devrites 5.7.2 → 5.9.0

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [5.9.0](https://github.com/ViktorsBaikers/DevRites/compare/v5.8.0...v5.9.0) (2026-09-15)
+
+### Added
+
+* **rite:** land proven WIP commits and keep autocomplete running ([#75](https://github.com/ViktorsBaikers/DevRites/issues/75)) ([73bf932](https://github.com/ViktorsBaikers/DevRites/commit/73bf932568d7bae34ea20ce6476c33842b123467))
+
+## [5.8.0](https://github.com/ViktorsBaikers/DevRites/compare/v5.7.2...v5.8.0) (2026-09-14)
+
+### Added
+
+* **agents:** allowlist lean-ctx and lens tools on pi agents ([#74](https://github.com/ViktorsBaikers/DevRites/issues/74)) ([08390d3](https://github.com/ViktorsBaikers/DevRites/commit/08390d3bf3ccffec0353803e910ee7a7227ff6ba))
+
+### Fixed
+
+* **rite:** re-select parallel width after a serial round ([#73](https://github.com/ViktorsBaikers/DevRites/issues/73)) ([ac8f073](https://github.com/ViktorsBaikers/DevRites/commit/ac8f073c0640ab0350b92a87a86193de39dedd57))
+
 ## [5.7.2](https://github.com/ViktorsBaikers/DevRites/compare/v5.7.1...v5.7.2) (2026-09-14)
 
 ### Fixed

package/README.md

@@ -33,7 +33,7 @@ project-conventional push, tag, or PR action, and archive the workspace.
 Unattended runs may create local WIP checkpoint commits along the way, but they
 remain local unless Ship's disclosed plan includes an approved remote action.
 
-**Status:** [`v5.7.2`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v5.7.2): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v5.9.0`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v5.9.0): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -152,7 +152,7 @@ the original decisions and proof.
 .devrites/
   ACTIVE                 # active feature slug
   AFK                    # optional unattended-mode configuration
-  CHECKPOINT             # optional local WIP checkpoint mode
+  CHECKPOINT             # reserved path; not a commit gate
   principles.md          # project rules that gate the workflow
   specs/                 # living structured capabilities
   work/<slug>/

package/docs/architecture.md

@@ -336,10 +336,10 @@ workflow. It carries state through workspace files rather than chat. A vague
 prompt starts `devrites-interview`; `/rite-spec` and `/rite-clarify` then
 finish the only interactive window. After decision coverage is CLEAR it runs unattended,
 choosing the recommended option at each soft gate and recording the rationale
-in `decisions.md`. It does **not** weaken the safety gates: genuine
-product/scope/policy decisions, irreversible risk, human-only access/actions,
-an open human-owned gate, a NO-GO, exhausted `max_slices`, or low confidence
-still pause. Agents use bounded recovery for red tests, runtime failures, and
+in `decisions.md`. It does **not** weaken blocking/escalating or irreversible-risk
+gates: human-only access/actions, those gates, a NO-GO, or low confidence still
+pause. Temper expand, validating gates, and default slice/agent/time/review-queue
+caps do not. `--max-slices` is ignored the same way. Agents use bounded recovery for red tests, runtime failures, and
 missing technical coverage. By default the workflow stops at Seal GO with `/rite-ship` as the next step.
 The `--ship` flag (alias `--yolo`) continues through Ship preflight, discloses
 the exact Git plan, and still stops for a fresh literal `GO` plus native host

package/docs/command-map.md

@@ -40,7 +40,7 @@ The Go surface is intentionally closed and deterministic:
 
 | Lane | Commands | Owner |
 |---|---|---|
-| Candidate and deterministic checks | `check candidate`, `check readiness [--emit-binding]`, `check seal`, `check task-graph`, `check path-disjoint`, `check skill-trust`, `check indexes` | Candidate validates/hashes the strict project manifest; readiness checks phase files, the required `tasks.md` slice graph, or emits the vetted Build-input binding; seal checks final files/open gates, that graph and binding, then exact candidate bindings. `check indexes` reports install manifest and optional code-index directory presence as JSON. |
+| Candidate and deterministic checks | `check candidate`, `check readiness [--emit-binding]`, `check seal`, `check task-graph`, `check path-disjoint`, `parallel select`, `check skill-trust`, `check indexes` | Candidate validates/hashes the strict project manifest; readiness checks phase files, the required `tasks.md` slice graph, or emits the vetted Build-input binding; seal checks final files/open gates, that graph and binding, then exact candidate bindings. `check indexes` reports install manifest and optional code-index directory presence as JSON. `parallel select` returns the greedy path-disjoint subset ≤ cap from the supplied ready slices. |
 | Workspace observation | `observe summary`, `orient`, `observe slice <slug> <SLICE-ID>` | JSON workspace snapshot for agents (cursor, task graph, `artifact_budgets`, `bulk_files`); `orient` is an alias for `observe summary`. `observe slice` prints one `SLICE-###` section of `tasks.md` so Build reads a slice, not the file. |
 | Atomic workspace state | `state resolve`, `state merge-manifest`, `state close`, `migrate [--dry-run] [--answer id=choice]` | Go owns answer/drop/batch resolution, the recorded predecessor-chain manifest union for a release milestone, transactional close, and fail-closed v5 schema normalization. |
 | Security | `secret-scan` | `/rite-ship`, safe hooks, or an operator scans staged blobs, stdin, or touched files. |
@@ -91,7 +91,7 @@ See [`cli.md`](cli.md).
 | [`/rite-define`](../pack/.claude/skills/rite-define/SKILL.md) | define → plan | `[slug]` | Authors architecture, plan, vertical `SLICE-###` tasks, and traceability. A changed provider/consumer boundary names one canonical shared contract plus consuming provider/consumer tests; no change uses a justified no-impact statement. | `spec.md` + `decision-coverage.md` (+ `strategy.md`) + references | `architecture.md`, `plan.md`, `tasks.md`, `traceability.md`, `state.md`, `decisions.md` |
 | [`/rite-vet`](../pack/.claude/skills/rite-vet/SKILL.md) | vet | `[slug] [--cross-model] [--full]` | **Before build: every feature.** Engineering review of the defined plan: scope challenge (reuse / minimum-diff / complexity smell) + architecture / plan code-quality / test-coverage design / performance, confidence-banded with a quote-the-source verification gate; failure-mode and dependency-safety review. Hardens `plan.md` / `tasks.md` in place; writes the build-readable `test-plan.md` and a semantic `READY` verdict reconciled by the exact native reviewer; acceptance-changing deltas route via the Spec Drift Guard. Runs on every plan: depth scales to stakes (light pass on simple plans, full on big/risky), never skipped; **always in `/rite-autocomplete`**. Reviewer: `devrites-plan-reviewer` (+ optional `--cross-model`). | `plan.md` + `tasks.md` + `spec.md` (+ `strategy.md`) | `eng-review.md`, `test-plan.md`, `plan.md`, `tasks.md`, `decisions.md`, `state.md` |
 | [`/rite-plan`](../pack/.claude/skills/rite-plan/SKILL.md) | repair → plan | `[mode]` | Reslice / repair / re-order / split / unblock an active plan and return to the `plan` checkpoint; `revise` is artifact-only and `/rite-vet` is the normal resume. | spec/plan/tasks/state/drift + diff | `plan.md`, `tasks.md`, `state.md`, `decisions.md` |
-| [`/rite-build`](../pack/.claude/skills/rite-build/SKILL.md) | build | `[slice]` | In HITL, orchestrates one vertical slice through the sole wright; an explicit `.devrites/AFK` sentinel may chain bounded low-risk slices. Every task states exact project-relative paths; after return, the root rejects extra paths or weakened tests, runs repository proof, and maintains the strict candidate manifest. | workspace + diff + `.devrites/CHECKPOINT` | code + `state.md`, `evidence.md`, `traceability.md`, `touched-files.md` (+ local `WIP(<slug>)` commit in checkpoint mode) |
+| [`/rite-build`](../pack/.claude/skills/rite-build/SKILL.md) | build | `[slice]` | In HITL, orchestrates one vertical slice through the sole wright; an explicit `.devrites/AFK` sentinel may chain bounded low-risk slices. Every task states exact project-relative paths; after return, the root rejects extra paths or weakened tests, runs independent review and repository proof, and maintains the strict candidate manifest. Lands a local `WIP(<slug>):` commit only after that check loop is green (never on wright return). | workspace + diff | code + `state.md`, `evidence.md`, `traceability.md`, `touched-files.md` (+ local `WIP(<slug>):` after checks; never a slice id) |
 | [`/rite-converge`](../pack/.claude/skills/rite-converge/SKILL.md) | converge | `[slug]` | **Recovery.** Compare live code with clarified intent, append each unmet piece as a traceable `SLICE-###`, and invalidate the old vet verdict so changed work returns through `/rite-vet`. `tasks.md` stays byte-identical when already converged. | clarified spec + plan/tasks + principles + live code | `tasks.md` (appended), `traceability.md`, `state.md`, `eng-review.md` (invalidated), `decisions.md` |
 | [`/rite-upgrade`](../pack/.claude/skills/rite-upgrade/SKILL.md) | compatibility | `[slug]` | **Conditional recovery.** Audit an older released workspace against current contracts. Only cited defects route through Clarify, Plan repair, Converge, Vet, Prove, Polish, Review, or Seal. Ambiguous candidate scope is a gap; age/cursor form alone is never a defect, and old passes are never synthesized. | active workspace + named current contracts | admitted unfinished artifacts via their owning rite |
 | [`/rite-prove`](../pack/.claude/skills/rite-prove/SKILL.md) | prove | `[feature-slug]` | Positive, discriminating tests + build/runtime/browser proof; checks the same candidate before/after commands and binds evidence to its digest. | `traceability.md` + workspace + candidate | `evidence.md`, `browser-evidence.md`, `traceability.md`, `state.md` |
@@ -99,7 +99,7 @@ See [`cli.md`](cli.md).
 | [`/rite-review`](../pack/.claude/skills/rite-review/SKILL.md) | review | `[scope: slice N \| feature] [--full]` | Feature-scoped parallel Spec + Standards review of the closed candidate; binds `review.md` to its digest. | workspace + candidate | `review.md`, `evidence.md`, `state.md` |
 | [`/rite-seal`](../pack/.claude/skills/rite-seal/SKILL.md) | seal | `[feature-slug] [--full]` | Candidate-bound GO / NO-GO **decision**. Rechecks exact proof/review bindings and runs no git; on GO sets `Next step: /rite-ship`. | all artifacts + candidate | `seal.md`, `state.md` |
 | [`/rite-ship`](../pack/.claude/skills/rite-ship/SKILL.md) | ship | `[slug]` | Starts with a read-only Seal/candidate check and exact plan disclosure, then requires fresh literal `GO`. Only then may it collapse checkpoints, stage exact candidate paths, validate staged scope/bytes/bindings/secrets, commit and reverify, perform optional separately approved push/tag/PR actions, and archive/close. | `seal.md` + candidate + Git index | `ship.md`, `state.md`, archive |
-| [`/rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | (orchestrator) | `[idea] [--ship\|--yolo] [--max-slices N] [--full] [--cross-model]` | Full lifecycle (spec → clarify → … → seal → ship). Spec + clarify form the one interactive window; AFK/checkpoint mode arms only after decision coverage is CLEAR. Pauses for genuine human-owned decisions/actions, NO-GO, or budget exhaustion; objective red checks use bounded technical recovery. Default stops at Seal GO; `--ship` (`--yolo`) reaches Ship preflight but still requires fresh literal `GO` and native approval; `--full` selects the Full profile and `--cross-model` arms Vet's second opinion. | idea + workspace | whole workspace (drives every phase) |
+| [`/rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | (orchestrator) | `[idea] [--ship\|--yolo] [--max-slices N] [--full] [--cross-model]` | Full lifecycle (spec → clarify → … → seal → ship). Spec + clarify form the one interactive window; AFK/checkpoint mode arms only after decision coverage is CLEAR. Pauses for irreversible risk, blocking/escalating, human-only access, or NO-GO — not temper expand, validating gates, `--max-slices`, or default resource caps. Objective red checks use bounded technical recovery. Default stops at Seal GO; `--ship` (`--yolo`) reaches Ship preflight but still requires fresh literal `GO` and native approval; `--full` selects the Full profile and `--cross-model` arms Vet's second opinion. | idea + workspace | whole workspace (drives every phase) |
 | [`/rite-quick`](../pack/.claude/skills/rite-quick/SKILL.md) | (express) | `<change>` | Express lane for a **small, reversible, unambiguous** change: one-line contract → TDD build → scoped prove → review-lite → ship, no full artifact tree. **Significance gate first**: auth / migration / public-API / destructive / multi-slice / ambiguous → escalates to `/rite-spec`. Triggers: "quick fix", "small change", "tiny tweak", "just do X". | the change + codebase | code + commit (optional `brief.md` / `evidence.md`) |
 | [`/rite-frame`](../pack/.claude/skills/rite-frame/SKILL.md) | lens | `[ask \| diff]` | Pre-flight + self-audit lens for ad-hoc work the lifecycle gates never see: **FRAME** turns an imperative ask into a falsifiable success criterion + verify command before code; **AUDIT** checks a raw diff against the four LLM coding failure modes (silent assumption / overcomplication / out-of-scope edit / unverifiable goal). Top of `/rite-quick` or before a plain "just do X". | the ask / a raw diff | success criterion + verify command (inline) |
 | [`/rite-adopt`](../pack/.claude/skills/rite-adopt/SKILL.md) | onboard | `[path or area to adopt] [+ what you want to build next]` | Reverse-derive the existing baseline and next objective; propose any durable project guidance in the nearest native instruction file. | codebase + project instructions | workspace spec/state artifacts + optional guidance proposal |

package/docs/engine/commands.md

@@ -16,6 +16,7 @@ workflow strategy.
 | `check readiness --emit-binding <slug>` | Render the exact stable Build-input binding for Vet to record after review. |
 | `check seal <slug>` | Check files required by target Phase `seal`, open human gates, the `tasks.md` slice graph, canonical `AC-###` presence when `tasks.md`/`test-plan.md` are required, the stable Build-input binding, and exact candidate bindings. |
 | `check path-disjoint [--root <dir>] [<json-file> | -]` | Verify slice path sets are pairwise disjoint. |
+| `parallel select --cap <1-10> [--root <dir>] [<json-file> | -]` | Choose the greedy path-disjoint subset ≤ cap from supplied ready slices. |
 | `check task-graph <slug>` | Validate `tasks.md` slice dependency graph for cycles, unknown deps, malformed tokens, duplicate IDs, missing `Dependencies`, and `depends_on` mismatch. |
 | `check skill-trust <path>` | Scan one skill/agent Markdown file for structural trust violations. |
 | `observe summary <slug>` | Emit sanitized JSON workspace summary from one retained observation. `task_graph.ok` is true iff `task_graph.problems` is empty; `problems` lists cycle, unknown-dep, malformed-token, duplicate-id, and missing-`Dependencies` blockers. |

package/docs/engine/workspace-schema.md

@@ -21,7 +21,7 @@ budgets, IDs, and read order live in
 .devrites/
   ACTIVE
   AFK                         # optional run-mode sentinel
-  CHECKPOINT                  # optional local WIP checkpoint sentinel
+  CHECKPOINT                  # reserved path; not a commit gate
   principles.md               # ratified project invariants
   specs/                      # living capability Markdown, maintained by skills
   work/

package/docs/flow.md

@@ -304,8 +304,10 @@ Each workspace-operating lifecycle skill reads durable state from
 `.devrites/work/<feature-slug>/` before acting and reports the owning create or
 selection command when no workspace is active. Utility and on-ramp skills use
 their own stated preconditions. The optional `.devrites/AFK` sentinel sits
-beside `ACTIVE` and toggles the session-level run mode; `.devrites/CHECKPOINT`
-separately enables eligible local WIP checkpoint commits.
+beside `ACTIVE` and toggles the session-level run mode. Local `WIP(<slug>):`
+checkpoints land after independent review and fail-on-red proof are green, not
+when a wright returns; `.devrites/CHECKPOINT` is a reserved
+path, not a gate.
 
 ```mermaid
 erDiagram

package/docs/orchestration.md

@@ -130,8 +130,8 @@ Isolation does not authorize same-worktree throughput. Parallel writers are allo
 **only** under the `/rite-build` batch path when path-disjoint eligibility, abort-batch,
 and a control `parallel-lease.md` apply. `--parallel N` (or the AFK sentinel
 `max_parallel`, default cap 10 under `/rite-autocomplete`) is a **cap**: each round runs
-the largest eligible set, recomputes after every integrate, and repeats until no pending
-slice remains; fewer than two eligible slices fall back to the serial cycle (see
+the largest eligible set, recomputes after every completed round, and repeats until no
+pending slice remains; a one-slice round is serial for that round only (see
 [`parallel-batch.md`](../pack/.claude/skills/rite-build/reference/parallel-batch.md)).
 Same-worktree multi-writer and root-emulated worktrees remain forbidden; default
 `/rite-build` stays one writer across linked worktrees.

package/docs/skills.md

@@ -222,7 +222,7 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 
 | Skill | What It Does | Use When |
 |---|---|---|
-| [`rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | Runs the lifecycle unattended (spec → clarify → … → seal → ship), choosing the recommended option at each soft gate and recording the rationale in `decisions.md`.<br>A vague prompt gets one up-front spec/clarify window; after CLEAR it does not iterate per phase.<br>It pauses only for genuine product/scope/policy decisions, irreversible risk, human-only access, NO-GO, or budget exhaustion.<br>Objective red checks use bounded technical recovery, including cold-resume from retained one-shot evidence and one-time migration of stale missing-writer stops when an upgraded contract supplies the first supported writer. That migration applies once; the first real materializer failure is attempt one under normal bounded recovery. Internal `NEEDS_REPLAN` and new agent-owned review findings stay caller-owned backward edges, not user-facing stops. Spending an action authorization blocks another real execution, not offline repair.<br>Default stops at Seal GO. `--ship` (alias `--yolo`) reaches Ship preflight but still requires a fresh literal `GO` and native approval. | "Autocomplete", "do the whole thing", "run the full cycle", "one-shot this feature". |
+| [`rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | Runs the lifecycle unattended (spec → clarify → … → seal → ship), choosing the recommended option at each soft gate and recording the rationale in `decisions.md`.<br>A vague prompt gets one up-front spec/clarify window; after CLEAR it does not iterate per phase.<br>It pauses only for irreversible risk, blocking/escalating gates, human-only access, or NO-GO — not temper expand, validating gates, or default slice/agent/time/review-queue caps.<br>Objective red checks use bounded technical recovery, including cold-resume from retained one-shot evidence and one-time migration of stale missing-writer stops when an upgraded contract supplies the first supported writer. That migration applies once; the first real materializer failure is attempt one under normal bounded recovery. Internal `NEEDS_REPLAN` and new agent-owned review findings stay caller-owned backward edges, not user-facing stops. Spending an action authorization blocks another real execution, not offline repair.<br>Default stops at Seal GO. `--ship` (alias `--yolo`) reaches Ship preflight but still requires a fresh literal `GO` and native approval. | "Autocomplete", "do the whole thing", "run the full cycle", "one-shot this feature". |
 | [`rite-zoom-out`](../pack/.claude/skills/rite-zoom-out/SKILL.md) | Map the modules, callers, callees, and decisions in an unfamiliar area using the project's domain glossary. | Explicit-only: `/rite-zoom-out` / `/rite zoom-out`. |
 | [`rite-prototype`](../pack/.claude/skills/rite-prototype/SKILL.md) | Throwaway code answering ONE design question: logic harness OR 2 to 4 UI variations on one route. | Explicit-only: `/rite-prototype` / `/rite prototype`. |
 | [`rite-handoff`](../pack/.claude/skills/rite-handoff/SKILL.md) | Compact chat session → handoff doc. References existing `.devrites/work/<slug>/` artifacts by path. | Explicit-only: `/rite-handoff` / `/rite handoff`. |

package/docs/usage.md

@@ -69,7 +69,7 @@ Project-root sentinel (outside the workspace):
 | File | Created by | Holds |
 |---|---|---|
 | `.devrites/AFK` | you (presence = AFK mode active) | optional YAML: `max_slices`, `notify`, `allow_gates`. Empty file = AFK with defaults. See [`pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md`](../pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md). |
-| `.devrites/CHECKPOINT` | you or `/rite-autocomplete` (presence = checkpoint mode) | empty sentinel. When set, `/rite-build` commits each proven slice local-only as `WIP(<slug>)` so a crash mid-build loses neither source nor reasoning; after literal `GO`, `/rite-ship` collapses an eligible disclosed WIP run into the feature commit. See [`pack/.claude/skills/rite-build/reference/checkpoint.md`](../pack/.claude/skills/rite-build/reference/checkpoint.md). |
+| `.devrites/CHECKPOINT` | unused as a gate | reserved path (not a candidate). After Independent Build review and fail-on-red proof are green (not when a wright returns), `/rite-build` / `/rite-prove` / `/rite-polish` / `/rite-review` land a local `WIP(<slug>): <imperative summary>` commit (serial: checkpoint git recipe or no-op if nothing staged; parallel: `devrites-engine parallel integrate`); `/rite-ship` later collapses an eligible WIP run. See [`pack/.claude/skills/rite-build/reference/checkpoint.md`](../pack/.claude/skills/rite-build/reference/checkpoint.md). |
 
 The shape of this directory is also documented in
 [`flow.md` § Workspace state model](flow.md#7-workspace-state-model).
@@ -368,7 +368,7 @@ full list.
 ## 11) Full unattended lifecycle: `/rite-autocomplete`
 
 ```text
-/rite-autocomplete "add CSV export for admins" --max-slices 8
+/rite-autocomplete "add CSV export for admins"
   → vague idea → runs devrites-interview, then /rite-spec + /rite-clarify in
     the only interactive window
   → Decision coverage: CLEAR → arms AFK, then drives: /rite-temper →
@@ -384,17 +384,18 @@ You: GO                        # → commit, optional approved push/tag/PR, then
 
 Add `--ship` (alias `--yolo`) to continue through `/rite-ship` preflight.
 Autocomplete discloses the exact Git plan, then still stops for a fresh literal
-`GO` and native host approval. It also pauses for genuine product/scope/policy
-decisions, irreversible risk, human-only access/actions, a NO-GO, exhausted
-`max_slices`, or low confidence. Objective red checks use bounded recovery
-instead. Args:
+`GO` and native host approval. It also pauses for irreversible risk, human-only access/actions, blocking or
+escalating gates, a NO-GO, or low confidence — not for temper expand, validating
+gates, `--max-slices`, or default slice/agent/time/review-queue caps.
+Objective red checks use bounded recovery instead. Args:
 `[idea] [--ship|--yolo] [--max-slices N] [--full] [--cross-model]`.
 Optional flags are inactive unless their exact token occurs in the invocation;
-`--max-slices` requires one positive base-10 integer. `--full` selects the Full
+`--max-slices` requires one positive base-10 integer and does not cap this run.
+`--full` selects the Full
 execution profile, and `--cross-model` arms Vet's second opinion.
-Autocomplete never rewrites an existing `.devrites/AFK`. After Vet fixes the
-pending-slice count, it stores the lower effective budget in `state.md`; an
-existing remaining counter can only stay the same or decrease.
+Autocomplete never rewrites an existing `.devrites/AFK`. After Vet it seeds
+remaining from the pending-slice count and ignores leftover remaining and
+`--max-slices`.
 
 ## Checking in
 

package/engine/internal/parallel/cli.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"strconv"
 	"strings"
 )
 
@@ -71,6 +72,71 @@ func runPathDisjoint(args []string, stdin io.Reader, stdout, stderr io.Writer) i
 	return ExitOK
 }
 
+func cmdSelect(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
+	const usage = "usage: parallel select --cap <1-10> [--root <dir>] [<json-file>|-]"
+	root := ""
+	jsonPath := "-"
+	capN := 0
+	sawCap := false
+	for i := 0; i < len(args); i++ {
+		switch args[i] {
+		case "--root":
+			if i+1 >= len(args) {
+				fmt.Fprintln(stderr, usage)
+				return ExitUsage
+			}
+			i++
+			root = args[i]
+		case "--cap":
+			if i+1 >= len(args) {
+				fmt.Fprintln(stderr, usage)
+				return ExitUsage
+			}
+			i++
+			n, err := strconv.Atoi(args[i])
+			if err != nil {
+				fmt.Fprintf(stderr, "parallel select: --cap must be an integer\n")
+				return ExitUsage
+			}
+			capN = n
+			sawCap = true
+		case "-h", "--help":
+			fmt.Fprintln(stdout, usage)
+			return ExitOK
+		default:
+			if args[i] != "-" && strings.HasPrefix(args[i], "-") {
+				fmt.Fprintf(stderr, "parallel select: unknown flag %s\n", args[i])
+				return ExitUsage
+			}
+			jsonPath = args[i]
+		}
+	}
+	if !sawCap {
+		fmt.Fprintln(stderr, usage)
+		return ExitUsage
+	}
+	data, err := readJSONInput(jsonPath, stdin)
+	if err != nil {
+		fmt.Fprintf(stderr, "parallel select: %v\n", err)
+		return ExitBlocked
+	}
+	slices, err := ParseSlicesJSON(data)
+	if err != nil {
+		fmt.Fprintf(stderr, "parallel select: %v\n", err)
+		return ExitBlocked
+	}
+	selected, err := SelectGreedy(capN, slices, root)
+	if err != nil {
+		fmt.Fprintf(stderr, "parallel select: %v\n", err)
+		if strings.Contains(err.Error(), "cap must be") {
+			return ExitUsage
+		}
+		return ExitBlocked
+	}
+	fmt.Fprintln(stdout, formatSelect(selected))
+	return ExitOK
+}
+
 func runParallel(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 	if len(args) == 0 {
 		fmt.Fprintln(stderr, parallelUsage())
@@ -98,6 +164,8 @@ func runParallel(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 		return cmdLeaseClear(rest, stdout, stderr)
 	case "check-disjoint", "path-disjoint":
 		return runPathDisjoint(rest, stdin, stdout, stderr)
+	case "select":
+		return cmdSelect(rest, stdin, stdout, stderr)
 	case "-h", "--help", "help":
 		fmt.Fprintln(stdout, parallelUsage())
 		return ExitOK
@@ -121,6 +189,7 @@ Subcommands:
   lease-read      --root --slug [--field name]
   lease-clear     --root --slug
   check-disjoint  [--root] [<json-file>|-]
+  select          --cap <1-10> [--root] [<json-file>|-]
 
 Exit codes: 0 ok, 2 usage, 3 blocked`)
 }

package/engine/internal/parallel/git.go

@@ -211,6 +211,10 @@ func mergeFFOnly(repo, commit string) error {
 	return err
 }
 
+func commitSubject(repo, rev string) (string, error) {
+	return git(repo, "log", "-1", "--format=%s", rev)
+}
+
 func cherryPickNoCommit(repo, fromExclusive, toInclusive string) error {
 	_, err := git(repo, "cherry-pick", "-n", fromExclusive+".."+toInclusive)
 	return err
@@ -219,3 +223,7 @@ func cherryPickNoCommit(repo, fromExclusive, toInclusive string) error {
 func cherryPickAbort(repo string) {
 	_, _ = git(repo, "cherry-pick", "--abort")
 }
+
+func cherryPickQuit(repo string) {
+	_, _ = git(repo, "cherry-pick", "--quit")
+}

package/engine/internal/parallel/ops.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"regexp"
 	"sort"
 	"strings"
 
@@ -285,10 +286,8 @@ func integrateLocked(opts IntegrateOpts) (tip string, lease *Lease, err error) {
 	}
 
 	union := make([]string, 0, len(lease.Slices))
-	ids := make([]string, 0, len(lease.Slices))
 	for _, sl := range lease.Slices {
 		union = append(union, sl.Paths...)
-		ids = append(ids, sl.ID)
 	}
 	if opts.ApplyToControl {
 		// FF into control must not silently absorb or clobber the user's
@@ -381,14 +380,19 @@ func integrateLocked(opts IntegrateOpts) (tip string, lease *Lease, err error) {
 
 		if err := cherryPickNoCommit(stageWT, base, tc); err != nil {
 			cherryPickAbort(stageWT)
-			return fail(fmt.Errorf("squash apply failed for slice %s: %w", sl.ID, err))
+			return fail(fmt.Errorf("apply failed for slice %s: %w", sl.ID, err))
 		}
+		subj, err := commitSubject(opts.Root, tc)
+		if err != nil {
+			return fail(fmt.Errorf("transfer subject for %s: %w", sl.ID, err))
+		}
+		if _, err = stagePathsAndCommit(stageWT, controlCommitMessage(opts.Slug, subj), sl.Paths); err != nil {
+			return fail(fmt.Errorf("control commit for %s: %w", sl.ID, err))
+		}
+		cherryPickQuit(stageWT)
 	}
-
-	msg := fmt.Sprintf("WIP(%s): parallel batch %s (%s)\n\n[devrites-context]\nslices: %s\nbase: %s",
-		opts.Slug, lease.BatchID, strings.Join(ids, ", "), strings.Join(ids, ", "), base)
-	if tip, err = stagePathsAndCommit(stageWT, msg, union); err != nil {
-		return fail(fmt.Errorf("squash commit: %w", err))
+	if tip, err = headSHA(stageWT); err != nil {
+		return fail(fmt.Errorf("integrate tip: %w", err))
 	}
 	if err := removeWorktree(opts.Root, stageWT); err != nil {
 		if _, statErr := os.Stat(stageWT); statErr == nil {
@@ -414,12 +418,36 @@ func integrateLocked(opts IntegrateOpts) (tip string, lease *Lease, err error) {
 	} else if err := ensureControlAtBase(opts.Root, base); err != nil {
 		return fail(err)
 	}
-	// Without --apply-to-control the lease stays running: the squash commit
-	// lives only on the integrate branch, and a running lease keeps a
-	// non-forced cleanup from discarding the refs that hold it.
+	// Without --apply-to-control the lease stays running: the integrate
+	// commits live only on the integrate branch, and a running lease keeps a
+	// non-forced cleanup from discarding the refs that hold them.
 	return tip, lease, nil
 }
 
+var (
+	sliceTaskID       = regexp.MustCompile(`(?i)\bSLICE-\d+\b`)
+	sliceProcessMark  = regexp.MustCompile(`(?i)\bthis slice\b|\bslice\s+\d+\b`)
+	existingWIPPrefix = regexp.MustCompile(`(?i)^WIP\([^)]+\):\s*`)
+)
+
+// controlCommitMessage is the local unpushed subject/body landed on control.
+// Ship collapse still keys off the WIP(<slug>): prefix; the rest is a human
+// summary with DevRites process marks stripped (SLICE-###, "this slice",
+// "slice N"). Ordinary English such as "array slice" is left intact.
+func controlCommitMessage(slug, transferSubject string) string {
+	prefix := fmt.Sprintf("WIP(%s): ", slug)
+	line := strings.TrimSpace(strings.SplitN(transferSubject, "\n", 2)[0])
+	line = existingWIPPrefix.ReplaceAllString(line, "")
+	line = sliceTaskID.ReplaceAllString(line, "")
+	line = sliceProcessMark.ReplaceAllString(line, "")
+	line = strings.TrimSpace(strings.Trim(line, ":-"))
+	line = strings.Join(strings.Fields(line), " ")
+	if line == "" {
+		line = "land proven work"
+	}
+	return prefix + line + "\n\n[devrites-context]\n"
+}
+
 func pathListsEqual(a, b []string) bool {
 	if len(a) != len(b) {
 		return false
@@ -470,7 +498,7 @@ func salvageSlice(sl LeaseSlice, batchID string) (string, error) {
 		return "", nil
 	}
 	return stagePathsAndCommit(sl.WorktreePath,
-		fmt.Sprintf("devrites: salvage %s WIP (%s)", sl.ID, batchID), sl.Paths)
+		fmt.Sprintf("devrites: salvage WIP (%s)", batchID), sl.Paths)
 }
 
 // Cleanup removes worker worktrees and clears the lease. A complete batch

package/engine/internal/parallel/ops_test.go

@@ -19,7 +19,7 @@ func commitIn(t *testing.T, wt, file, marker string) string {
 		t.Fatal(err)
 	}
 	gitOk(t, wt, "add", file)
-	gitOk(t, wt, "commit", "-m", "slice "+marker)
+	gitOk(t, wt, "commit", "-m", "WIP(demo-feature): add "+marker+" helper")
 	return gitOk(t, wt, "rev-parse", "HEAD")
 }
 
@@ -426,3 +426,31 @@ func TestCleanupWarnsOnFailedBranchCleanup(t *testing.T) {
 		t.Fatalf("cleanup should still clear the lease, got %v", err)
 	}
 }
+
+func TestControlCommitMessage(t *testing.T) {
+	t.Parallel()
+	got := controlCommitMessage("admin-report", "WIP(admin-report): SLICE-003 add CSV export")
+	wantPrefix := "WIP(admin-report): add CSV export\n"
+	if !strings.HasPrefix(got, wantPrefix) {
+		t.Fatalf("subject %q want prefix %q", got, wantPrefix)
+	}
+	if strings.Contains(got, "SLICE-") || strings.Contains(strings.ToLower(got), "slice-003") {
+		t.Fatalf("message still names a slice id: %q", got)
+	}
+	got = controlCommitMessage("admin-report", "WIP(other): complete slice 3")
+	if !strings.HasPrefix(got, "WIP(admin-report): complete\n") {
+		t.Fatalf("foreign WIP prefix / slice N: %q", got)
+	}
+	got = controlCommitMessage("admin-report", "add this slice CSV")
+	if !strings.HasPrefix(got, "WIP(admin-report): add CSV\n") {
+		t.Fatalf("this slice: %q", got)
+	}
+	got = controlCommitMessage("admin-report", "keep array slice helper")
+	if !strings.HasPrefix(got, "WIP(admin-report): keep array slice helper\n") {
+		t.Fatalf("ordinary English stripped: %q", got)
+	}
+	got = controlCommitMessage("admin-report", "SLICE-001")
+	if !strings.HasPrefix(got, "WIP(admin-report): land proven work\n") {
+		t.Fatalf("empty summary after strip: %q", got)
+	}
+}

package/engine/internal/parallel/parallel_test.go

@@ -216,6 +216,13 @@ func TestCleanupSalvagesAbortedWork(t *testing.T) {
 	if body := gitOk(t, repo, "show", sb.Commit+":src/b_new.go"); !strings.Contains(body, "Bnew") {
 		t.Fatalf("salvaged file content missing: %q", body)
 	}
+	subj := gitOk(t, repo, "log", "-1", "--format=%s", sb.Commit)
+	if strings.Contains(subj, "slice-b") || strings.Contains(subj, "SLICE-") {
+		t.Fatalf("salvage subject names a slice id: %q", subj)
+	}
+	if !strings.HasPrefix(subj, "devrites: salvage WIP (") {
+		t.Fatalf("salvage subject %q", subj)
+	}
 
 	// Worktrees removed, lease cleared, kept branches still resolve.
 	for _, wt := range []string{wtA, wtB, wtC} {
@@ -375,14 +382,14 @@ func TestIntegrateDivergentSiblings(t *testing.T) {
 		t.Fatal(err)
 	}
 	gitOk(t, wtA, "add", "src/a.go")
-	gitOk(t, wtA, "commit", "-m", "slice-a green")
+	gitOk(t, wtA, "commit", "-m", "WIP(demo-feature): add A helper")
 	tcA := gitOk(t, wtA, "rev-parse", "HEAD")
 
 	if err := os.WriteFile(filepath.Join(wtB, "src", "b.go"), []byte("package main\n\nfunc B() {}\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	gitOk(t, wtB, "add", "src/b.go")
-	gitOk(t, wtB, "commit", "-m", "slice-b green")
+	gitOk(t, wtB, "commit", "-m", "WIP(demo-feature): add B helper")
 	tcB := gitOk(t, wtB, "rev-parse", "HEAD")
 
 	if _, err := RecordGreen(repo, slug, "slice-a", tcA); err != nil {
@@ -406,12 +413,17 @@ func TestIntegrateDivergentSiblings(t *testing.T) {
 	if head != tip {
 		t.Fatalf("control head %s want tip %s", head, tip)
 	}
-	if n := gitOk(t, repo, "rev-list", "--count", base+"..HEAD"); n != "1" {
-		t.Fatalf("control should gain exactly one squash commit, got %s", n)
+	if n := gitOk(t, repo, "rev-list", "--count", base+"..HEAD"); n != "2" {
+		t.Fatalf("control should gain one commit per sibling, got %s", n)
 	}
-	subj := gitOk(t, repo, "log", "-1", "--format=%s")
-	if !strings.HasPrefix(subj, "WIP(demo-feature):") {
-		t.Fatalf("squash subject %q missing WIP(demo-feature): prefix", subj)
+	log := gitOk(t, repo, "log", "--format=%s", base+"..HEAD")
+	for _, subj := range strings.Split(log, "\n") {
+		if !strings.HasPrefix(subj, "WIP(demo-feature):") {
+			t.Fatalf("control subject %q missing WIP(demo-feature): prefix", subj)
+		}
+		if strings.Contains(strings.ToUpper(subj), "SLICE-") {
+			t.Fatalf("control subject %q still names a slice id", subj)
+		}
 	}
 	a := mustRead(t, filepath.Join(repo, "src", "a.go"))
 	b := mustRead(t, filepath.Join(repo, "src", "b.go"))
@@ -428,7 +440,7 @@ func TestIntegrateDivergentSiblings(t *testing.T) {
 }
 
 // TestIntegrateWithoutApplyKeepsLeaseRunning proves a flag-less integrate
-// stages the squash commit on the integrate branch but leaves the lease
+// stages the per-sibling commits on the integrate branch but leaves the lease
 // running and control at base, so a later non-forced cleanup cannot discard
 // the only refs holding the integrated tree.
 func TestIntegrateWithoutApplyKeepsLeaseRunning(t *testing.T) {
@@ -441,7 +453,7 @@ func TestIntegrateWithoutApplyKeepsLeaseRunning(t *testing.T) {
 		t.Fatal(err)
 	}
 	if tip == "" || tip == base {
-		t.Fatalf("expected staged squash tip, got %s", tip)
+		t.Fatalf("expected staged integrate tip, got %s", tip)
 	}
 	if lease.Status != StatusRunning {
 		t.Fatalf("status=%s want running without --apply-to-control", lease.Status)
@@ -451,13 +463,13 @@ func TestIntegrateWithoutApplyKeepsLeaseRunning(t *testing.T) {
 	}
 	ibranch := IntegrateBranchName(slug, batch)
 	if got := gitOk(t, repo, "rev-parse", ibranch); got != tip {
-		t.Fatalf("integrate branch %s want squash tip %s", got, tip)
+		t.Fatalf("integrate branch %s want integrate tip %s", got, tip)
 	}
 	if _, err := Cleanup(repo, slug, false); err == nil {
 		t.Fatal("cleanup on running lease must refuse without --force")
 	}
 	// Forced cleanup salvages then removes; the integrate branch holds the
-	// squash tip, so it is kept and reported rather than deleted.
+	// integrate tip, so it is kept and reported rather than deleted.
 	if _, err := Cleanup(repo, slug, true); err != nil {
 		t.Fatal(err)
 	}
@@ -468,7 +480,7 @@ func TestIntegrateWithoutApplyKeepsLeaseRunning(t *testing.T) {
 
 // TestIntegrateFailedLeaseRepairsAndRetries proves integrate-failed is not a
 // dead end: a repaired transfer re-records on the failed lease and a retried
-// integrate completes into one squash commit on control.
+// integrate completes into one control commit per sibling.
 func TestIntegrateFailedLeaseRepairsAndRetries(t *testing.T) {
 	repo, base := setupRepo(t)
 	slug, batch := "demo-feature", "batch1"
@@ -506,8 +518,8 @@ func TestIntegrateFailedLeaseRepairsAndRetries(t *testing.T) {
 	} else if lease.Status != StatusComplete {
 		t.Fatalf("status=%s want complete", lease.Status)
 	}
-	if n := gitOk(t, repo, "rev-list", "--count", base+"..HEAD"); n != "1" {
-		t.Fatalf("expected one squash commit on control, got %s", n)
+	if n := gitOk(t, repo, "rev-list", "--count", base+"..HEAD"); n != "2" {
+		t.Fatalf("expected one control commit per sibling, got %s", n)
 	}
 }