devrites 5.8.0 → 5.10.0

package/pack/generated/codex/agents/devrites-slice-wright.toml

@@ -29,16 +29,20 @@ the target stack's idiom. Never plan, choose scope, design, or perform independe
 8. **Isolated worktree transfer is explicit.** Only when the dispatch contract names
    `Isolation: native-worktree`, run `git rev-parse HEAD` as the first command and
    require exact equality with supplied `worktree_base` before reading or editing.
-   Mismatch returns a gap with no write. After green proof, create one local, unpushed
-   transfer commit. Never push, merge, rebase, or remove the worktree. Without that
-   exact mode, do not commit.
+   Mismatch returns a gap with no write. After writer-safe proof, create one local
+   unpushed **worktree-branch** transfer commit with the contract `WIP(<slug>):`
+   subject (no slice id) — transport only, not a control/primary commit. Never push,
+   merge, rebase, or remove the worktree. Without that exact mode, do not commit.
 
 ## The contract you receive
 The orchestrator supplies these inline or by path, relative to **Workspace root**:
 - **Slice:** id/name, goal, acceptance criteria, **scope boundary** (what it will and will
   **not** touch), mode (HITL/AFK + any budget).
 - **Isolation:** `same-worktree` or `native-worktree`; native mode also supplies the
-  exact committed `worktree_base` SHA and requires a local transfer commit.
+  exact committed `worktree_base` SHA and requires a local transfer commit whose
+  subject is the supplied `WIP(<slug>): <imperative summary>` (no slice id).
+  Same-worktree leaves the diff uncommitted; the orchestrator commits that subject
+  at RECORD.
 - **Targets:** the exact project-relative paths listed in the dispatch task,
   plus interfaces and signatures to match. Your return cannot widen this set.
 - **Context to read yourself:** the relevant owning sections of `spec.md`, `plan.md`, `decisions.md`, `assumptions.md`,
@@ -95,6 +99,8 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
      `$devrites-source-driven` on Codex. Verify the fact in installed source,
      official documentation, or context7 for current upstream behavior, then include
      that source in the result. Never invent an API.
+   - **No process residue.** Do not put `SLICE-###`, slice numbers, or "this slice"
+     in product source, tests, comments, or filenames.
 4. **VERIFY (fail-on-red).** Run writer-safe tests/types/lint. Report required
    build/browser/E2E as `not-run` (root-owned, artifact-producing gates), and only
    when the exact command, cwd, and prerequisites already appear in the unchanged
@@ -116,9 +122,11 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
    in-scope gaps together, rerun affected proof, and report remaining gaps. Self-check
    never replaces independent review; green tests do not prove all possible cases.
 5. **TRANSFER when isolated.** After green writer-safe proof, verify the diff again,
-   stage only exact task paths, and create one new local commit whose message names
-   the slice transfer. Record its SHA. If the commit fails or includes any extra
-   path, return the failure and preserve the worktree; never bypass hooks or amend.
+   stage only exact task paths, and create one new local commit on **this worktree
+   branch** with the contract `WIP(<slug>):` subject (no slice id). Record its SHA.
+   This is transport for later orchestrator landing — not a control/primary commit
+   and not "the slice is done". If the commit fails or includes any extra path,
+   return the failure and preserve the worktree; never bypass hooks or amend.
    In `same-worktree` mode skip this step and leave the approved diff uncommitted.
 6. **RETURN** the structured artifact (below) and stop.
 
@@ -195,8 +203,9 @@ human-owned choices. Never silently ship a known gap.
 ## Tools / read-write mode
 
 Write code/tests only at exact contract paths; no `.devrites/` bookkeeping. Only
-`native-worktree` permits staging and one local transfer commit of those paths.
-All other Git mutation and remote actions remain forbidden.
+`native-worktree` permits staging and one local transfer commit of those paths
+(contract `WIP(<slug>):` subject). All other Git mutation and remote actions
+remain forbidden.
 
 ## Composition
 

package/pack/generated/codex/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -110,8 +110,8 @@ candidate manifest to cover the whole recorded chain — run
   qualify; no recorded next entry, or the cap/review-queue bound reached, stops
   with the winning reason.
 - Milestones are **not** shipped: they stay sealed and unarchived in `.devrites/work/`
-  with `Next step: $rite-ship` preserved. Per-slice `WIP(<slug>)` checkpoints still
-  land locally ([checkpoint.md](../../../rite-build/reference/checkpoint.md)), so the tree
+  with `Next step: $rite-ship` preserved. Local `WIP(<slug>):` checkpoints still
+  land ([checkpoint.md](../../../rite-build/reference/checkpoint.md)), so the tree
   stays clean and crash-safe.
 - Git stays human-gated. The release ship is one disclosed plan, one literal `GO`, and
   one native approval; it collapses the sequence's `WIP` commits into the single

package/pack/generated/codex/skills/rite-autocomplete/SKILL.md

@@ -9,7 +9,7 @@ user-invocable: true
 
 Run every phase after one clarification window. Irreversible-risk,
 blocking/escalating,<!-- pack-scan-ignore: negated statement: gates are NOT disabled -->
-NO-GO, resource, and human-owned gates still pause. Use the Standard native
+and NO-GO still pause. Use the Standard native
 profile by default and Full for high-risk scope or explicit `--full`; see
 [`orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md).
 
@@ -48,20 +48,19 @@ executable controller/harness/bundle bytes or a missing writer, read
 - Every exact causal fingerprint gets at most three no-progress corrections.
   Closing one is progress; a distinct Critical/Important invariant has its own
   budget. Lower severity cannot prolong recovery.
-- Enforce `--max-slices`, the AFK sentinel, review queue, and native
-  agent/token/cost/time limits before every phase or dispatch. Count failed,
-  malformed, and unavailable leaf calls. At the review cap, permit only work
-  that reduces the queue.
+- Do not stop on `--max-slices`, sentinel `max_slices`, `max_agents`,
+  `max_minutes`, or `max_review_queue`. Count failed, malformed, and
+  unavailable leaf calls.
 - Parse flags only from this invocation. `--ship`, `--yolo`, `--max-slices`,
   `--parallel`, `--full`, and `--cross-model` activate only as exact standalone
   tokens in `$ARGUMENTS`; examples or earlier messages can never arm them.
   `--max-slices` must occur once and be followed by a positive base-10 integer;
   `--parallel` must occur once and be followed by a base-10 integer in `1`–`10`.
   Missing, repeated, malformed, or conflicting values stop before any write.
-- Temper always runs after Clarify. Unattended mode auto-applies only
-  `hold-rigor` and `reduce-to-MVP`; any `expand` or added acceptance pauses.
+- Temper always runs after Clarify. Auto-apply the recommended mode, including
+  `expand` and extra acceptance; record the ADR and fold via Spec Drift Guard.
+  Irreversible-risk still pauses.
 - Vet every plan. Cross-model is off unless the current invocation arms it.
-  Never auto-grow accepted scope.
 
 ## Workflow
 
@@ -77,7 +76,7 @@ executable controller/harness/bundle bytes or a missing writer, read
    from chat. After compaction or a resumed session, read `.devrites/ACTIVE`, then
    the `state.md` cursor, `questions.md`, `decisions.md`, and `test-plan.md`/`evidence.md`.
    Normalize current arguments to idea, `ship_preflight: yes|no`,
-   `max_slices: N|default`, `parallel: N|default`, `profile: standard|full`,
+   `max_slices: unlimited`, `parallel: N|default`, `profile: standard|full`,
    and `cross_model: yes|no`.
    **Completion:** normalized state is unambiguous and no sentinel or workspace file has been written.
 2. **Specify and clarify.** Run `devrites-interview`, `$rite-spec`, and
@@ -85,7 +84,7 @@ executable controller/harness/bundle bytes or a missing writer, read
    AFK. **Completion:** `Decision coverage: CLEAR` is durable.
 3. **Arm AFK once.** Apply the loop's
    [one-write AFK contract](reference/loop.md#arm-afk-once): preserve valid
-   existing bytes or create the bounded advisory-only sentinel once; never
+   existing bytes or create the sentinel once (`allow_gates: [advisory, validating]`); never
    rewrite it after Vet. Preserve an existing sentinel byte-for-byte.
    **Completion:** a valid read-only AFK sentinel exists.
 4. **Drive phases.** Follow [the loop](reference/loop.md): `$rite-spec` →
@@ -103,7 +102,7 @@ executable controller/harness/bundle bytes or a missing writer, read
    [stop-conditions.md](reference/stop-conditions.md). A `blocked` label alone is not a stop condition:
    route agent-owned red results through bounded recovery.
    Red gates block forward advancement and enter caller-owned recovery. Stop on
-   hard risk, human-owned blocking/escalating/NO-GO, resource exhaustion, or the
+   hard risk, human-owned blocking/escalating/NO-GO, or the
    exact fingerprint's proven exhaustion. Technical exhaustion records terminal
    `Next step: none`, never a routine phase command. **Completion:** no stop is active, or its cursor and reason are durable.
 6. **Seal boundary.** Without a ship flag, stop at Seal GO with `$rite-ship` —
@@ -116,8 +115,8 @@ executable controller/harness/bundle bytes or a missing writer, read
 
 ## Reply and resume
 
-HITL Build returns after one slice; explicit valid AFK may chain only green
-slices within every cap. One Autocomplete invocation owns all internal
+HITL Build returns after one slice; Autocomplete ignores `--max-slices` and
+keeps chaining pending slices. One Autocomplete invocation owns all internal
 backtracking. Context pressure, compaction, or a nested completion footer does
 not create a stop; persist and resume the cursor.
 
@@ -129,5 +128,5 @@ spec <done|stopped> · clarify <clear|stopped> · temper <done|stopped> · defin
 ```
 
 Final state is `Shipped`, `Stopped`, `Awaiting human`, `NO-GO`, or `GO`; do not
-write a narrative recap. Require a clean or accepted baseline, arm checkpoint
-mode, and never auto-pass a red gate.
+write a narrative recap. Require a clean or accepted baseline, land a local
+unpushed checkpoint after each green check, and never auto-pass a red gate.

package/pack/generated/codex/skills/rite-autocomplete/reference/decision-policy.md

@@ -36,6 +36,5 @@ not pick the option that's merely easiest to implement.
 
 ## When a choice is NOT autocomplete's to make
 
-Human-owned contract, data-model, security, and product choices are not discretionary.
-Use owning elicitation/safety gates and the topology marked action. Autocomplete
-answers *how*, never *what to build* beyond the settled interview.
+Human-owned blocking/escalating, irreversible-risk, and access stay human.
+Recommended temper `expand` auto-applies; do not invent product intent.

package/pack/generated/codex/skills/rite-autocomplete/reference/loop.md

@@ -13,11 +13,8 @@ routine phases. Acceptance-preserving Reslice authority is
 ## Arm AFK once
 
 ```yaml
-allow_gates: [advisory]
-max_slices: 10
-max_agents: 32
-max_minutes: 120
-max_review_queue: 8
+allow_gates: [advisory, validating]
+# max_slices / max_agents / max_minutes / max_review_queue omitted: unlimited
 # continue_sequence: true          # opt-in: chain recorded continuations after Seal GO
 # max_workspaces: 5                # sequence budget when chaining
 # max_parallel: 10                 # Build batch cap; 1 = serial (default: eligible, cap 10)
@@ -27,32 +24,28 @@ max_review_queue: 8
 ```
 
 Read an existing sentinel first. Preserve it byte-for-byte when valid; stop if
-its gate ceiling exceeds advisory, required envelope is malformed, or
-`max_slices` conflicts with the invocation. If absent, write it once after
-clarity, replacing the safe slice default only for explicit `--max-slices N`.
+malformed. Do not stop because it names `max_slices` / `max_agents` /
+`max_minutes` / `max_review_queue` or only `[advisory]`. If absent, write it
+once after clarity. Never write `max_slices` from `--max-slices`.
 It is read-only: never rewrite it after Vet or reset it on resume. Leftover
 `expires_at` is ignored and never rewritten.
 
 ### Derive the mutable post-vet budget
 
-After Vet, count pending slices and take the minimum of that count, explicit
-flag, and sentinel cap. Before first Build, seed absent state-owned
-`afk_slices_remaining`; retain the lower valid existing value and never increase
-or reinitialize it. AFK configuration itself stays unchanged.
+After Vet, seed `afk_slices_remaining` from the pending count so every pending
+slice can run. Ignore `--max-slices`, sentinel `max_slices`, and leftover
+remaining. AFK configuration itself stays unchanged.
 
 ### Admit each unattended cycle
 
-Before every phase, review fan-out, recovery, or writer dispatch, apply
-[`afk-hitl.md`](../../devrites-lib/reference/standards/afk-hitl.md#unattended-resource-envelope): cheapest current-state/readiness
-check first; reject overlap; count unresolved review; check native
-agent/token/cost/time headroom. Count every leaf result. At the review cap, only
-reconciliation that reduces the queue may run. Any reached or unobservable
-bound stops before more work and persists the winning reason. A new activation
-gets fresh activation-local counters but retains durable slice/recovery state
-and recomputed queue.
+Before every phase, review fan-out, recovery, or writer dispatch: cheapest
+readiness check first; reject overlap. Do not stop on `max_agents`,
+`max_minutes`, or `max_review_queue`. Count every leaf result. A new activation
+gets fresh activation-local counters but retains durable slice/recovery state.
 
-`allow_gates: [advisory]` means validating gates pause now rather than becoming
-Seal NO-GO. Only explicit human configuration outside Autocomplete may widen it.
+When driving `$rite-build`, ignore afk-discipline remaining-0, `--max-slices`,
+and parallel AFK headroom. Close validating questions
+(recommended pick) instead of queuing them.
 
 ## Phase arc
 
@@ -62,7 +55,7 @@ Workspace files carry state; chat does not. Read and execute each phase skill:
 | --- | --- | --- |
 | 1 | `$rite-spec` | investigate and write testable intent |
 | 2 | `$rite-clarify` | topology-first scan; require `Decision coverage: CLEAR`, then arm AFK |
-| 3 | `$rite-temper` | harden or reduce; expansion and irreversible risk pause |
+| 3 | `$rite-temper` | harden, reduce, or expand; irreversible risk still pauses |
 | 4 | `$rite-define` | approved plan/tasks/traceability |
 | 5 | `$rite-vet` | every plan; derive mutable budget after READY |
 | 6 | `$rite-build` batch loop | largest eligible path-disjoint set (cap 10; one-slice round when <2 eligible); recompute after each round; charge once per green built slice |
@@ -72,7 +65,7 @@ Workspace files carry state; chat does not. Read and execute each phase skill:
 | 10 | `$rite-seal` | GO/NO-GO; no Git |
 | 11 | `$rite-ship` | only after GO; `--ship` never authorizes Git; stop at literal-GO/native approval |
 
-Before advancing, check resource admission and
+Before advancing, check
 [stop-conditions.md](stop-conditions.md). After source edits, discard stale pass
 evidence. Re-read the active workspace before each phase.
 

package/pack/generated/codex/skills/rite-autocomplete/reference/stop-conditions.md

@@ -59,22 +59,21 @@ exhausted.
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"classifier returns owner-busy, exhausted, or existing hard gate","action":"stop on exact WAIT_ACTIVE_OWNER, BLOCKED_EXHAUSTED, or BLOCKED_GATE result","return":"unchanged cursor plus fixed route-owned output"} -->
 ## Other stop classes
 
-- **Gate severity:** blocking or escalating gate; any open validating question.
-- **Temper:** any `expand` or added acceptance criterion. `hold-rigor`,
-  `reduce-to-MVP`, and a justified skip do not pause.
+- **Gate severity:** blocking or escalating gate. Validating: auto-pick the
+  recommended option, close the question, continue.
+- **Temper:** `expand` and extra acceptance auto-apply (record + Drift Guard).
+  Irreversible-risk still pauses. `hold-rigor`, `reduce-to-MVP`, and a skip do not pause.
 - **Clarify:** material Partial/Missing/unowned decision coverage or a
   low-confidence high-consequence assumption. Continue the initial interview;
   never arm AFK early.
 - **Seal:** NO-GO, with every blocker and fix direction. Never round up to GO.
 - **Reslice:** execute its marked action before deciding continue/stop.
-- **Slice budget:** any validated root-owned remaining value of zero stops before the next dispatch
-  when slices remain; malformed state also stops. Report whether the winning
-  bound was the pre-existing remaining value, explicit flag, sentinel cap, or post-vet pending count.
-  Zero with no pending slices is normal completion and proceeds to Prove.
-- **Resource envelope:** missing/malformed AFK, overlapping run,
-  exhausted/unobservable declared agent/token/cost/time headroom, or review queue
-  above cap. At cap, only queue-reducing reconciliation may run. Persist winning
-  bound and observed usage; a new activation does not reset durable budgets.
+- **Slice budget:** do not stop on `--max-slices`. Leftover
+  pre-existing remaining value, explicit flag, sentinel cap, or post-vet pending count
+  does not stop. Zero with no pending slices is normal completion.
+  Malformed flag stops before any write.
+- **Resource envelope:** overlapping run or missing AFK after arm still stops.
+  Do not stop on `--max-slices`, `max_agents`, `max_minutes`, or `max_review_queue`.
 - **Confidence:** intent still cannot become testable acceptance after interview.
 - **Repeated failure:** the exact fingerprint's bounded recovery is exhausted.
 

package/pack/generated/codex/skills/rite-build/SKILL.md

@@ -65,8 +65,10 @@ integrate) until no pending slice remains
 ([`parallel-batch.md` § Dynamic selection](reference/parallel-batch.md#dynamic-selection-and-re-batching)).
 Unattended runs (`$rite-autocomplete`, `.devrites/AFK` `max_parallel`) repeat batches
 inside the same run; HITL stops after each batch. Non-integer/`N≤0`/`N>10` hard refuse.
-All-green serial integrate; a red/gap sibling gets a bounded repair round in
-its own worktree — never rebuilt from scratch while budget remains.
+All-green (independent review + proof) then integrate as one local `WIP(<slug>):`
+commit per sibling onto the current control branch (never pushed). Do not
+integrate a sibling because the wright returned. A red/gap sibling gets a bounded repair
+round in its own worktree — never rebuilt from scratch while budget remains.
 Post-writer inventory and affected rechecks follow `phase-contract.md` § Independent
 Build review; fold accounts before one repair-all wright.
 Plan-owned gaps still route through Spec Drift Guard
@@ -89,9 +91,11 @@ the next slice automatically; AFK obeys remaining budget; Prove requires all sli
 
 ## Phase exit
 
-**Complete when:** the dispatched wright returns green proof for the slice,
-`git diff --name-only` ⊆ allowlist, independent test analysis admits no Critical
-gap, and `state.md` cursor advances with recorded evidence paths.
+**Complete when:** Independent Build review and fail-on-red proof are green,
+`git diff --name-only` ⊆ allowlist, no open Critical/Important, `state.md` cursor
+advances with recorded evidence, and the control-branch checkpoint has landed
+per [`checkpoint.md`](reference/checkpoint.md).
 
-**Failing case:** wright reports "done" but proof command was not executed or
-failed → slice incomplete; do not advance cursor.
+**Failing case:** wright reports "done" but independent review or proof was
+skipped, red, or followed by an uncommitted repair → slice incomplete; do not
+advance cursor or commit on control.

package/pack/generated/codex/skills/rite-build/reference/anti-patterns.md

@@ -21,3 +21,7 @@ Pack-wide rationalizations and red flags live in
 - Writing a `try/catch` block wider than what you handle.
 - A comment that restates what the next line does.
 - Touching files that aren't in `touched-files.md` for "tidiness".
+- A comment, filename, test name, or commit subject that mentions `SLICE-###`,
+  a slice number, or "this slice".
+- Committing onto control when the wright returns, or before Independent Build
+  review and fail-on-red proof are green.

package/pack/generated/codex/skills/rite-build/reference/checkpoint.md

@@ -1,28 +1,46 @@
-# Checkpoint: proven slices land as local WIP commits
+# Checkpoint: land local WIP only after the check loop is green
 
-A slice's source never stays uncommitted after its gates are green: at RECORD
-the orchestrator commits the proven slice as a local `WIP`, so the working
-tree stays clean and the work survives a crash or compaction.
+The wright does not commit onto the control/primary branch. Independent review
+and fail-on-red proof run first; a red or gap finding dispatches another wright.
+Only when that loop is green does the orchestrator land the local unpushed
+`WIP(<slug>):` commit. Same rule for `$rite-build`, `$rite-prove`, `$rite-polish`,
+`$rite-review`, and `$rite-autocomplete`. Never push. `.devrites/CHECKPOINT` is
+not a gate.
 
-## The checkpoint commit: orchestrator, at RECORD, after gates are green
-A checkpoint records a **proven** slice only after its gates are green. Stage the exact
-slice-owned candidate paths from the manifest, passing each literal path separately.
+## When (and when not)
+
+- **Do:** after Independent Build review (or the phase's independent validators)
+  and fail-on-red proof are green, with no open Critical/Important and no repair
+  wright still in flight. Serial: git recipe below (skip empty index) or isolated
+  FF of a matching `transfer_commit`. Parallel: `devrites-engine parallel
+  integrate --apply-to-control` (no second control `git commit`).
+- **Do not:** when a wright returns; before review/proof; with red/gap findings;
+  fast-forward an isolated transfer onto control before those checks.
+
+A native-worktree `transfer_commit` is transport on the worker branch only.
+
+## The commit
+Stage the exact candidate paths from the manifest, each as its own argv.
 Never stage `touched-files.md`, a directory, glob, unrelated path, or user change.
-Verify the staged set, then commit locally with a `[devrites-context]` body:
+Verify the staged set, then commit locally.
+
+Subject: `WIP(<slug>):` plus an imperative summary of the change (from the
+goal). Never a slice id, `SLICE-###`, a slice number, or "this slice"
+(`WIP(admin-report): add CSV export for usage rows`, not `SLICE-003` or
+`complete slice 3`). Product source, tests, comments, and filenames omit the
+same marks; they stay in `.devrites/` only.
 
 ```bash
-git commit -m "WIP(<slug>): <slice>" -m "$(cat <<'BODY'
+git commit -m "WIP(<slug>): <imperative summary>" -m "$(cat <<'BODY'
 [devrites-context]
-decisions: <one-line delta this slice added to decisions.md>
-remaining: <pending slices — count or names>
-dead-ends: <approaches ruled out this slice, if any>
+decisions: <one-line delta this work added to decisions.md>
+remaining: <pending count>
+dead-ends: <approaches ruled out, if any>
 BODY
 )"
 ```
 
-When host reconciliation already landed the isolated transfer commit, nothing
-is staged and the step no-ops. **Local-only:** never push a checkpoint or let
-scratch work trigger CI.
+**Local-only:** never push or let scratch work trigger CI.
 
 ## Restore
 After a crash, a fresh session may read the last `WIP(<slug>)` body as crash context.
@@ -36,9 +54,3 @@ WIP commits are scratch and never reach shared history. `$rite-ship` folds them
 one atomic feature commit before the Conventional-Commit ladder: see the collapse step in
 [git-ship.md](../../rite-ship/reference/git-ship.md). Result: one clean commit, bisect
 stays green.
-
-## Autocomplete
-Checkpoints are unconditional; `$rite-autocomplete` needs no sentinel arming.
-Each wright returns after one slice; HITL stops, while explicit `.devrites/AFK`
-lets the controlling Build root chain another green slice only under its cap
-and pause rules.

package/pack/generated/codex/skills/rite-build/reference/one-slice-cycle.md

@@ -17,15 +17,16 @@ DISPATCH  → hand the slice contract to devrites-slice-wright (fresh context).
    ORIENT    → load only the files this slice touches; learn the project's idiom; reuse-first
    (RED)     → if behavior change: write the failing test first
    IMPLEMENT → smallest complete version; match conventions; devrites-frontend-craft for UI
-   VERIFY    → writer-safe tests/types/lint; return code + tests
+   VERIFY    → writer-safe tests/types/lint; return code + tests (no control-branch commit)
 (DOUBT)   → orchestrator, on return: devrites-doubt each non-trivial decision the wright stood up
             — dispatch the initial read-only reviews of distinct decisions in parallel
             (independent claims, fresh contexts); wright fixes stay serial — writers share files
 PROVE     → root: required build/browser/E2E, then returned-diff/path review; fail-on-red
+            (red/gap → repair wright, then re-review/re-prove; do not commit yet)
 RECORD    → orchestrator: after green verification, update state.md/evidence.md and
             upsert the authoritative candidate manifest from the actual scoped diff
-(CHECKPOINT) → orchestrator: commit the proven slice local-only as WIP(<slug>)
-            with a [devrites-context] body → clean tree, survives a crash (checkpoint.md)
+(CHECKPOINT) → only now, with review+proof green: local WIP(<slug>): <imperative summary>
+            on the control branch (no slice id) → checkpoint.md
 NEXT      → HITL root reports and stops. AFK with parallel cap>1: return to parallel-batch selection and run the new N_eff; otherwise repeat under afk-discipline.md
 ```
 

package/pack/generated/codex/skills/rite-build/reference/parallel-batch.md

@@ -94,13 +94,16 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    Expected test-first RED is not a terminal gate failure. Cancel only for a shared
    invalid foundation, safety/access failure, resource boundary, or explicit stop;
    preserve completed and in-progress recoverable work and classify each result.
-6. Integrate: each `transfer_commit` descends from `B` and diffs path-exact vs
-   `B`; squash-apply all in plan order into one `WIP(<slug>):` commit on the
-   staging branch (Ship collapses it). Conflict → reset to `B`,
-   `integrate-failed`; classify under repair rounds (siblings stay in place).
-7. Success: FF control to the squash commit — the batch lands as one local
-   commit, never pushed; union `touched-files.md`; update state/evidence;
-   AFK +1 per integrated sibling; optional `check candidate`.
+6. `parallel integrate --apply-to-control` **only after steps 4–5 are green**:
+   each `transfer_commit` descends from `B` and diffs path-exact vs
+   `B`; apply each in plan order as its own local `WIP(<slug>):` commit
+   (imperative summary, never a slice id). Staging branch, then FF. Conflict →
+   reset to `B`, `integrate-failed`; classify under repair rounds (siblings stay
+   in place). Never integrate because a wright returned.
+7. Success: FF control (the branch that held `HEAD` when the batch started —
+   often `main`/`master`, otherwise whatever the user was on) to the integrate
+   tip: N local commits, never pushed; union `touched-files.md`; update
+   state/evidence; AFK +1 per integrated sibling; optional `check candidate`.
 8. Cleanup runs only after `integrate` marks the lease `complete` — work
    landed in control, so `parallel cleanup` removes worktrees/branches.
    Blocked/human-stopped batches keep lease, worktrees, branches — nothing is
@@ -178,9 +181,9 @@ devrites-engine parallel lease-write|lease-read|lease-clear --root <repo> --slug
 #   parallel cleanup --root <repo> --slug <slug> --force   (salvages, prints retained refs)
 ```
 
-`integrate` without `--apply-to-control` stages the squash commit, leaves the
-lease `running` and control at `B`; cleanup still refuses — the commit cannot
-be lost. `record-green` and `integrate` also accept an `integrate-failed`
+`integrate` without `--apply-to-control` stages the per-sibling commits, leaves
+the lease `running` and control at `B`; cleanup still refuses — the commits
+cannot be lost. `record-green` and `integrate` also accept an `integrate-failed`
 lease, so a failed integrate retries after repair. `--apply-to-control`
 refuses when control moved past `B` or holds uncommitted changes on slice
 paths — commit/stash and retry; the batch is untouched. Go is SSOT; never

package/pack/generated/codex/skills/rite-build/reference/phase-contract.md

@@ -44,8 +44,10 @@ Spec Drift Guard still applies.
    Reapply host admission before correction; affected proof/evidence follows candidate
    integrity. Human gates remain product/irreversible/access decisions.
 7. **Record green.** Upsert actual scoped `present`/`deleted` rows in `touched-files.md`;
-   update state, evidence and applicable UI/browser proof. Manifest stays mutable
-   until Polish. For a release milestone, after the last slice's rows run
+   update state, evidence and applicable UI/browser proof. Checkpoint per
+   [`checkpoint.md`](checkpoint.md) only after steps 5–6 are green and every
+   repair wright has been re-reviewed and re-proved; never on wright return.
+   Manifest stays mutable until Polish. For a release milestone, after the last slice's rows run
    `devrites-engine state merge-manifest <slug>` to fold the recorded
    predecessor chain into the union manifest before Prove. Record stood
    decisions/dead ends; refresh verified/falsified

package/pack/generated/codex/skills/rite-build/reference/wright-dispatch.md

@@ -25,12 +25,13 @@ discard user work to qualify. Ask host for an explicit current-`HEAD` base when
 supported. Regardless of host defaults, the wright's first command must prove actual `git rev-parse HEAD` equals supplied
 `worktree_base`. Mismatch returns a gap with no write before project reads or baseline proof.
 
-The isolated wright returns one local unpushed `transfer_commit`, its `worktree_base`,
-and exact files. Root proves descendant base, exact `git diff --name-only`
+The isolated wright returns one local unpushed `transfer_commit` (contract
+`WIP(<slug>):` subject, no slice id), its `worktree_base`, and exact files.
+That commit is worker-branch transport, not the control-branch checkpoint. Root proves descendant base, exact `git diff --name-only`
 `` `<base>..<transfer>` ``, no `.devrites/**`/submodule/symlink/unrelated delta, unchanged
 source base, and no user-work overwrite. Use only host-native explicit reconciliation;
-never ad hoc copy, cherry-pick, or merge from read-only root. Compare transferred bytes,
-run approved proof, record evidence, then let host remove worktree.
+never ad hoc copy, cherry-pick, or merge from read-only root. Land on control
+only per [`checkpoint.md`](checkpoint.md).
 
 Conflict, extra/missing commit, moved base, or cleanup failure is `gap`/STOP:
 preserve the worktree and commit. Without explicit reconciliation, use same-worktree serial.
@@ -48,7 +49,8 @@ worktrees stay forbidden.
    [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
    its rejection here is not a blocker.
 2. Include goal, verbatim acceptance, exclusions, context,
-   `test-plan.md` proof commands, and applicable standards. For each triggered
+   `test-plan.md` proof commands, applicable standards, and the exact
+   `WIP(<slug>):` subject (no slice id). For each triggered
    topology/data/integration standard, include only the feature-specific owner/invariant,
    failure or partial-state case, recovery rule, and required proof from the vetted plan.
    Do not paste the whole standard or silently omit an applicable risk.
@@ -75,12 +77,17 @@ Opt-in `$rite-build --parallel N` fans out only under [`parallel-batch.md`](para
    assertions. Dedicated test analysis treats weakening as Critical.
    Confirm a test for a data/integration/topology risk can actually exhibit that risk;
    mocks that erase it and one-root proof offered for another root are unproven.
-3. Run only repository proof already approved by `test-plan.md`, then inspect
-   `git diff --name-only` again in case a proof tool changed source.
-4. Apply [independent Build review](phase-contract.md#independent-build-review) before
-   proof acceptance. Human choices return; technical failures follow
+3. Apply [independent Build review](phase-contract.md#independent-build-review)
+   before proof. Human choices return; technical failures follow
    [the canonical retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve).
    Derive accounting from recorded reproductions, corrections, and decisive rechecks.
+4. Run only repository proof already approved by `test-plan.md`, then inspect
+   `git diff --name-only` again in case a proof tool changed source.
+   **Do not land on control until review and proof are green.** Isolated
+   `transfer_commit` stays on the worker branch; same-worktree diffs stay
+   uncommitted. Serial: [`checkpoint.md`](checkpoint.md), then host may remove the
+   worktree. Parallel: `record-green` only; land with `parallel integrate
+   --apply-to-control` after the batch; `parallel cleanup` removes worktrees.
 5. Reconcile returned reuse, conventions, principles, sources, assumptions,
    decisions, dead ends, follow-ups, gates, and touched files. Persist the
    relevant facts in canonical artifacts, not the wholesale report. A plan-gap

package/pack/generated/codex/skills/rite-plan/reference/slicing.md

@@ -106,8 +106,8 @@ Make each continuation cheap and drift-free:
 - Phases chain automatically only **inside** one workspace (`$rite-autocomplete`
   drives spec → clarify → temper → define → vet → build × slices → prove → polish →
   review → seal; plain HITL chains plan↔vet inline and stops at each other boundary).
-  Crossing into the next continuation is a new invocation by design, so the human sees
-  each delivered increment before the next one starts.
+  Next continuation is a new invocation by default. Same-run chaining is
+  `continue_sequence: true` (Deferred-ship).
 
 ### Release milestone (full-picture gate)
 
@@ -138,7 +138,8 @@ product:
   product picture across milestones; Polish folds each milestone's deltas.
 - **Deferred-ship sequence** (`.devrites/AFK` `continue_sequence: true`, `max_workspaces: N`):
   milestones are sealed but not shipped, and the armed run opens the next recorded
-  continuation automatically; per-slice `WIP(<slug>)` checkpoints still land locally,
+  continuation automatically; local `WIP(<slug>):` checkpoints still land with
+  human summaries (never a slice id),
   so the tree stays clean. One release ship at the end collapses the sequence's
   checkpoints into the single release commit, pushes/tags it, and may archive the
   sealed predecessors. Because no milestone boundary was shipped, later work can touch

package/pack/generated/codex/skills/rite-polish/SKILL.md

@@ -91,7 +91,9 @@ Incomplete comparison is **not** agreement. Record axis deltas in `polish-report
    affected real re-proof using the approved commands, fresh proof-runner
    validation, refreshed evidence/browser bindings, and an updated candidate
    manifest. Record a **`Re-verification:`** line in `polish-report.md`. Close
-   the candidate for Review only after these checks are green.
+   the candidate for Review only after these checks are green. Then checkpoint
+   remaining candidate diffs per
+   [`checkpoint.md`](../rite-build/reference/checkpoint.md).
 7. **Aggregate output:** each phase appends to the single `polish-report.md`.
 
 ## Refinement modes

package/pack/generated/codex/skills/rite-prove/SKILL.md

@@ -106,6 +106,9 @@ test changes.
    attempt. Never guess the runtime fix or reuse old GO.
 10. **Record.** Root updates `evidence.md`, optional `browser-evidence.md`,
     traceability, and state, with exactly one observed candidate binding.
+    After independent validators are green, checkpoint remaining candidate
+    diffs per [`checkpoint.md`](../rite-build/reference/checkpoint.md). A wright
+    correction during Recover red does not commit on control until this step.
 
 > Do not claim an unobserved pass, skip browser proof, or proceed with pending
 > slices. Load `reference/anti-patterns.md` when tempted to do so.

package/pack/generated/codex/skills/rite-review/SKILL.md

@@ -142,7 +142,9 @@ Pull these via `Read` when the diff demands them:
    binding in `review.md` for the current digest, distinguishing fresh accounts from
    cited unchanged sub-scope evidence and reconciling complete coverage.
    **Completion:** the records name the reviewed candidate identity and every accepted
-   correction has affected proof plus a fresh Review.
+   correction has affected proof plus a fresh Review. Then checkpoint remaining
+   candidate diffs per [`checkpoint.md`](../rite-build/reference/checkpoint.md);
+   a wright correction does not commit on control until that Review is green.
 
 ## Finding labels