devrites 5.4.0 → 5.6.0

package/pack/generated/codex/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -59,6 +59,9 @@ expires_at: "<ISO-8601 UTC timestamp>" # absolute unattended-authority expiry
 # max_cost_usd: 10                   # optional stricter host-observed cost cap
 notify: "ntfy.sh/my-topic"           # shell command; examples: rite-build/reference/afk-discipline.md
 allow_gates: [advisory, validating]  # gate severities AFK auto-handles (auto-picks the recommended option)
+continue_sequence: true              # after Seal GO, open the next recorded continuation
+max_workspaces: 5                    # workspaces one armed sequence may open
+max_parallel: 10                     # cap on eligible path-disjoint Build batches (1 = serial)
 ```
 
 The file is **read-only config**: never rewritten in place. `max_slices` is the initial
@@ -79,6 +82,49 @@ existing counter may be lowered but never increased or reinitialized. Once prese
 counter is the effective remaining budget even when the read-only sentinel omits
 `max_slices`.
 
+### Sequence continuation (`continue_sequence`, `max_workspaces`)
+
+`continue_sequence: true` lets one armed run open the next **recorded** continuation
+after a `Seal GO` instead of stopping. Absent means `1` — the current workspace only;
+an existing sentinel never receives the default implicitly. `max_workspaces` is the
+sequence budget (nonnegative decimal, fail closed): spend one when a new workspace is
+opened, never when resuming the current one. `max_slices` stays **per workspace** —
+each new workspace's `state.md` seeds its own `afk_slices_remaining`.
+
+The chain lives in root-owned `state.md` cursor fields, not in chat:
+`sequence_parent` (the immediately preceding workspace slug), `sequence_position`
+(1-based ordinal), `sequence_workspaces_remaining` (slots the chain may still
+open after this workspace), and — on the release milestone only —
+`sequence_role: release`. Seeding is exactly-once because the values are
+derived, not remembered: a continuation's fields are computed from its recorded
+parent and the parent's counter at creation, and a resumed run that finds a
+continuation workspace missing the fields re-derives the same values from its
+`brief.md` parent/position plus the parent's counter — never a second charge. A
+workspace without a recorded parent/position is not a sequence member; the
+counter only decreases, malformed values fail closed, and `0` opens nothing.
+`sequence_role: release` makes `check candidate` and `check seal` require the
+candidate manifest to cover the whole recorded chain — run
+`devrites-engine state merge-manifest <slug>` before Prove.
+
+- Only continuations recorded in the parent's `decisions.md` sequence
+  ([slicing.md § Continuation workspaces](../../../rite-plan/reference/slicing.md#continuation-workspaces))
+  qualify; no recorded next entry, or the cap/expiry/review-queue bound reached, stops
+  with the winning reason.
+- Milestones are **not** shipped: they stay sealed and unarchived in `.devrites/work/`
+  with `Next step: $rite-ship` preserved. Per-slice `WIP(<slug>)` checkpoints still
+  land locally ([checkpoint.md](../../../rite-build/reference/checkpoint.md)), so the tree
+  stays clean and crash-safe.
+- Git stays human-gated. The release ship is one disclosed plan, one literal `GO`, and
+  one native approval; it collapses the sequence's `WIP` commits into the single
+  release commit and may archive the sealed predecessors.
+- Every human-owned, safety, access, exhaustion, and `NO-GO` condition still stops the
+  run exactly as without this field.
+
+`max_parallel` caps a Build batch for unattended runs; `1` forces the serial cycle.
+Unattended runs take the largest eligible set ≤ cap and recompute after every integrate
+([parallel-batch.md § Dynamic selection and re-batching](../../../rite-build/reference/parallel-batch.md#dynamic-selection-and-re-batching));
+an explicit `$rite-build --parallel N` cap wins for that invocation.
+
 ## Unattended resource envelope
 
 AFK writer admission needs a bounded input queue, effective slice cap, and valid
@@ -258,65 +304,72 @@ When `$rite-resolve` does resume a stopped session, the skill does **not** auto-
 
 ## AFK exception for discretionary pauses
 
-`devrites-doubt` and similar skills that "ask the user" follow this rule when
-`.devrites/AFK` exists:
+With `.devrites/AFK`, apply decision ownership first. Accepted in-scope technical
+corrections return to the caller for repair/verification; severity blocks acceptance,
+not authorized repair. Never silently accept a defect or broaden existing approval.
 
-Ceiling comparison order: Suggestion/Nit/FYI < Important < Critical; gates advisory <
-validating < blocking < escalating; a finding is ≤ the ceiling when its severity's gate
-class (Suggestion/Nit/FYI→advisory, Important→validating, Critical→blocking) is at or
-below the slice's gate.
+Discretionary ceilings apply only to
+human-owned trade-off/risk decisions; accepted technical corrections do not enter
+these branches. Compare Suggestion/Nit/FYI→advisory, Important→validating,
+Critical→blocking against advisory < validating < blocking < escalating:
 
-- Finding severity ≤ slice's gate ceiling (slice's `Gate:` plus `.devrites/AFK`
-  `allow_gates`) → log to `questions.md` as `gate: advisory`, record the trade-off in
-  `decisions.md`, proceed.
-- Finding severity > gate ceiling, OR finding touches the irreversible-risk list →
-  log to `questions.md` as `gate: blocking`, set `state.md` `Status: awaiting_human`,
-  fire `notify:`, STOP.
+- Within the slice's `Gate:` and `.devrites/AFK` `allow_gates`: record advisory in
+  `questions.md`, trade-off in `decisions.md`, proceed.
+- Above ceiling, missing authority, or unapproved irreversible risk: record blocking
+  question, `Status: awaiting_human`, fire `notify:`, STOP.
 
-The loop limits of the calling skill still apply. At the limit, classify the unresolved
-finding by the decision-ownership rule above: human-owned uncertainty becomes a blocking
-question; an objective technical finding becomes a recorded blocker with its required
-changes, not a request for permission to retry.
+Recovery uses only the [retry contract](#retry-cap-no-progress-loops-and-self-resolve).
 
 ## Retry cap, no-progress loops, and self-resolve
 
-- **Fingerprint the failed invariant, not the review round.** An exact causal
-  fingerprint is the owning gate/invariant plus its minimal reproduction and
-  decisive failure signal. A new DEC/DRIFT number, changed line number, reviewer
-  wording, or splitting one finding does not create a new fingerprint.
+Owns all phase recovery, including Doubt/Vet/serial/parallel Build. Resource,
+access, safety and irreversible-action boundaries independently stop work.
+
+- **Fingerprint the failed invariant, not the review round.** Identify owning
+  invariant + defect mechanism + minimal reproduction/decisive failure signal.
+  DEC/DRIFT IDs, line numbers, wording and splitting one cause create no new budget.
 - **Cap no-progress retries:** three no-progress attempts per exact causal fingerprint
-  across wright and recovery is a hard cap. Only a repair whose narrow recheck
-  leaves that fingerprint open or reproduces the same decisive failure consumes
-  an attempt. Closing a prior finding with discriminating evidence is progress:
-  mark that fingerprint resolved and do not charge it as no-progress. A genuinely
-  new Critical or Important finding with a different failed invariant and exact
-  evidence gets its own fingerprint and budget; Suggestion, Nit, FYI, or renamed
-  evidence cannot open, reset, or extend recovery.
-- **Separate consumptive authority from recovery.** Spending a one-shot action's
-  authorization forbids another real execution but does not consume the offline
-  recovery budget for a newly evidenced fingerprint. The retained artifact starts
-  caller-owned diagnosis and correction immediately; only the next consumptive
-  execution waits for fresh authorization.
-- **Persist accounting in existing records.** Record each fingerprint,
-  reproduction, attempted correction, `progress: resolved|no-progress`, and
-  decisive result in `drift.md` and `evidence.md`. Cold resume derives the count
-  from those records. There is no recovery counter file or command.
-- **Reconcile before honoring a terminal cursor.** A persisted distinct
-  Critical/Important fingerprint with retained evidence and fewer than three
-  recorded no-progress corrections still has recovery budget, even when an older
-  `state.md` says `Next step: none`. Resume it; do not treat session age or the
-  prior action's spent authorization as exhaustion.
+  across wright/recovery. Only a correction whose narrow recheck leaves that cause
+  open or reproduces its failure consumes an attempt.
+  Closing a prior finding with discriminating evidence is progress: resolve it,
+  do not charge. A new Critical or Important finding gets its own budget only for
+  a distinct evidenced cause. The same invariant with a different evidenced mechanism qualifies;
+  renaming/splitting an unchanged cause does not. Suggestion/Nit/FYI cannot extend
+  recovery. Initial discovery and expected test-first RED are not corrections;
+  total rounds, re-batches and distinct-finding counts never exhaust recovery.
+- **Rechecks are scoped; late findings never reopen the round.** *Late* applies only
+  from a phase's **second** review pass (Vet 1b, Build's recheck after the first repair,
+  Review step 7); an initial pass has no late findings and every supported finding is
+  folded normally. A recheck packet
+  names the open fingerprints, the correction diff, and the dependents of each
+  changed clause/hunk; the owning reviewer's verdict covers exactly that. A finding
+  on text/code unchanged since that role's previous pass is *late*: Critical with a
+  concrete failure path → new fingerprint under this budget; otherwise recorded
+  (Plan/Vet: `eng-review.md` `## Deferred findings`; Build: `touched-files.md`
+  `## Review trail`) with severity · site · role · kind · round, and consumed by the
+  next full-inventory gate (Vet `mechanism` → one `test-plan.md` proof row; Build →
+  the `$rite-review` roster) — never by another repair round in this phase. Review
+  closes every deferred row with a labeled verdict; Seal blocks on any without one.
+  **Failing case:** round 4 finds three Important items on clauses untouched since
+  round 1 and dispatches another repair.
+- **Separate consumptive authority from recovery.** Spent one-shot authorization
+  blocks another execution, not offline recovery. Retained evidence starts caller-owned
+  diagnosis/correction immediately; the next consumptive execution needs fresh authority.
+- **Persist existing records.** Put fingerprint, reproduction, correction,
+  `progress: resolved|no-progress` and decisive result in `drift.md` and `evidence.md`.
+  Cold resume derives counts there; no new counter file/command.
+- **Reconcile terminal cursors.** Retained distinct Critical/Important evidence below
+  cap resumes despite stale `Next step: none`; age/spent action authority is not exhaustion.
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"unattended root reaches current admitted Workflow Artifact work","action":"invoke classifier; execute returned route without wright/slice charge","return":"saved lifecycle phase/action; no intermediate reply"} -->
-- **Classify exhaustion:** human-owned contract/risk/access gaps open their gate. Otherwise
-  preserve reproduction/dead ends, set `Status: blocked` and `Next step: none — technical recovery exhausted; requires new evidence or changed failure conditions`.
-  Do not emit `$rite-plan unblock`, another phase command, a question, or
-  `$rite-resolve`. Reinvocation with the unchanged fingerprint remains blocked
-  and never resets the retry cap.
-- **Resolve agent-owned questions first.** Before raising a question, try to answer it from the code, the docs,
-  or `decisions.md`. Communicate only for a blocked environment, a deliverable to hand over,
-  critical info you genuinely can't access, or a credential / permission you lack — never for
-  writing code, writing tests, or reviewing; the agent's own work is not a valid human gate.
-  This narrows needless pauses and never weakens the blocking / escalating / irreversible gates.
+- **Classify exhaustion:** human-owned contract/risk/access gaps open their gate.
+  Otherwise preserve reproduction/dead ends, set `Status: blocked` and
+  `Next step: none — technical recovery exhausted; requires new evidence or changed failure conditions`.
+  Emit no phase command, retry-permission question or `$rite-resolve`.
+  Reinvocation with unchanged cause stays blocked; it never resets the cap.
+- **Resolve agent-owned questions first** from code/docs/decisions. Human communication
+  is for blocked environment, handover, inaccessible critical information or missing
+  credentials/permission—not writing, testing or review. Blocking/escalating/
+  irreversible gates remain.
 
 ## What the rule does NOT cover
 

package/pack/generated/codex/skills/devrites-lib/reference/standards/agents.md

@@ -51,6 +51,7 @@ Each job gets objective/exclusions, exact paths/immutable candidate, rubric/resu
 ## Independence
 
 - A fresh result sees scope/paths-diff/rubric only — never another result's or the root's conclusions, severities, expected verdicts, or edited context; seeding voids the packet.
+- **Verify the packet is clean before admitting the account.** Confirm the returned packet/trace carries no host-injected context: an automatic memory/summary banner naming an earlier phase verdict (e.g. `past Temper PASS … next is $rite-define`) or harness reminder text seeds the pass and voids it. Cancel that account — never admit it — name the lost coverage, and re-dispatch with the host's context injection disabled for that child. Tool config changes that do not stop native child auto-injection are not a fix; verify on the next spawn instead of assuming.
 - A parent-context pass contributes attributed evidence but is not independent: exclude it from independent accounting and name the lost coverage.
 - Final severity is set at reconciliation after re-verifying the claimed consequence at the cited site (reviewer severity advisory); dismissals record a reason, and true facts about neighboring code route elsewhere instead of being dismissed.
 - Conflicting required results are arbitrated by re-verifying evidence at the site; the deciding evidence is recorded, truly unresolved conflicts stay open blockers. Two results describing the same defect merge only when both defect and fix path match; otherwise the more conservative classification stands, and severity never widens without new site evidence — an overridden or demoted finding stays visible with the reason, never silently merged away.

package/pack/generated/codex/skills/devrites-lib/reference/standards/context-hygiene.md

@@ -1,25 +1,52 @@
 # Context hygiene
 
-Long conversations degrade an agent's reasoning. End phases cleanly, persist important
-state to disk, and start the next phase in a fresh context.
-
-The feature workspace stores the next session's authority; chat memory does not.
+Persist phase results before starting fresh. The feature workspace, not chat memory,
+stores continuity.
 
 ## Working-set rule
 
-Long tool histories can displace important facts and retain failed attempts. Act at 50%
-to 70% context use, keep one task's working set small, and load only what the current
-step needs. The workspace, not a summary, is the source of truth.
+Act at 50% to 70% context use; load only the current task's working set. The
+workspace, not a summary, is the source of truth.
 
 - **Count before viewing:** on a search hit list, read match counts first (`grep -c`,
-  match summaries) and open only the files a one-line answer needs; dumping whole
-  files for a one-line question is common waste.
+  match summaries), then open relevant files.
 - **Cut before load, not after.** Drop low-signal files, prior-turn dumps, and
-  duplicate index queries before they enter context. Truncating a bloated window
-  after the fact is not an efficiency strategy — the cost is already paid.
+  duplicate index queries before loading; later truncation cannot undo that cost.
   **Failing case:** five whole-file reads, then `/compact`, treated as cost control.
 
-**Compaction-preservation directive.** If the harness compacts mid-feature, read `.devrites/ACTIVE`, then reload the `state.md` cursor, open `questions.md` gates, durable `decisions.md`, and `test-plan.md`/`evidence.md` proof pointers. Session hooks normally restore these; this is the fallback when no hook fires.
+## Dispatch packets
+
+Give each role the exact candidate identity, scope, applicable contract/decision IDs,
+all open findings, relevant tests/evidence, and anchored/hashed read-next paths. Read
+owning text and dependencies: IDs/digests are not semantic evidence. Exclude whole
+histories, duplicates, and raw transcripts from initial packets. Inspect serialized byte size
+and long lines; line counts alone are insufficient. Within the host budget
+and working-set rule, split retrieval rather than truncate active obligations.
+Broaden retrieval when dependency boundaries are unknown.
+
+Packets are **by reference**: project-relative path + SHA-256 + line anchors
+(`path:start-end`) for every input; the reviewer reads the live file. Inline only the
+excerpt a finding or claim needs, ≤ 4 KiB each. Never inline whole workspace artifacts,
+standards/skill files (name the path; the role reads it), foreign documents, prior
+packets, or another role's account. A serialized packet stays ≤ 64 KiB; larger means
+the scope is wrong — split by anchor-disjoint cluster, never truncate. Persist packets
+and admitted accounts under `.devrites/work/<slug>/packets/`; once a round's account
+is recorded in its owning artifact, packets older than the last closed round may be
+deleted. Never persist agent transcripts, traces, or
+`session_init` dumps anywhere in `.devrites/`. Bulk raw proof output stays outside
+`.devrites/work/`; `evidence.md` records the command, decisive lines, and that path.
+**Failing case:** a 4 MiB `vet-review-input.json` embedding `tasks.md`, the spec, six
+standards files, and a 2 MiB source document as `entries`, plus a 10 MiB
+`vet-review-audit.json` of agent traces beside it.
+
+Keep closed findings in immutable history/regressions; recheck those affected by
+changed contracts, implementation, proof, or dependencies, not every prior generation.
+Required review rosters and final proof remain. Preserve protected history unchanged;
+a compact current view references originals without omitting active requirements.
+
+**Compaction fallback:** when hooks do not restore context, read `.devrites/ACTIVE`,
+then the `state.md` cursor, open `questions.md` gates, `decisions.md`, and
+`test-plan.md`/`evidence.md` proof pointers.
 
 ## Authority and trust
 
@@ -39,15 +66,11 @@ Apply [`core.md` § Precedence](core.md#precedence); authority and evidence diff
 
 | Use `/clear` (default) when | Use `/compact` when |
 |---|---|
-| The current phase is done and its outputs are on disk (the common DevRites case). | You need to keep mid-flight reasoning that hasn't yet been written to the workspace. |
-| Next phase reads workspace files anyway (every `rite-*` does). | The remaining work is small and continuation beats restart. |
-| The chat is dominated by tool outputs (file reads, diffs, test logs, browser snapshots). | A drift or doubt loop is mid-flight and the trade-off discussion isn't yet recorded. |
-| You hit a wrong path that needs unwinding: fresh start beats arguing with stale context. | A user clarification just landed that materially changes the next phase. |
+| Phase results are persisted; the next phase reads them. | Important mid-flight reasoning is not yet persisted. |
+| Tool output or a wrong path dominates context. | Small remaining work, unrecorded drift/doubt discussion, or fresh clarification favors continuity. |
 
-**Default to `/clear`.** Use `/compact` only when the workspace does not capture
-important continuity. When in doubt, write the missing decision /
-assumption / question to the canonical file (`$rite-handoff` does this in one step),
-then `/clear`.
+**Default to `/clear`.** First persist missing decisions, assumptions, or questions
+to their owners (`$rite-handoff`); `/compact` preserves unrecorded continuity.
 
 ## The "Session hygiene" footer (every rite-* output)
 
@@ -82,8 +105,5 @@ handoff.
 
 ## The handoff bridge
 
-When the user is leaving for a long break rather than moving directly between phases, `$rite-handoff`
-is safer than `/clear` alone because it syncs chat-only context into the canonical
-workspace files **before** the reset, then the user can `/clear` (or even close the
-session) without losing anything. The session-hygiene footer points at `$rite-handoff`
-when the gap to the next session is likely > a few hours.
+For a break longer than a few hours, point the footer at `$rite-handoff`: persist
+chat-only context to canonical files before clearing or closing the session.

package/pack/generated/codex/skills/devrites-lib/reference/standards/core.md

@@ -42,7 +42,7 @@ Repository conventions follow [Precedence](#precedence).
 
 ## Lifecycle rest points
 
-Before advancing a phase, run `devrites-engine check readiness <slug>` for structure (semantics belong to exact agents/checklists). Standalone rites persist and stop on block; under a controlling caller, agent-owned technical blocks return backward as a nested phase boundary, not a user-facing handoff. `$rite-seal` runs `devrites-engine check seal <slug>` for structure/freshness, not prose. HITL/blocked stops follow [Persistence before stopping](#persistence-before-stopping-handoff-discipline).
+Before advancing a phase, run `devrites-engine check readiness <slug>` for structure, including artifact budgets (semantics belong to exact agents/checklists). Standalone rites persist and stop on block; under a controlling caller, agent-owned technical blocks return backward as a nested phase boundary, not a user-facing handoff. `$rite-seal` runs `devrites-engine check seal <slug>` for structure/freshness, not prose. HITL/blocked stops follow [Persistence before stopping](#persistence-before-stopping-handoff-discipline).
 
 ### Gate contract
 

package/pack/generated/codex/skills/devrites-lib/reference/workspace-artifact-schema.md

@@ -1,23 +1,19 @@
 # Workspace artifact schema
 
-Feature truth lives in `.devrites/work/<slug>/`; discovery requires `state.md`.
-`README.md` is an optional discovery map; the spec phase still writes it. Operational remnants and archive entries are not
-active workspaces. Current writers use canonical filenames. Both released cursor
-forms remain official; `$rite-upgrade` audits them in place and never performs
-path, alias, or format migration.
+Feature truth: `.devrites/work/<slug>/`, discovered by `state.md`; remnants/archives
+are inactive. Spec writes optional `README.md`. Use canonical filenames; both released
+cursor forms remain valid. `$rite-upgrade` audits without path/alias/format migration.
 
 ## Slug identity
 
-New workspaces use a meaningful objective-derived slug that is lowercase ASCII
-kebab-case, matches `[a-z0-9]+(?:-[a-z0-9]+)*`, and is at most 64 characters.
-Prefer shortening at a word boundary. After the final shortening or suffix step,
-trim boundary hyphens and reject an empty result.
+New slugs derive from the objective: lowercase ASCII kebab-case matching
+`[a-z0-9]+(?:-[a-z0-9]+)*`, at most 64 characters. Shorten at word boundaries.
+After the final shortening or suffix step, trim boundary hyphens; reject empty results.
 
-Before creating a directory, compare any matching workspace's `brief.md`
-objective. Reuse it only for the same feature. Otherwise append the smallest
-unused numeric suffix (`-2`, `-3`, ...), shortening and trimming the base again
-to stay within 64 characters. Never overwrite a workspace by slug alone.
-Readers continue to accept safe legacy basenames; no ordinary phase renames one.
+Before creation, compare a matching workspace's `brief.md` objective: reuse only the
+same feature. Otherwise append the smallest unused suffix (`-2`, `-3`, ...), keeping
+the trimmed base within 64 characters. Never overwrite a workspace by slug alone;
+accept safe legacy basenames. Ordinary phases never rename them.
 
 ## Required by phase
 
@@ -31,13 +27,13 @@ Readers continue to accept safe legacy basenames; no ordinary phase renames one.
 | vet/build/converge | plan artifacts plus `eng-review.md`, `test-plan.md`; Build creates and maintains `touched-files.md` after its first green slice |
 | prove/polish/review | vetted plan artifacts plus `evidence.md`, `touched-files.md` |
 | seal/ship/done | proof artifacts plus `review.md`, `seal.md`; Ship writes `ship.md` |
-| conditional | `flows.md` when diagrams clarify; `visual/` HTML+`.outline.md` companions when a richer reviewable visual earns it (optional; never readiness-required); `design-brief.md` and `browser-evidence.md` for UI; `drift.md` for drift; `polish-report.md` for polish; `handoff.md` only when requested; `references.md` + `references/` when references exist; `investigation-map.md` for pressure-test; `dogfood.md` for dogfood |
+| conditional | `flows.md` when diagrams clarify; `visual/` HTML+`.outline.md` companions when a richer reviewable visual earns it (optional; never readiness-required); `design-brief.md` and `browser-evidence.md` for UI; `drift.md` for drift; `polish-report.md` for polish; `handoff.md` only when requested; `references.md` + `references/` when references exist; `investigation-map.md` for pressure-test; `dogfood.md` for dogfood; `packets/` for by-reference dispatch packets and admitted accounts (≤ 64 KiB each; older closed rounds may be deleted; never transcripts); `history/` for verbatim relocated checkpoint narrative (append-only, never a read-next) |
 
 ## What each file owns
 
 | File | Job | Budget |
 | --- | --- | --- |
-| `README.md` | compact workspace map: phase, status, next action, artifact map, read-next table, blocking gates, last updated | 120 lines |
+| `README.md` | map: phase/status/next action, artifacts/read-next, blocking gates, last update | 120 lines |
 | `brief.md` | user request, objective, non-goals, success definition | 80 lines |
 | `spec.md` | product WHAT/WHY, requirements, acceptance criteria, edge cases, measurable success, scope boundaries | 260 lines |
 | `decision-coverage.md` | topology-first coverage matrix, assumption audit, residual uncertainty, and typed clarity verdict | 200 lines |
@@ -53,22 +49,23 @@ Readers continue to accept safe legacy basenames; no ordinary phase renames one.
 | `plan.md` | technical approach, slice strategy, canonical shared-contract proof, validation strategy, rollback | 220 lines |
 | `tasks.md` | `SLICE-###` vertical slices with AC IDs, likely files, tests/proof, mode/gate, dependencies, done condition | 280 lines |
 | `traceability.md` | matrix: AC/REQ ID, slice IDs, test/proof, evidence ID, touched files, status | 220 lines |
-| `eng-review.md` | vetted scope/architecture/quality/performance, failure modes, preflight, stable-input binding | 240 lines |
+| `eng-review.md` | vetted scope/architecture/quality/performance, failure modes, preflight, stable-input binding, `## Deferred findings` (late rows: severity · site · role · kind · round) for Review | 240 lines |
 | `test-plan.md` | executable proof commands, preflight/provenance contract, acceptance and interaction coverage | 260 lines |
 | `state.md` | compact cursor table/key-values; no narrative log | 120 lines |
 | `evidence.md` | `EVID-###` command/action, result, timestamp if available, related AC/slice IDs, limitation | 280 lines |
 | `browser-evidence.md` | UI route/viewports/screenshots/console/network/interactions and Visual Verdict | 220 lines |
 | `drift.md` | `DRIFT-###` spec/plan drift and resolution | 160 lines |
-| `touched-files.md` | sole candidate manifest plus a concern-ordered `## Review trail` of `path:line` stops for human review | 160 lines |
+| `touched-files.md` | sole candidate manifest plus a concern-ordered `## Review trail` of `path:line` stops for human review and Build's deferred late findings (severity · site · role · round) that `$rite-review` must close | 160 lines |
 | `design-brief.md` | UI design direction, states, interaction model | 160 lines |
-| `handoff.md` | cold-resume guide: objective, last slice, next action, blockers, read-next. Sections carry content or `Nothing yet`; unevidenced recollections go under `Not tried yet`, never as results | 120 lines |
+| `handoff.md` | resume objective/last slice/next action/blockers/read-next; sections hold content or `Nothing yet`; unevidenced recollections: `Not tried yet`, never results | 120 lines |
 | `polish-report.md` | polish axis deltas, re-verification lines, residual subjective preferences | 200 lines |
 | `ship.md` | ship preflight, disclosed Git plan, commit/push/tag/PR record | 120 lines |
+| `review.md` | reconciled Review verdict: `## Spec` and `## Code review` accounts, deferred-finding labels/actions, drift | 240 lines |
+| `seal.md` | seal preflight, exact reviewer roster accounts, GO/NO-GO verdict and disclosures | 200 lines |
+| `ai-spec.md` | model/RAG/agent/eval/LLM-output scope for AI surfaces | 160 lines |
 
-When emitting `visual/` HTML+outline pairs, open matching playbooks via
-[`visual-playbooks/index.md`](visual-playbooks/index.md) (progressive load; do not
-preload all seven). Required outline headings:
-[`visual-playbooks/outline-template.md`](visual-playbooks/outline-template.md).
+For visual pairs load only matching [playbooks](visual-playbooks/index.md); use
+the [required outline headings](visual-playbooks/outline-template.md).
 
 ## Candidate manifest and bindings
 
@@ -98,14 +95,19 @@ candidate scope; only manifest rows do.
 The public candidate limits are a 1 MiB manifest, 4,096 rows, a 4,096-byte
 path, 64 MiB per present file, and 256 MiB across all present files.
 
-Workspace and audit artifacts are not candidate paths. That includes every path
-under `.devrites/work/<slug>/visual/` (HTML, `.outline.md`, and optional
-`visual/README.md`). Durable project files include `.devrites/specs/**`,
-`DESIGN.md`, and `docs/adr/**`, plus the exact `.devrites/principles.md` owner.
-Under `.devrites`, only those principles and spec owners may be candidates;
-`ACTIVE`, `AFK`, `CHECKPOINT`, `archive/**`, `work/**`, and every other sibling
-fail closed. Engine owns malformed path, type, and size rejection; phases do
-not reinterpret a rejected manifest.
+A release milestone's union manifest is produced by `devrites-engine state
+merge-manifest <release-slug>` — it walks the recorded `sequence_parent` chain,
+folds every predecessor manifest, and resolves a path collision in favor of the
+later sequence position; a hand-assembled union is not authoritative. When the
+workspace cursor declares `sequence_role: release`, `check candidate` and
+`check seal` require the manifest to cover the whole recorded chain.
+
+Workspace and audit artifacts are not candidate paths, including all
+`.devrites/work/<slug>/visual/`. Durable owners include `.devrites/specs/**`,
+`DESIGN.md`, and `docs/adr/**`, plus `.devrites/principles.md`. Under `.devrites`,
+only those spec/principles owners qualify; all other siblings (`ACTIVE`, `AFK`,
+`CHECKPOINT`, `archive/**`, `work/**`) fail closed. Engine owns malformed path, type,
+and size rejection; phases never reinterpret a rejected manifest.
 
 `evidence.md`, `review.md`, and `seal.md` each contain exactly one unindented standalone
 binding line; `browser-evidence.md` does too when that file exists:
@@ -122,16 +124,46 @@ against a malicious concurrent same-size rewrite. Ship's exact Git-index scope,
 byte, binding, and secret checks own the final freeze immediately before commit.
 
 Only a structural `Budget override: <reason>` line (not a fenced example)
-permits excess. Phase writers check these limits before returning; there is no
+permits excess. Each line budget also bounds bytes at 400 bytes per budgeted line
+(`state.md` 120 lines → 48 KiB); long lines do not evade it.
+`devrites-engine orient <slug>` reports `artifact_budgets` (lines/bytes/over/override)
+and `bulk_files` (non-canonical files over 64 KiB) so a phase can decide what to read
+before loading. Phase writers check these limits before returning; there is no
 repository-local script assumption in the installed workflow.
 
+`check readiness` and `check seal` enforce the material band deterministically: a
+required artifact at or above 1.5× its line or byte budget with no structural override
+line blocks with the exact measurement and the three legal remedies (relocate history
+via `$rite-plan revise`, split via `$rite-plan course-correct`, or record the override).
+Overshoot below that band stays advisory and is reported by `orient`. Proof ledgers
+(`evidence.md`, `browser-evidence.md`, `touched-files.md`) are always advisory: they
+scale with proof volume, and `touched-files.md` keeps its own manifest limits.
+Because they are never gate-blocked they are also the only artifacts that can grow
+unboundedly — so phases read them by index, not whole-file: the standalone binding
+line, a `EVID-###`/section-header index (`grep -n`), then bodies only for entries
+naming this candidate's AC/slice IDs. An entry naming no in-scope ID is anomaly
+evidence to inspect, not skip. A whole-file read is allowed only when `orient`
+reports the artifact within budget; completeness for seal is engine-checked
+(literal `AC-###` presence), the reader judges quality.
+
+Two reasons are not durable fixes: slice or acceptance-criteria count (an over-budget
+`tasks.md`/`plan.md`/`traceability.md` from decomposition size is a
+[feature-sequence split](../../rite-plan/reference/slicing.md#feature-ceiling-split-an-epic-never-override-the-budget)),
+and history in `state.md` (checkpoint narrative moves verbatim to
+`history/<file>-<YYYYMMDD>.md`, append-only, never a phase read-next, with a one-line
+pointer left behind). A legacy workspace may carry a temporary `Budget override:` line
+as a bridge; `$rite-upgrade` routes it to relocation or the split, and new writers never
+create one for those two reasons.
+Apply [`context-hygiene.md` dispatch packets](standards/context-hygiene.md#dispatch-packets)
+for byte-size checks and lossless retrieval; budget overrides neither rewrite protected
+history nor require loading it all.
+
 ## Native readiness ownership
 
-`decision-coverage.md` records the topology scan; `test-plan.md` records executable proof;
-`eng-review.md` records exact reviewer verdicts, `Implementation readiness`, and the emitted
-`Readiness inputs SHA-256`. Root re-reads them and applies the ID-and-meaning checklist.
-The digest binds reviewed bytes; it never substitutes for semantic review. Normal readiness
-checks structure plus that binding, and Seal rechecks it.
+`decision-coverage.md` owns topology; `test-plan.md`, executable proof; `eng-review.md`,
+reviewer verdicts, `Implementation readiness`, and `Readiness inputs SHA-256`. Root
+re-reads their IDs/meaning. The digest binds bytes, never semantic correctness.
+Readiness checks structure/binding; Seal rechecks both.
 
 Proof commands must be repository-portable: no host wrappers, user-specific absolute paths,
 or temporary proof trees. Evidence records the executed command. Optional `visual/`
@@ -189,9 +221,9 @@ unless the stated reason makes the boundary irreducible.
 | temper | `spec.md`, `decision-coverage.md`, `decisions.md`, `assumptions.md`, `design-brief.md` |
 | define | `README.md`, `state.md`, `spec.md`, `decision-coverage.md`, `architecture.md`, `decisions.md`, `assumptions.md` |
 | vet | `state.md`, `spec.md`, `decision-coverage.md`, `README.md`, `traceability.md`, `plan.md`, `tasks.md`, `architecture.md`, `decisions.md` |
-| build | `state.md`, `decision-coverage.md`, `eng-review.md`, `test-plan.md`, `tasks.md`, `plan.md`, `architecture.md`, `traceability.md`, `questions.md`, and `touched-files.md` when present |
-| prove | `traceability.md`, `tasks.md`, `evidence.md`, `browser-evidence.md`, `touched-files.md` |
-| review/seal | `README.md`, `traceability.md`, `spec.md`, `evidence.md`, `decisions.md`, `drift.md`, `touched-files.md` |
+| build | `devrites-engine orient <slug>` first; then `state.md`, `eng-review.md` (Build readback + `## Deferred findings`), the selected slice and its `depends_on` via `devrites-engine observe slice <slug> <SLICE-ID>`, the `test-plan.md` and `traceability.md` rows that slice's AC IDs name, open `questions.md` gates, and `touched-files.md` when present. Load whole `tasks.md`/`plan.md`/`architecture.md`/`decision-coverage.md` only when `orient` shows them within budget or the slice cites a section by ID |
+| prove | `traceability.md`, `touched-files.md`; each built slice's `Tests/proof` and `Evidence required` via `observe slice`; `evidence.md`/`browser-evidence.md` via the bounded advisory read above |
+| review/seal | `README.md`, `traceability.md`, `spec.md`, `decisions.md`, `drift.md`, `touched-files.md`; `evidence.md`/`browser-evidence.md` via the bounded advisory read above |
 | handoff | `README.md`, `state.md`, `handoff.md`, then the linked source artifacts |
 
 ## Do not duplicate
@@ -199,7 +231,14 @@ unless the stated reason makes the boundary irreducible.
 - Do not make `spec.md` carry deep architecture; link to `architecture.md`/`flows.md`.
 - Do not copy acceptance criteria into `plan.md`; reference `AC-###`.
 - Do not copy full proof into `handoff.md`; link to `evidence.md`.
-- Do not make `state.md` an append-only log; keep only the current cursor.
+- Do not make `state.md` an append-only log; keep only the current cursor. A
+  checkpoint entry is at most three lines: what changed, the canonical record path or
+  DEC/EVID ID, and the next action. Digests, packet hashes, and finding narratives
+  belong to the record they identify, not the cursor.
+- Give each normative fact one owner and stable ID; reference rather than copy it.
+  Required schema mirrors remain required. Derive counts/mirrors or mechanically
+  check equality using available tools, never invented commands. Repair stale
+  derived values and assess consumer impact; they are not new policy decisions.
 - Do not create optional files before their phase; absence is meaningful. Do not
   treat `visual/` as required for readiness; emit HTML+outline only when a writer
   earns a richer visual, and keep Mermaid in `flows.md` when that is enough.

package/pack/generated/codex/skills/rite-autocomplete/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: rite-autocomplete
 description: Run the full DevRites lifecycle unattended; --ship continues to the final Git approval boundary. Use for one-shot autonomous work; not for a single phase.
-argument-hint: "[idea] [--ship|--yolo] [--max-slices N] [--full] [--cross-model]"
+argument-hint: "[idea] [--ship|--yolo] [--max-slices N] [--parallel N] [--full] [--cross-model]"
 user-invocable: true
 ---
 
@@ -53,9 +53,11 @@ executable controller/harness/bundle bytes or a missing writer, read
   malformed, and unavailable leaf calls. At the review cap, permit only work
   that reduces the queue.
 - Parse flags only from this invocation. `--ship`, `--yolo`, `--max-slices`,
-  `--full`, and `--cross-model` activate only as exact standalone tokens in
-  `$ARGUMENTS`; examples or earlier messages can never arm them. `--max-slices`
-  must occur once and be followed by a positive base-10 integer; missing, repeated, malformed, or conflicting values stop before any write.
+  `--parallel`, `--full`, and `--cross-model` activate only as exact standalone
+  tokens in `$ARGUMENTS`; examples or earlier messages can never arm them.
+  `--max-slices` must occur once and be followed by a positive base-10 integer;
+  `--parallel` must occur once and be followed by a base-10 integer in `1`–`10`.
+  Missing, repeated, malformed, or conflicting values stop before any write.
 - Temper always runs after Clarify. Unattended mode auto-applies only
   `hold-rigor` and `reduce-to-MVP`; any `expand` or added acceptance pauses.
 - Vet every plan. Cross-model is off unless the current invocation arms it.
@@ -75,7 +77,8 @@ executable controller/harness/bundle bytes or a missing writer, read
    from chat. After compaction or a resumed session, read `.devrites/ACTIVE`, then
    the `state.md` cursor, `questions.md`, `decisions.md`, and `test-plan.md`/`evidence.md`.
    Normalize current arguments to idea, `ship_preflight: yes|no`,
-   `max_slices: N|default`, `profile: standard|full`, and `cross_model: yes|no`.
+   `max_slices: N|default`, `parallel: N|default`, `profile: standard|full`,
+   and `cross_model: yes|no`.
    **Completion:** normalized state is unambiguous and no sentinel or workspace file has been written.
 2. **Specify and clarify.** Run `devrites-interview`, `$rite-spec`, and
    `$rite-clarify` as one window. Partial/Missing material coverage never arms
@@ -87,9 +90,13 @@ executable controller/harness/bundle bytes or a missing writer, read
    **Completion:** a valid read-only AFK sentinel exists.
 4. **Drive phases.** Follow [the loop](reference/loop.md): `$rite-spec` →
    `$rite-clarify` → `$rite-temper` → `$rite-define` → `$rite-vet` →
-   `$rite-build` × pending slices → `$rite-prove` → `$rite-polish` →
+   `$rite-build` batch loop → `$rite-prove` → `$rite-polish` →
    `$rite-review` → `$rite-seal`. Read and execute each skill; durable files, not
    chat, carry state. Apply the mutable post-vet budget before first Build.
+   Build runs the largest eligible path-disjoint batch (cap: `--parallel N`, else
+   sentinel `max_parallel`, else 10) and recomputes after every integrate until no
+   pending slice remains; serial only when fewer than two slices are eligible or the
+   host cannot isolate concurrent worktree writers.
    **Completion:** loop reaches Seal GO or persists a valid stop before any later phase.
 5. **Apply stops.** At every gate use
    [stop-conditions.md](reference/stop-conditions.md). A `blocked` label alone is not a stop condition:
@@ -98,8 +105,12 @@ executable controller/harness/bundle bytes or a missing writer, read
    hard risk, human-owned blocking/escalating/NO-GO, resource exhaustion, or the
    exact fingerprint's proven exhaustion. Technical exhaustion records terminal
    `Next step: none`, never a routine phase command. **Completion:** no stop is active, or its cursor and reason are durable.
-6. **Seal boundary.** Without a ship flag, stop at Seal GO with `$rite-ship`.
-   With one, perform Ship preflight, disclose the exact Git plan, and stop for
+6. **Seal boundary.** Without a ship flag, stop at Seal GO with `$rite-ship` —
+   unless `continue_sequence` is armed and sequence budget remains, in which case
+   leave the sealed workspace unshipped and open the next recorded continuation
+   ([loop.md § Sequence continuation](reference/loop.md#sequence-continuation));
+   report the sequence position on every stop.
+   With a ship flag, perform Ship preflight, disclose the exact Git plan, and stop for
    fresh literal `GO` plus native approval. **Completion:** performed no Git action before fresh literal `GO` plus native approval.
 
 ## Reply and resume