devrites 5.4.0 → 5.5.0

package/pack/.claude/skills/devrites-lib/reference/workspace-artifact-schema.md

@@ -1,23 +1,19 @@
 # Workspace artifact schema
 
-Feature truth lives in `.devrites/work/<slug>/`; discovery requires `state.md`.
-`README.md` is an optional discovery map; the spec phase still writes it. Operational remnants and archive entries are not
-active workspaces. Current writers use canonical filenames. Both released cursor
-forms remain official; `/rite-upgrade` audits them in place and never performs
-path, alias, or format migration.
+Feature truth: `.devrites/work/<slug>/`, discovered by `state.md`; remnants/archives
+are inactive. Spec writes optional `README.md`. Use canonical filenames; both released
+cursor forms remain valid. `/rite-upgrade` audits without path/alias/format migration.
 
 ## Slug identity
 
-New workspaces use a meaningful objective-derived slug that is lowercase ASCII
-kebab-case, matches `[a-z0-9]+(?:-[a-z0-9]+)*`, and is at most 64 characters.
-Prefer shortening at a word boundary. After the final shortening or suffix step,
-trim boundary hyphens and reject an empty result.
+New slugs derive from the objective: lowercase ASCII kebab-case matching
+`[a-z0-9]+(?:-[a-z0-9]+)*`, at most 64 characters. Shorten at word boundaries.
+After the final shortening or suffix step, trim boundary hyphens; reject empty results.
 
-Before creating a directory, compare any matching workspace's `brief.md`
-objective. Reuse it only for the same feature. Otherwise append the smallest
-unused numeric suffix (`-2`, `-3`, ...), shortening and trimming the base again
-to stay within 64 characters. Never overwrite a workspace by slug alone.
-Readers continue to accept safe legacy basenames; no ordinary phase renames one.
+Before creation, compare a matching workspace's `brief.md` objective: reuse only the
+same feature. Otherwise append the smallest unused suffix (`-2`, `-3`, ...), keeping
+the trimmed base within 64 characters. Never overwrite a workspace by slug alone;
+accept safe legacy basenames. Ordinary phases never rename them.
 
 ## Required by phase
 
@@ -31,13 +27,13 @@ Readers continue to accept safe legacy basenames; no ordinary phase renames one.
 | vet/build/converge | plan artifacts plus `eng-review.md`, `test-plan.md`; Build creates and maintains `touched-files.md` after its first green slice |
 | prove/polish/review | vetted plan artifacts plus `evidence.md`, `touched-files.md` |
 | seal/ship/done | proof artifacts plus `review.md`, `seal.md`; Ship writes `ship.md` |
-| conditional | `flows.md` when diagrams clarify; `visual/` HTML+`.outline.md` companions when a richer reviewable visual earns it (optional; never readiness-required); `design-brief.md` and `browser-evidence.md` for UI; `drift.md` for drift; `polish-report.md` for polish; `handoff.md` only when requested; `references.md` + `references/` when references exist; `investigation-map.md` for pressure-test; `dogfood.md` for dogfood |
+| conditional | `flows.md` when diagrams clarify; `visual/` HTML+`.outline.md` companions when a richer reviewable visual earns it (optional; never readiness-required); `design-brief.md` and `browser-evidence.md` for UI; `drift.md` for drift; `polish-report.md` for polish; `handoff.md` only when requested; `references.md` + `references/` when references exist; `investigation-map.md` for pressure-test; `dogfood.md` for dogfood; `packets/` for by-reference dispatch packets and admitted accounts (≤ 64 KiB each; older closed rounds may be deleted; never transcripts); `history/` for verbatim relocated checkpoint narrative (append-only, never a read-next) |
 
 ## What each file owns
 
 | File | Job | Budget |
 | --- | --- | --- |
-| `README.md` | compact workspace map: phase, status, next action, artifact map, read-next table, blocking gates, last updated | 120 lines |
+| `README.md` | map: phase/status/next action, artifacts/read-next, blocking gates, last update | 120 lines |
 | `brief.md` | user request, objective, non-goals, success definition | 80 lines |
 | `spec.md` | product WHAT/WHY, requirements, acceptance criteria, edge cases, measurable success, scope boundaries | 260 lines |
 | `decision-coverage.md` | topology-first coverage matrix, assumption audit, residual uncertainty, and typed clarity verdict | 200 lines |
@@ -53,22 +49,23 @@ Readers continue to accept safe legacy basenames; no ordinary phase renames one.
 | `plan.md` | technical approach, slice strategy, canonical shared-contract proof, validation strategy, rollback | 220 lines |
 | `tasks.md` | `SLICE-###` vertical slices with AC IDs, likely files, tests/proof, mode/gate, dependencies, done condition | 280 lines |
 | `traceability.md` | matrix: AC/REQ ID, slice IDs, test/proof, evidence ID, touched files, status | 220 lines |
-| `eng-review.md` | vetted scope/architecture/quality/performance, failure modes, preflight, stable-input binding | 240 lines |
+| `eng-review.md` | vetted scope/architecture/quality/performance, failure modes, preflight, stable-input binding, `## Deferred findings` (late rows: severity · site · role · kind · round) for Review | 240 lines |
 | `test-plan.md` | executable proof commands, preflight/provenance contract, acceptance and interaction coverage | 260 lines |
 | `state.md` | compact cursor table/key-values; no narrative log | 120 lines |
 | `evidence.md` | `EVID-###` command/action, result, timestamp if available, related AC/slice IDs, limitation | 280 lines |
 | `browser-evidence.md` | UI route/viewports/screenshots/console/network/interactions and Visual Verdict | 220 lines |
 | `drift.md` | `DRIFT-###` spec/plan drift and resolution | 160 lines |
-| `touched-files.md` | sole candidate manifest plus a concern-ordered `## Review trail` of `path:line` stops for human review | 160 lines |
+| `touched-files.md` | sole candidate manifest plus a concern-ordered `## Review trail` of `path:line` stops for human review and Build's deferred late findings (severity · site · role · round) that `/rite-review` must close | 160 lines |
 | `design-brief.md` | UI design direction, states, interaction model | 160 lines |
-| `handoff.md` | cold-resume guide: objective, last slice, next action, blockers, read-next. Sections carry content or `Nothing yet`; unevidenced recollections go under `Not tried yet`, never as results | 120 lines |
+| `handoff.md` | resume objective/last slice/next action/blockers/read-next; sections hold content or `Nothing yet`; unevidenced recollections: `Not tried yet`, never results | 120 lines |
 | `polish-report.md` | polish axis deltas, re-verification lines, residual subjective preferences | 200 lines |
 | `ship.md` | ship preflight, disclosed Git plan, commit/push/tag/PR record | 120 lines |
+| `review.md` | reconciled Review verdict: `## Spec` and `## Code review` accounts, deferred-finding labels/actions, drift | 240 lines |
+| `seal.md` | seal preflight, exact reviewer roster accounts, GO/NO-GO verdict and disclosures | 200 lines |
+| `ai-spec.md` | model/RAG/agent/eval/LLM-output scope for AI surfaces | 160 lines |
 
-When emitting `visual/` HTML+outline pairs, open matching playbooks via
-[`visual-playbooks/index.md`](visual-playbooks/index.md) (progressive load; do not
-preload all seven). Required outline headings:
-[`visual-playbooks/outline-template.md`](visual-playbooks/outline-template.md).
+For visual pairs load only matching [playbooks](visual-playbooks/index.md); use
+the [required outline headings](visual-playbooks/outline-template.md).
 
 ## Candidate manifest and bindings
 
@@ -98,14 +95,19 @@ candidate scope; only manifest rows do.
 The public candidate limits are a 1 MiB manifest, 4,096 rows, a 4,096-byte
 path, 64 MiB per present file, and 256 MiB across all present files.
 
-Workspace and audit artifacts are not candidate paths. That includes every path
-under `.devrites/work/<slug>/visual/` (HTML, `.outline.md`, and optional
-`visual/README.md`). Durable project files include `.devrites/specs/**`,
-`DESIGN.md`, and `docs/adr/**`, plus the exact `.devrites/principles.md` owner.
-Under `.devrites`, only those principles and spec owners may be candidates;
-`ACTIVE`, `AFK`, `CHECKPOINT`, `archive/**`, `work/**`, and every other sibling
-fail closed. Engine owns malformed path, type, and size rejection; phases do
-not reinterpret a rejected manifest.
+A release milestone's union manifest is produced by `devrites-engine state
+merge-manifest <release-slug>` — it walks the recorded `sequence_parent` chain,
+folds every predecessor manifest, and resolves a path collision in favor of the
+later sequence position; a hand-assembled union is not authoritative. When the
+workspace cursor declares `sequence_role: release`, `check candidate` and
+`check seal` require the manifest to cover the whole recorded chain.
+
+Workspace and audit artifacts are not candidate paths, including all
+`.devrites/work/<slug>/visual/`. Durable owners include `.devrites/specs/**`,
+`DESIGN.md`, and `docs/adr/**`, plus `.devrites/principles.md`. Under `.devrites`,
+only those spec/principles owners qualify; all other siblings (`ACTIVE`, `AFK`,
+`CHECKPOINT`, `archive/**`, `work/**`) fail closed. Engine owns malformed path, type,
+and size rejection; phases never reinterpret a rejected manifest.
 
 `evidence.md`, `review.md`, and `seal.md` each contain exactly one unindented standalone
 binding line; `browser-evidence.md` does too when that file exists:
@@ -122,16 +124,46 @@ against a malicious concurrent same-size rewrite. Ship's exact Git-index scope,
 byte, binding, and secret checks own the final freeze immediately before commit.
 
 Only a structural `Budget override: <reason>` line (not a fenced example)
-permits excess. Phase writers check these limits before returning; there is no
+permits excess. Each line budget also bounds bytes at 400 bytes per budgeted line
+(`state.md` 120 lines → 48 KiB); long lines do not evade it.
+`devrites-engine orient <slug>` reports `artifact_budgets` (lines/bytes/over/override)
+and `bulk_files` (non-canonical files over 64 KiB) so a phase can decide what to read
+before loading. Phase writers check these limits before returning; there is no
 repository-local script assumption in the installed workflow.
 
+`check readiness` and `check seal` enforce the material band deterministically: a
+required artifact at or above 1.5× its line or byte budget with no structural override
+line blocks with the exact measurement and the three legal remedies (relocate history
+via `/rite-plan revise`, split via `/rite-plan course-correct`, or record the override).
+Overshoot below that band stays advisory and is reported by `orient`. Proof ledgers
+(`evidence.md`, `browser-evidence.md`, `touched-files.md`) are always advisory: they
+scale with proof volume, and `touched-files.md` keeps its own manifest limits.
+Because they are never gate-blocked they are also the only artifacts that can grow
+unboundedly — so phases read them by index, not whole-file: the standalone binding
+line, a `EVID-###`/section-header index (`grep -n`), then bodies only for entries
+naming this candidate's AC/slice IDs. An entry naming no in-scope ID is anomaly
+evidence to inspect, not skip. A whole-file read is allowed only when `orient`
+reports the artifact within budget; completeness for seal is engine-checked
+(literal `AC-###` presence), the reader judges quality.
+
+Two reasons are not durable fixes: slice or acceptance-criteria count (an over-budget
+`tasks.md`/`plan.md`/`traceability.md` from decomposition size is a
+[feature-sequence split](../../rite-plan/reference/slicing.md#feature-ceiling-split-an-epic-never-override-the-budget)),
+and history in `state.md` (checkpoint narrative moves verbatim to
+`history/<file>-<YYYYMMDD>.md`, append-only, never a phase read-next, with a one-line
+pointer left behind). A legacy workspace may carry a temporary `Budget override:` line
+as a bridge; `/rite-upgrade` routes it to relocation or the split, and new writers never
+create one for those two reasons.
+Apply [`context-hygiene.md` dispatch packets](standards/context-hygiene.md#dispatch-packets)
+for byte-size checks and lossless retrieval; budget overrides neither rewrite protected
+history nor require loading it all.
+
 ## Native readiness ownership
 
-`decision-coverage.md` records the topology scan; `test-plan.md` records executable proof;
-`eng-review.md` records exact reviewer verdicts, `Implementation readiness`, and the emitted
-`Readiness inputs SHA-256`. Root re-reads them and applies the ID-and-meaning checklist.
-The digest binds reviewed bytes; it never substitutes for semantic review. Normal readiness
-checks structure plus that binding, and Seal rechecks it.
+`decision-coverage.md` owns topology; `test-plan.md`, executable proof; `eng-review.md`,
+reviewer verdicts, `Implementation readiness`, and `Readiness inputs SHA-256`. Root
+re-reads their IDs/meaning. The digest binds bytes, never semantic correctness.
+Readiness checks structure/binding; Seal rechecks both.
 
 Proof commands must be repository-portable: no host wrappers, user-specific absolute paths,
 or temporary proof trees. Evidence records the executed command. Optional `visual/`
@@ -189,9 +221,9 @@ unless the stated reason makes the boundary irreducible.
 | temper | `spec.md`, `decision-coverage.md`, `decisions.md`, `assumptions.md`, `design-brief.md` |
 | define | `README.md`, `state.md`, `spec.md`, `decision-coverage.md`, `architecture.md`, `decisions.md`, `assumptions.md` |
 | vet | `state.md`, `spec.md`, `decision-coverage.md`, `README.md`, `traceability.md`, `plan.md`, `tasks.md`, `architecture.md`, `decisions.md` |
-| build | `state.md`, `decision-coverage.md`, `eng-review.md`, `test-plan.md`, `tasks.md`, `plan.md`, `architecture.md`, `traceability.md`, `questions.md`, and `touched-files.md` when present |
-| prove | `traceability.md`, `tasks.md`, `evidence.md`, `browser-evidence.md`, `touched-files.md` |
-| review/seal | `README.md`, `traceability.md`, `spec.md`, `evidence.md`, `decisions.md`, `drift.md`, `touched-files.md` |
+| build | `devrites-engine orient <slug>` first; then `state.md`, `eng-review.md` (Build readback + `## Deferred findings`), the selected slice and its `depends_on` via `devrites-engine observe slice <slug> <SLICE-ID>`, the `test-plan.md` and `traceability.md` rows that slice's AC IDs name, open `questions.md` gates, and `touched-files.md` when present. Load whole `tasks.md`/`plan.md`/`architecture.md`/`decision-coverage.md` only when `orient` shows them within budget or the slice cites a section by ID |
+| prove | `traceability.md`, `touched-files.md`; each built slice's `Tests/proof` and `Evidence required` via `observe slice`; `evidence.md`/`browser-evidence.md` via the bounded advisory read above |
+| review/seal | `README.md`, `traceability.md`, `spec.md`, `decisions.md`, `drift.md`, `touched-files.md`; `evidence.md`/`browser-evidence.md` via the bounded advisory read above |
 | handoff | `README.md`, `state.md`, `handoff.md`, then the linked source artifacts |
 
 ## Do not duplicate
@@ -199,7 +231,14 @@ unless the stated reason makes the boundary irreducible.
 - Do not make `spec.md` carry deep architecture; link to `architecture.md`/`flows.md`.
 - Do not copy acceptance criteria into `plan.md`; reference `AC-###`.
 - Do not copy full proof into `handoff.md`; link to `evidence.md`.
-- Do not make `state.md` an append-only log; keep only the current cursor.
+- Do not make `state.md` an append-only log; keep only the current cursor. A
+  checkpoint entry is at most three lines: what changed, the canonical record path or
+  DEC/EVID ID, and the next action. Digests, packet hashes, and finding narratives
+  belong to the record they identify, not the cursor.
+- Give each normative fact one owner and stable ID; reference rather than copy it.
+  Required schema mirrors remain required. Derive counts/mirrors or mechanically
+  check equality using available tools, never invented commands. Repair stale
+  derived values and assess consumer impact; they are not new policy decisions.
 - Do not create optional files before their phase; absence is meaningful. Do not
   treat `visual/` as required for readiness; emit HTML+outline only when a writer
   earns a richer visual, and keep Mermaid in `flows.md` when that is enough.

package/pack/.claude/skills/rite-autocomplete/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: rite-autocomplete
 description: Run the full DevRites lifecycle unattended; --ship continues to the final Git approval boundary. Use for one-shot autonomous work; not for a single phase.
-argument-hint: "[idea] [--ship|--yolo] [--max-slices N] [--full] [--cross-model]"
+argument-hint: "[idea] [--ship|--yolo] [--max-slices N] [--parallel N] [--full] [--cross-model]"
 user-invocable: true
 ---
 
@@ -53,9 +53,11 @@ executable controller/harness/bundle bytes or a missing writer, read
   malformed, and unavailable leaf calls. At the review cap, permit only work
   that reduces the queue.
 - Parse flags only from this invocation. `--ship`, `--yolo`, `--max-slices`,
-  `--full`, and `--cross-model` activate only as exact standalone tokens in
-  `$ARGUMENTS`; examples or earlier messages can never arm them. `--max-slices`
-  must occur once and be followed by a positive base-10 integer; missing, repeated, malformed, or conflicting values stop before any write.
+  `--parallel`, `--full`, and `--cross-model` activate only as exact standalone
+  tokens in `$ARGUMENTS`; examples or earlier messages can never arm them.
+  `--max-slices` must occur once and be followed by a positive base-10 integer;
+  `--parallel` must occur once and be followed by a base-10 integer in `1`–`10`.
+  Missing, repeated, malformed, or conflicting values stop before any write.
 - Temper always runs after Clarify. Unattended mode auto-applies only
   `hold-rigor` and `reduce-to-MVP`; any `expand` or added acceptance pauses.
 - Vet every plan. Cross-model is off unless the current invocation arms it.
@@ -75,7 +77,8 @@ executable controller/harness/bundle bytes or a missing writer, read
    from chat. After compaction or a resumed session, read `.devrites/ACTIVE`, then
    the `state.md` cursor, `questions.md`, `decisions.md`, and `test-plan.md`/`evidence.md`.
    Normalize current arguments to idea, `ship_preflight: yes|no`,
-   `max_slices: N|default`, `profile: standard|full`, and `cross_model: yes|no`.
+   `max_slices: N|default`, `parallel: N|default`, `profile: standard|full`,
+   and `cross_model: yes|no`.
    **Completion:** normalized state is unambiguous and no sentinel or workspace file has been written.
 2. **Specify and clarify.** Run `devrites-interview`, `/rite-spec`, and
    `/rite-clarify` as one window. Partial/Missing material coverage never arms
@@ -87,9 +90,13 @@ executable controller/harness/bundle bytes or a missing writer, read
    **Completion:** a valid read-only AFK sentinel exists.
 4. **Drive phases.** Follow [the loop](reference/loop.md): `/rite-spec` →
    `/rite-clarify` → `/rite-temper` → `/rite-define` → `/rite-vet` →
-   `/rite-build` × pending slices → `/rite-prove` → `/rite-polish` →
+   `/rite-build` batch loop → `/rite-prove` → `/rite-polish` →
    `/rite-review` → `/rite-seal`. Read and execute each skill; durable files, not
    chat, carry state. Apply the mutable post-vet budget before first Build.
+   Build runs the largest eligible path-disjoint batch (cap: `--parallel N`, else
+   sentinel `max_parallel`, else 10) and recomputes after every integrate until no
+   pending slice remains; serial only when fewer than two slices are eligible or the
+   host cannot isolate concurrent worktree writers.
    **Completion:** loop reaches Seal GO or persists a valid stop before any later phase.
 5. **Apply stops.** At every gate use
    [stop-conditions.md](reference/stop-conditions.md). A `blocked` label alone is not a stop condition:
@@ -98,8 +105,12 @@ executable controller/harness/bundle bytes or a missing writer, read
    hard risk, human-owned blocking/escalating/NO-GO, resource exhaustion, or the
    exact fingerprint's proven exhaustion. Technical exhaustion records terminal
    `Next step: none`, never a routine phase command. **Completion:** no stop is active, or its cursor and reason are durable.
-6. **Seal boundary.** Without a ship flag, stop at Seal GO with `/rite-ship`.
-   With one, perform Ship preflight, disclose the exact Git plan, and stop for
+6. **Seal boundary.** Without a ship flag, stop at Seal GO with `/rite-ship` —
+   unless `continue_sequence` is armed and sequence budget remains, in which case
+   leave the sealed workspace unshipped and open the next recorded continuation
+   ([loop.md § Sequence continuation](reference/loop.md#sequence-continuation));
+   report the sequence position on every stop.
+   With a ship flag, perform Ship preflight, disclose the exact Git plan, and stop for
    fresh literal `GO` plus native approval. **Completion:** performed no Git action before fresh literal `GO` plus native approval.
 
 ## Reply and resume

package/pack/.claude/skills/rite-autocomplete/reference/loop.md

@@ -19,6 +19,9 @@ max_agents: 32
 max_minutes: 120
 max_review_queue: 8
 expires_at: "<now + 4 hours>"
+# continue_sequence: true          # opt-in: chain recorded continuations after Seal GO
+# max_workspaces: 5                # sequence budget when chaining
+# max_parallel: 10                 # Build batch cap; 1 = serial (default: eligible, cap 10)
 # max_tokens: <N>
 # max_cost_usd: <amount>
 # notify: "<cmd>"
@@ -63,7 +66,7 @@ Workspace files carry state; chat does not. Read and execute each phase skill:
 | 3 | `/rite-temper` | harden or reduce; expansion and irreversible risk pause |
 | 4 | `/rite-define` | approved plan/tasks/traceability |
 | 5 | `/rite-vet` | every plan; derive mutable budget after READY |
-| 6 | `/rite-build` ×N | one pending slice per wright; charge once only after green built state |
+| 6 | `/rite-build` batch loop | largest eligible path-disjoint set (cap 10; serial when <2 eligible); recompute after each integrate; charge once per green built slice |
 | 7 | `/rite-prove` | all slices built; approved proof; recovery on red |
 | 8 | `/rite-polish` | re-prove after code edits |
 | 9 | `/rite-review` | in-scope correction then fresh proof |
@@ -74,6 +77,35 @@ Before advancing, check resource admission and
 [stop-conditions.md](stop-conditions.md). After source edits, discard stale pass
 evidence. Re-read the active workspace before each phase.
 
+## Sequence continuation
+
+With `continue_sequence: true` and sequence budget remaining
+([sentinel](../../devrites-lib/reference/standards/afk-hitl.md#sequence-continuation-continue_sequence-max_workspaces)),
+step 10 does not end the run: leave the sealed workspace unshipped with its
+`Next step: /rite-ship`, then invoke the next recorded continuation
+(`/rite-spec <parent>-<n> "<objective>"` from the parent's `decisions.md` sequence)
+and re-enter step 1. Spend one workspace per opened continuation.
+
+Spend accounting is durable in `state.md` cursors, not chat. Before invoking the
+continuation, ensure the current workspace's `sequence_workspaces_remaining` is
+set — absent, write `max_workspaces - 1` and `sequence_position: 1` first — and
+`> 0`. `/rite-spec` seeds the child's sequence cursor at creation per the
+[continuation contract](../../rite-plan/reference/slicing.md#continuation-workspaces);
+after the child's `state.md` exists, verify it — `sequence_parent` = the current
+slug, `sequence_position` = parent position + 1,
+`sequence_workspaces_remaining` = parent remaining − 1, and — when the recorded
+entry is the sequence's release milestone — `sequence_role: release` (gates then
+require the union manifest). On resume, a child whose
+fields are missing is re-seeded from its `brief.md` parent/position and the
+parent's counter (same values, never a second charge); a child with no recorded
+parent/position is not a sequence member and the chain stops.
+
+Stop instead when: no recorded next entry; the cap, expiry, or review-queue bound is
+reached; a human-owned, safety, access, or exhaustion condition fires; or Seal returns
+`NO-GO`. On stop, report the sequence position, the sealed-but-unshipped workspaces, and
+the single release command (`/rite-autocomplete <release milestone> --ship`, or
+`/rite-ship` for the current sealed workspace when the sequence is complete).
+
 ## Backtrack without handing off
 
 The active Autocomplete root remains caller whenever a later phase exposes an

package/pack/.claude/skills/rite-build/SKILL.md

@@ -1,22 +1,22 @@
 ---
 name: rite-build
-description: Build the next approved vertical slice with evidence. HITL one-slice default; AFK may chain serially; opt-in `--parallel N` (2≤N≤10) for path-disjoint worktrees.
+description: Build the next approved vertical slice with evidence. HITL one-slice default; AFK/autocomplete chain serially or in eligible path-disjoint batches (dynamic size, cap 10); `--parallel N` caps a batch.
 argument-hint: "[--parallel N] [slice number or name]"
 user-invocable: true
 ---
 
 # /rite-build: one verified slice
 
-Build and prove one slice. HITL stops; a later user invocation starts the next.
-Explicit `.devrites/AFK` alone lets the controlling root chain pending slices
-serially under green proof, caps, and pause rules. Every wright returns after one slice.
+HITL stops; a later user invocation starts the next slice.
+Explicit `.devrites/AFK` alone lets the controlling root chain under green proof,
+caps and pause rules. Every wright returns after one slice.
 **Opt-in:** `/rite-build --parallel N` (2≤N≤10; N=1≡serial) follows
 [`reference/parallel-batch.md`](reference/parallel-batch.md)
 ([`one-slice-cycle.md`](reference/one-slice-cycle.md)).
 
-Root owns gates/bookkeeping. Fresh
-[`devrites-slice-wright`](../../agents/devrites-slice-wright.md) writes product
-source/tests. Workflow Artifact paths use
+Root owns gates/bookkeeping; fresh
+[`devrites-slice-wright`](../../agents/devrites-slice-wright.md) writes source/tests.
+Workflow Artifacts use
 [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md).
 Execute [`reference/phase-contract.md`](reference/phase-contract.md)
 ([`one-slice-cycle.md`](reference/one-slice-cycle.md),
@@ -37,7 +37,8 @@ Wright applies anti-slop; root verifies returns and never patches source.
   multi-writer / root-emulated concurrency forbidden. Native-worktree pilot =
   single-slice isolation when `wright-dispatch.md` preflight + reconcile hold.
 - Exact feature scope only; reject out-of-allowlist diffs; record adjacent issues.
-- Never rerun an unchanged check; re-prove after edits.
+- Re-prove affected behavior after edits; reuse observations only under
+  [evidence validity](../devrites-lib/reference/candidate-integrity.md#evidence-validity).
 - Unplanned dependency/design-system/gap/repair → Vet/Spec Drift Guard batch
   sweep: every contract-assumption violation recorded before one folded
   repair+vet. Ask only for licensing/cost/security/product or explicit
@@ -57,29 +58,35 @@ Wright applies anti-slop; root verifies returns and never patches source.
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"Vet-ready admitted bytes require root authorship outside product wright","action":"ROOT_TRANSACTION; root writes only admitted .devrites/** targets","return":"saved Build slice cursor; wright product allowlist unchanged"} -->
 ## `--parallel N` (opt-in)
 
-Omitted/`1` ≡ serial; `2`–`10` → path-disjoint fan-out when eligible; else hard refuse.
+Omitted/`1` ≡ serial; `2`–`10` is a **cap** — the root runs the largest eligible
+path-disjoint set it can start now (`N_eff`), takes fewer when the cap cannot be
+filled, and recomputes after every integrate until no pending slice remains
+([`parallel-batch.md` § Dynamic selection](reference/parallel-batch.md#dynamic-selection-and-re-batching)).
+Unattended runs (`/rite-autocomplete`, `.devrites/AFK` `max_parallel`) repeat batches
+inside the same run; HITL stops after each batch. Non-integer/`N≤0`/`N>10` hard refuse.
 All-green serial integrate; a red/gap sibling gets a bounded repair round in
 its own worktree — never rebuilt from scratch while budget remains.
-Plan-owned gaps still route through Spec Drift Guard (batch sweep, one folded
-plan repair + one vet recheck inline); do not emit a human `Fix`. Exhausted
-repair blocks and preserves everything; `cleanup --force` salvages slice
-branches before removing worktrees — human-gated to abandon a batch,
-orchestrator-emitted only as the salvage step of an automatic frozen-lease
-re-batch.
+Post-writer inventory and affected rechecks follow `phase-contract.md` § Independent
+Build review; fold accounts before one repair-all wright.
+Plan-owned gaps still route through Spec Drift Guard
+(batch sweep, one folded plan repair + one vet recheck inline); do not emit
+a human `Fix`. Exhausted repair blocks and preserves everything;
+`cleanup --force` salvages slice branches before removing worktrees —
+human-gated to abandon a batch, orchestrator-emitted only as the salvage
+step of an automatic frozen-lease re-batch.
 AFK charges after integrate only. Running lease blocks another
 `/rite-build`. Details: `parallel-batch.md`.
 
 ## Execute and reply
 
 Run every step in `reference/phase-contract.md`: readiness, one target, dispatch
-or canonical transaction, return inspection, independent doubt/test analysis,
+or canonical transaction, return inspection, independent code/doubt/test analysis,
 approved fail-on-red proof, record, AFK accounting, and stop. Use
 [`reference/output.md`](reference/output.md) plus the shared
 [`reply contract`](../devrites-lib/reference/reply-contract.md). HITL never starts
-the next slice automatically; AFK chains only within its durable remaining
-budget; Prove starts only after all slices are built.
+the next slice automatically; AFK obeys remaining budget; Prove requires all slices built.
 
-## Phase exit (observable)
+## Phase exit
 
 **Complete when:** the dispatched wright returns green proof for the slice,
 `git diff --name-only` ⊆ allowlist, independent test analysis admits no Critical

package/pack/.claude/skills/rite-build/reference/afk-discipline.md

@@ -87,7 +87,7 @@ any of:
 - External-service contract change (webhook payload, partner-facing schema).
 - Filesystem destructive operation outside the workspace (`rm -rf` of project paths,
   rewriting `.gitignore`-listed paths, deleting fixtures).
-- Anything the slice's `Gate: blocking` plus `tasks.md` `Why HITL:` flags as irreversible.
+- Anything the slice's `Gate: blocking` plus its `Checkpoint:` line in `tasks.md` flags as irreversible.
 
 This is the Claude Code auto-mode transcript classifier list adapted to the DevRites
 workspace.

package/pack/.claude/skills/rite-build/reference/parallel-batch.md

@@ -7,13 +7,39 @@ Opt-in only. Default `/rite-build` stays [`one-slice-cycle.md`](one-slice-cycle.
 | Input | Behavior |
 | --- | --- |
 | omitted / `--parallel 1` | Serial one-slice |
-| `--parallel N` (**2≤N≤10**) | Parallel when eligible + host pass |
+| `--parallel N` (**2≤N≤10**) | N is a **cap**, not a quota: run the largest eligible set ≤ N |
 | non-integer / `N≤0` / `N>10` | Hard refuse (no silent clamp) |
+| Autocomplete, no flag | Same path, cap from sentinel `max_parallel` else 10; serial only when ineligible |
 
-AFK caps `N` by remaining budget. Charge **only after successful integrate**
-(once per integrated green sibling). Abort / integrate-failed → **0**. A
-present lease is resumable: `/rite-build` continues it (repair rounds or the
-blocked verdict); `parallel create` refuses until cleanup.
+AFK caps `N`. Charge green siblings once after integrate; abort /
+integrate-failed → **0**. `parallel create` refuses while a lease exists.
+Reconcile retained repair-round artifacts by exact causal fingerprint before honoring a stored blocked status/verdict. Blocked status, round count, or distinct finding alone cannot stop cold resume: establish missing or stale review coverage under step 4; repair unless a stop condition remains evidenced.
+
+## Dynamic selection and re-batching
+
+Size each batch by what is runnable **now**, never by the requested number:
+
+```text
+N_eff = min(
+  cap                  -- --parallel N | sentinel max_parallel | 10 (autocomplete default)
+  eligible set         -- dependency-satisfied pending slices, pairwise path-disjoint
+  AFK headroom         -- remaining max_slices, max_agents, max_minutes, review queue
+  host capacity        -- concurrent worktree writers + the runtime isolation table
+)
+```
+
+Select **greedily in plan order**: walk pending slices whose `depends_on` are built and
+add each one while it stays pairwise disjoint with the selected set and the cap is not
+reached. Then `N_eff ≥ 2` → parallel batch; `N_eff = 1` → the serial one-slice cycle;
+nothing pending → Prove. A cap that cannot be filled is normal: take fewer.
+
+**Re-batch automatically.** After integrate + cleanup are green, re-read `state.md`,
+the pending slices (`observe slice`), and the updated tree, then recompute: integrated
+siblings leave the pending set and free their paths, and satisfied dependencies unlock
+new slices. Repeat until no pending slice remains. Under `.devrites/AFK` and
+`/rite-autocomplete` the repeat is part of the same run — a new batch is another
+`/rite-build --parallel` round inside it, not a new user invocation; HITL stops after
+each batch. A batch of three followed by one of four and then two is the expected shape.
 
 ## Path-disjoint
 
@@ -21,7 +47,9 @@ Exact project-relative source/test paths only. Normalize `\`→`/`. Reject `..`,
 duplicates, absolutes, `.devrites/**`. Empty pairwise intersection required.
 
 **SSOT:** `devrites-engine check path-disjoint [--root <dir>] [<json-file>|-]`
-(N≥2 only; pass `--root`). Exit `0` → fan-out; else force serial. Inspect-time
+(N≥2 only; pass `--root`). Input is `{"slices":[{"id":"SLICE-002","paths":["src/policy.rs","src/policy/mod.rs"]}]}`
+(or a top-level array) built from each candidate's `Files likely touched`.
+Exit `0` → fan-out; else force serial. Inspect-time
 overlap → sibling **gap** (a shared path is a contract defect). **Failing
 case:** two parallel wrights share a path and fan-out proceeds without that
 check.
@@ -40,14 +68,29 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
 
 ## Lifecycle
 
-1. Orient/gate; parse N; select ≤N path-disjoint pending slices.
+1. Orient/gate; parse the cap; compute `N_eff` and select the eligible set
+   ([Dynamic selection and re-batching](#dynamic-selection-and-re-batching)) —
+   candidates from `orient` `task_graph.slices` + built list, each candidate's
+   `Files likely touched` via `observe slice`, disjointness via `check path-disjoint`.
 2. Write lease; freeze `B=HEAD`; `parallel create` worktrees.
 3. Dispatch ≤10 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`).
-4. Inspect + fail-on-red → `green|red|gap`. Independent-review Critical is `gap`
-   even when targeted tests are green.
+4. Inspect each returned path list, cumulative diff from `B`, transfer identity,
+   and required result fields against the immutable contract. Reject malformed,
+   stale, or out-of-scope work. Apply
+   [independent Build review](phase-contract.md#independent-build-review): first
+   full inventory, then bounded owning-role rechecks after repairs. Gap or
+   Critical/Important → `gap`; else approved proof → `green|red|gap`.
+   Reviewer fan-out for a batch is itself batched under
+   [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md#scale-limits)
+   (≈4 concurrent read-only reviewers, 8 only with disjoint paths), and `max_agents`
+   headroom bounds the batch size — one batch never assumes unbounded reviewers.
 5. Non-green siblings → **repair round** (below) in the same worktrees; lease
    stays `running` — no abort while repair budget remains. A green sibling →
    `parallel record-green`. No partial integrate. All green → integrate.
+   A recoverable RED blocks integration but does not cancel independent safe running siblings.
+   Expected test-first RED is not a terminal gate failure. Cancel only for a shared
+   invalid foundation, safety/access failure, resource boundary, or explicit stop;
+   preserve completed and in-progress recoverable work and classify each result.
 6. Integrate: each `transfer_commit` descends from `B` and diffs path-exact vs
    `B`; squash-apply all in plan order into one `WIP(<slug>):` commit on the
    staging branch (Ship collapses it). Conflict → reset to `B`,
@@ -69,46 +112,53 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
 
 ## Repair rounds
 
-Rejected work is repaired in place — never discarded and rebuilt from scratch
-while budget remains.
+Repair rejected work in place; never discard/rebuild while budget remains.
 
-- Record each round as `build-parallel-<batch>-repair-<round>.json`: per
-  non-green sibling — status, verbatim findings, transfer_commit or null.
-- Classify first: **implementation defect** (review Critical on the diff, red
-  wright/proof) → repair wright in the same worktree. **Durable-plan defect**
+- Record each round as `build-parallel-<batch>-repair-<round>.json`: each
+  non-green sibling's status, verbatim findings, transfer_commit/null.
+- Use step 4's initial inventory or affected recheck as appropriate; never start
+  a correction from an early reviewer result while required accounts are pending.
+- Classify the complete inventory: **implementation defect** (review
+  Critical/Important on the diff, red wright/proof) → one repair-all wright in
+  the same worktree with the full inventory. **Durable-plan defect**
   (falsified contract assumption, AC unchanged) →
   [`spec-drift-guard.md`](spec-drift-guard.md): batch-sweep contract
   assumptions, one folded `/rite-plan repair` + one `/rite-vet` recheck
   inline, resume repair in the same worktrees under the amended contract;
-  never emit `Fix:`. **Frozen-lease scope defect** — the amended contract or
-  a review requirement needs paths outside a slice's allowlist, or re-slices
-  the plan (a lease is immutable once written: its allowlists are the
-  disjointness guarantee) → **automatic re-batch, no human gate**:
-  `parallel cleanup --force` as the salvage step, record the retained refs in
-  the repair-round artifact, `parallel create` a fresh batch from control
-  `HEAD` under the corrected decomposition. Prior attempts stay reachable —
-  hand each new wright the salvaged branch ref
-  (`devrites/parallel/<slug>/<old-batch>/<slice>`) so it builds on what worked
-  instead of starting blind. If no corrected decomposition exists, that is
-  exhaustion → blocked, preserve, STOP. **Reviewer stall/cancel or missing
+  never emit `Fix:`. **Frozen-lease scope defect** (correction needs
+  out-of-allowlist paths or re-slicing; lease allowlists are immutable) →
+  **automatic re-batch, no human gate**: `parallel cleanup --force` salvages
+  and records refs; `parallel create` starts from control `HEAD` under the
+  corrected decomposition. Give each new wright its salvaged
+  `devrites/parallel/<slug>/<old-batch>/<slice>` ref. If the inventory proves the accepted
+  approach unsound and no corrected decomposition exists, that is exhaustion
+  → blocked, preserve, STOP. **Reviewer stall/cancel or missing
   verdict** → re-dispatch the reviewer, not the wright. **Product/policy/
   irreversible** → stops for the human.
-- Dispatch a fresh `devrites-slice-wright` (cwd = the sibling's worktree, same
-  allowlist and host rules as step 3 — siblings may repair in parallel) with
-  the original contract + verbatim findings + "preserve what works; fix the
-  named findings; return a new `transfer_commit`". Never reset the worktree
+- Dispatch one fresh repair-all `devrites-slice-wright` (cwd=worktree; step 3
+  rules) with the original contract + complete inventory +
+  "preserve what works; fix every finding; **then attack your own correction** —
+  probe the changed hunks for defects the fix itself introduced (adjacent cases of
+  the same rule, new observation/ordering windows, alias or boundary escapes) and
+  fold them in before returning; return a new `transfer_commit`". A correction whose
+  own diff is unexamined is not ready: a green writer gate plus an unexamined fix is
+  how the same defect family reappears one case deeper each round. Never reset
   to `B` — that destroys the work under repair. The commit must still descend
   from `B` and diff path-exact vs `B`.
-- Each repair return re-runs the full gate chain: inspect, fresh doubt +
-  test-analysis, approved proof.
-- Budget: the shared causal-fingerprint cap — three total failed attempts per
-  sibling per fingerprint (build + repairs count together); a distinct
-  Critical is a new fingerprint. Exhaustion is not abort: record one
-  technical blocker (`Status: blocked`; `Next step: none — technical recovery
-  exhausted for <fingerprint>; requires new evidence or changed failure
-  conditions`), preserve lease/worktrees/branches, STOP — same fingerprint
-  stays blocked on reinvoke; new evidence resumes repair in place. Human-
-  owned decisions use the drift-guard question and wait.
+- Budget and exhaustion follow only
+  [the canonical retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve).
+  Record one failed invariant, mechanism, reproduction, correction, and decisive
+  recheck per fingerprint; never use an umbrella like "covering" or "review is red again".
+- A distinct post-repair Critical/Important gets a new fingerprint: refresh the
+  inventory and affected owning-role rechecks. It proves neither plan defect nor
+  exhaustion. Use plan path only if inventory proves the approach unsound.
+- Stop under the canonical retry/authority/resource conditions, or when evidence
+  proves the approach unsound and no in-scope corrected decomposition exists.
+- Exhaustion is not abort: record one technical blocker (`Status: blocked`;
+  `Next step: none — technical recovery exhausted; requires new evidence or changed failure conditions`), preserve
+  lease/worktrees/branches, STOP — same fingerprint stays blocked on
+  reinvoke; new evidence resumes repair in place. Human-owned decisions use
+  the drift-guard question and wait.
 
 ## Engine verbs