devrites 5.13.1 → 5.14.0

package/bin/devrites.mjs

@@ -62,7 +62,7 @@ Common flags:
   --dry-run             Show the plan, change nothing
   --force               Overwrite existing non-DevRites files
   --no-codex            Skip Codex support files (.agents, .codex, AGENTS.md)
-  --no-omp              Skip OMP support files (.omp/skills, .omp/agents)
+  --no-omp              Skip OMP support files (.omp/skills, .omp/agents, .omp/commands)
   --no-pi               Skip pi support files (.pi/skills, .pi/agents, .pi/prompts)
   --no-devin            Skip Devin CLI support files (.devin/skills, .devin/agents)
   --short-aliases=all   Also install /define /build /prove /seal

package/docs/adr/0031-overhaul-agents-keep-every-tool.md

@@ -0,0 +1,52 @@
+# ADR-0031: `/overhaul` ships its own agents that keep every tool
+
+- **Status:** Accepted
+- **Date:** 2026-09-25
+
+## Context
+
+The explicit-only `/overhaul` skill dispatched its eight roles (recon, frontend
+engineer, backend engineer, boundary, craft, specialist, implementer, verifier) as
+generic subagents told to read `skills/overhaul/roles/<role>.md`. Registered agents
+give each role a named dispatch target on every host, carry the role contract as the
+agent's own instructions, and let a host pick a model per role.
+
+The DevRites lifecycle keeps one writer: ADR-0010, ADR-0015, ADR-0017, ADR-0018 and
+ADR-0019 make `devrites-slice-wright` the only writable specialist. Every `/overhaul`
+role also writes, because each one records a receipt and evidence in the run area,
+and the implementer edits approved target paths. `/overhaul` has its own approval
+gate, path contracts, snapshot fingerprints and admission tool
+(`devrites-engine overhaul`), independent of the lifecycle.
+
+## Decision
+
+- The pack ships `pack/.claude/agents/overhaul-{recon,frontend-engineer,
+  backend-engineer,boundary,craft,specialist,implementer,verifier}.md`. They are
+  dispatched only by `/overhaul`, and their composition line names `/overhaul` as the
+  caller.
+- These agents keep every tool: no `tools:` allowlist and no `permissionMode:`
+  override, so Claude Code applies the user's own permission mode. Codex gives them
+  `default_permissions = ":workspace"`; omp, pi and Devin give them the full write
+  tool set. Host permission prompts stay authoritative and are never bypassed.
+- Read-only behavior for reviewer roles stays an instruction in the agent body. The
+  coordinator detects writes by comparing snapshot fingerprints around every wave and
+  admits patches only when the observed changed paths equal the approved contract.
+- The role files are removed; each agent file is the single source of its role.
+- `validate-agent-composition.py` accepts `overhaul-*` agents as write-capable when
+  they state their mode. The lifecycle's one-writer rule is unchanged for every
+  `devrites-*` agent.
+
+## Consequences
+
+- The ADR-0010/0015/0017/0018/0019 writer clauses now read "one writer among
+  `devrites-*` specialists"; they do not govern `/overhaul`.
+- Eight more agents are installed, updated and removed with the pack. The installer
+  keeps an existing unmanaged `.claude/agents/overhaul-*.md`, and `/overhaul` stops
+  with `BLOCKED_ENVIRONMENT` when a required agent is missing (for example with
+  `--no-agents`).
+- Instruction-level read-only modes give weaker isolation than host allowlists. The
+  user chose full tool access; fingerprints and path-contract admission remain the
+  enforcement.
+
+Verified by `scripts/validate-agent-composition.py`, `tests/codex-agent-generation-test.sh`
+and the host generators' `overhaul-*` branches.

package/docs/adr/0032-single-lint-gate-and-cached-pr-tests.md

@@ -0,0 +1,60 @@
+# ADR-0032: One engine lint gate, and PR tests that reuse main's results
+
+- **Status:** Accepted
+- **Date:** 2026-09-25
+
+## Context
+
+ADR-0006 wired `staticcheck` and `govulncheck` into CI. Since then `gosec` and
+`golangci-lint` were added the same way, as separate `go install` builds and
+separate passes. Each pass loaded and type-checked the engine again. After a
+Go toolchain or analyzer bump, the engine job compiled all four tools from
+source (85s) before it analyzed anything.
+
+The Go cache setup also cost time without helping much:
+
+- Every run saved a new ~600 MB snapshot, including PR runs.
+- `setup-go`'s built-in cache froze its first snapshot until `go.mod` changed.
+- The shell shards restored a linux/arm64 key that no job saved, so every
+  shard compiled the engine from nothing.
+- `-count=1` on every platform ran every package on every PR, even when the
+  change touched none of them.
+
+## Decision
+
+- **One lint run.** `engine/.golangci.yml` enables gofmt, govet, staticcheck
+  (standalone default checks), gosec (same per-call `#nosec` policy, source
+  files only), errcheck, and ineffassign. CI runs it through
+  `golangci-lint-action` (a prebuilt binary). `make lint` runs the same config.
+  govulncheck stays a separate step because it is a database lookup, not a
+  linter.
+- **One engine test matrix.** `engine-test` runs the suite on linux amd64,
+  linux arm64, macOS (all `-race`), and Windows. Linux amd64 also runs a
+  shuffled, uncached pass to catch order dependence on every PR.
+- **Pushes to main run every test.** On main, `go clean -testcache` runs
+  first, so every test executes. The results are saved with the cache.
+- **PRs reuse main's results.** A PR runs `go test` without `-count=1`. The go
+  command re-runs any package whose code, dependencies, testdata, or read env
+  vars changed.
+- **Only main saves caches.** Each OS/arch/job gets its own key, suffixed with
+  the run ID. Before saving, entries the run did not touch are trimmed. PRs
+  restore the newest main snapshot.
+
+## Alternatives considered
+
+| Option | Why not |
+|--------|---------|
+| Keep four standalone analyzers | Four builds and four package loads for the same findings. |
+| `-count=1` on PRs too | Re-runs packages the PR cannot affect. Windows alone spent ~70s. |
+| Cache test results on PRs, skip them on main | Main would never run the full suite. |
+| Save caches from PRs as well | Pays the upload on every push. Lets a PR seed the cache main builds from. |
+
+## Consequences
+
+- Warm engine jobs skip analyzer builds entirely. Unchanged engine packages
+  cost nothing on PRs.
+- The go command does not track external programs a test runs (for example
+  `git`) as cache inputs. On PRs, a result that depends only on such a program
+  can come from the cache. Main still runs everything.
+- `tests/validation-governance-test.sh` keeps `make quality` and CI pinned to
+  the same golangci-lint and govulncheck versions.

package/docs/adr/README.md

@@ -51,7 +51,7 @@ architecture; per-feature `decisions.md` files stay scoped to that feature.
 | [0003](0003-gate-model-hitl-pause.md) | Gates block as HITL pause, never crash | Accepted | `engine/tests/adr_0003_gate_exit_code_test.go` |
 | [0004](0004-state-schema-phases-sections.md) | Phase-relative section completeness | Accepted | `engine/tests/adr_0004_required_by_phase_test.go`, `engine/internal/state/state_test.go` |
 | [0005](0005-hooks-as-engine-subcommands.md) | Hooks are engine subcommands, not shell scripts | Accepted; active hook clause superseded by 0018 | historical |
-| [0006](0006-clock-seam-and-engine-ci-gates.md) | Clock seam + Go static-analysis CI gates | Accepted in part; next-qid seam/guard superseded by 0024, CI clauses retained | historical |
+| [0006](0006-clock-seam-and-engine-ci-gates.md) | Clock seam + Go static-analysis CI gates | Accepted in part; next-qid seam/guard superseded by 0024, CI analyzer wiring superseded by 0032 | historical |
 | [0007](0007-canonical-live-workspace-filenames.md) | Canonical live workspace filenames | Accepted; unsupported alias/migration clauses superseded by 0022 | `engine/internal/state/state_test.go`, `engine/internal/lib/cursor_compat_test.go` |
 | [0008](0008-sanctioned-engine-network-boundary.md) | Sanctioned engine network boundary | Accepted in part; engine network allowance superseded by 0024 | `engine/tests/meta_test.go` |
 | [0009](0009-prebuild-decision-coverage-and-readiness.md) | Pre-build decision coverage and implementation readiness | Accepted; semantic engine-gate implementation superseded by 0022 | historical |
@@ -75,3 +75,5 @@ architecture; per-feature `decisions.md` files stay scoped to that feature.
 | [0027](0027-content-bound-build-readiness.md) | Content-bound build readiness | Accepted; AC ID map amended 2026-09-04 | `engine/tests/adr_0027_readiness_binding_test.go`, `engine/internal/state/acceptance_test.go` |
 | [0028](0028-self-contained-engine-update.md) | Self-contained engine update | Accepted | `engine/internal/install/install_test.go`, `engine/internal/release/release_test.go`, `engine/tests/meta_test.go` |
 | [0029](0029-v5-workspace-schema-and-native-migration.md) | v5 workspace schema and native migration | Accepted | `engine/internal/state/workspaceschema_test.go`, `engine/tests/parity_resolve_test.go`, `engine/tests/parity_closeout_test.go` |
+| [0031](0031-overhaul-agents-keep-every-tool.md) | `/overhaul` ships its own agents that keep every tool | Accepted; scopes the one-writer clauses of 0010/0015/0017/0018/0019 to `devrites-*` specialists | `scripts/validate-agent-composition.py`, `tests/codex-agent-generation-test.sh` |
+| [0032](0032-single-lint-gate-and-cached-pr-tests.md) | One engine lint gate, and PR tests that reuse main's results | Accepted | `tests/validation-governance-test.sh` |

package/docs/architecture.md

@@ -412,7 +412,8 @@ contract.
 - **Design**: `devrites-frontend-craft` + a four-phase `/rite-polish` orchestrator (code + backend always; UI normalize + polish when UI is in scope).
 - **Agents**: 17 fresh-context roles at flat depth one: 16 read-only leaves and
   one wright. Dispatch uses the exact named project role; if it cannot spawn,
-  the workflow stops for HITL.
+  the workflow stops for HITL. `/overhaul` adds eight `overhaul-*` agents
+  that only it dispatches and that keep every tool (ADR-0031).
 - **Review**: **feature-scoped** multi-axis review with severity labels and
   fresh-context agents at the seal.
 - **Scope**: clarify → seal (decide) → ship (read-only preflight → type-GO →

package/docs/command-map.md

@@ -122,7 +122,7 @@ See [`cli.md`](cli.md).
 | [`/rite-watch-pr`](../pack/.claude/skills/rite-watch-pr/SKILL.md) | utility | `[PR number\|PR URL\|blank for current branch]` | Observe one GitHub PR/CI/review snapshot, classify one next action, and stop. Safe for capability-admitted native schedules/events; never mutates code, Git, checks, threads, or PR state. | PR/check/review metadata + bounded failed-log excerpts | none |
 | [`/rite-pressure-test`](../pack/.claude/skills/rite-pressure-test/SKILL.md) | utility | `[idea]` | Pressure-test a rough idea: 3 to 5 genuinely different options → converge on one with trade-off + hinge. | spec / surrounding code | `decisions.md` (optional) |
 | [`/rite-doctor`](../pack/.claude/skills/rite-doctor/SKILL.md) | diagnostic | none | Diagnose the DevRites binary, pack, schema, and native host permission/profile configuration. | install + host config | none |
-| [`/overhaul`](../pack/.claude/skills/overhaul/SKILL.md) | standalone | `[full \| pr <n\|url> \| branch <head> --base <base> \| audit <scope> \| apply <run-id> --plan <rev> \| status <run-id> \| resume <run-id>]` | Explicit-only, outside the lifecycle. Concurrent frontend and backend engineering review plus boundary, craft and specialist roles (skill-local role files dispatched as fresh contexts); one verified plan; stops for the user's approval of the exact plan revision; then test-first repairs, independent verification, measurement and evidence-backed scoring, cycling inside the approved envelope. `audit` never repairs. Never commits, pushes, stashes or touches the index. | target repository (read-only until approval) | run area outside the repository (JSON records, HTML/Markdown views, evidence); approved target paths only after approval |
+| [`/overhaul`](../pack/.claude/skills/overhaul/SKILL.md) | standalone | `[full \| pr <n\|url> \| branch <head> --base <base> \| audit <scope> \| apply <run-id> --plan <rev> \| status <run-id> \| resume <run-id>] [--isolate]` | Explicit-only, outside the lifecycle. Concurrent frontend and backend engineering review plus boundary, craft and specialist roles (its own `overhaul-*` agents, which keep every tool); one verified plan; stops for the user's approval of the exact plan revision; then test-first repairs, independent verification, measurement and evidence-backed scoring, cycling inside the approved envelope. `audit` never repairs. Never commits, pushes, stashes or touches the index. | target repository (read-only until approval) | git-ignored run area `.devrites/overhaul/<run-id>/` (JSON records, HTML/Markdown views opened in the browser at each stop, evidence); approved target paths only after approval |
 
 `/rite use <slug>` and `/rite guide` are inline router operations owned by
 `/rite`, not separate skills. There is no `/rite-use` or `/rite-guide` shortcut.

package/docs/engine/commands.md

@@ -145,7 +145,7 @@ network. The skill documents the record schemas and when to call each tool.
 
 | Tool | Forms | Exit codes |
 | --- | --- | --- |
-| `records` | `digest <file>`, `stage <run>`, `publish <run>`, `validate <run>` | 0 ok; 1 violations (listed as `VIOLATION:` lines); 2 usage or I/O |
+| `records` | `init <repo> <run-id>`, `digest <file>`, `stage <run>`, `publish <run>`, `validate <run>` | 0 ok; 1 violations (listed as `VIOLATION:` lines); 2 usage or I/O |
 | `admit` | `receipt <run> <receipt.json> [--observed <file>]`, `anchor <tree> <proposals.json>` | 0 admissible; 1 rejected; 2 usage or I/O; 3 duplicate or late receipt |
 | `snapshot` | `capture <repo> <out>`, `fingerprint <repo>`, `verify <repo> <out> [--agent-paths <file>]`, `state <repo> <out.json>`, `delta <before.json> <repo>` | 0 ok; 1 index changed or changes outside agent paths; 2 refusal, usage or I/O |
 | `score` | `--rubric <r> --results <s> --gates <g> [--out <file>]`, `compare --rubric <r> --baseline <a> --candidate <b>` | 0 computed; 2 invalid input (nothing counts as scored) |
@@ -156,6 +156,16 @@ network. The skill documents the record schemas and when to call each tool.
 `diff.autoRefreshIndex=false` and no external diff drivers, so `.git/index`
 stays byte-identical. Secret-pattern files and files holding private key material
 are hashed only: never copied into the snapshot tree and never included in its patches.
+Clean tracked files are hashed but not copied, because git already holds them;
+only dirty and untracked files are copied. A snapshot may live outside the
+repository or inside its `.devrites/overhaul/` run area, which every snapshot
+command leaves out of the repository state. `records init` creates
+`<repo>/.devrites/overhaul/<run-id>/` (mode 0700) and, when git does not already
+ignore it, adds `/.devrites/overhaul/` to the local `.git/info/exclude`, never to
+the shared `.gitignore`.
+`admit receipt` checks the attempt in the open staged generation (`g<N>.tmp` whose
+`.base` is `CURRENT`) when one exists, otherwise in `CURRENT`, so a phase can record
+many dispatches and admissions before one publish.
 
 ## Output and exit contracts
 

package/docs/orchestration.md

@@ -49,7 +49,9 @@ Claude project settings use `permissions.defaultMode: plan`; its slice-wright
 profile uses `permissionMode: acceptEdits`. Codex uses a workspace-capable root
 because children cannot elevate above the parent permission ceiling. Its exact
 slice-wright uses `default_permissions = ":workspace"` and the other 16
-specialists use `default_permissions = ":read-only"`.
+specialists use `default_permissions = ":read-only"`. The eight `overhaul-*` agents of the
+explicit `/overhaul` skill sit outside this split: Claude gives them every tool and
+Codex gives them `:workspace` ([ADR-0031](adr/0031-overhaul-agents-keep-every-tool.md)).
 
 If the exact role is unavailable, the root stops instead of substituting a
 generic agent or doing specialist/writer work inline.

package/docs/skills.md

@@ -246,7 +246,7 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 
 | Skill | What It Does | Use When |
 |---|---|---|
-| [`overhaul`](../pack/.claude/skills/overhaul/SKILL.md) | Audits a whole project, a PR or a branch comparison with separate frontend and backend engineering reviewers running concurrently, plus boundary, craft and specialist roles; reconciles verified findings into one plan and stops for the user's explicit approval of that exact plan revision. After approval it repairs test-first, verifies independently, measures, and keeps cycling inside the approved plan until the evidence-backed scores (global and per-lane 9.7, domains 9.0) and every hard gate pass or an honest blocker remains. It lives outside the DevRites lifecycle: no `.devrites/` workspace and no `/rite-*` phase; its records, admission, snapshot, scoring, benchmark and view tools are `devrites-engine overhaul` commands. Completion evidence is a run area outside the repository with canonical JSON records, a local HTML review and report, and a reviewable local patch; it never commits. | Explicit-only: `/overhaul`, `/overhaul full`, `/overhaul pr <n>`, `/overhaul branch <head> --base <base>`, `/overhaul audit …` (assessment only). |
+| [`overhaul`](../pack/.claude/skills/overhaul/SKILL.md) | Audits a whole project, a PR or a branch comparison with separate frontend and backend engineering reviewers running concurrently, plus boundary, craft and specialist roles; reconciles verified findings into one plan and stops for the user's explicit approval of that exact plan revision. After approval it repairs test-first, verifies independently, measures, and keeps cycling inside the approved plan until the evidence-backed scores (global and per-lane 9.7, domains 9.0) and every hard gate pass or an honest blocker remains. It lives outside the DevRites lifecycle: no `.devrites/` workspace and no `/rite-*` phase; its records, admission, snapshot, scoring, benchmark and view tools are `devrites-engine overhaul` commands. Completion evidence is a git-ignored run area, `.devrites/overhaul/<run-id>/`, with canonical JSON records, a local HTML review and report that open in the browser at each stop, and a reviewable local patch; it never commits. Target code runs in place by default; `--isolate` runs it only in a sandboxed copy. | Explicit-only: `/overhaul`, `/overhaul full`, `/overhaul pr <n>`, `/overhaul branch <head> --base <base>`, `/overhaul audit …` (assessment only). |
 
 ### Foundation: engineering rules
 
@@ -259,7 +259,10 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 ## Fresh-context agents
 
 DevRites ships 17 role profiles at depth one. Both hosts have 16 read-only
-leaves and one source/test writer role. Four read-only work roles handle
+leaves and one source/test writer role. The explicit `/overhaul` skill ships eight
+more agents, `overhaul-*`, that only it dispatches and that keep every tool
+([ADR-0031](adr/0031-overhaul-agents-keep-every-tool.md)); the counts here cover the
+lifecycle roles. Four read-only work roles handle
 bounded evidence, planning, proof, and compatibility while the root keeps
 authority:
 

package/engine/.golangci.yml

@@ -1,16 +1,54 @@
-# golangci-lint v2 — curated complement to the existing strict gates
-# (staticcheck, govulncheck, gosec). Enables only checkers that add findings
-# staticcheck does not produce; see the engine job in ci.yml and `make lint`.
+# golangci-lint v2: the engine's single static-analysis gate. One run loads
+# and type-checks the packages once and shares that work across every linter,
+# instead of separate gofmt/go vet/staticcheck/gosec passes. CI (engine job) and
+# `make lint` both run this file. govulncheck stays separate: it is a
+# vulnerability database lookup, not a linter.
 version: "2"
 
+run:
+  # Never rewrite go.mod/go.sum during analysis.
+  modules-download-mode: readonly
+
 linters:
   default: none
   enable:
+    # go vet analyzers (the default vet set).
+    - govet
+    # staticcheck (gosimple and stylecheck are merged into it in v2).
+    - staticcheck
+    # Security analysis. No rule-class exclusions: every G204/G304/G702/G703
+    # site carries a per-call `// #nosec GXXX -- <justification>` instead, so a
+    # genuinely new injection or traversal sink fails the gate.
+    - gosec
     # Unchecked error returns: staticcheck does not flag ignored errors.
     - errcheck
     # Assignments never read: distinct from staticcheck's unused analysis.
     - ineffassign
   settings:
+    staticcheck:
+      # Standalone staticcheck's default set. Quickfix (QF) suggestions are
+      # editor refactors, not defects, so they stay out of the gate.
+      checks:
+        - all
+        - -ST1000
+        - -ST1003
+        - -ST1016
+        - -ST1020
+        - -ST1021
+        - -ST1022
+        - -ST1023
+        - -QF*
+    gosec:
+      # G602 (slice bounds) misfires on length-guarded indexes under
+      # golangci-lint's shared SSA build, and Go bounds-checks at runtime.
+      excludes:
+        - G602
+      # Permission expectations for what the engine writes: 0644 files,
+      # 0755 dirs and binaries.
+      config:
+        G301: "0755"
+        G302: "0755"
+        G306: "0644"
     errcheck:
       # The engine's CLI boundary reports via exit paths, not error returns;
       # writes to the operator's stdout/stderr streams fail only on closed
@@ -22,6 +60,20 @@ linters:
         - (*bytes.Buffer).WriteByte
         - (*strings.Builder).WriteByte
         - (*strings.Builder).WriteString
+  exclusions:
+    rules:
+      # Tests read fixtures and spawn the engine by design; gosec gates
+      # shipped code only (standalone gosec's default).
+      - path: _test\.go
+        linters: [gosec]
+
+issues:
+  # Report every finding; the defaults (50 per linter, 3 identical) can hide
+  # real issues behind a truncated list.
+  max-issues-per-linter: 0
+  max-same-issues: 0
 
+# Formatting is part of the same run: an unformatted file fails the gate.
 formatters:
-  default: none
+  enable:
+    - gofmt

package/engine/AGENTS.md

@@ -17,8 +17,8 @@ completeness.
   coverage quality. They may require that a canonical `AC-###` ID declared in
   `spec.md` also appears as a literal substring in `tasks.md` and
   `test-plan.md` when those artifacts are required.
-- Local full gate: `make quality` (`gofmt`, `go vet`, `staticcheck`,
-  `govulncheck`, `gosec`, `golangci-lint`, `osv-scanner`,
-  `go test -race -shuffle=on -count=1`).
+- Local full gate: `make quality` (`golangci-lint` with gofmt, go vet,
+  staticcheck, gosec, errcheck, ineffassign; then `govulncheck`,
+  `osv-scanner`, `go test -race -shuffle=on -count=1`).
 
 See [`../CONTEXT.md`](../CONTEXT.md) and [`../docs/adr/README.md`](../docs/adr/README.md).

package/engine/Makefile

@@ -1,28 +1,20 @@
 BINARY  := devrites
 DIST    := dist
-GOFILES := $(shell find . -name '*.go' -not -path './$(DIST)/*')
 # darwin/amd64 kept for Intel Macs; the five targets the release matrix ships.
 PLATFORMS := darwin/arm64 darwin/amd64 linux/amd64 linux/arm64 windows/amd64
 
-.PHONY: build fmt-check test test-race vet quality staticcheck govulncheck gosec lint cover crosscompile clean
+.PHONY: build test test-race vet quality govulncheck lint cover crosscompile clean
 
-STATICCHECK_VERSION := 2026.1
-GOVULNCHECK_VERSION := v1.6.0
-GOSEC_VERSION := v2.28.0
-GOLANGCI_VERSION := v2.13.2
-OSV_SCANNER_VERSION := v2.5.1
-STATICCHECK := go run honnef.co/go/tools/cmd/staticcheck@$(STATICCHECK_VERSION)
+GOVULNCHECK_VERSION := v1.8.0
+GOLANGCI_VERSION := v2.14.0
+OSV_SCANNER_VERSION := v2.6.0
 GOVULNCHECK := go run golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION)
-GOSEC := go run github.com/securego/gosec/v2/cmd/gosec@$(GOSEC_VERSION)
 GOLANGCI := go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_VERSION)
 OSV_SCANNER := go run github.com/google/osv-scanner/v2/cmd/osv-scanner@$(OSV_SCANNER_VERSION)
 
 build:
 	CGO_ENABLED=0 go build -o $(BINARY) .
 
-fmt-check:
-	@test -z "$$(gofmt -l $(GOFILES))" || (echo "gofmt required:"; gofmt -l $(GOFILES); exit 1)
-
 test:
 	go test -shuffle=on ./...
 
@@ -35,21 +27,13 @@ vet:
 
 # quality is the full local gate. Mirror it in CI so a green `make quality`
 # means a green pipeline (the date-sensitive parity golden aside; see ADR-0006).
-quality: fmt-check vet staticcheck govulncheck gosec lint osv test-race
-
-staticcheck:
-	$(STATICCHECK) ./...
+quality: lint govulncheck osv test-race
 
 govulncheck:
 	$(GOVULNCHECK) ./...
 
-# No rule-class exclusions: G204/G304/G702/G703 sites carry per-call
-# `// #nosec GXXX -- <justification>` annotations in the source, so a genuinely
-# new injection or traversal sink fails this target.
-gosec:
-	$(GOSEC) -conf .gosec.json ./...
-
-# Curated complement to staticcheck (errcheck + ineffassign; .golangci.yml).
+# gofmt, go vet, staticcheck, gosec, errcheck and ineffassign in one run
+# (.golangci.yml).
 lint:
 	$(GOLANGCI) run ./...
 

package/engine/go.mod

@@ -2,4 +2,4 @@ module github.com/devrites/devrites
 
 go 1.26
 
-toolchain go1.26.7
+toolchain go1.27.1

package/engine/internal/devritespaths/paths.go

@@ -21,6 +21,7 @@ const (
 	ClaudeAgentsTarget    = ".claude/agents"
 	CodexAgentsTarget     = ".codex/agents"
 	OmpAgentsTarget       = ".omp/agents"
+	OmpCommandsTarget     = ".omp/commands"
 	PiAgentsTarget        = ".pi/agents"
 	DevinAgentsTarget     = ".devin/agents"
 	PiPromptsTarget       = ".pi/prompts"
@@ -64,6 +65,7 @@ func WorkspaceOverrideChecked(root, slug string) (string, error) {
 		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: resolve DevRites root %q: %w", root, err)
 	}
 	sameRoot := path == resolvedRoot
+	// #nosec G703 -- read-only Stat of a path resolved and proven inside root above
 	if pathInfo, pathErr := os.Stat(path); pathErr == nil {
 		if rootInfo, rootErr := os.Stat(resolvedRoot); rootErr == nil {
 			sameRoot = os.SameFile(pathInfo, rootInfo)

package/engine/internal/hostpack/hostpack.go

@@ -22,6 +22,7 @@ const (
 	ClaudeAgentsTarget    = devritespaths.ClaudeAgentsTarget
 	CodexAgentsTarget     = devritespaths.CodexAgentsTarget
 	OmpAgentsTarget       = devritespaths.OmpAgentsTarget
+	OmpCommandsTarget     = devritespaths.OmpCommandsTarget
 	PiAgentsTarget        = devritespaths.PiAgentsTarget
 	DevinAgentsTarget     = devritespaths.DevinAgentsTarget
 	PiPromptsTarget       = devritespaths.PiPromptsTarget
@@ -181,6 +182,7 @@ func RequiredPayload(withCodex, withOmp, withPi, withDevin bool) []string {
 		required = append(required,
 			"omp/skills",
 			"omp/agents",
+			"omp/commands",
 			"omp/.omp-plugin/plugin.json",
 		)
 	}
@@ -219,7 +221,10 @@ func InstallTrees(withSkills, withAgents, withCodex, withOmp, withPi, withDevin
 			trees = append(trees, Tree{PayloadPrefix: "codex/skills", TargetPrefix: CodexSkillsTarget})
 		}
 		if withOmp {
-			trees = append(trees, Tree{PayloadPrefix: "omp/skills", TargetPrefix: OmpSkillsTarget})
+			trees = append(trees,
+				Tree{PayloadPrefix: "omp/skills", TargetPrefix: OmpSkillsTarget},
+				Tree{PayloadPrefix: "omp/commands", TargetPrefix: OmpCommandsTarget},
+			)
 		}
 		if withPi {
 			trees = append(trees,

package/engine/internal/hostpack/hostpack_test.go

@@ -20,6 +20,7 @@ func TestValidatePayloadRequiresClaudeAndCodexFiles(t *testing.T) {
 		"codex/config.toml":                            {},
 		"omp/skills/rite/SKILL.md":                     {},
 		"omp/agents/devrites-code-reviewer.md":         {},
+		"omp/commands/rite.md":                         {},
 		"omp/.omp-plugin/plugin.json":                  {},
 		"pi/skills/rite/SKILL.md":                      {},
 		"pi/agents/devrites-code-reviewer.md":          {},
@@ -66,6 +67,7 @@ func TestInstallTreesMapPayloadsToTargets(t *testing.T) {
 		{PayloadPrefix: "claude/skills", TargetPrefix: ".claude/skills"},
 		{PayloadPrefix: "codex/skills", TargetPrefix: ".agents/skills"},
 		{PayloadPrefix: "omp/skills", TargetPrefix: ".omp/skills"},
+		{PayloadPrefix: "omp/commands", TargetPrefix: ".omp/commands"},
 		{PayloadPrefix: "pi/skills", TargetPrefix: ".pi/skills"},
 		{PayloadPrefix: "pi/prompts", TargetPrefix: ".pi/prompts"},
 		{PayloadPrefix: "devin/skills", TargetPrefix: ".devin/skills"},

package/engine/internal/install/install_test.go

@@ -1294,6 +1294,7 @@ extends = ":workspace"
 `)
 	testutil.WriteFile(t, filepath.Join(root, "omp", "skills", "rite", "SKILL.md"), "omp rite\n")
 	testutil.WriteFile(t, filepath.Join(root, "omp", "agents", "devrites-code-reviewer.md"), "omp agent\n")
+	testutil.WriteFile(t, filepath.Join(root, "omp", "commands", "rite.md"), "omp command\n")
 	testutil.WriteFile(t, filepath.Join(root, "omp", ".omp-plugin", "plugin.json"), "{}\n")
 	testutil.WriteFile(t, filepath.Join(root, "pi", "skills", "rite", "SKILL.md"), "pi rite\n")
 	testutil.WriteFile(t, filepath.Join(root, "pi", "agents", "devrites-code-reviewer.md"), "pi agent\n")

package/engine/internal/overhaul/admit/admit_test.go

@@ -101,6 +101,31 @@ func TestReceipt(t *testing.T) {
 	}
 }
 
+// A receipt is admitted against the open working generation (g<N+1>.tmp based on
+// CURRENT) when one exists, so dispatches need not be published one by one.
+func TestReceiptAgainstOpenStage(t *testing.T) {
+	dir := newRun(t)
+	stage := filepath.Join(dir, "g0002.tmp")
+	write(t, filepath.Join(stage, ".base"), "g0001")
+	write(t, filepath.Join(stage, "run.json"), J{"run_id": "run-1",
+		"revisions": J{"plan": J{"rev": 1, "file": "revisions/plan-r1.json"}}})
+	write(t, filepath.Join(stage, "dispatch.json"), J{"attempts": L{
+		J{"task_id": "R-2", "attempt_id": "A1", "role": "reviewer", "lane": "security", "snapshot": "s1", "status": "running"},
+	}})
+	rc := writerReceipt()
+	rc["task_id"], rc["role"], rc["lane"], rc["outcome"], rc["inspected"] = "R-2", "reviewer", "security", "no-findings", L{"src/a.py:1-9"}
+	delete(rc, "changed_paths")
+	p := write(t, filepath.Join(dir, "receipts/r2.json"), rc)
+	if code, out, errs := run("receipt", dir, p); code != 0 || !strings.Contains(out, "ADMISSIBLE") {
+		t.Fatalf("open stage: %d %s%s", code, out, errs)
+	}
+	// A stage based on an older generation is stale and never consulted.
+	write(t, filepath.Join(stage, ".base"), "g0000")
+	if code, out, _ := run("receipt", dir, p); code != 1 || !strings.Contains(out, "no such dispatched attempt") {
+		t.Fatalf("stale stage consulted: %d %s", code, out)
+	}
+}
+
 func TestReceiptIOError(t *testing.T) {
 	dir := newRun(t)
 	if code, _, errs := run("receipt", dir, filepath.Join(dir, "missing.json")); code != 2 || !strings.HasPrefix(errs, "ERROR: ") {

package/engine/internal/overhaul/admit/run.go

@@ -175,12 +175,24 @@ func sortedVals(s map[string]any) []any {
 	return out
 }
 
+// workingGeneration is the open staged generation when one exists and is based on
+// CURRENT (the coordinator records dispatches there during a phase), else CURRENT.
+func workingGeneration(run, cur string) string {
+	stages, _ := filepath.Glob(join(run, "g*.tmp"))
+	if len(stages) == 1 {
+		if base, err := os.ReadFile(join(stages[0], ".base")); err == nil && strings.TrimSpace(string(base)) == cur { // #nosec G304 -- stage marker inside the operator-selected run area
+			return stages[0]
+		}
+	}
+	return join(run, cur)
+}
+
 func receipt(run, path, observed string, hasObserved bool, stdout io.Writer) (int, error) {
 	cur, err := os.ReadFile(join(run, "CURRENT"))
 	if err != nil {
 		return 0, err
 	}
-	gen := join(run, strings.TrimSpace(string(cur)))
+	gen := workingGeneration(run, strings.TrimSpace(string(cur)))
 	rj, err := ovio.LoadObject(join(gen, "run.json"))
 	if err != nil {
 		return 0, err

package/engine/internal/overhaul/overhaul.go

@@ -19,6 +19,7 @@ import (
 // Usage is the command-family help text.
 const Usage = `usage: devrites-engine overhaul <tool> ...
 
+  overhaul records init <repo> <run-id>
   overhaul records digest <file>
   overhaul records stage <run>
   overhaul records publish <run>

package/engine/internal/overhaul/records/check.go

@@ -12,6 +12,7 @@ import (
 	"strings"
 
 	"github.com/devrites/devrites/internal/overhaul/ovio"
+	"github.com/devrites/devrites/internal/overhaul/snapshot"
 )
 
 func set(vals ...string) map[string]bool {
@@ -199,6 +200,9 @@ func BadPath(p any, repo string) string {
 			return "names a directory or git metadata"
 		}
 	}
+	if strings.HasPrefix(s, snapshot.RunAreaDir) {
+		return "names the overhaul run area"
+	}
 	if isDir(join(repo, s)) {
 		return "names a directory or git metadata"
 	}
@@ -820,6 +824,26 @@ func Check(run, genDir, prevDir string) ([]string, error) {
 			}
 		}
 	}
+	// Views are how the user reads a stop: every stop carries the report, and a
+	// pending approval carries the review page and the plan it approves.
+	if outcome := str(rj, "execution_outcome"); outcome != "" && outcome != "RUNNING" {
+		for _, v := range []string{"report.html", "report.md"} {
+			if !isFile(join(vdir, v)) {
+				add("views/%s is required once the run stops (execution_outcome %s)", v, outcome)
+			}
+		}
+	}
+	if str(rj, "phase") == "AWAITING_APPROVAL" {
+		need := []string{"review.html", "review.md"}
+		if hasPR {
+			need = append(need, "plan.md")
+		}
+		for _, v := range need {
+			if !isFile(join(vdir, v)) {
+				add("views/%s is required while awaiting approval", v)
+			}
+		}
+	}
 	return errs, nil
 }