-stop with the observed technical blocker because a blind retry cannot manufacture
-the destroyed evidence.
+from successful offline repair.
+
+## Diagnostic amplification
+
+If a retained artifact is absent or maps one fingerprint to multiple causal
+boundaries, do not guess a runtime correction. The fact that evidence from the
+past attempt is irretrievable does not prove that a safe future evidence-acquisition
+design is unavailable.
+
+When an in-scope trusted seam can add the missing stable discriminator, classify
+the ambiguity as an agent-owned **diagnostic-amplification plan gap**. Without
+executing the action, repair the diagnostic schema, finite boundary map, per-seam
+fault fixtures, cleanup-survival proof, and collision mutant; then run narrow Vet.
+Once READY, stop for fresh authorization before exactly one diagnostic-amplification attempt
+bound to that vetted design and artifact identity. This exception does not
+claim the runtime failure condition changed: the independently proven change is the
+evidence-acquisition invariant, and the attempt's acceptance signal is the promised
+unique retained boundary (or action success).
+
+Terminal `Next: none` is valid only when no safe in-scope diagnostic-amplification
+seam exists, the required change is human/risk/scope owned, or the exact evidence-gap
+fingerprint exhausts bounded recovery. A missing old artifact alone is not terminal,
+and an amplification attempt never inherits authorization from the failed action.

package/pack/.claude/skills/devrites-lib/reference/standards/skill-authoring.md

@@ -132,4 +132,5 @@ Public commands need docs/generated hosts/reply marker;
 internal skills need trigger/not-for plus proof they are not an agent/reference.
 Agents need role/scope/mode/output/composition and
 [`agents.md` § Result admission](agents.md#result-admission) for review roles.
-Only `devrites-slice-wright` writes.
+Only `devrites-slice-wright` writes product source/tests. The controlling root's
+path-bounded `.devrites/**` workflow artifacts follow `workflow-artifacts.md`.

package/pack/.claude/skills/devrites-lib/reference/standards/workflow-artifacts.md

@@ -0,0 +1,57 @@
+# Executable workflow artifacts
+
+Executable files used only to plan, isolate, or prove a DevRites workflow—such as
+a controller, harness, proof bundle, fixture generator, or bounded materializer
+under the active `.devrites/work/<slug>/`—are **workflow artifacts**, not product
+source/tests. They remain excluded from the product candidate and never authorize
+the real action they prepare.
+
+## Ownership
+
+After an exact design and path set pass Vet, the **controlling root is the sole materializer**
+of these artifacts under its existing `.devrites/**` authority. For these paths,
+never dispatch `devrites-slice-wright`,
+never widen the wright contract, and never ask a
+read-only planner/reviewer for implementation bodies. Product source/tests remain
+wright-only.
+
+Missing implementation bytes are an agent-owned materialization task, not
+technical-recovery exhaustion, while the vetted behavior and exact paths are
+complete. The root may not invent unresolved protocol choices; those return to
+Plan/Vet.
+
+## Admission
+
+Before writing:
+
+1. Require the active slug, current readiness binding, resolved human gates, and
+   an exact file list in `plan.md` / `test-plan.md`. Reject directories, globs,
+   traversal, duplicates, symlinks, paths outside the active feature workspace,
+   and any product source/test or dependency path.
+2. Bind the complete behavior, interfaces, failure relations, proof commands,
+   expected signals, and rollback for the atomic artifact set. A prose placeholder
+   or a request that a drafter supply code is a Plan gap, not implementation input.
+3. Record preimages or absence for every target plus protected product manifests
+   and the current candidate digest. Resolve every parent no-follow before mutation.
+
+## Materialize
+
+The root authors the smallest complete bytes for all admitted targets. Write each
+through a same-parent private temporary file, set the planned mode, flush it, and
+atomically replace the target; settle the whole set or roll back partial output.
+Do not install dependencies, touch Git, use the network, mutate product paths, or
+execute the consumptive action.
+
+## Verify and return
+
+Read back the exact path set, modes, and SHA-256 identities. Run only the vetted
+compile/static/fixture/mutant commands in their isolated non-consumptive modes;
+require every discriminating signal. Recheck protected preimages and require the
+candidate digest remains identical. Record the workflow-artifact hashes and proof
+in canonical evidence, but never add these paths to the product candidate manifest
+or built-slice count. Run the affected narrow Vet, restore the controlling return
+cursor, and stop for fresh authorization before any real consumptive action.
+
+An actual host permission failure, unresolved design choice, out-of-scope path, or
+failed atomic/proof check blocks truthfully. The absence of a writable specialist
+does not: root ownership is the supported path.

package/pack/.claude/skills/rite-autocomplete/reference/stop-conditions.md

@@ -46,6 +46,13 @@ no-progress corrections. A retained fingerprint with remaining offline budget is
 not terminal merely because `state.md` was written by the failed action or a prior
 session ended.
 
+Past evidence being irretrievable is not by itself terminal. When an in-scope
+trusted diagnostic seam can make the next retained fingerprint uniquely
+actionable, Autocomplete must run diagnostic-amplification Plan repair and narrow
+Vet inline, then pause for a fresh GO before the single evidence-acquisition
+attempt. Use `Next: none` only after proving no safe in-scope amplification seam
+exists, a real human/risk/scope gate owns it, or bounded recovery is exhausted.
+
 ## Stop on gate severity
 
 - `blocking` gate fires → synchronous pause.

package/pack/.claude/skills/rite-build/SKILL.md

@@ -14,7 +14,9 @@ first**; if none, tell the user to run `/rite-spec <feature>`.
 
 The root owns gates/workspace; a
 fresh-context [`devrites-slice-wright`](../../agents/devrites-slice-wright.md)
-writes source and tests. Apply the readiness, selection, host, HITL/AFK,
+writes product source and tests. Exact Vet-ready executable workflow artifacts use
+[`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md).
+Apply the readiness, selection, host, HITL/AFK,
 dispatch, doubt, fail-on-red, record, and stop checks. See
 [`reference/wright-dispatch.md`](reference/wright-dispatch.md).
 
@@ -61,7 +63,9 @@ reads named on-demand rules while writing; root reads them for doubt/record gate
   principle was broken**; a fresh violation is handled like any irreversible-risk item: a
   human-approved, scoped exception in the register or a stop, never folded into the slice. No
   `.devrites/principles.md` → none declared → nothing to honor.
-- **You never edit source.** You write only `.devrites/` bookkeeping. Follow the
+- **You never edit product source/tests.** You write `.devrites/` bookkeeping and,
+  only through `workflow-artifacts.md`, an exact Vet-ready executable workflow-artifact set.
+  Follow the
   host gate in `wright-dispatch.md` before every build or recovery dispatch. On a
   supported host, the wright is the only writer of code and tests. Codex gives
   the root workspace permission only so that native writer dispatch can execute;
@@ -69,6 +73,11 @@ reads named on-demand rules while writing; root reads them for doubt/record gate
   list directly in the task, dispatch the exact `devrites-slice-wright`, then
   compare `git diff --name-only` with those task paths. Any extra source file is
   a hard STOP.
+- **Executable workflow-artifact branch.** If every implementation target is an
+  exact admitted path under the active `.devrites/work/<slug>/`, the controlling
+  root materializes and proves that atomic set itself. It does not dispatch the wright,
+  decrement/count a product slice, update the candidate manifest, or execute the
+  consumptive action. After narrow Vet, restore the caller cursor.
 
 ## Workflow
 

package/pack/.claude/skills/rite-build/reference/phase-contract.md

@@ -8,16 +8,30 @@ See [`one-slice-cycle.md`](one-slice-cycle.md); candidate lifecycle is
    `Readiness inputs SHA-256`, all applicable exact reviewer accounts,
    ID-and-meaning traceability, and green proof preflight; run
    `devrites-engine check readiness <slug>`. Any miss/nonzero stops.
-2. **Select one slice.** Restate goal, acceptance criteria, exclusions, and exact
+2. **Select one target.** Restate goal, acceptance criteria, exclusions, and exact
    source/test paths. Before dispatch, validate relevant `assumptions.md` rows
    against live evidence. If one is disproved and changes acceptance, architecture,
    scope, or proof, use the Spec Drift Guard/plan recovery; a human-owned unknown
    stops. Resolve HITL before source work. AFK answers only permitted gates;
    human-owned or irreversible risk persists a question and stops for `/rite-resolve`.
-3. **Dispatch the sole writer.** Apply [`wright-dispatch.md`](wright-dispatch.md).
+   If the target is only an exact Vet-ready executable workflow-artifact set under
+   the active feature workspace, apply
+   [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md)
+   instead of treating it as a product slice.
+3. **Dispatch or materialize.** Product source/tests apply [`wright-dispatch.md`](wright-dispatch.md).
    Put the smallest exact project-relative source/test path list directly in the task;
-   dispatch the exact `devrites-slice-wright` fresh. Root never writes, wright never
-   widens, and a missing profile stops.
+   dispatch the exact `devrites-slice-wright` fresh. Root never writes those product
+   paths, wright never widens, and a missing profile stops.
+   For the workflow-artifact branch, the controlling root writes only the admitted
+   `.devrites/work/<slug>/` paths, proves the complete atomic set, rechecks an
+   identical product candidate, records hashes/evidence, and runs narrow Vet. Do not
+   dispatch any agent as a substitute writer and do not charge a product slice.
+
+### Executable workflow-artifact branch
+
+The controlling root materializes the exact admitted workflow-artifact set and
+**does not dispatch the wright**. This branch never changes product slice state or
+the candidate manifest; it returns through narrow Vet before any consumptive action.
 4. **Inspect the return.** Wait; compare its file list and `git diff --name-only`
    with the contract. Reject stale, partial, malformed, or out-of-scope work.
    Preserve user work; source restoration uses the same bounded wright.

package/pack/.claude/skills/rite-build/reference/wright-dispatch.md

@@ -15,6 +15,10 @@ the wright or recreate an engine bridge.
 
 1. Derive the smallest exact project-relative source/test path list; reject
    directories/globs, traversal, symlink escapes, duplicates, and `.devrites/**`.
+   A target composed only of vetted executable workflow artifacts routes to the
+   controlling root under
+   [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
+   its rejection here is not a blocker.
 2. Put it in the task with goal, verbatim acceptance, exclusions, context,
    `test-plan.md` proof commands, and applicable standards.
    A new path requires a new bounded contract; the wright cannot widen the task.

package/pack/.claude/skills/rite-plan/SKILL.md

@@ -81,6 +81,16 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
    `devrites-plan-drafter` in `repair` mode with only the selected mode, affected artifact
    paths, settled contract, and observed failure/drift. Await one atomic `plan-candidate`;
    the drafter writes nothing and returns human-owned choices separately.
+   When the observed failure is missing or ambiguous consumptive-action evidence,
+   require the drafter to apply `one-shot-actions.md` and return the bounded
+   diagnostic-amplification design, injective boundary map, per-seam fixtures, and
+   collision mutant. Past evidence loss alone is not a terminal conclusion.
+   The drafter never supplies implementation bodies. Bind the exact active
+   `.devrites/work/<slug>/` targets and complete executable contract; after Vet
+   READY, the controlling root materializes the exact vetted workflow-artifact paths
+   under
+   [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
+   without dispatching the product wright.
 3. Reason about dependencies: [dependency-graph](reference/dependency-graph.md).
    Reconcile `plan.md`'s canonical `Shared contract proof`: changed provider/consumer
    boundaries keep one reused contract artifact ahead of both asserting tests, and unaffected

package/pack/.claude/skills/rite-prove/SKILL.md

@@ -40,6 +40,8 @@ Pull these via `Read` when relevant:
 - `definition-of-done.md`: acceptance, proof, gates, scope, rollback/docs.
 - `one-shot-actions.md`: pre-attempt evidence completeness and no-rerun handling for
   consumptive proof actions.
+- `workflow-artifacts.md`: exact root-owned executable proof/controller/harness
+  artifacts under the active feature workspace.
 
 
 ## Operating rules
@@ -57,8 +59,11 @@ Pull these via `Read` when relevant:
   [`agents.md`](../devrites-lib/reference/standards/agents.md). The root owns exact
   vetted gate execution, browser capability, the evidence verdict, and canonical
   writes. The proof runner is read-only and validates immutable logs/artifacts.
-  Every accepted source/test correction is one bounded
+  Every accepted product source/test correction is one bounded
   `devrites-slice-wright` task, never an inline edit.
+  Exact Vet-ready executable workflow artifacts under the active `.devrites/**`
+  workspace follow `workflow-artifacts.md` and are materialized by the controlling
+  root; they are not product writer work.
 - **Prove remains the controlling caller during technical backtracking.** Save
   its return cursor, invoke Plan/Vet or bounded remediation inline, consume each
   nested phase boundary, then resume the failed Prove step. Never make the human
@@ -114,7 +119,8 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
    gates prove only their named static criterion.
    Immediately before any consumptive action, apply `one-shot-actions.md` to the
    live candidate: require the vetted retained-artifact identity, bounds,
-   sanitization, terminal-path fixtures, and cleanup-survival proof. A missing,
+   sanitization, injective boundary map, per-seam fault fixtures, collision mutant,
+   terminal-path fixtures, and cleanup-survival proof. A missing,
    stale, or disposable-only evidence surface returns to Vet inline and consumes
    no attempt. Record the admitted artifact identity before execution. After a
    failed consumptive action, triage from that artifact; never reproduce it by
@@ -155,6 +161,11 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
    reproduction to fix and re-vet the retained fingerprint. Once the failure
    condition is demonstrably changed, stop at the fresh-authorization boundary;
    only a new human GO may admit the next real attempt.
+   If the retained fingerprint is missing or ambiguous, the lost past evidence
+   does not prove that no safe future acquisition design exists. Treat an in-scope
+   discriminator as a diagnostic-amplification Plan gap: repair and narrow-Vet the
+   boundary map and collision proof inline, then stop for fresh GO before one
+   evidence-acquisition attempt. Do not guess the runtime fix or reuse the old GO.
 8. The root updates `evidence.md`, `browser-evidence.md` (when present),
    `traceability.md`, and `state.md`. Record exactly one binding for the observed
    digest in evidence and browser evidence. New proof goes to canonical

package/pack/.claude/skills/rite-prove/reference/failure-triage.md

@@ -17,6 +17,10 @@ loop to `devrites-debug-recovery`.
    - flaky (passes on re-run, timing/order) → note it; don't paper over with retries.
    - external dependency down → record blocker; don't fake the result.
 3. **Isolate:** minimize to the smallest failing case; bisect the diff if needed.
+   If consumptive evidence maps to multiple causal seams, this is a
+   diagnostic-amplification plan gap: design and Vet an injective boundary
+   discriminator offline instead of guessing a runtime correction or declaring
+   the cleaned-away past state terminal.
 4. **Fix within scope:** the current slice/feature only. If the fix reaches outside
    scope, stop and record a blocker in `state.md` (then `/rite-plan unblock`).
 5. **Re-run** the same command when it is repeatable; confirm green and record both
@@ -24,6 +28,8 @@ loop to `devrites-debug-recovery`.
    completeness and any fresh authorization before a new attempt. Its spent
    action authorization does not stop offline recovery: a retained new fingerprint
    enters caller-owned diagnosis, correction, fixtures, and narrow Vet immediately.
+   A separately authorized diagnostic-amplification attempt may acquire the missing
+   discriminator after its evidence design passes Vet; it is not a blind rerun.
 
 ## Rules
 - Quote the real error text; don't paraphrase it away.

package/pack/.claude/skills/rite-vet/SKILL.md

@@ -100,8 +100,10 @@ Pull the standard named by the active axis: `principles.md`, `patterns.md`,
    discriminating assertion and decisive signal, not merely a command or expected exit zero.
    Identify every consumptive action under `one-shot-actions.md`. Before admitting
    it, require the exact durable retention surface, trust-safe diagnostic schema,
-   cleanup ordering, terminal-path coverage, and discriminating fixtures in
-   `test-plan.md`. Missing or stale one-shot evidence completeness is a technical
+   cleanup ordering, terminal-path coverage, a finite injective boundary map,
+   per-boundary fault fixtures, and an executed collision mutant in `test-plan.md`.
+   Every retained failure fingerprint must identify one actionable seam; a broad
+   operation/cause shared by multiple emit sites is a gap. Missing or stale one-shot evidence completeness is a technical
    preflight gap; do not spend the action to learn what cleanup would erase.
    Preflight observes; it need not make future behavior pass.
 2c. **Implementation-readiness audit.** Goal-backward map every REQ/AC/NFR, interaction,

package/pack/.claude/skills/rite-vet/reference/artifacts.md

@@ -35,7 +35,7 @@ Inventory/currentness: <pass/gaps> · slice order/independence: <pass/gaps> ·
 UX/spec/architecture: <pass/n-a/gaps> · operations/rollout/rollback: <pass/n-a/gaps>
 
 Shared contract proof: <pass | gap: missing/one-sided/duplicated-contract/vague/non-consuming>
-One-shot evidence completeness: <n/a | pass: action + retained artifact + bounds/sanitization + cleanup-survival fixtures | gap: exact missing proof>
+One-shot evidence completeness: <n/a | pass: action + retained artifact + bounds/sanitization + injective boundary map + per-seam/collision/cleanup fixtures | gap: exact missing proof>
 
 ## 3. Axis findings (floor-gated)
 | Axis | Floor band | Findings (sev · confidence) |
@@ -96,9 +96,9 @@ aliases, user-specific absolute paths, or temporary proof trees. Evidence record
 the command actually executed.
 
 ## Consumptive action gates
-| Action | Why one-shot/consumptive | Retained artifact | Bounds + sanitization | Terminal-path fixtures | Cleanup survival | Retry authority |
-|---|---|---|---|---|---|---|
-| <exact approved action or n/a> | <one attempt/quota/state/evidence deletion> | <durable operator-controlled path/schema> | <size/cardinality + known/unknown/malformed handling> | <success/known/unknown/hostile> | <assertion> | <none/fresh human authorization> |
+| Action | Why one-shot/consumptive | Retained artifact | Bounds + sanitization | Boundary map + collision proof | Terminal-path fixtures | Cleanup survival | Retry authority |
+|---|---|---|---|---|---|---|---|
+| <exact approved action or n/a> | <one attempt/quota/state/evidence deletion> | <durable operator-controlled path/schema> | <size/cardinality + known/unknown/malformed handling> | <every emit seam -> stable boundary ID; per-seam injection + alias mutant rejected> | <success/known/unknown/hostile> | <assertion> | <none/fresh human authorization> |
 
 Every behavioral row names a positive, discriminating assertion and the decisive output it
 produces. A command or expected exit zero alone is not a behavioral assertion; static gates

package/pack/generated/claude/agents/devrites-plan-drafter.md

@@ -25,6 +25,13 @@ slices in dependency order. Map every REQ and AC to a slice and executable proof
 name rollback and failure paths; keep acceptance-changing proposals separate. Durable
 proof commands must be portable repository commands, never host-local wrappers,
 user-specific absolute paths, or temporary proof trees.
+For every consumptive action, apply `one-shot-actions.md`: draft a durable bounded
+artifact, a finite injective map from every failure emit seam to a stable non-secret
+boundary ID and offline decision, per-seam fault fixtures, cleanup-survival proof,
+and a collision mutant. If prior retained evidence is missing or ambiguous, draft a
+diagnostic-amplification repair and narrow-Vet proof rather than guessing the
+runtime correction or declaring the old evidence loss terminal. Keep the future
+evidence-acquisition attempt separately gated by fresh human authorization.
 For `plan.md`, include exactly one canonical `Shared contract proof` table when an API,
 event, schema, or other provider/consumer boundary changes. Name a reused canonical artifact
 and asserting provider/consumer tests that both consume it, ordered through slice dependencies.
@@ -36,6 +43,8 @@ principle-exception questions. List them for the root.
 ## Rules
 
 - Read-only. Do not edit source, tests, `.devrites/**`, Git state, or dependencies.
+- Design executable workflow artifacts completely, but never return implementation bodies
+  or materialize them; the later Vet-ready step follows `workflow-artifacts.md`.
 - Do not ask the user, approve the plan, set readiness, or advance a phase.
 - Do not invoke another agent.
 - Return candidate content only for requested paths. If unfinished, name the exact

package/pack/generated/claude/agents/devrites-plan-reviewer.md

@@ -58,7 +58,10 @@ line, and then assign the band. Do not choose a score and justify it afterward:
    no error handling** is a critical gap. For every consumptive action under
    `one-shot-actions.md`, require durable bounded trust-safe evidence for every
    terminal path plus unknown-well-formed, malformed/hostile, and cleanup-survival
-   fixtures. Missing evidence completeness is `broken`: the plan must not consume
+   fixtures. Require a finite injective map from every failure emit site to one
+   stable non-secret boundary ID and one actionable failure seam, per-seam fault
+   injection, and a negative collision mutant. A shared broad operation/cause is
+   not actionable evidence. Missing evidence completeness is `broken`: the plan must not consume
    the action to discover diagnostics that cleanup can erase.
 
 ## Confidence calibration + verification gate (mandatory)

package/pack/generated/claude/skills/devrites-debug-recovery/SKILL.md

@@ -63,6 +63,17 @@ has no clear next move.
   retained artifact supplies a new Critical/Important fingerprint, continue
   offline diagnosis, correction, fixtures, and narrow Vet under that fingerprint's
   no-progress budget. Stop for fresh authorization only before the next real action.
+- **Ambiguous retained evidence requires diagnostic amplification, not a guessed
+  runtime fix.** If a trusted in-scope seam can add a stable unique boundary ID,
+  repair its finite map and collision/fault fixtures offline, narrow-Vet it, and
+  stop for fresh authorization before the evidence-acquisition attempt. Missing
+  past evidence is terminal only when no safe amplification seam exists.
+- **Route by artifact ownership.** Product source/tests go to the exact bounded
+  wright. Exact Vet-ready executable proof artifacts under the active `.devrites/**`
+  workspace follow
+  [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
+  and are materialized by the controlling root. Never ask a read-only planner or
+  reviewer to return implementation bodies.
 - **Classify before routing** with
   [cleanup-and-classify.md](reference/cleanup-and-classify.md).
 - **Durably record class and rationale** in `decisions.md` and the applicable

package/pack/generated/claude/skills/devrites-lib/reference/reply-contract.md

@@ -60,7 +60,9 @@ output or an artifact. Use exactly one recommended next action except for
 terminal agent-owned technical exhaustion, which has no runnable action.
 
 Use that terminal case only after three recorded no-progress corrections of the
-exact fingerprint, or when required evidence was irretrievably absent. A spent
+exact fingerprint, or when required evidence was irretrievably absent **and** no safe in-scope diagnostic-amplification seam exists. Loss from the
+past attempt alone is not terminal: repair and Vet a boundary-discriminating
+evidence design, then request fresh authorization for its acquisition attempt. A spent
 consumptive-action authorization plus a retained new fingerprint is not terminal;
 it continues offline recovery and waits for fresh authorization only after repair.
 For a true terminal case use:

package/pack/generated/claude/skills/devrites-lib/reference/standards/README.md

@@ -33,6 +33,7 @@ topic's owner.
 | `principles.md` | Authoring or checking project invariants and approved exceptions. |
 | `deprecation.md` | Removing, replacing, or migrating behavior, code, APIs, or data. |
 | `agents.md` | Dispatching, awaiting, validating, or reconciling fresh-context agents. |
+| `workflow-artifacts.md` | Materializing executable proof/controller/harness files under the active `.devrites/work/<slug>/`. |
 | `context-hygiene.md` | Choosing `/clear`, `/compact`, or a handoff. |
 | `anti-patterns.md` | A pack-wide rationalization or red flag appears. |
 | `afk-hitl.md` | A pause, question, resume, or AFK decision is possible. |