devrites 5.4.0 → 5.6.0

package/pack/generated/codex/skills/rite-autocomplete/reference/loop.md

@@ -19,6 +19,9 @@ max_agents: 32
 max_minutes: 120
 max_review_queue: 8
 expires_at: "<now + 4 hours>"
+# continue_sequence: true          # opt-in: chain recorded continuations after Seal GO
+# max_workspaces: 5                # sequence budget when chaining
+# max_parallel: 10                 # Build batch cap; 1 = serial (default: eligible, cap 10)
 # max_tokens: <N>
 # max_cost_usd: <amount>
 # notify: "<cmd>"
@@ -63,7 +66,7 @@ Workspace files carry state; chat does not. Read and execute each phase skill:
 | 3 | `$rite-temper` | harden or reduce; expansion and irreversible risk pause |
 | 4 | `$rite-define` | approved plan/tasks/traceability |
 | 5 | `$rite-vet` | every plan; derive mutable budget after READY |
-| 6 | `$rite-build` ×N | one pending slice per wright; charge once only after green built state |
+| 6 | `$rite-build` batch loop | largest eligible path-disjoint set (cap 10; serial when <2 eligible); recompute after each integrate; charge once per green built slice |
 | 7 | `$rite-prove` | all slices built; approved proof; recovery on red |
 | 8 | `$rite-polish` | re-prove after code edits |
 | 9 | `$rite-review` | in-scope correction then fresh proof |
@@ -74,6 +77,35 @@ Before advancing, check resource admission and
 [stop-conditions.md](stop-conditions.md). After source edits, discard stale pass
 evidence. Re-read the active workspace before each phase.
 
+## Sequence continuation
+
+With `continue_sequence: true` and sequence budget remaining
+([sentinel](../../devrites-lib/reference/standards/afk-hitl.md#sequence-continuation-continue_sequence-max_workspaces)),
+step 10 does not end the run: leave the sealed workspace unshipped with its
+`Next step: $rite-ship`, then invoke the next recorded continuation
+(`$rite-spec <parent>-<n> "<objective>"` from the parent's `decisions.md` sequence)
+and re-enter step 1. Spend one workspace per opened continuation.
+
+Spend accounting is durable in `state.md` cursors, not chat. Before invoking the
+continuation, ensure the current workspace's `sequence_workspaces_remaining` is
+set — absent, write `max_workspaces - 1` and `sequence_position: 1` first — and
+`> 0`. `$rite-spec` seeds the child's sequence cursor at creation per the
+[continuation contract](../../rite-plan/reference/slicing.md#continuation-workspaces);
+after the child's `state.md` exists, verify it — `sequence_parent` = the current
+slug, `sequence_position` = parent position + 1,
+`sequence_workspaces_remaining` = parent remaining − 1, and — when the recorded
+entry is the sequence's release milestone — `sequence_role: release` (gates then
+require the union manifest). On resume, a child whose
+fields are missing is re-seeded from its `brief.md` parent/position and the
+parent's counter (same values, never a second charge); a child with no recorded
+parent/position is not a sequence member and the chain stops.
+
+Stop instead when: no recorded next entry; the cap, expiry, or review-queue bound is
+reached; a human-owned, safety, access, or exhaustion condition fires; or Seal returns
+`NO-GO`. On stop, report the sequence position, the sealed-but-unshipped workspaces, and
+the single release command (`$rite-autocomplete <release milestone> --ship`, or
+`$rite-ship` for the current sealed workspace when the sequence is complete).
+
 ## Backtrack without handing off
 
 The active Autocomplete root remains caller whenever a later phase exposes an

package/pack/generated/codex/skills/rite-build/SKILL.md

@@ -1,22 +1,22 @@
 ---
 name: rite-build
-description: Build the next approved vertical slice with evidence. HITL one-slice default; AFK may chain serially; opt-in `--parallel N` (2≤N≤10) for path-disjoint worktrees.
+description: Build the next approved vertical slice with evidence. HITL one-slice default; AFK/autocomplete chain serially or in eligible path-disjoint batches (dynamic size, cap 10); `--parallel N` caps a batch.
 argument-hint: "[--parallel N] [slice number or name]"
 user-invocable: true
 ---
 
 # $rite-build: one verified slice
 
-Build and prove one slice. HITL stops; a later user invocation starts the next.
-Explicit `.devrites/AFK` alone lets the controlling root chain pending slices
-serially under green proof, caps, and pause rules. Every wright returns after one slice.
+HITL stops; a later user invocation starts the next slice.
+Explicit `.devrites/AFK` alone lets the controlling root chain under green proof,
+caps and pause rules. Every wright returns after one slice.
 **Opt-in:** `$rite-build --parallel N` (2≤N≤10; N=1≡serial) follows
 [`reference/parallel-batch.md`](reference/parallel-batch.md)
 ([`one-slice-cycle.md`](reference/one-slice-cycle.md)).
 
-Root owns gates/bookkeeping. Fresh
-[`devrites-slice-wright`](.codex/agents/devrites-slice-wright.toml) writes product
-source/tests. Workflow Artifact paths use
+Root owns gates/bookkeeping; fresh
+[`devrites-slice-wright`](.codex/agents/devrites-slice-wright.toml) writes source/tests.
+Workflow Artifacts use
 [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md).
 Execute [`reference/phase-contract.md`](reference/phase-contract.md)
 ([`one-slice-cycle.md`](reference/one-slice-cycle.md),
@@ -37,7 +37,8 @@ Wright applies anti-slop; root verifies returns and never patches source.
   multi-writer / root-emulated concurrency forbidden. Native-worktree pilot =
   single-slice isolation when `wright-dispatch.md` preflight + reconcile hold.
 - Exact feature scope only; reject out-of-allowlist diffs; record adjacent issues.
-- Never rerun an unchanged check; re-prove after edits.
+- Re-prove affected behavior after edits; reuse observations only under
+  [evidence validity](../devrites-lib/reference/candidate-integrity.md#evidence-validity).
 - Unplanned dependency/design-system/gap/repair → Vet/Spec Drift Guard batch
   sweep: every contract-assumption violation recorded before one folded
   repair+vet. Ask only for licensing/cost/security/product or explicit
@@ -57,29 +58,35 @@ Wright applies anti-slop; root verifies returns and never patches source.
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"Vet-ready admitted bytes require root authorship outside product wright","action":"ROOT_TRANSACTION; root writes only admitted .devrites/** targets","return":"saved Build slice cursor; wright product allowlist unchanged"} -->
 ## `--parallel N` (opt-in)
 
-Omitted/`1` ≡ serial; `2`–`10` → path-disjoint fan-out when eligible; else hard refuse.
+Omitted/`1` ≡ serial; `2`–`10` is a **cap** — the root runs the largest eligible
+path-disjoint set it can start now (`N_eff`), takes fewer when the cap cannot be
+filled, and recomputes after every integrate until no pending slice remains
+([`parallel-batch.md` § Dynamic selection](reference/parallel-batch.md#dynamic-selection-and-re-batching)).
+Unattended runs (`$rite-autocomplete`, `.devrites/AFK` `max_parallel`) repeat batches
+inside the same run; HITL stops after each batch. Non-integer/`N≤0`/`N>10` hard refuse.
 All-green serial integrate; a red/gap sibling gets a bounded repair round in
 its own worktree — never rebuilt from scratch while budget remains.
-Plan-owned gaps still route through Spec Drift Guard (batch sweep, one folded
-plan repair + one vet recheck inline); do not emit a human `Fix`. Exhausted
-repair blocks and preserves everything; `cleanup --force` salvages slice
-branches before removing worktrees — human-gated to abandon a batch,
-orchestrator-emitted only as the salvage step of an automatic frozen-lease
-re-batch.
+Post-writer inventory and affected rechecks follow `phase-contract.md` § Independent
+Build review; fold accounts before one repair-all wright.
+Plan-owned gaps still route through Spec Drift Guard
+(batch sweep, one folded plan repair + one vet recheck inline); do not emit
+a human `Fix`. Exhausted repair blocks and preserves everything;
+`cleanup --force` salvages slice branches before removing worktrees —
+human-gated to abandon a batch, orchestrator-emitted only as the salvage
+step of an automatic frozen-lease re-batch.
 AFK charges after integrate only. Running lease blocks another
 `$rite-build`. Details: `parallel-batch.md`.
 
 ## Execute and reply
 
 Run every step in `reference/phase-contract.md`: readiness, one target, dispatch
-or canonical transaction, return inspection, independent doubt/test analysis,
+or canonical transaction, return inspection, independent code/doubt/test analysis,
 approved fail-on-red proof, record, AFK accounting, and stop. Use
 [`reference/output.md`](reference/output.md) plus the shared
 [`reply contract`](../devrites-lib/reference/reply-contract.md). HITL never starts
-the next slice automatically; AFK chains only within its durable remaining
-budget; Prove starts only after all slices are built.
+the next slice automatically; AFK obeys remaining budget; Prove requires all slices built.
 
-## Phase exit (observable)
+## Phase exit
 
 **Complete when:** the dispatched wright returns green proof for the slice,
 `git diff --name-only` ⊆ allowlist, independent test analysis admits no Critical

package/pack/generated/codex/skills/rite-build/reference/afk-discipline.md

@@ -87,7 +87,7 @@ any of:
 - External-service contract change (webhook payload, partner-facing schema).
 - Filesystem destructive operation outside the workspace (`rm -rf` of project paths,
   rewriting `.gitignore`-listed paths, deleting fixtures).
-- Anything the slice's `Gate: blocking` plus `tasks.md` `Why HITL:` flags as irreversible.
+- Anything the slice's `Gate: blocking` plus its `Checkpoint:` line in `tasks.md` flags as irreversible.
 
 This is the Claude Code auto-mode transcript classifier list adapted to the DevRites
 workspace.

package/pack/generated/codex/skills/rite-build/reference/parallel-batch.md

@@ -7,13 +7,39 @@ Opt-in only. Default `$rite-build` stays [`one-slice-cycle.md`](one-slice-cycle.
 | Input | Behavior |
 | --- | --- |
 | omitted / `--parallel 1` | Serial one-slice |
-| `--parallel N` (**2≤N≤10**) | Parallel when eligible + host pass |
+| `--parallel N` (**2≤N≤10**) | N is a **cap**, not a quota: run the largest eligible set ≤ N |
 | non-integer / `N≤0` / `N>10` | Hard refuse (no silent clamp) |
+| Autocomplete, no flag | Same path, cap from sentinel `max_parallel` else 10; serial only when ineligible |
 
-AFK caps `N` by remaining budget. Charge **only after successful integrate**
-(once per integrated green sibling). Abort / integrate-failed → **0**. A
-present lease is resumable: `$rite-build` continues it (repair rounds or the
-blocked verdict); `parallel create` refuses until cleanup.
+AFK caps `N`. Charge green siblings once after integrate; abort /
+integrate-failed → **0**. `parallel create` refuses while a lease exists.
+Reconcile retained repair-round artifacts by exact causal fingerprint before honoring a stored blocked status/verdict. Blocked status, round count, or distinct finding alone cannot stop cold resume: establish missing or stale review coverage under step 4; repair unless a stop condition remains evidenced.
+
+## Dynamic selection and re-batching
+
+Size each batch by what is runnable **now**, never by the requested number:
+
+```text
+N_eff = min(
+  cap                  -- --parallel N | sentinel max_parallel | 10 (autocomplete default)
+  eligible set         -- dependency-satisfied pending slices, pairwise path-disjoint
+  AFK headroom         -- remaining max_slices, max_agents, max_minutes, review queue
+  host capacity        -- concurrent worktree writers + the runtime isolation table
+)
+```
+
+Select **greedily in plan order**: walk pending slices whose `depends_on` are built and
+add each one while it stays pairwise disjoint with the selected set and the cap is not
+reached. Then `N_eff ≥ 2` → parallel batch; `N_eff = 1` → the serial one-slice cycle;
+nothing pending → Prove. A cap that cannot be filled is normal: take fewer.
+
+**Re-batch automatically.** After integrate + cleanup are green, re-read `state.md`,
+the pending slices (`observe slice`), and the updated tree, then recompute: integrated
+siblings leave the pending set and free their paths, and satisfied dependencies unlock
+new slices. Repeat until no pending slice remains. Under `.devrites/AFK` and
+`$rite-autocomplete` the repeat is part of the same run — a new batch is another
+`$rite-build --parallel` round inside it, not a new user invocation; HITL stops after
+each batch. A batch of three followed by one of four and then two is the expected shape.
 
 ## Path-disjoint
 
@@ -21,7 +47,9 @@ Exact project-relative source/test paths only. Normalize `\`→`/`. Reject `..`,
 duplicates, absolutes, `.devrites/**`. Empty pairwise intersection required.
 
 **SSOT:** `devrites-engine check path-disjoint [--root <dir>] [<json-file>|-]`
-(N≥2 only; pass `--root`). Exit `0` → fan-out; else force serial. Inspect-time
+(N≥2 only; pass `--root`). Input is `{"slices":[{"id":"SLICE-002","paths":["src/policy.rs","src/policy/mod.rs"]}]}`
+(or a top-level array) built from each candidate's `Files likely touched`.
+Exit `0` → fan-out; else force serial. Inspect-time
 overlap → sibling **gap** (a shared path is a contract defect). **Failing
 case:** two parallel wrights share a path and fan-out proceeds without that
 check.
@@ -40,14 +68,29 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
 
 ## Lifecycle
 
-1. Orient/gate; parse N; select ≤N path-disjoint pending slices.
+1. Orient/gate; parse the cap; compute `N_eff` and select the eligible set
+   ([Dynamic selection and re-batching](#dynamic-selection-and-re-batching)) —
+   candidates from `orient` `task_graph.slices` + built list, each candidate's
+   `Files likely touched` via `observe slice`, disjointness via `check path-disjoint`.
 2. Write lease; freeze `B=HEAD`; `parallel create` worktrees.
 3. Dispatch ≤10 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`).
-4. Inspect + fail-on-red → `green|red|gap`. Independent-review Critical is `gap`
-   even when targeted tests are green.
+4. Inspect each returned path list, cumulative diff from `B`, transfer identity,
+   and required result fields against the immutable contract. Reject malformed,
+   stale, or out-of-scope work. Apply
+   [independent Build review](phase-contract.md#independent-build-review): first
+   full inventory, then bounded owning-role rechecks after repairs. Gap or
+   Critical/Important → `gap`; else approved proof → `green|red|gap`.
+   Reviewer fan-out for a batch is itself batched under
+   [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md#scale-limits)
+   (≈4 concurrent read-only reviewers, 8 only with disjoint paths), and `max_agents`
+   headroom bounds the batch size — one batch never assumes unbounded reviewers.
 5. Non-green siblings → **repair round** (below) in the same worktrees; lease
    stays `running` — no abort while repair budget remains. A green sibling →
    `parallel record-green`. No partial integrate. All green → integrate.
+   A recoverable RED blocks integration but does not cancel independent safe running siblings.
+   Expected test-first RED is not a terminal gate failure. Cancel only for a shared
+   invalid foundation, safety/access failure, resource boundary, or explicit stop;
+   preserve completed and in-progress recoverable work and classify each result.
 6. Integrate: each `transfer_commit` descends from `B` and diffs path-exact vs
    `B`; squash-apply all in plan order into one `WIP(<slug>):` commit on the
    staging branch (Ship collapses it). Conflict → reset to `B`,
@@ -69,46 +112,53 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
 
 ## Repair rounds
 
-Rejected work is repaired in place — never discarded and rebuilt from scratch
-while budget remains.
+Repair rejected work in place; never discard/rebuild while budget remains.
 
-- Record each round as `build-parallel-<batch>-repair-<round>.json`: per
-  non-green sibling — status, verbatim findings, transfer_commit or null.
-- Classify first: **implementation defect** (review Critical on the diff, red
-  wright/proof) → repair wright in the same worktree. **Durable-plan defect**
+- Record each round as `build-parallel-<batch>-repair-<round>.json`: each
+  non-green sibling's status, verbatim findings, transfer_commit/null.
+- Use step 4's initial inventory or affected recheck as appropriate; never start
+  a correction from an early reviewer result while required accounts are pending.
+- Classify the complete inventory: **implementation defect** (review
+  Critical/Important on the diff, red wright/proof) → one repair-all wright in
+  the same worktree with the full inventory. **Durable-plan defect**
   (falsified contract assumption, AC unchanged) →
   [`spec-drift-guard.md`](spec-drift-guard.md): batch-sweep contract
   assumptions, one folded `$rite-plan repair` + one `$rite-vet` recheck
   inline, resume repair in the same worktrees under the amended contract;
-  never emit `Fix:`. **Frozen-lease scope defect** — the amended contract or
-  a review requirement needs paths outside a slice's allowlist, or re-slices
-  the plan (a lease is immutable once written: its allowlists are the
-  disjointness guarantee) → **automatic re-batch, no human gate**:
-  `parallel cleanup --force` as the salvage step, record the retained refs in
-  the repair-round artifact, `parallel create` a fresh batch from control
-  `HEAD` under the corrected decomposition. Prior attempts stay reachable —
-  hand each new wright the salvaged branch ref
-  (`devrites/parallel/<slug>/<old-batch>/<slice>`) so it builds on what worked
-  instead of starting blind. If no corrected decomposition exists, that is
-  exhaustion → blocked, preserve, STOP. **Reviewer stall/cancel or missing
+  never emit `Fix:`. **Frozen-lease scope defect** (correction needs
+  out-of-allowlist paths or re-slicing; lease allowlists are immutable) →
+  **automatic re-batch, no human gate**: `parallel cleanup --force` salvages
+  and records refs; `parallel create` starts from control `HEAD` under the
+  corrected decomposition. Give each new wright its salvaged
+  `devrites/parallel/<slug>/<old-batch>/<slice>` ref. If the inventory proves the accepted
+  approach unsound and no corrected decomposition exists, that is exhaustion
+  → blocked, preserve, STOP. **Reviewer stall/cancel or missing
   verdict** → re-dispatch the reviewer, not the wright. **Product/policy/
   irreversible** → stops for the human.
-- Dispatch a fresh `devrites-slice-wright` (cwd = the sibling's worktree, same
-  allowlist and host rules as step 3 — siblings may repair in parallel) with
-  the original contract + verbatim findings + "preserve what works; fix the
-  named findings; return a new `transfer_commit`". Never reset the worktree
+- Dispatch one fresh repair-all `devrites-slice-wright` (cwd=worktree; step 3
+  rules) with the original contract + complete inventory +
+  "preserve what works; fix every finding; **then attack your own correction** —
+  probe the changed hunks for defects the fix itself introduced (adjacent cases of
+  the same rule, new observation/ordering windows, alias or boundary escapes) and
+  fold them in before returning; return a new `transfer_commit`". A correction whose
+  own diff is unexamined is not ready: a green writer gate plus an unexamined fix is
+  how the same defect family reappears one case deeper each round. Never reset
   to `B` — that destroys the work under repair. The commit must still descend
   from `B` and diff path-exact vs `B`.
-- Each repair return re-runs the full gate chain: inspect, fresh doubt +
-  test-analysis, approved proof.
-- Budget: the shared causal-fingerprint cap — three total failed attempts per
-  sibling per fingerprint (build + repairs count together); a distinct
-  Critical is a new fingerprint. Exhaustion is not abort: record one
-  technical blocker (`Status: blocked`; `Next step: none — technical recovery
-  exhausted for <fingerprint>; requires new evidence or changed failure
-  conditions`), preserve lease/worktrees/branches, STOP — same fingerprint
-  stays blocked on reinvoke; new evidence resumes repair in place. Human-
-  owned decisions use the drift-guard question and wait.
+- Budget and exhaustion follow only
+  [the canonical retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve).
+  Record one failed invariant, mechanism, reproduction, correction, and decisive
+  recheck per fingerprint; never use an umbrella like "covering" or "review is red again".
+- A distinct post-repair Critical/Important gets a new fingerprint: refresh the
+  inventory and affected owning-role rechecks. It proves neither plan defect nor
+  exhaustion. Use plan path only if inventory proves the approach unsound.
+- Stop under the canonical retry/authority/resource conditions, or when evidence
+  proves the approach unsound and no in-scope corrected decomposition exists.
+- Exhaustion is not abort: record one technical blocker (`Status: blocked`;
+  `Next step: none — technical recovery exhausted; requires new evidence or changed failure conditions`), preserve
+  lease/worktrees/branches, STOP — same fingerprint stays blocked on
+  reinvoke; new evidence resumes repair in place. Human-owned decisions use
+  the drift-guard question and wait.
 
 ## Engine verbs
 

package/pack/generated/codex/skills/rite-build/reference/phase-contract.md

@@ -1,67 +1,87 @@
 # rite-build phase contract
 
-See [`one-slice-cycle.md`](one-slice-cycle.md); candidate lifecycle is
+Apply [`one-slice-cycle.md`](one-slice-cycle.md) and
 [`candidate-integrity.md`](../../devrites-lib/reference/candidate-integrity.md).
-Opt-in `--parallel N` uses [`parallel-batch.md`](parallel-batch.md) instead of steps 2–8.
-Spec Drift Guard still applies on abort or plan-gap.
+Opt-in `--parallel N` replaces steps 2–8 with [`parallel-batch.md`](parallel-batch.md);
+Spec Drift Guard still applies.
 
-1. **Orient and gate.** Read core, `.devrites/ACTIVE`, `state.md`, and required
-   slice artifacts. Require `Implementation readiness: READY`, its current
-   `Readiness inputs SHA-256`, all applicable exact reviewer accounts,
-   ID-and-meaning traceability, and green proof preflight; run
-   `devrites-engine check readiness <slug>`. Any miss/nonzero stops.
-2. **Select one target.** Restate goal, acceptance criteria, exclusions, and exact
-   source/test paths. Reconcile the spec/plan applicability map and include only the
-   triggered topology/data/integration standards plus their named failure/recovery/proof
-   cases in the writer contract. Before dispatch, validate relevant `assumptions.md` rows
-   against live evidence. If one is disproved and changes acceptance, architecture,
-   scope, or proof, use the Spec Drift Guard/plan recovery; a human-owned unknown
-   stops. Resolve HITL before source work. AFK answers only permitted gates;
-   human-owned or irreversible risk persists a question and stops for `$rite-resolve`.
-   If the target is an exact Vet-ready Workflow Artifact set, apply
-   [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md)
-   instead of treating it as a product slice.
-3. **Dispatch or transact.** Product source/tests apply [`wright-dispatch.md`](wright-dispatch.md).
-   Put the smallest exact project-relative source/test path list directly in the task;
-   dispatch the exact `devrites-slice-wright` fresh. Root never writes those product
-   paths, wright never widens, and a missing profile stops.
+1. **Gate.** Read core, `.devrites/ACTIVE`, then `devrites-engine orient <slug>`
+   and the Build read-next in
+   [`workspace-artifact-schema.md`](../../devrites-lib/reference/workspace-artifact-schema.md#read-next-by-phase):
+   the selected slice via `devrites-engine observe slice <slug> <SLICE-ID>`, not whole
+   `tasks.md`; over-budget or `bulk_files` artifacts are read by anchor only. Require
+   `Implementation readiness: READY`, current `Readiness inputs SHA-256`, exact
+   required accounts, ID/meaning traceability and green proof preflight.
+   Run `devrites-engine check readiness <slug>`; any miss/nonzero blocks.
+2. **Select.** Pick the lowest pending slice whose `depends_on` are all built, using
+   `orient` `task_graph.slices` plus the `state.md` built list — never by scanning
+   `tasks.md`; then `observe slice` it. Restate its goal, ACs, exclusions and exact paths. Include
+   applicable topology/data/integration invariants and failure/recovery/proof cases.
+   Verify relevant assumptions live; falsified acceptance/architecture/scope/proof
+   routes through Spec Drift Guard. Resolve human-owned/irreversible gates before
+   source work; AFK follows its ceiling. Vet-ready Workflow Artifacts use
+   [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md).
+3. **Dispatch.** Apply [`wright-dispatch.md`](wright-dispatch.md). Put the smallest
+   exact project-relative source/test path list directly in the task;
+   dispatch the exact `devrites-slice-wright` fresh. Root never writes product
+   paths; wright cannot widen scope; missing profile blocks.
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"Build gate enters or resumes transaction","action":"invoke canonical operation table; reconcile exact result","return":"same slice/checkpoint cursor or Plan/Vet route"} -->
-4. **Inspect the return.** Wait; compare its file list and `git diff --name-only`
-   with the contract. Reject stale, partial, malformed, or out-of-scope work.
-   Preserve user work; source restoration uses the same bounded wright.
-5. **Challenge stood decisions.** For each stood decision, run exact
-   `devrites-doubt-reviewer` fresh/read-only and record accepted or resolved-rejected
-   in `decisions.md`. A missing verdict, principle breach, scope change, or
-   irreversible risk blocks.
-6. **Prove without guessing.** Against the frozen pre-slice candidate, inspect
-   test hunks for deletion, skipping/focus, tautology, or weaker expectations. Dispatch exact
-   `devrites-test-analyst` on that immutable diff; missing account or adverse criterion
-   verdict is Critical. Run only `test-plan.md` repository/CI commands, capture output,
-   and recheck `git diff --name-only`. Missing, weakened, red, or source-mutating proof
-   is not success.
+4. **Inspect.** Wait; compare returned paths and `git diff --name-only` with the
+   contract. Reject stale/partial/malformed/out-of-scope work; preserve user work.
+   Restoration uses the bounded wright.
+5. **Review.** Apply [Independent Build review](#independent-build-review).
+   Missing verdicts, principle breaches and open Critical/Important block acceptance.
+6. **Prove.** Against the frozen pre-slice candidate inspect
+   test hunks for deletion, skipping/focus, tautology, or weaker expectations.
+   Use step 5's exact test-analyst account; missing/adverse criterion verdict is
+   Critical. Run only `test-plan.md` repository/CI commands, record output, recheck
+   `git diff --name-only`. Missing/weakened/red/source-mutating proof cannot pass.
+   Pre-existing/environment-specific claims need a predating same-command,
+   same-environment baseline; otherwise unresolved.
 
-   A failure is `pre-existing` or environment-specific only with a same-command,
-   same-environment baseline predating the candidate; otherwise it remains unresolved.
+   Technical failure uses `devrites-debug-recovery` and
+   [canonical recovery](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve).
+   Reapply host admission before correction; affected proof/evidence follows candidate
+   integrity. Human gates remain product/irreversible/access decisions.
+7. **Record green.** Upsert actual scoped `present`/`deleted` rows in `touched-files.md`;
+   update state, evidence and applicable UI/browser proof. Manifest stays mutable
+   until Polish. For a release milestone, after the last slice's rows run
+   `devrites-engine state merge-manifest <slug>` to fold the recorded
+   predecessor chain into the union manifest before Prove. Record stood
+   decisions/dead ends; refresh verified/falsified
+   assumptions. Propose reviewed durable project rules in the nearest guidance.
+8. **Account/reply.** Apply `afk-discipline.md`: charge
+   exactly once after each green built slice; never negative, stop at zero,
+   malformed budget fails closed. Reply names next pending slice or `$rite-prove`
+   only when all built; no decorative renderer/dispatch telemetry.
 
-   Technical failure uses bounded `devrites-debug-recovery`: reapply the host gate
-   before an accepted in-slice correction, keep one exact fingerprint/three
-   no-progress attempts, and never rerun an unchanged check. A closed reproduction
-   is progress; a different Critical/Important invariant gets its own fingerprint.
-   Ask humans only for product decisions,
-   irreversible risk, or genuinely human-only access.
-7. **Record.** After green proof, upsert `touched-files.md`'s authoritative candidate
-   manifest from the actual scoped diff with explicit `present`/`deleted` rows;
-   update `state.md`, `evidence.md`, and applicable UI/browser evidence. The manifest
-   stays mutable until Polish closes it.
-   Record stood decisions/dead ends in `decisions.md`; update checked assumptions'
-   status/evidence, never leaving a disproved row live. If code reveals a durable
-   project rule, propose a reviewed `AGENTS.md`/nearest-doc update, not a scored ledger.
-8. **AFK and reply.** Under `afk-discipline.md`, root charges
-   exactly once after each green built slice, never below zero; stop before another dispatch at zero, and fail closed
-   on malformed budget. Use the reply contract; name the next pending slice or, only
-   when all slices are built, `$rite-prove`. Emit no decorative progress renderer or
-   dispatch telemetry.
+One contract builds one slice: preserve TDD, exact paths and independent judgment.
 
-> **Mid-flight discipline.** One writer contract builds one slice. Do not skip
-> TDD, widen paths, fold in a second slice, or accept the writer's judgment as
-> independent review.
+## Independent Build review
+
+After inspection, freeze full slice scope and cumulative baseline diff. Initial
+inventory: one full-diff `devrites-code-reviewer`, one `devrites-test-analyst`,
+and one exact `devrites-doubt-reviewer` per stood decision that meets
+`devrites-doubt` § When to use (boundary, data model, auth, public API, migration,
+user flow, assumption tests cannot prove); other stood decisions are recorded in
+`decisions.md` without dispatch. Dispatch fresh,
+read-only under [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md).
+Wait for every required account to become terminal; missing/gap needs a valid result.
+Fold supported in-scope Critical/Important findings by cause into one inventory.
+Dispatch one repair-all wright instructed to fix every finding, then attack its own
+correction for fix-introduced defects before returning; durable contract defects use Spec
+Drift Guard.
+Suggestion/Nit/FYI cannot prolong recovery.
+
+Rechecks use Vet's bounded pattern: each exact responsible reviewer checks
+all open findings owned by that role and affected dependency/regression closure
+in one fresh dispatch. Supply new candidate, inventory, correction diff, tests
+and unchanged-coverage evidence under candidate integrity; include newly triggered
+roles. A changed contract or uncertain impact requires the full inventory.
+Collect all required rechecks before another folded correction. Canonical recovery
+owns fingerprints/budget and the
+[late-finding rule](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve):
+a recheck's `Late:` rows on hunks unchanged since that role's previous pass go to
+`touched-files.md` `## Review trail` for `$rite-review`, not into another slice
+repair, unless Critical with a failure path. Evidenced scope coverage never
+guarantees no later defect; the feature-level Review and Seal gates still run.

package/pack/generated/codex/skills/rite-build/reference/spec-drift-guard.md

@@ -1,8 +1,7 @@
 # Spec Drift Guard (build phase)
 
-Active throughout `$rite-build`. The spec is living, not sacred, but you may not
-silently code against a plan you know is wrong. This is the canonical Spec Drift Guard;
-other phases reference it here.
+Canonical Spec Drift Guard, active in `$rite-build` and referenced by other
+phases. Never silently code against a known-wrong plan.
 
 ## Drift has occurred when
 - the spec says X but the code makes X impossible/wrong;
@@ -16,7 +15,7 @@ other phases reference it here.
 ## Workflow
 ```
 1. STOP coding.
-2. Record in drift.md (assumed vs observed, when).
+2. Record drift.md (assumed vs observed, when).
 3. Classify: requirement ambiguity | implementation-plan error | codebase reality
    mismatch | design-system mismatch | test/evidence mismatch | external-doc mismatch
    | user-decision required.
@@ -35,12 +34,14 @@ other phases reference it here.
 
 ## Batch sweep (before repair)
 
-A durable-plan drift abort never repairs the first gap alone:
+Repair durable-plan drift as a folded set:
 
-1. Verify every remaining statically-checkable contract assumption against the
-   live repo — named paths, symbols/APIs/signatures, routes, commands, dependency
-   versions, contract artifacts. The wright's return names what it falsified;
-   check the rest yourself — existence checks are deterministic, no dispatch.
+1. Trace the falsified assumption's full dependency/consumer closure and affected
+   frontier, including dependent future slices. Verify unchecked paths, symbols/APIs/
+   signatures, routes, commands, versions, and artifacts there against live source.
+   Reuse the wright inventory and unchanged evidence; deterministic existence checks
+   need no dispatch. Do not rescan unrelated slices. Broaden unknown closure or shared
+   contract changes until coverage is justified; retain every known gap.
 2. Record each violation as its own `drift.md` entry/fingerprint; one folded
    repair + one batched recheck resolves the set.
 3. A recheck-surfaced gap is a new fingerprint with its own budget — loop
@@ -75,11 +76,9 @@ human permission question. Re-plan only when the durable plan changed.
 
 ## Inline return contract
 
-The phase that detected agent-owned drift owns the whole backtrack, batch sweep
-included. Preserve it
-as `return_phase`/`return_next_action`; consume Plan and Vet's nested `STOP`
-boundaries internally; follow any vetted remediation required by the settled
-acceptance; then restore the cursor and resume the failed step. Do not hand an
-intermediate command to the human. The shared three-attempt causal-fingerprint
+The detecting phase owns backtracking and the batch sweep. Save
+`return_phase`/`return_next_action`; consume nested Plan/Vet `STOP` internally, complete
+vetted acceptance-preserving remediation, then restore the cursor and failed step.
+Never hand the human an intermediate command. The shared three-attempt causal-fingerprint
 cap still applies: exhaustion produces one technical blocker, while a genuinely
 human-owned decision uses the question format below.

package/pack/generated/codex/skills/rite-build/reference/wright-dispatch.md

@@ -1,12 +1,12 @@
 # Slice-wright dispatch
 
 `$rite-build` gives one bounded task to exact `devrites-slice-wright`.
-Root owns scope, artifacts, inspection, and routing but never writes source/tests; only
-the wright writes them and invokes no agent.
+Root owns scope/artifacts/inspection; never writes source/tests.
+Wright alone writes; no agents.
 
 ## Host gate
 
-Follow the canonical [source-writing boundary](../../devrites-lib/reference/standards/agents.md#source-writing-boundary):
+Apply [source-writing boundary](../../devrites-lib/reference/standards/agents.md#source-writing-boundary):
 Claude grants only the exact wright `acceptEdits`; Codex uses its workspace root,
 the exact `:workspace` wright, and read-only specialists. Never bypass/substitute
 the wright or recreate an engine bridge.
@@ -47,7 +47,7 @@ worktrees stay forbidden.
    controlling root under
    [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
    its rejection here is not a blocker.
-2. Put it in the task with goal, verbatim acceptance, exclusions, context,
+2. Include goal, verbatim acceptance, exclusions, context,
    `test-plan.md` proof commands, and applicable standards. For each triggered
    topology/data/integration standard, include only the feature-specific owner/invariant,
    failure or partial-state case, recovery rule, and required proof from the vetted plan.
@@ -77,10 +77,10 @@ Opt-in `$rite-build --parallel N` fans out only under [`parallel-batch.md`](para
    mocks that erase it and one-root proof offered for another root are unproven.
 3. Run only repository proof already approved by `test-plan.md`, then inspect
    `git diff --name-only` again in case a proof tool changed source.
-4. Challenge decisions. Human choices return; native diagnosis routes failures.
-   The root counts the wright plus recovery failures by causal fingerprint from
-   the current context and recorded Dead ends/evidence. Three total failed
-   attempts is the limit; persist each and never dispatch a fourth related try.
+4. Apply [independent Build review](phase-contract.md#independent-build-review) before
+   proof acceptance. Human choices return; technical failures follow
+   [the canonical retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve).
+   Derive accounting from recorded reproductions, corrections, and decisive rechecks.
 5. Reconcile returned reuse, conventions, principles, sources, assumptions,
    decisions, dead ends, follow-ups, gates, and touched files. Persist the
    relevant facts in canonical artifacts, not the wholesale report. A plan-gap

package/pack/generated/codex/skills/rite-define/SKILL.md

@@ -33,7 +33,10 @@ Pull these via `Read` when shaping the plan:
 - **Derive the slice count from the work.**
   One per independently-shippable increment, sized by `slicing.md`; map every acceptance
   criterion. User counts are hints: explain honest differences, never pad/compress.
-  `.devrites/AFK` `max_slices` is an iteration budget, not decomposition.
+  `.devrites/AFK` `max_slices` is an iteration budget, not decomposition. A derivation
+  over the [feature ceiling](../rite-plan/reference/slicing.md#feature-ceiling-split-an-epic-never-override-the-budget)
+  is a split signal, never a `Budget override`: keep the thinnest shippable subset
+  here and route the rest to Non-goals + continuation workspaces via the Drift Guard.
 - **Complexity does not shrink scope.** Split/reorder; never drop/defer approved REQ/AC.
   Reduction needs Drift Guard + human decision; hard/large means decompose.
 - **Wide refactors use expand → migrate → contract.** Add compatibility, migrate green

package/pack/generated/codex/skills/rite-plan/SKILL.md

@@ -97,7 +97,10 @@ Before classifying any Reslice, read `.agents/skills/devrites-lib/reference/stan
    in one cluster, and each bundle applies independently. A `partial`-
    continuation re-dispatch continues the same packet; it does not advance the
    same-seam counter. Count consecutive repair packets whose findings' cited clause sets overlap
-   the immediately previous packet's — the overlap is the seam. At the third
+   the immediately previous packet's — the overlap is the seam. Carry it as an explicit
+   integer `same_seam_count` in every packet (previous value + 1 when the seam repeats,
+   else 1) so the threshold is counted rather than judged; a packet that reports the same
+   seam without the counter is malformed. At the third
    same-seam packet, mark it `convergence_pressure: true` with the seam named.
    Under pressure the drafter may close a finding marked as a refinement of an
    already-pinned clause by folding an explicit, bounded declared