devrites 4.0.8 → 4.0.10

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [4.0.10](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.9...v4.0.10) (2026-08-08)
+
+### Fixed
+
+* **rite:** reopen stale writer stops ([aebb7fb](https://github.com/ViktorsBaikers/DevRites/commit/aebb7fb5b3510d068172aa1ec9f654063f39d545))
+
+## [4.0.9](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.8...v4.0.9) (2026-08-08)
+
+### Fixed
+
+* **rite:** materialize workflow proof artifacts ([95ec9d7](https://github.com/ViktorsBaikers/DevRites/commit/95ec9d7dfa2b0708566a66723a289eaeb0607ddf))
+
 ## [4.0.8](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.7...v4.0.8) (2026-08-08)
 
 ### Fixed

package/README.md

@@ -28,7 +28,7 @@ project-conventional push, tag, or PR action, and archive the workspace.
 Unattended runs may create local WIP checkpoint commits along the way, but they
 remain local unless Ship's disclosed plan includes an approved remote action.
 
-**Status:** [`v4.0.8`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.0.8): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v4.0.10`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.0.10): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -83,7 +83,7 @@ the same skill.
 | 3 | Temper | [`/rite-temper`](pack/.claude/skills/rite-temper/SKILL.md) | Challenges scope and failure modes before Define. It is optional for small work and always runs in `/rite-autocomplete`. |
 | 4 | Define | [`/rite-define`](pack/.claude/skills/rite-define/SKILL.md) | Turns the approved spec into architecture, a plan, traceability, and vertical task slices; changed provider/consumer boundaries name one shared contract and consuming tests on both sides. |
 | 5 | Vet | [`/rite-vet`](pack/.claude/skills/rite-vet/SKILL.md) | Reviews every plan before implementation. The review depth scales with the risk. |
-| 6 | Build | [`/rite-build`](pack/.claude/skills/rite-build/SKILL.md) | In HITL, implements and verifies one slice, then stops. Run it again for each remaining slice. An explicit `.devrites/AFK` sentinel permits bounded low-risk slice chaining under its cap and pause rules. |
+| 6 | Build | [`/rite-build`](pack/.claude/skills/rite-build/SKILL.md) | In HITL, implements and verifies one product slice, then stops. Run it again for each remaining slice. An explicit `.devrites/AFK` sentinel permits bounded low-risk slice chaining under its cap and pause rules. Exact Vet-ready executable workflow artifacts under the active feature workspace are root-materialized and excluded from product slice accounting. |
 | 7 | Converge | [`/rite-converge`](pack/.claude/skills/rite-converge/SKILL.md) | Runs only when recovery is needed. It compares the code with the recorded intent, adds missing slices, and sends the changed plan back to Vet. |
 | 8 | Prove | [`/rite-prove`](pack/.claude/skills/rite-prove/SKILL.md) | Runs positive, discriminating tests, build/runtime checks, and UI proof, then binds the evidence to the exact candidate digest. |
 | 9 | Polish | [`/rite-polish`](pack/.claude/skills/rite-polish/SKILL.md) | Cleans up the candidate, normalizes UI when needed, performs durable capability/design/ADR rollups, and refreshes affected proof before closing it. |
@@ -103,7 +103,9 @@ Some work needs a different route:
   consumptive proof action never retries blindly: retained evidence drives
   offline repair and re-vetting. Ambiguous retained evidence first drives a vetted
   boundary-discriminating diagnostic design; only its next real acquisition attempt
-  needs a new GO.
+  needs a new GO. After an upgrade introduces a supported workflow-artifact writer,
+  Autocomplete reopens a stale missing-writer stop once instead of preserving the
+  obsolete recovery count.
 - [`/rite-upgrade [slug]`](pack/.claude/skills/rite-upgrade/SKILL.md) is a
   compatibility route for an older active workspace that cannot resume. Age or
   cursor form alone never triggers repair; it is not a lifecycle phase.

package/docs/skills.md

@@ -178,7 +178,7 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 
 | Skill | What It Does | Use When |
 |---|---|---|
-| [`rite-build`](../pack/.claude/skills/rite-build/SKILL.md) | In HITL, orchestrates one vertical slice through the sole wright; an explicit `.devrites/AFK` sentinel may chain bounded low-risk slices. Every dispatch enforces exact paths/test integrity, runs repository proof, and maintains the strict project-candidate manifest. | A plan exists, native semantic `CLEAR` and `READY` review passes, `test-plan.md` is complete, and the content-bound engine check passes. |
+| [`rite-build`](../pack/.claude/skills/rite-build/SKILL.md) | In HITL, orchestrates one vertical product slice through the sole wright; an explicit `.devrites/AFK` sentinel may chain bounded low-risk slices. Exact Vet-ready executable proof artifacts under the active `.devrites/work/<slug>/` are instead materialized atomically by the controlling root and remain outside product candidate/slice accounting. | A plan exists, native semantic `CLEAR` and `READY` review passes, `test-plan.md` is complete, and the content-bound engine check passes. |
 | [`devrites-source-driven`](../pack/.claude/skills/devrites-source-driven/SKILL.md) | Consult official docs / source before relying on framework behavior; record the source. | API, config, or framework behavior is assumed rather than known. |
 | [`devrites-api-interface`](../pack/.claude/skills/devrites-api-interface/SKILL.md) | Design stable API / interface contracts: REST/GraphQL, module boundaries, type contracts, FE/BE split. | A slice crosses a boundary or defines a public interface. |
 | [`devrites-debug-recovery`](../pack/.claude/skills/devrites-debug-recovery/SKILL.md) | Reproduce → ranked hypotheses → instrument → fix in scope → regression-test. Caller and recovery count at most three failures per causal fingerprint from context and Dead ends/evidence. | Tests, builds, or runtime checks fail. |
@@ -222,7 +222,7 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 
 | Skill | What It Does | Use When |
 |---|---|---|
-| [`rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | Runs the whole lifecycle unattended (spec → clarify → … → seal → ship), choosing the recommended option at each soft gate and recording the rationale in `decisions.md`. A vague prompt triggers one up-front spec/clarify window; after decision coverage is CLEAR it runs without per-phase iteration, pausing only for genuine product/scope/policy decisions, irreversible risk, human-only access/actions, NO-GO, or budget exhaustion. Objective red checks use bounded technical recovery, including cold-resume recovery from retained one-shot evidence; spending an action authorization blocks only another real execution, not offline repair. Default stops at Seal GO; `--ship` (alias `--yolo`) reaches Ship preflight but still requires a fresh literal `GO` and native approval. | "Autocomplete", "do the whole thing", "run the full cycle", "one-shot this feature". |
+| [`rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | Runs the whole lifecycle unattended (spec → clarify → … → seal → ship), choosing the recommended option at each soft gate and recording the rationale in `decisions.md`. A vague prompt triggers one up-front spec/clarify window; after decision coverage is CLEAR it runs without per-phase iteration, pausing only for genuine product/scope/policy decisions, irreversible risk, human-only access/actions, NO-GO, or budget exhaustion. Objective red checks use bounded technical recovery, including cold-resume recovery from retained one-shot evidence and one-time migration of stale missing-writer stops when an upgraded contract supplies the first supported workflow-artifact writer. Spending an action authorization blocks only another real execution, not offline repair. Default stops at Seal GO; `--ship` (alias `--yolo`) reaches Ship preflight but still requires a fresh literal `GO` and native approval. | "Autocomplete", "do the whole thing", "run the full cycle", "one-shot this feature". |
 | [`rite-zoom-out`](../pack/.claude/skills/rite-zoom-out/SKILL.md) | Map the modules, callers, callees, and decisions in an unfamiliar area using the project's domain glossary. | Explicit-only: `/rite-zoom-out` / `/rite zoom-out`. |
 | [`rite-prototype`](../pack/.claude/skills/rite-prototype/SKILL.md) | Throwaway code answering ONE design question: logic harness OR 2 to 4 UI variations on one route. | Explicit-only: `/rite-prototype` / `/rite prototype`. |
 | [`rite-handoff`](../pack/.claude/skills/rite-handoff/SKILL.md) | Compact chat session → handoff doc. References existing `.devrites/work/<slug>/` artifacts by path. | Explicit-only: `/rite-handoff` / `/rite handoff`. |

package/pack/.claude/agents/devrites-plan-drafter.md

@@ -43,6 +43,8 @@ principle-exception questions. List them for the root.
 ## Rules
 
 - Read-only. Do not edit source, tests, `.devrites/**`, Git state, or dependencies.
+- Design executable workflow artifacts completely, but never return implementation bodies
+  or materialize them; the later Vet-ready step follows `workflow-artifacts.md`.
 - Do not ask the user, approve the plan, set readiness, or advance a phase.
 - Do not invoke another agent.
 - Return candidate content only for requested paths. If unfinished, name the exact

package/pack/.claude/skills/devrites-debug-recovery/SKILL.md

@@ -68,6 +68,12 @@ has no clear next move.
   repair its finite map and collision/fault fixtures offline, narrow-Vet it, and
   stop for fresh authorization before the evidence-acquisition attempt. Missing
   past evidence is terminal only when no safe amplification seam exists.
+- **Route by artifact ownership.** Product source/tests go to the exact bounded
+  wright. Exact Vet-ready executable proof artifacts under the active `.devrites/**`
+  workspace follow
+  [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
+  and are materialized by the controlling root. Never ask a read-only planner or
+  reviewer to return implementation bodies.
 - **Classify before routing** with
   [cleanup-and-classify.md](reference/cleanup-and-classify.md).
 - **Durably record class and rationale** in `decisions.md` and the applicable

package/pack/.claude/skills/devrites-lib/reference/standards/README.md

@@ -33,6 +33,7 @@ topic's owner.
 | `principles.md` | Authoring or checking project invariants and approved exceptions. |
 | `deprecation.md` | Removing, replacing, or migrating behavior, code, APIs, or data. |
 | `agents.md` | Dispatching, awaiting, validating, or reconciling fresh-context agents. |
+| `workflow-artifacts.md` | Materializing executable proof/controller/harness files under the active `.devrites/work/<slug>/`. |
 | `context-hygiene.md` | Choosing `/clear`, `/compact`, or a handoff. |
 | `anti-patterns.md` | A pack-wide rationalization or red flag appears. |
 | `afk-hitl.md` | A pause, question, resume, or AFK decision is possible. |

package/pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -259,6 +259,12 @@ changes, not a request for permission to retry.
   recorded no-progress corrections still has recovery budget, even when an older
   `state.md` says `Next step: none`. Resume it; do not treat session age or the
   prior action's spent authorization as exhaustion.
+- **Treat a newly supported writer route as progress once.** For exact Vet-ready
+  workflow artifacts, apply `workflow-artifacts.md` when prior attempts only asked
+  a read-only role or product wright for implementation and evidence records
+  **no controlling-root materialization attempt**. Preserve the old attempts, but
+  do not count them against the new root-materialization fingerprint. Record the
+  migration; after a root attempt exists, normal fingerprint accounting applies.
 - **Classify exhaustion:** human-owned contract/risk/access gaps open their gate. Otherwise
   preserve reproduction/dead ends, set `Status: blocked` and `Next step: none — technical recovery exhausted for <causal fingerprint>; requires new evidence or changed failure conditions`.
   Do not emit `/rite-plan unblock`, another phase command, a question, or

package/pack/.claude/skills/devrites-lib/reference/standards/agents.md

@@ -5,8 +5,9 @@ Follow DevRites policy and [`depth profiles`](../orchestration-profiles.md).
 ## Authority
 
 - Root owns scope, questions/decisions/results, `.devrites/**`, and phase
-  transitions—not source/tests.
-- Only bounded wright writes source/tests; others inspect an immutable
+  transitions—not product source/tests. Exact vetted executable workflow artifacts
+  follow [`workflow-artifacts.md`](workflow-artifacts.md).
+- Only bounded wright writes product source/tests; others inspect an immutable
   candidate.
 - Every named role runs; unavailable → HITL, never skip/substitute.
 - Leaves never invoke agents, ask humans, change phase, commit/push,
@@ -48,11 +49,16 @@ Running/orphaned/unavailable = `gap`; no root/generic substitute.
 Claude grants only wright `acceptEdits`; Codex root is workspace-capable because
 children cannot elevate. Wright alone is `:workspace`; others are `:read-only`.
 
-Give wright the smallest exact project-relative file list—no directories/globs,
-traversal/`.devrites/**`. No scope widening. Root rejects
-`git diff --name-only` extras. Never patch in root, bypass/substitute wright,
+Give wright the smallest exact project-relative product source/test file list—no
+directories/globs, traversal/`.devrites/**`. No scope widening. Root rejects
+`git diff --name-only` extras. Never patch product source/tests in root, bypass/substitute wright,
 accept drift, or recreate a dispatch bridge.
 
+The controlling root may materialize only the exact Vet-ready executable workflow
+artifact paths under the active `.devrites/work/<slug>/` using
+[`workflow-artifacts.md`](workflow-artifacts.md). This is not a writer dispatch,
+product slice, candidate mutation, or exception to the source-writing boundary.
+
 ## Inputs and results
 
 Each job gets objective/exclusions, exact paths/immutable candidate, rubric/result

package/pack/.claude/skills/devrites-lib/reference/standards/skill-authoring.md

@@ -132,4 +132,5 @@ Public commands need docs/generated hosts/reply marker;
 internal skills need trigger/not-for plus proof they are not an agent/reference.
 Agents need role/scope/mode/output/composition and
 [`agents.md` § Result admission](agents.md#result-admission) for review roles.
-Only `devrites-slice-wright` writes.
+Only `devrites-slice-wright` writes product source/tests. The controlling root's
+path-bounded `.devrites/**` workflow artifacts follow `workflow-artifacts.md`.

package/pack/.claude/skills/devrites-lib/reference/standards/workflow-artifacts.md

@@ -0,0 +1,76 @@
+# Executable workflow artifacts
+
+Executable files used only to plan, isolate, or prove a DevRites workflow—such as
+a controller, harness, proof bundle, fixture generator, or bounded materializer
+under the active `.devrites/work/<slug>/`—are **workflow artifacts**, not product
+source/tests. They remain excluded from the product candidate and never authorize
+the real action they prepare.
+
+## Ownership
+
+After an exact design and path set pass Vet, the **controlling root is the sole materializer**
+of these artifacts under its existing `.devrites/**` authority. For these paths,
+never dispatch `devrites-slice-wright`,
+never widen the wright contract, and never ask a
+read-only planner/reviewer for implementation bodies. Product source/tests remain
+wright-only.
+
+Missing implementation bytes are an agent-owned materialization task, not
+technical-recovery exhaustion, while the vetted behavior and exact paths are
+complete. The root may not invent unresolved protocol choices; those return to
+Plan/Vet.
+
+## Cold-resume migration
+
+A **stale writer-exhaustion cursor** must reopen when all of these are durable:
+
+- Vet accepted the exact workflow-artifact paths and complete executable contract;
+- the recorded blocker is only missing implementation bodies or a writable actor;
+- prior no-progress attempts asked a read-only drafter/reviewer for bodies or sent
+  `.devrites/**` paths toward the product wright; and
+- evidence records **no controlling-root materialization attempt** for that exact set.
+
+This is a changed routing condition, not another correction attempt against the
+old unsupported-writer fingerprint. Preserve that history, close or supersede its
+terminal claim, record one new root-materialization fingerprint, and materialize
+directly even when all product slices are built or the AFK slice budget is zero.
+Do not consume product-slice budget, reopen an answered human gate, or require GO
+for this offline work. After any controlling-root attempt is recorded, this
+migration cannot apply again; route its observed atomic/proof failure under the
+new fingerprint instead.
+
+## Admission
+
+Before writing:
+
+1. Require the active slug, current readiness binding, resolved human gates, and
+   an exact file list in `plan.md` / `test-plan.md`. Reject directories, globs,
+   traversal, duplicates, symlinks, paths outside the active feature workspace,
+   and any product source/test or dependency path.
+2. Bind the complete behavior, interfaces, failure relations, proof commands,
+   expected signals, and rollback for the atomic artifact set. A prose placeholder
+   or a request that a drafter supply code is a Plan gap, not implementation input.
+3. Record preimages or absence for every target plus protected product manifests
+   and the current candidate digest. Resolve every parent no-follow before mutation.
+
+## Materialize
+
+The root authors the smallest complete bytes for all admitted targets. Write each
+through a same-parent private temporary file, set the planned mode, flush it, and
+atomically replace the target; settle the whole set or roll back partial output.
+Do not install dependencies, touch Git, use the network, mutate product paths, or
+execute the consumptive action.
+
+## Verify and return
+
+Read back the exact path set, modes, and SHA-256 identities. Run only the vetted
+compile/static/fixture/mutant commands in their isolated non-consumptive modes;
+require every discriminating signal. Recheck protected preimages and require the
+candidate digest remains identical. Record the workflow-artifact hashes and proof
+in canonical evidence, but never add these paths to the product candidate manifest
+or built-slice count. Run the affected narrow Vet, restore the controlling return
+cursor, and stop for fresh authorization before any real consumptive action.
+
+An actual host permission failure, unresolved design choice, out-of-scope path, or
+failed atomic/proof check blocks truthfully. The absence of a writable specialist
+does not: root ownership is the supported path.

package/pack/.claude/skills/rite-autocomplete/SKILL.md

@@ -18,6 +18,10 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
 When the cursor or approved plan contains a consumptive action, also read
 `.claude/skills/devrites-lib/reference/standards/one-shot-actions.md` before any
 stop/continue or execution decision.
+When a blocked cursor names missing executable controller/harness/bundle bytes or
+a missing writer under the active feature workspace, read
+`.claude/skills/devrites-lib/reference/standards/workflow-artifacts.md` before honoring
+the terminal cursor or its recovery count.
 
 ## Operating rules
 - **Use one initial human window.** Run spec and topology-first clarify; arm AFK
@@ -67,6 +71,11 @@ stop/continue or execution decision.
    terminal `next_action`, reconcile retained consumptive-action artifacts and
    per-fingerprint attempts from `drift.md` / `evidence.md`. A distinct retained
    fingerprint below its no-progress cap reopens caller-owned offline recovery;
+   a stale pre-ownership workflow-artifact writer stop reopens under
+   `workflow-artifacts.md` when no controlling-root materialization attempt exists.
+   That materialization runs directly as non-consumptive prerequisite recovery,
+   even with no pending product slice or AFK budget; it does not re-ask an answered
+   human gate.
    reconstruct any missing return cursor only from the current phase plus the
    exact approved action in `test-plan.md` / evidence, never from chat or guesswork.
    The idea + flags: `--ship` / `--yolo` (continue through ship preflight, then stop

package/pack/.claude/skills/rite-autocomplete/reference/loop.md

@@ -64,6 +64,17 @@ Restore `return_phase` from the current phase and `return_next_action` only from
 the exact approved action recorded in `test-plan.md` / evidence; ambiguity returns
 to the applicable Vet contract and never licenses execution.
 
+Also reconcile a **stale writer-exhaustion cursor** against
+`workflow-artifacts.md`. When exact Vet-ready workflow-artifact paths and behavior
+exist, the old attempts only targeted the read-only drafter/reviewer or product
+wright, and there is **no controlling-root materialization attempt**, supported
+root ownership is a changed routing condition. Preserve the old fingerprint,
+record the new materialization fingerprint, and run that offline branch directly;
+do not charge or require product-slice/AFK budget, re-ask a resolved question, or
+request GO. Once a root materialization attempt exists, never apply this migration
+again—route its observed failure normally. This reconciliation runs even when all
+product slices are already built, before selecting the next forward phase.
+
 1. Save the originating phase/action in the native return cursor unless a valid
    one already exists.
 2. Invoke the required repair, Vet, remediation, and proof skills inline. After

package/pack/.claude/skills/rite-autocomplete/reference/stop-conditions.md

@@ -46,6 +46,14 @@ no-progress corrections. A retained fingerprint with remaining offline budget is
 not terminal merely because `state.md` was written by the failed action or a prior
 session ended.
 
+A pre-ownership workflow-artifact writer stop is not unchanged evidence when the
+current contract supplies controlling-root materialization. Prior drafter/wright refusals do not count
+as root materialization attempts. Reopen only when exact paths and executable
+behavior passed Vet and there is **no controlling-root materialization attempt**;
+record the routing migration so it cannot reset again. Missing product slices,
+unresolved protocol choices, or a recorded root attempt remain under their normal
+gate/fingerprint rules.
+
 Past evidence being irretrievable is not by itself terminal. When an in-scope
 trusted diagnostic seam can make the next retained fingerprint uniquely
 actionable, Autocomplete must run diagnostic-amplification Plan repair and narrow

package/pack/.claude/skills/rite-build/SKILL.md

@@ -14,7 +14,9 @@ first**; if none, tell the user to run `/rite-spec <feature>`.
 
 The root owns gates/workspace; a
 fresh-context [`devrites-slice-wright`](../../agents/devrites-slice-wright.md)
-writes source and tests. Apply the readiness, selection, host, HITL/AFK,
+writes product source and tests. Exact Vet-ready executable workflow artifacts use
+[`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md).
+Apply the readiness, selection, host, HITL/AFK,
 dispatch, doubt, fail-on-red, record, and stop checks. See
 [`reference/wright-dispatch.md`](reference/wright-dispatch.md).
 
@@ -61,7 +63,9 @@ reads named on-demand rules while writing; root reads them for doubt/record gate
   principle was broken**; a fresh violation is handled like any irreversible-risk item: a
   human-approved, scoped exception in the register or a stop, never folded into the slice. No
   `.devrites/principles.md` → none declared → nothing to honor.
-- **You never edit source.** You write only `.devrites/` bookkeeping. Follow the
+- **You never edit product source/tests.** You write `.devrites/` bookkeeping and,
+  only through `workflow-artifacts.md`, an exact Vet-ready executable workflow-artifact set.
+  Follow the
   host gate in `wright-dispatch.md` before every build or recovery dispatch. On a
   supported host, the wright is the only writer of code and tests. Codex gives
   the root workspace permission only so that native writer dispatch can execute;
@@ -69,6 +73,11 @@ reads named on-demand rules while writing; root reads them for doubt/record gate
   list directly in the task, dispatch the exact `devrites-slice-wright`, then
   compare `git diff --name-only` with those task paths. Any extra source file is
   a hard STOP.
+- **Executable workflow-artifact branch.** If every implementation target is an
+  exact admitted path under the active `.devrites/work/<slug>/`, the controlling
+  root materializes and proves that atomic set itself. It does not dispatch the wright,
+  decrement/count a product slice, update the candidate manifest, or execute the
+  consumptive action. After narrow Vet, restore the caller cursor.
 
 ## Workflow
 

package/pack/.claude/skills/rite-build/reference/phase-contract.md

@@ -8,16 +8,30 @@ See [`one-slice-cycle.md`](one-slice-cycle.md); candidate lifecycle is
    `Readiness inputs SHA-256`, all applicable exact reviewer accounts,
    ID-and-meaning traceability, and green proof preflight; run
    `devrites-engine check readiness <slug>`. Any miss/nonzero stops.
-2. **Select one slice.** Restate goal, acceptance criteria, exclusions, and exact
+2. **Select one target.** Restate goal, acceptance criteria, exclusions, and exact
    source/test paths. Before dispatch, validate relevant `assumptions.md` rows
    against live evidence. If one is disproved and changes acceptance, architecture,
    scope, or proof, use the Spec Drift Guard/plan recovery; a human-owned unknown
    stops. Resolve HITL before source work. AFK answers only permitted gates;
    human-owned or irreversible risk persists a question and stops for `/rite-resolve`.
-3. **Dispatch the sole writer.** Apply [`wright-dispatch.md`](wright-dispatch.md).
+   If the target is only an exact Vet-ready executable workflow-artifact set under
+   the active feature workspace, apply
+   [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md)
+   instead of treating it as a product slice.
+3. **Dispatch or materialize.** Product source/tests apply [`wright-dispatch.md`](wright-dispatch.md).
    Put the smallest exact project-relative source/test path list directly in the task;
-   dispatch the exact `devrites-slice-wright` fresh. Root never writes, wright never
-   widens, and a missing profile stops.
+   dispatch the exact `devrites-slice-wright` fresh. Root never writes those product
+   paths, wright never widens, and a missing profile stops.
+   For the workflow-artifact branch, the controlling root writes only the admitted
+   `.devrites/work/<slug>/` paths, proves the complete atomic set, rechecks an
+   identical product candidate, records hashes/evidence, and runs narrow Vet. Do not
+   dispatch any agent as a substitute writer and do not charge a product slice.
+
+### Executable workflow-artifact branch
+
+The controlling root materializes the exact admitted workflow-artifact set and
+**does not dispatch the wright**. This branch never changes product slice state or
+the candidate manifest; it returns through narrow Vet before any consumptive action.
 4. **Inspect the return.** Wait; compare its file list and `git diff --name-only`
    with the contract. Reject stale, partial, malformed, or out-of-scope work.
    Preserve user work; source restoration uses the same bounded wright.

package/pack/.claude/skills/rite-build/reference/wright-dispatch.md

@@ -15,6 +15,10 @@ the wright or recreate an engine bridge.
 
 1. Derive the smallest exact project-relative source/test path list; reject
    directories/globs, traversal, symlink escapes, duplicates, and `.devrites/**`.
+   A target composed only of vetted executable workflow artifacts routes to the
+   controlling root under
+   [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
+   its rejection here is not a blocker.
 2. Put it in the task with goal, verbatim acceptance, exclusions, context,
    `test-plan.md` proof commands, and applicable standards.
    A new path requires a new bounded contract; the wright cannot widen the task.

package/pack/.claude/skills/rite-plan/SKILL.md

@@ -85,6 +85,12 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
    require the drafter to apply `one-shot-actions.md` and return the bounded
    diagnostic-amplification design, injective boundary map, per-seam fixtures, and
    collision mutant. Past evidence loss alone is not a terminal conclusion.
+   The drafter never supplies implementation bodies. Bind the exact active
+   `.devrites/work/<slug>/` targets and complete executable contract; after Vet
+   READY, the controlling root materializes the exact vetted workflow-artifact paths
+   under
+   [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
+   without dispatching the product wright.
 3. Reason about dependencies: [dependency-graph](reference/dependency-graph.md).
    Reconcile `plan.md`'s canonical `Shared contract proof`: changed provider/consumer
    boundaries keep one reused contract artifact ahead of both asserting tests, and unaffected

package/pack/.claude/skills/rite-prove/SKILL.md

@@ -40,6 +40,8 @@ Pull these via `Read` when relevant:
 - `definition-of-done.md`: acceptance, proof, gates, scope, rollback/docs.
 - `one-shot-actions.md`: pre-attempt evidence completeness and no-rerun handling for
   consumptive proof actions.
+- `workflow-artifacts.md`: exact root-owned executable proof/controller/harness
+  artifacts under the active feature workspace.
 
 
 ## Operating rules
@@ -57,8 +59,11 @@ Pull these via `Read` when relevant:
   [`agents.md`](../devrites-lib/reference/standards/agents.md). The root owns exact
   vetted gate execution, browser capability, the evidence verdict, and canonical
   writes. The proof runner is read-only and validates immutable logs/artifacts.
-  Every accepted source/test correction is one bounded
+  Every accepted product source/test correction is one bounded
   `devrites-slice-wright` task, never an inline edit.
+  Exact Vet-ready executable workflow artifacts under the active `.devrites/**`
+  workspace follow `workflow-artifacts.md` and are materialized by the controlling
+  root; they are not product writer work.
 - **Prove remains the controlling caller during technical backtracking.** Save
   its return cursor, invoke Plan/Vet or bounded remediation inline, consume each
   nested phase boundary, then resume the failed Prove step. Never make the human

package/pack/generated/claude/agents/devrites-plan-drafter.md

@@ -43,6 +43,8 @@ principle-exception questions. List them for the root.
 ## Rules
 
 - Read-only. Do not edit source, tests, `.devrites/**`, Git state, or dependencies.
+- Design executable workflow artifacts completely, but never return implementation bodies
+  or materialize them; the later Vet-ready step follows `workflow-artifacts.md`.
 - Do not ask the user, approve the plan, set readiness, or advance a phase.
 - Do not invoke another agent.
 - Return candidate content only for requested paths. If unfinished, name the exact

package/pack/generated/claude/skills/devrites-debug-recovery/SKILL.md

@@ -68,6 +68,12 @@ has no clear next move.
   repair its finite map and collision/fault fixtures offline, narrow-Vet it, and
   stop for fresh authorization before the evidence-acquisition attempt. Missing
   past evidence is terminal only when no safe amplification seam exists.
+- **Route by artifact ownership.** Product source/tests go to the exact bounded
+  wright. Exact Vet-ready executable proof artifacts under the active `.devrites/**`
+  workspace follow
+  [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
+  and are materialized by the controlling root. Never ask a read-only planner or
+  reviewer to return implementation bodies.
 - **Classify before routing** with
   [cleanup-and-classify.md](reference/cleanup-and-classify.md).
 - **Durably record class and rationale** in `decisions.md` and the applicable

package/pack/generated/claude/skills/devrites-lib/reference/standards/README.md

@@ -33,6 +33,7 @@ topic's owner.
 | `principles.md` | Authoring or checking project invariants and approved exceptions. |
 | `deprecation.md` | Removing, replacing, or migrating behavior, code, APIs, or data. |
 | `agents.md` | Dispatching, awaiting, validating, or reconciling fresh-context agents. |
+| `workflow-artifacts.md` | Materializing executable proof/controller/harness files under the active `.devrites/work/<slug>/`. |
 | `context-hygiene.md` | Choosing `/clear`, `/compact`, or a handoff. |
 | `anti-patterns.md` | A pack-wide rationalization or red flag appears. |
 | `afk-hitl.md` | A pause, question, resume, or AFK decision is possible. |

package/pack/generated/claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -259,6 +259,12 @@ changes, not a request for permission to retry.
   recorded no-progress corrections still has recovery budget, even when an older
   `state.md` says `Next step: none`. Resume it; do not treat session age or the
   prior action's spent authorization as exhaustion.
+- **Treat a newly supported writer route as progress once.** For exact Vet-ready
+  workflow artifacts, apply `workflow-artifacts.md` when prior attempts only asked
+  a read-only role or product wright for implementation and evidence records
+  **no controlling-root materialization attempt**. Preserve the old attempts, but
+  do not count them against the new root-materialization fingerprint. Record the
+  migration; after a root attempt exists, normal fingerprint accounting applies.
 - **Classify exhaustion:** human-owned contract/risk/access gaps open their gate. Otherwise
   preserve reproduction/dead ends, set `Status: blocked` and `Next step: none — technical recovery exhausted for <causal fingerprint>; requires new evidence or changed failure conditions`.
   Do not emit `/rite-plan unblock`, another phase command, a question, or

package/pack/generated/claude/skills/devrites-lib/reference/standards/agents.md

@@ -5,8 +5,9 @@ Follow DevRites policy and [`depth profiles`](../orchestration-profiles.md).
 ## Authority
 
 - Root owns scope, questions/decisions/results, `.devrites/**`, and phase
-  transitions—not source/tests.
-- Only bounded wright writes source/tests; others inspect an immutable
+  transitions—not product source/tests. Exact vetted executable workflow artifacts
+  follow [`workflow-artifacts.md`](workflow-artifacts.md).
+- Only bounded wright writes product source/tests; others inspect an immutable
   candidate.
 - Every named role runs; unavailable → HITL, never skip/substitute.
 - Leaves never invoke agents, ask humans, change phase, commit/push,
@@ -48,11 +49,16 @@ Running/orphaned/unavailable = `gap`; no root/generic substitute.
 Claude grants only wright `acceptEdits`; Codex root is workspace-capable because
 children cannot elevate. Wright alone is `:workspace`; others are `:read-only`.
 
-Give wright the smallest exact project-relative file list—no directories/globs,
-traversal/`.devrites/**`. No scope widening. Root rejects
-`git diff --name-only` extras. Never patch in root, bypass/substitute wright,
+Give wright the smallest exact project-relative product source/test file list—no
+directories/globs, traversal/`.devrites/**`. No scope widening. Root rejects
+`git diff --name-only` extras. Never patch product source/tests in root, bypass/substitute wright,
 accept drift, or recreate a dispatch bridge.
 
+The controlling root may materialize only the exact Vet-ready executable workflow
+artifact paths under the active `.devrites/work/<slug>/` using
+[`workflow-artifacts.md`](workflow-artifacts.md). This is not a writer dispatch,
+product slice, candidate mutation, or exception to the source-writing boundary.
+
 ## Inputs and results
 
 Each job gets objective/exclusions, exact paths/immutable candidate, rubric/result

package/pack/generated/claude/skills/devrites-lib/reference/standards/skill-authoring.md

@@ -132,4 +132,5 @@ Public commands need docs/generated hosts/reply marker;
 internal skills need trigger/not-for plus proof they are not an agent/reference.
 Agents need role/scope/mode/output/composition and
 [`agents.md` § Result admission](agents.md#result-admission) for review roles.
-Only `devrites-slice-wright` writes.
+Only `devrites-slice-wright` writes product source/tests. The controlling root's
+path-bounded `.devrites/**` workflow artifacts follow `workflow-artifacts.md`.

package/pack/generated/claude/skills/devrites-lib/reference/standards/workflow-artifacts.md

@@ -0,0 +1,76 @@
+# Executable workflow artifacts
+
+Executable files used only to plan, isolate, or prove a DevRites workflow—such as
+a controller, harness, proof bundle, fixture generator, or bounded materializer
+under the active `.devrites/work/<slug>/`—are **workflow artifacts**, not product
+source/tests. They remain excluded from the product candidate and never authorize
+the real action they prepare.
+
+## Ownership
+
+After an exact design and path set pass Vet, the **controlling root is the sole materializer**
+of these artifacts under its existing `.devrites/**` authority. For these paths,
+never dispatch `devrites-slice-wright`,
+never widen the wright contract, and never ask a
+read-only planner/reviewer for implementation bodies. Product source/tests remain
+wright-only.
+
+Missing implementation bytes are an agent-owned materialization task, not
+technical-recovery exhaustion, while the vetted behavior and exact paths are
+complete. The root may not invent unresolved protocol choices; those return to
+Plan/Vet.
+
+## Cold-resume migration
+
+A **stale writer-exhaustion cursor** must reopen when all of these are durable:
+
+- Vet accepted the exact workflow-artifact paths and complete executable contract;
+- the recorded blocker is only missing implementation bodies or a writable actor;
+- prior no-progress attempts asked a read-only drafter/reviewer for bodies or sent
+  `.devrites/**` paths toward the product wright; and
+- evidence records **no controlling-root materialization attempt** for that exact set.
+
+This is a changed routing condition, not another correction attempt against the
+old unsupported-writer fingerprint. Preserve that history, close or supersede its
+terminal claim, record one new root-materialization fingerprint, and materialize
+directly even when all product slices are built or the AFK slice budget is zero.
+Do not consume product-slice budget, reopen an answered human gate, or require GO
+for this offline work. After any controlling-root attempt is recorded, this
+migration cannot apply again; route its observed atomic/proof failure under the
+new fingerprint instead.
+
+## Admission
+
+Before writing:
+
+1. Require the active slug, current readiness binding, resolved human gates, and
+   an exact file list in `plan.md` / `test-plan.md`. Reject directories, globs,
+   traversal, duplicates, symlinks, paths outside the active feature workspace,
+   and any product source/test or dependency path.
+2. Bind the complete behavior, interfaces, failure relations, proof commands,
+   expected signals, and rollback for the atomic artifact set. A prose placeholder
+   or a request that a drafter supply code is a Plan gap, not implementation input.
+3. Record preimages or absence for every target plus protected product manifests
+   and the current candidate digest. Resolve every parent no-follow before mutation.
+
+## Materialize
+
+The root authors the smallest complete bytes for all admitted targets. Write each
+through a same-parent private temporary file, set the planned mode, flush it, and
+atomically replace the target; settle the whole set or roll back partial output.
+Do not install dependencies, touch Git, use the network, mutate product paths, or
+execute the consumptive action.
+
+## Verify and return
+
+Read back the exact path set, modes, and SHA-256 identities. Run only the vetted
+compile/static/fixture/mutant commands in their isolated non-consumptive modes;
+require every discriminating signal. Recheck protected preimages and require the
+candidate digest remains identical. Record the workflow-artifact hashes and proof
+in canonical evidence, but never add these paths to the product candidate manifest
+or built-slice count. Run the affected narrow Vet, restore the controlling return
+cursor, and stop for fresh authorization before any real consumptive action.
+
+An actual host permission failure, unresolved design choice, out-of-scope path, or
+failed atomic/proof check blocks truthfully. The absence of a writable specialist
+does not: root ownership is the supported path.

package/pack/generated/claude/skills/rite-autocomplete/SKILL.md

@@ -18,6 +18,10 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
 When the cursor or approved plan contains a consumptive action, also read
 `.claude/skills/devrites-lib/reference/standards/one-shot-actions.md` before any
 stop/continue or execution decision.
+When a blocked cursor names missing executable controller/harness/bundle bytes or
+a missing writer under the active feature workspace, read
+`.claude/skills/devrites-lib/reference/standards/workflow-artifacts.md` before honoring
+the terminal cursor or its recovery count.
 
 ## Operating rules
 - **Use one initial human window.** Run spec and topology-first clarify; arm AFK
@@ -67,6 +71,11 @@ stop/continue or execution decision.
    terminal `next_action`, reconcile retained consumptive-action artifacts and
    per-fingerprint attempts from `drift.md` / `evidence.md`. A distinct retained
    fingerprint below its no-progress cap reopens caller-owned offline recovery;
+   a stale pre-ownership workflow-artifact writer stop reopens under
+   `workflow-artifacts.md` when no controlling-root materialization attempt exists.
+   That materialization runs directly as non-consumptive prerequisite recovery,
+   even with no pending product slice or AFK budget; it does not re-ask an answered
+   human gate.
    reconstruct any missing return cursor only from the current phase plus the
    exact approved action in `test-plan.md` / evidence, never from chat or guesswork.
    The idea + flags: `--ship` / `--yolo` (continue through ship preflight, then stop

package/pack/generated/claude/skills/rite-autocomplete/reference/loop.md

@@ -64,6 +64,17 @@ Restore `return_phase` from the current phase and `return_next_action` only from
 the exact approved action recorded in `test-plan.md` / evidence; ambiguity returns
 to the applicable Vet contract and never licenses execution.
 
+Also reconcile a **stale writer-exhaustion cursor** against
+`workflow-artifacts.md`. When exact Vet-ready workflow-artifact paths and behavior
+exist, the old attempts only targeted the read-only drafter/reviewer or product
+wright, and there is **no controlling-root materialization attempt**, supported
+root ownership is a changed routing condition. Preserve the old fingerprint,
+record the new materialization fingerprint, and run that offline branch directly;
+do not charge or require product-slice/AFK budget, re-ask a resolved question, or
+request GO. Once a root materialization attempt exists, never apply this migration
+again—route its observed failure normally. This reconciliation runs even when all
+product slices are already built, before selecting the next forward phase.
+
 1. Save the originating phase/action in the native return cursor unless a valid
    one already exists.
 2. Invoke the required repair, Vet, remediation, and proof skills inline. After

package/pack/generated/claude/skills/rite-autocomplete/reference/stop-conditions.md

@@ -46,6 +46,14 @@ no-progress corrections. A retained fingerprint with remaining offline budget is
 not terminal merely because `state.md` was written by the failed action or a prior
 session ended.
 
+A pre-ownership workflow-artifact writer stop is not unchanged evidence when the
+current contract supplies controlling-root materialization. Prior drafter/wright refusals do not count
+as root materialization attempts. Reopen only when exact paths and executable
+behavior passed Vet and there is **no controlling-root materialization attempt**;
+record the routing migration so it cannot reset again. Missing product slices,
+unresolved protocol choices, or a recorded root attempt remain under their normal
+gate/fingerprint rules.
+
 Past evidence being irretrievable is not by itself terminal. When an in-scope
 trusted diagnostic seam can make the next retained fingerprint uniquely
 actionable, Autocomplete must run diagnostic-amplification Plan repair and narrow

package/pack/generated/claude/skills/rite-build/SKILL.md

@@ -14,7 +14,9 @@ first**; if none, tell the user to run `/rite-spec <feature>`.
 
 The root owns gates/workspace; a
 fresh-context [`devrites-slice-wright`](../../agents/devrites-slice-wright.md)
-writes source and tests. Apply the readiness, selection, host, HITL/AFK,
+writes product source and tests. Exact Vet-ready executable workflow artifacts use
+[`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md).
+Apply the readiness, selection, host, HITL/AFK,
 dispatch, doubt, fail-on-red, record, and stop checks. See
 [`reference/wright-dispatch.md`](reference/wright-dispatch.md).
 
@@ -61,7 +63,9 @@ reads named on-demand rules while writing; root reads them for doubt/record gate
   principle was broken**; a fresh violation is handled like any irreversible-risk item: a
   human-approved, scoped exception in the register or a stop, never folded into the slice. No
   `.devrites/principles.md` → none declared → nothing to honor.
-- **You never edit source.** You write only `.devrites/` bookkeeping. Follow the
+- **You never edit product source/tests.** You write `.devrites/` bookkeeping and,
+  only through `workflow-artifacts.md`, an exact Vet-ready executable workflow-artifact set.
+  Follow the
   host gate in `wright-dispatch.md` before every build or recovery dispatch. On a
   supported host, the wright is the only writer of code and tests. Codex gives
   the root workspace permission only so that native writer dispatch can execute;
@@ -69,6 +73,11 @@ reads named on-demand rules while writing; root reads them for doubt/record gate
   list directly in the task, dispatch the exact `devrites-slice-wright`, then
   compare `git diff --name-only` with those task paths. Any extra source file is
   a hard STOP.
+- **Executable workflow-artifact branch.** If every implementation target is an
+  exact admitted path under the active `.devrites/work/<slug>/`, the controlling
+  root materializes and proves that atomic set itself. It does not dispatch the wright,
+  decrement/count a product slice, update the candidate manifest, or execute the
+  consumptive action. After narrow Vet, restore the caller cursor.
 
 ## Workflow
 

package/pack/generated/claude/skills/rite-build/reference/phase-contract.md

@@ -8,16 +8,30 @@ See [`one-slice-cycle.md`](one-slice-cycle.md); candidate lifecycle is
    `Readiness inputs SHA-256`, all applicable exact reviewer accounts,
    ID-and-meaning traceability, and green proof preflight; run
    `devrites-engine check readiness <slug>`. Any miss/nonzero stops.
-2. **Select one slice.** Restate goal, acceptance criteria, exclusions, and exact
+2. **Select one target.** Restate goal, acceptance criteria, exclusions, and exact
    source/test paths. Before dispatch, validate relevant `assumptions.md` rows
    against live evidence. If one is disproved and changes acceptance, architecture,
    scope, or proof, use the Spec Drift Guard/plan recovery; a human-owned unknown
    stops. Resolve HITL before source work. AFK answers only permitted gates;
    human-owned or irreversible risk persists a question and stops for `/rite-resolve`.
-3. **Dispatch the sole writer.** Apply [`wright-dispatch.md`](wright-dispatch.md).
+   If the target is only an exact Vet-ready executable workflow-artifact set under
+   the active feature workspace, apply
+   [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md)
+   instead of treating it as a product slice.
+3. **Dispatch or materialize.** Product source/tests apply [`wright-dispatch.md`](wright-dispatch.md).
    Put the smallest exact project-relative source/test path list directly in the task;
-   dispatch the exact `devrites-slice-wright` fresh. Root never writes, wright never
-   widens, and a missing profile stops.
+   dispatch the exact `devrites-slice-wright` fresh. Root never writes those product
+   paths, wright never widens, and a missing profile stops.
+   For the workflow-artifact branch, the controlling root writes only the admitted
+   `.devrites/work/<slug>/` paths, proves the complete atomic set, rechecks an
+   identical product candidate, records hashes/evidence, and runs narrow Vet. Do not
+   dispatch any agent as a substitute writer and do not charge a product slice.
+
+### Executable workflow-artifact branch
+
+The controlling root materializes the exact admitted workflow-artifact set and
+**does not dispatch the wright**. This branch never changes product slice state or
+the candidate manifest; it returns through narrow Vet before any consumptive action.
 4. **Inspect the return.** Wait; compare its file list and `git diff --name-only`
    with the contract. Reject stale, partial, malformed, or out-of-scope work.
    Preserve user work; source restoration uses the same bounded wright.

package/pack/generated/claude/skills/rite-build/reference/wright-dispatch.md

@@ -15,6 +15,10 @@ the wright or recreate an engine bridge.
 
 1. Derive the smallest exact project-relative source/test path list; reject
    directories/globs, traversal, symlink escapes, duplicates, and `.devrites/**`.
+   A target composed only of vetted executable workflow artifacts routes to the
+   controlling root under
+   [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
+   its rejection here is not a blocker.
 2. Put it in the task with goal, verbatim acceptance, exclusions, context,
    `test-plan.md` proof commands, and applicable standards.
    A new path requires a new bounded contract; the wright cannot widen the task.

package/pack/generated/claude/skills/rite-plan/SKILL.md

@@ -85,6 +85,12 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
    require the drafter to apply `one-shot-actions.md` and return the bounded
    diagnostic-amplification design, injective boundary map, per-seam fixtures, and
    collision mutant. Past evidence loss alone is not a terminal conclusion.
+   The drafter never supplies implementation bodies. Bind the exact active
+   `.devrites/work/<slug>/` targets and complete executable contract; after Vet
+   READY, the controlling root materializes the exact vetted workflow-artifact paths
+   under
+   [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
+   without dispatching the product wright.
 3. Reason about dependencies: [dependency-graph](reference/dependency-graph.md).
    Reconcile `plan.md`'s canonical `Shared contract proof`: changed provider/consumer
    boundaries keep one reused contract artifact ahead of both asserting tests, and unaffected

package/pack/generated/claude/skills/rite-prove/SKILL.md

@@ -40,6 +40,8 @@ Pull these via `Read` when relevant:
 - `definition-of-done.md`: acceptance, proof, gates, scope, rollback/docs.
 - `one-shot-actions.md`: pre-attempt evidence completeness and no-rerun handling for
   consumptive proof actions.
+- `workflow-artifacts.md`: exact root-owned executable proof/controller/harness
+  artifacts under the active feature workspace.
 
 
 ## Operating rules
@@ -57,8 +59,11 @@ Pull these via `Read` when relevant:
   [`agents.md`](../devrites-lib/reference/standards/agents.md). The root owns exact
   vetted gate execution, browser capability, the evidence verdict, and canonical
   writes. The proof runner is read-only and validates immutable logs/artifacts.
-  Every accepted source/test correction is one bounded
+  Every accepted product source/test correction is one bounded
   `devrites-slice-wright` task, never an inline edit.
+  Exact Vet-ready executable workflow artifacts under the active `.devrites/**`
+  workspace follow `workflow-artifacts.md` and are materialized by the controlling
+  root; they are not product writer work.
 - **Prove remains the controlling caller during technical backtracking.** Save
   its return cursor, invoke Plan/Vet or bounded remediation inline, consume each
   nested phase boundary, then resume the failed Prove step. Never make the human

package/pack/generated/codex/AGENTS.md

@@ -16,7 +16,7 @@ This project has DevRites installed for both Claude Code and Codex.
 - Custom Codex subagents generated from the DevRites review agents live in `.codex/agents`.
 - In DevRites guidance, **invoke** means run a skill inline in the current context; **dispatch** means start a fresh agent with `spawn_agent`, wait for it, and reconcile its result.
 - Dispatch every exact named `devrites-<role>` required by the active workflow in a fresh subagent thread, wait for it, and reconcile its result. If that role is unavailable, stop for HITL; never skip it, never substitute a generic/default child, and never execute the specialist role in the root context.
-- The root uses the workspace-capable `devrites-orchestrator` profile because Codex children cannot elevate above the parent permission ceiling. This permission is for native writer dispatch and workflow artifacts; the root must never edit source or tests itself.
+- The root uses the workspace-capable `devrites-orchestrator` profile because Codex children cannot elevate above the parent permission ceiling. This permission is for native writer dispatch and exact path-bounded executable workflow artifacts under the active `.devrites/work/<slug>/`; the root must never edit product source or tests itself.
 - Every generated specialist is hook-free. `devrites-slice-wright` alone uses `default_permissions = ":workspace"`; every other specialist uses `default_permissions = ":read-only"`. Exact paths are instruction-enforced: put the project-relative paths in the task, wait for the wright, compare its file list and `git diff --name-only` with that contract, and reject any extra path. Never bypass the wright, widen its contract, or edit source in the root; the root must never recreate an engine dispatch bridge.
 - A seal GO, AFK mode, or autocomplete flag never authorizes an irreversible action. Disclose the exact commit/push/tag/PR plan and obtain fresh explicit user approval for that attempt; any changed or retried plan needs fresh approval. Native host permission and sandbox prompts remain authoritative and cannot be inferred or bypassed.
 

package/pack/generated/codex/agents/devrites-plan-drafter.toml

@@ -41,6 +41,8 @@ principle-exception questions. List them for the root.
 ## Rules
 
 - Read-only. Do not edit source, tests, `.devrites/**`, Git state, or dependencies.
+- Design executable workflow artifacts completely, but never return implementation bodies
+  or materialize them; the later Vet-ready step follows `workflow-artifacts.md`.
 - Do not ask the user, approve the plan, set readiness, or advance a phase.
 - Do not invoke another agent.
 - Return candidate content only for requested paths. If unfinished, name the exact

package/pack/generated/codex/skills/devrites-debug-recovery/SKILL.md

@@ -68,6 +68,12 @@ has no clear next move.
   repair its finite map and collision/fault fixtures offline, narrow-Vet it, and
   stop for fresh authorization before the evidence-acquisition attempt. Missing
   past evidence is terminal only when no safe amplification seam exists.
+- **Route by artifact ownership.** Product source/tests go to the exact bounded
+  wright. Exact Vet-ready executable proof artifacts under the active `.devrites/**`
+  workspace follow
+  [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
+  and are materialized by the controlling root. Never ask a read-only planner or
+  reviewer to return implementation bodies.
 - **Classify before routing** with
   [cleanup-and-classify.md](reference/cleanup-and-classify.md).
 - **Durably record class and rationale** in `decisions.md` and the applicable

package/pack/generated/codex/skills/devrites-lib/reference/standards/README.md

@@ -33,6 +33,7 @@ topic's owner.
 | `principles.md` | Authoring or checking project invariants and approved exceptions. |
 | `deprecation.md` | Removing, replacing, or migrating behavior, code, APIs, or data. |
 | `agents.md` | Dispatching, awaiting, validating, or reconciling fresh-context agents. |
+| `workflow-artifacts.md` | Materializing executable proof/controller/harness files under the active `.devrites/work/<slug>/`. |
 | `context-hygiene.md` | Choosing `/clear`, `/compact`, or a handoff. |
 | `anti-patterns.md` | A pack-wide rationalization or red flag appears. |
 | `afk-hitl.md` | A pause, question, resume, or AFK decision is possible. |

package/pack/generated/codex/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -259,6 +259,12 @@ changes, not a request for permission to retry.
   recorded no-progress corrections still has recovery budget, even when an older
   `state.md` says `Next step: none`. Resume it; do not treat session age or the
   prior action's spent authorization as exhaustion.
+- **Treat a newly supported writer route as progress once.** For exact Vet-ready
+  workflow artifacts, apply `workflow-artifacts.md` when prior attempts only asked
+  a read-only role or product wright for implementation and evidence records
+  **no controlling-root materialization attempt**. Preserve the old attempts, but
+  do not count them against the new root-materialization fingerprint. Record the
+  migration; after a root attempt exists, normal fingerprint accounting applies.
 - **Classify exhaustion:** human-owned contract/risk/access gaps open their gate. Otherwise
   preserve reproduction/dead ends, set `Status: blocked` and `Next step: none — technical recovery exhausted for <causal fingerprint>; requires new evidence or changed failure conditions`.
   Do not emit `$rite-plan unblock`, another phase command, a question, or

package/pack/generated/codex/skills/devrites-lib/reference/standards/agents.md

@@ -5,8 +5,9 @@ Follow DevRites policy and [`depth profiles`](../orchestration-profiles.md).
 ## Authority
 
 - Root owns scope, questions/decisions/results, `.devrites/**`, and phase
-  transitions—not source/tests.
-- Only bounded wright writes source/tests; others inspect an immutable
+  transitions—not product source/tests. Exact vetted executable workflow artifacts
+  follow [`workflow-artifacts.md`](workflow-artifacts.md).
+- Only bounded wright writes product source/tests; others inspect an immutable
   candidate.
 - Every named role runs; unavailable → HITL, never skip/substitute.
 - Leaves never invoke agents, ask humans, change phase, commit/push,
@@ -48,11 +49,16 @@ Running/orphaned/unavailable = `gap`; no root/generic substitute.
 Claude grants only wright `acceptEdits`; Codex root is workspace-capable because
 children cannot elevate. Wright alone is `:workspace`; others are `:read-only`.
 
-Give wright the smallest exact project-relative file list—no directories/globs,
-traversal/`.devrites/**`. No scope widening. Root rejects
-`git diff --name-only` extras. Never patch in root, bypass/substitute wright,
+Give wright the smallest exact project-relative product source/test file list—no
+directories/globs, traversal/`.devrites/**`. No scope widening. Root rejects
+`git diff --name-only` extras. Never patch product source/tests in root, bypass/substitute wright,
 accept drift, or recreate a dispatch bridge.
 
+The controlling root may materialize only the exact Vet-ready executable workflow
+artifact paths under the active `.devrites/work/<slug>/` using
+[`workflow-artifacts.md`](workflow-artifacts.md). This is not a writer dispatch,
+product slice, candidate mutation, or exception to the source-writing boundary.
+
 ## Inputs and results
 
 Each job gets objective/exclusions, exact paths/immutable candidate, rubric/result

package/pack/generated/codex/skills/devrites-lib/reference/standards/skill-authoring.md

@@ -132,4 +132,5 @@ Public commands need docs/generated hosts/reply marker;
 internal skills need trigger/not-for plus proof they are not an agent/reference.
 Agents need role/scope/mode/output/composition and
 [`agents.md` § Result admission](agents.md#result-admission) for review roles.
-Only `devrites-slice-wright` writes.
+Only `devrites-slice-wright` writes product source/tests. The controlling root's
+path-bounded `.devrites/**` workflow artifacts follow `workflow-artifacts.md`.

package/pack/generated/codex/skills/devrites-lib/reference/standards/workflow-artifacts.md

@@ -0,0 +1,76 @@
+# Executable workflow artifacts
+
+Executable files used only to plan, isolate, or prove a DevRites workflow—such as
+a controller, harness, proof bundle, fixture generator, or bounded materializer
+under the active `.devrites/work/<slug>/`—are **workflow artifacts**, not product
+source/tests. They remain excluded from the product candidate and never authorize
+the real action they prepare.
+
+## Ownership
+
+After an exact design and path set pass Vet, the **controlling root is the sole materializer**
+of these artifacts under its existing `.devrites/**` authority. For these paths,
+never dispatch `devrites-slice-wright`,
+never widen the wright contract, and never ask a
+read-only planner/reviewer for implementation bodies. Product source/tests remain
+wright-only.
+
+Missing implementation bytes are an agent-owned materialization task, not
+technical-recovery exhaustion, while the vetted behavior and exact paths are
+complete. The root may not invent unresolved protocol choices; those return to
+Plan/Vet.
+
+## Cold-resume migration
+
+A **stale writer-exhaustion cursor** must reopen when all of these are durable:
+
+- Vet accepted the exact workflow-artifact paths and complete executable contract;
+- the recorded blocker is only missing implementation bodies or a writable actor;
+- prior no-progress attempts asked a read-only drafter/reviewer for bodies or sent
+  `.devrites/**` paths toward the product wright; and
+- evidence records **no controlling-root materialization attempt** for that exact set.
+
+This is a changed routing condition, not another correction attempt against the
+old unsupported-writer fingerprint. Preserve that history, close or supersede its
+terminal claim, record one new root-materialization fingerprint, and materialize
+directly even when all product slices are built or the AFK slice budget is zero.
+Do not consume product-slice budget, reopen an answered human gate, or require GO
+for this offline work. After any controlling-root attempt is recorded, this
+migration cannot apply again; route its observed atomic/proof failure under the
+new fingerprint instead.
+
+## Admission
+
+Before writing:
+
+1. Require the active slug, current readiness binding, resolved human gates, and
+   an exact file list in `plan.md` / `test-plan.md`. Reject directories, globs,
+   traversal, duplicates, symlinks, paths outside the active feature workspace,
+   and any product source/test or dependency path.
+2. Bind the complete behavior, interfaces, failure relations, proof commands,
+   expected signals, and rollback for the atomic artifact set. A prose placeholder
+   or a request that a drafter supply code is a Plan gap, not implementation input.
+3. Record preimages or absence for every target plus protected product manifests
+   and the current candidate digest. Resolve every parent no-follow before mutation.
+
+## Materialize
+
+The root authors the smallest complete bytes for all admitted targets. Write each
+through a same-parent private temporary file, set the planned mode, flush it, and
+atomically replace the target; settle the whole set or roll back partial output.
+Do not install dependencies, touch Git, use the network, mutate product paths, or
+execute the consumptive action.
+
+## Verify and return
+
+Read back the exact path set, modes, and SHA-256 identities. Run only the vetted
+compile/static/fixture/mutant commands in their isolated non-consumptive modes;
+require every discriminating signal. Recheck protected preimages and require the
+candidate digest remains identical. Record the workflow-artifact hashes and proof
+in canonical evidence, but never add these paths to the product candidate manifest
+or built-slice count. Run the affected narrow Vet, restore the controlling return
+cursor, and stop for fresh authorization before any real consumptive action.
+
+An actual host permission failure, unresolved design choice, out-of-scope path, or
+failed atomic/proof check blocks truthfully. The absence of a writable specialist
+does not: root ownership is the supported path.

package/pack/generated/codex/skills/rite-autocomplete/SKILL.md

@@ -18,6 +18,10 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
 When the cursor or approved plan contains a consumptive action, also read
 `.agents/skills/devrites-lib/reference/standards/one-shot-actions.md` before any
 stop/continue or execution decision.
+When a blocked cursor names missing executable controller/harness/bundle bytes or
+a missing writer under the active feature workspace, read
+`.agents/skills/devrites-lib/reference/standards/workflow-artifacts.md` before honoring
+the terminal cursor or its recovery count.
 
 ## Operating rules
 - **Use one initial human window.** Run spec and topology-first clarify; arm AFK
@@ -67,6 +71,11 @@ stop/continue or execution decision.
    terminal `next_action`, reconcile retained consumptive-action artifacts and
    per-fingerprint attempts from `drift.md` / `evidence.md`. A distinct retained
    fingerprint below its no-progress cap reopens caller-owned offline recovery;
+   a stale pre-ownership workflow-artifact writer stop reopens under
+   `workflow-artifacts.md` when no controlling-root materialization attempt exists.
+   That materialization runs directly as non-consumptive prerequisite recovery,
+   even with no pending product slice or AFK budget; it does not re-ask an answered
+   human gate.
    reconstruct any missing return cursor only from the current phase plus the
    exact approved action in `test-plan.md` / evidence, never from chat or guesswork.
    The idea + flags: `--ship` / `--yolo` (continue through ship preflight, then stop

package/pack/generated/codex/skills/rite-autocomplete/reference/loop.md

@@ -64,6 +64,17 @@ Restore `return_phase` from the current phase and `return_next_action` only from
 the exact approved action recorded in `test-plan.md` / evidence; ambiguity returns
 to the applicable Vet contract and never licenses execution.
 
+Also reconcile a **stale writer-exhaustion cursor** against
+`workflow-artifacts.md`. When exact Vet-ready workflow-artifact paths and behavior
+exist, the old attempts only targeted the read-only drafter/reviewer or product
+wright, and there is **no controlling-root materialization attempt**, supported
+root ownership is a changed routing condition. Preserve the old fingerprint,
+record the new materialization fingerprint, and run that offline branch directly;
+do not charge or require product-slice/AFK budget, re-ask a resolved question, or
+request GO. Once a root materialization attempt exists, never apply this migration
+again—route its observed failure normally. This reconciliation runs even when all
+product slices are already built, before selecting the next forward phase.
+
 1. Save the originating phase/action in the native return cursor unless a valid
    one already exists.
 2. Invoke the required repair, Vet, remediation, and proof skills inline. After

package/pack/generated/codex/skills/rite-autocomplete/reference/stop-conditions.md

@@ -46,6 +46,14 @@ no-progress corrections. A retained fingerprint with remaining offline budget is
 not terminal merely because `state.md` was written by the failed action or a prior
 session ended.
 
+A pre-ownership workflow-artifact writer stop is not unchanged evidence when the
+current contract supplies controlling-root materialization. Prior drafter/wright refusals do not count
+as root materialization attempts. Reopen only when exact paths and executable
+behavior passed Vet and there is **no controlling-root materialization attempt**;
+record the routing migration so it cannot reset again. Missing product slices,
+unresolved protocol choices, or a recorded root attempt remain under their normal
+gate/fingerprint rules.
+
 Past evidence being irretrievable is not by itself terminal. When an in-scope
 trusted diagnostic seam can make the next retained fingerprint uniquely
 actionable, Autocomplete must run diagnostic-amplification Plan repair and narrow

package/pack/generated/codex/skills/rite-build/SKILL.md

@@ -14,7 +14,9 @@ first**; if none, tell the user to run `$rite-spec <feature>`.
 
 The root owns gates/workspace; a
 fresh-context [`devrites-slice-wright`](.codex/agents/devrites-slice-wright.toml)
-writes source and tests. Apply the readiness, selection, host, HITL/AFK,
+writes product source and tests. Exact Vet-ready executable workflow artifacts use
+[`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md).
+Apply the readiness, selection, host, HITL/AFK,
 dispatch, doubt, fail-on-red, record, and stop checks. See
 [`reference/wright-dispatch.md`](reference/wright-dispatch.md).
 
@@ -61,7 +63,9 @@ reads named on-demand rules while writing; root reads them for doubt/record gate
   principle was broken**; a fresh violation is handled like any irreversible-risk item: a
   human-approved, scoped exception in the register or a stop, never folded into the slice. No
   `.devrites/principles.md` → none declared → nothing to honor.
-- **You never edit source.** You write only `.devrites/` bookkeeping. Follow the
+- **You never edit product source/tests.** You write `.devrites/` bookkeeping and,
+  only through `workflow-artifacts.md`, an exact Vet-ready executable workflow-artifact set.
+  Follow the
   host gate in `wright-dispatch.md` before every build or recovery dispatch. On a
   supported host, the wright is the only writer of code and tests. Codex gives
   the root workspace permission only so that native writer dispatch can execute;
@@ -69,6 +73,11 @@ reads named on-demand rules while writing; root reads them for doubt/record gate
   list directly in the task, dispatch the exact `devrites-slice-wright`, then
   compare `git diff --name-only` with those task paths. Any extra source file is
   a hard STOP.
+- **Executable workflow-artifact branch.** If every implementation target is an
+  exact admitted path under the active `.devrites/work/<slug>/`, the controlling
+  root materializes and proves that atomic set itself. It does not dispatch the wright,
+  decrement/count a product slice, update the candidate manifest, or execute the
+  consumptive action. After narrow Vet, restore the caller cursor.
 
 ## Workflow
 

package/pack/generated/codex/skills/rite-build/reference/phase-contract.md

@@ -8,16 +8,30 @@ See [`one-slice-cycle.md`](one-slice-cycle.md); candidate lifecycle is
    `Readiness inputs SHA-256`, all applicable exact reviewer accounts,
    ID-and-meaning traceability, and green proof preflight; run
    `devrites-engine check readiness <slug>`. Any miss/nonzero stops.
-2. **Select one slice.** Restate goal, acceptance criteria, exclusions, and exact
+2. **Select one target.** Restate goal, acceptance criteria, exclusions, and exact
    source/test paths. Before dispatch, validate relevant `assumptions.md` rows
    against live evidence. If one is disproved and changes acceptance, architecture,
    scope, or proof, use the Spec Drift Guard/plan recovery; a human-owned unknown
    stops. Resolve HITL before source work. AFK answers only permitted gates;
    human-owned or irreversible risk persists a question and stops for `$rite-resolve`.
-3. **Dispatch the sole writer.** Apply [`wright-dispatch.md`](wright-dispatch.md).
+   If the target is only an exact Vet-ready executable workflow-artifact set under
+   the active feature workspace, apply
+   [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md)
+   instead of treating it as a product slice.
+3. **Dispatch or materialize.** Product source/tests apply [`wright-dispatch.md`](wright-dispatch.md).
    Put the smallest exact project-relative source/test path list directly in the task;
-   dispatch the exact `devrites-slice-wright` fresh. Root never writes, wright never
-   widens, and a missing profile stops.
+   dispatch the exact `devrites-slice-wright` fresh. Root never writes those product
+   paths, wright never widens, and a missing profile stops.
+   For the workflow-artifact branch, the controlling root writes only the admitted
+   `.devrites/work/<slug>/` paths, proves the complete atomic set, rechecks an
+   identical product candidate, records hashes/evidence, and runs narrow Vet. Do not
+   dispatch any agent as a substitute writer and do not charge a product slice.
+
+### Executable workflow-artifact branch
+
+The controlling root materializes the exact admitted workflow-artifact set and
+**does not dispatch the wright**. This branch never changes product slice state or
+the candidate manifest; it returns through narrow Vet before any consumptive action.
 4. **Inspect the return.** Wait; compare its file list and `git diff --name-only`
    with the contract. Reject stale, partial, malformed, or out-of-scope work.
    Preserve user work; source restoration uses the same bounded wright.

package/pack/generated/codex/skills/rite-build/reference/wright-dispatch.md

@@ -15,6 +15,10 @@ the wright or recreate an engine bridge.
 
 1. Derive the smallest exact project-relative source/test path list; reject
    directories/globs, traversal, symlink escapes, duplicates, and `.devrites/**`.
+   A target composed only of vetted executable workflow artifacts routes to the
+   controlling root under
+   [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
+   its rejection here is not a blocker.
 2. Put it in the task with goal, verbatim acceptance, exclusions, context,
    `test-plan.md` proof commands, and applicable standards.
    A new path requires a new bounded contract; the wright cannot widen the task.

package/pack/generated/codex/skills/rite-plan/SKILL.md

@@ -85,6 +85,12 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
    require the drafter to apply `one-shot-actions.md` and return the bounded
    diagnostic-amplification design, injective boundary map, per-seam fixtures, and
    collision mutant. Past evidence loss alone is not a terminal conclusion.
+   The drafter never supplies implementation bodies. Bind the exact active
+   `.devrites/work/<slug>/` targets and complete executable contract; after Vet
+   READY, the controlling root materializes the exact vetted workflow-artifact paths
+   under
+   [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
+   without dispatching the product wright.
 3. Reason about dependencies: [dependency-graph](reference/dependency-graph.md).
    Reconcile `plan.md`'s canonical `Shared contract proof`: changed provider/consumer
    boundaries keep one reused contract artifact ahead of both asserting tests, and unaffected

package/pack/generated/codex/skills/rite-prove/SKILL.md

@@ -40,6 +40,8 @@ Pull these via `Read` when relevant:
 - `definition-of-done.md`: acceptance, proof, gates, scope, rollback/docs.
 - `one-shot-actions.md`: pre-attempt evidence completeness and no-rerun handling for
   consumptive proof actions.
+- `workflow-artifacts.md`: exact root-owned executable proof/controller/harness
+  artifacts under the active feature workspace.
 
 
 ## Operating rules
@@ -57,8 +59,11 @@ Pull these via `Read` when relevant:
   [`agents.md`](../devrites-lib/reference/standards/agents.md). The root owns exact
   vetted gate execution, browser capability, the evidence verdict, and canonical
   writes. The proof runner is read-only and validates immutable logs/artifacts.
-  Every accepted source/test correction is one bounded
+  Every accepted product source/test correction is one bounded
   `devrites-slice-wright` task, never an inline edit.
+  Exact Vet-ready executable workflow artifacts under the active `.devrites/**`
+  workspace follow `workflow-artifacts.md` and are materialized by the controlling
+  root; they are not product writer work.
 - **Prove remains the controlling caller during technical backtracking.** Save
   its return cursor, invoke Plan/Vet or bounded remediation inline, consume each
   nested phase boundary, then resume the failed Prove step. Never make the human

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "4.0.8",
+  "version": "4.0.10",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",

package/scripts/codex-generate.sh

@@ -95,7 +95,7 @@ This project has DevRites installed for both Claude Code and Codex.
 - Custom Codex subagents generated from the DevRites review agents live in `.codex/agents`.
 - In DevRites guidance, **invoke** means run a skill inline in the current context; **dispatch** means start a fresh agent with `spawn_agent`, wait for it, and reconcile its result.
 - Dispatch every exact named `devrites-<role>` required by the active workflow in a fresh subagent thread, wait for it, and reconcile its result. If that role is unavailable, stop for HITL; never skip it, never substitute a generic/default child, and never execute the specialist role in the root context.
-- The root uses the workspace-capable `devrites-orchestrator` profile because Codex children cannot elevate above the parent permission ceiling. This permission is for native writer dispatch and workflow artifacts; the root must never edit source or tests itself.
+- The root uses the workspace-capable `devrites-orchestrator` profile because Codex children cannot elevate above the parent permission ceiling. This permission is for native writer dispatch and exact path-bounded executable workflow artifacts under the active `.devrites/work/<slug>/`; the root must never edit product source or tests itself.
 - Every generated specialist is hook-free. `devrites-slice-wright` alone uses `default_permissions = ":workspace"`; every other specialist uses `default_permissions = ":read-only"`. Exact paths are instruction-enforced: put the project-relative paths in the task, wait for the wright, compare its file list and `git diff --name-only` with that contract, and reject any extra path. Never bypass the wright, widen its contract, or edit source in the root; the root must never recreate an engine dispatch bridge.
 - A seal GO, AFK mode, or autocomplete flag never authorizes an irreversible action. Disclose the exact commit/push/tag/PR plan and obtain fresh explicit user approval for that attempt; any changed or retried plan needs fresh approval. Native host permission and sandbox prompts remain authoritative and cannot be inferred or bypassed.