devrites 5.8.0 → 5.9.0

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [5.9.0](https://github.com/ViktorsBaikers/DevRites/compare/v5.8.0...v5.9.0) (2026-09-15)
+
+### Added
+
+* **rite:** land proven WIP commits and keep autocomplete running ([#75](https://github.com/ViktorsBaikers/DevRites/issues/75)) ([73bf932](https://github.com/ViktorsBaikers/DevRites/commit/73bf932568d7bae34ea20ce6476c33842b123467))
+
 ## [5.8.0](https://github.com/ViktorsBaikers/DevRites/compare/v5.7.2...v5.8.0) (2026-09-14)
 
 ### Added

package/README.md

@@ -33,7 +33,7 @@ project-conventional push, tag, or PR action, and archive the workspace.
 Unattended runs may create local WIP checkpoint commits along the way, but they
 remain local unless Ship's disclosed plan includes an approved remote action.
 
-**Status:** [`v5.8.0`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v5.8.0): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v5.9.0`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v5.9.0): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -152,7 +152,7 @@ the original decisions and proof.
 .devrites/
   ACTIVE                 # active feature slug
   AFK                    # optional unattended-mode configuration
-  CHECKPOINT             # optional local WIP checkpoint mode
+  CHECKPOINT             # reserved path; not a commit gate
   principles.md          # project rules that gate the workflow
   specs/                 # living structured capabilities
   work/<slug>/

package/docs/architecture.md

@@ -336,10 +336,10 @@ workflow. It carries state through workspace files rather than chat. A vague
 prompt starts `devrites-interview`; `/rite-spec` and `/rite-clarify` then
 finish the only interactive window. After decision coverage is CLEAR it runs unattended,
 choosing the recommended option at each soft gate and recording the rationale
-in `decisions.md`. It does **not** weaken the safety gates: genuine
-product/scope/policy decisions, irreversible risk, human-only access/actions,
-an open human-owned gate, a NO-GO, exhausted `max_slices`, or low confidence
-still pause. Agents use bounded recovery for red tests, runtime failures, and
+in `decisions.md`. It does **not** weaken blocking/escalating or irreversible-risk
+gates: human-only access/actions, those gates, a NO-GO, or low confidence still
+pause. Temper expand, validating gates, and default slice/agent/time/review-queue
+caps do not. `--max-slices` is ignored the same way. Agents use bounded recovery for red tests, runtime failures, and
 missing technical coverage. By default the workflow stops at Seal GO with `/rite-ship` as the next step.
 The `--ship` flag (alias `--yolo`) continues through Ship preflight, discloses
 the exact Git plan, and still stops for a fresh literal `GO` plus native host

package/docs/command-map.md

@@ -91,7 +91,7 @@ See [`cli.md`](cli.md).
 | [`/rite-define`](../pack/.claude/skills/rite-define/SKILL.md) | define → plan | `[slug]` | Authors architecture, plan, vertical `SLICE-###` tasks, and traceability. A changed provider/consumer boundary names one canonical shared contract plus consuming provider/consumer tests; no change uses a justified no-impact statement. | `spec.md` + `decision-coverage.md` (+ `strategy.md`) + references | `architecture.md`, `plan.md`, `tasks.md`, `traceability.md`, `state.md`, `decisions.md` |
 | [`/rite-vet`](../pack/.claude/skills/rite-vet/SKILL.md) | vet | `[slug] [--cross-model] [--full]` | **Before build: every feature.** Engineering review of the defined plan: scope challenge (reuse / minimum-diff / complexity smell) + architecture / plan code-quality / test-coverage design / performance, confidence-banded with a quote-the-source verification gate; failure-mode and dependency-safety review. Hardens `plan.md` / `tasks.md` in place; writes the build-readable `test-plan.md` and a semantic `READY` verdict reconciled by the exact native reviewer; acceptance-changing deltas route via the Spec Drift Guard. Runs on every plan: depth scales to stakes (light pass on simple plans, full on big/risky), never skipped; **always in `/rite-autocomplete`**. Reviewer: `devrites-plan-reviewer` (+ optional `--cross-model`). | `plan.md` + `tasks.md` + `spec.md` (+ `strategy.md`) | `eng-review.md`, `test-plan.md`, `plan.md`, `tasks.md`, `decisions.md`, `state.md` |
 | [`/rite-plan`](../pack/.claude/skills/rite-plan/SKILL.md) | repair → plan | `[mode]` | Reslice / repair / re-order / split / unblock an active plan and return to the `plan` checkpoint; `revise` is artifact-only and `/rite-vet` is the normal resume. | spec/plan/tasks/state/drift + diff | `plan.md`, `tasks.md`, `state.md`, `decisions.md` |
-| [`/rite-build`](../pack/.claude/skills/rite-build/SKILL.md) | build | `[slice]` | In HITL, orchestrates one vertical slice through the sole wright; an explicit `.devrites/AFK` sentinel may chain bounded low-risk slices. Every task states exact project-relative paths; after return, the root rejects extra paths or weakened tests, runs repository proof, and maintains the strict candidate manifest. | workspace + diff + `.devrites/CHECKPOINT` | code + `state.md`, `evidence.md`, `traceability.md`, `touched-files.md` (+ local `WIP(<slug>)` commit in checkpoint mode) |
+| [`/rite-build`](../pack/.claude/skills/rite-build/SKILL.md) | build | `[slice]` | In HITL, orchestrates one vertical slice through the sole wright; an explicit `.devrites/AFK` sentinel may chain bounded low-risk slices. Every task states exact project-relative paths; after return, the root rejects extra paths or weakened tests, runs independent review and repository proof, and maintains the strict candidate manifest. Lands a local `WIP(<slug>):` commit only after that check loop is green (never on wright return). | workspace + diff | code + `state.md`, `evidence.md`, `traceability.md`, `touched-files.md` (+ local `WIP(<slug>):` after checks; never a slice id) |
 | [`/rite-converge`](../pack/.claude/skills/rite-converge/SKILL.md) | converge | `[slug]` | **Recovery.** Compare live code with clarified intent, append each unmet piece as a traceable `SLICE-###`, and invalidate the old vet verdict so changed work returns through `/rite-vet`. `tasks.md` stays byte-identical when already converged. | clarified spec + plan/tasks + principles + live code | `tasks.md` (appended), `traceability.md`, `state.md`, `eng-review.md` (invalidated), `decisions.md` |
 | [`/rite-upgrade`](../pack/.claude/skills/rite-upgrade/SKILL.md) | compatibility | `[slug]` | **Conditional recovery.** Audit an older released workspace against current contracts. Only cited defects route through Clarify, Plan repair, Converge, Vet, Prove, Polish, Review, or Seal. Ambiguous candidate scope is a gap; age/cursor form alone is never a defect, and old passes are never synthesized. | active workspace + named current contracts | admitted unfinished artifacts via their owning rite |
 | [`/rite-prove`](../pack/.claude/skills/rite-prove/SKILL.md) | prove | `[feature-slug]` | Positive, discriminating tests + build/runtime/browser proof; checks the same candidate before/after commands and binds evidence to its digest. | `traceability.md` + workspace + candidate | `evidence.md`, `browser-evidence.md`, `traceability.md`, `state.md` |
@@ -99,7 +99,7 @@ See [`cli.md`](cli.md).
 | [`/rite-review`](../pack/.claude/skills/rite-review/SKILL.md) | review | `[scope: slice N \| feature] [--full]` | Feature-scoped parallel Spec + Standards review of the closed candidate; binds `review.md` to its digest. | workspace + candidate | `review.md`, `evidence.md`, `state.md` |
 | [`/rite-seal`](../pack/.claude/skills/rite-seal/SKILL.md) | seal | `[feature-slug] [--full]` | Candidate-bound GO / NO-GO **decision**. Rechecks exact proof/review bindings and runs no git; on GO sets `Next step: /rite-ship`. | all artifacts + candidate | `seal.md`, `state.md` |
 | [`/rite-ship`](../pack/.claude/skills/rite-ship/SKILL.md) | ship | `[slug]` | Starts with a read-only Seal/candidate check and exact plan disclosure, then requires fresh literal `GO`. Only then may it collapse checkpoints, stage exact candidate paths, validate staged scope/bytes/bindings/secrets, commit and reverify, perform optional separately approved push/tag/PR actions, and archive/close. | `seal.md` + candidate + Git index | `ship.md`, `state.md`, archive |
-| [`/rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | (orchestrator) | `[idea] [--ship\|--yolo] [--max-slices N] [--full] [--cross-model]` | Full lifecycle (spec → clarify → … → seal → ship). Spec + clarify form the one interactive window; AFK/checkpoint mode arms only after decision coverage is CLEAR. Pauses for genuine human-owned decisions/actions, NO-GO, or budget exhaustion; objective red checks use bounded technical recovery. Default stops at Seal GO; `--ship` (`--yolo`) reaches Ship preflight but still requires fresh literal `GO` and native approval; `--full` selects the Full profile and `--cross-model` arms Vet's second opinion. | idea + workspace | whole workspace (drives every phase) |
+| [`/rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | (orchestrator) | `[idea] [--ship\|--yolo] [--max-slices N] [--full] [--cross-model]` | Full lifecycle (spec → clarify → … → seal → ship). Spec + clarify form the one interactive window; AFK/checkpoint mode arms only after decision coverage is CLEAR. Pauses for irreversible risk, blocking/escalating, human-only access, or NO-GO — not temper expand, validating gates, `--max-slices`, or default resource caps. Objective red checks use bounded technical recovery. Default stops at Seal GO; `--ship` (`--yolo`) reaches Ship preflight but still requires fresh literal `GO` and native approval; `--full` selects the Full profile and `--cross-model` arms Vet's second opinion. | idea + workspace | whole workspace (drives every phase) |
 | [`/rite-quick`](../pack/.claude/skills/rite-quick/SKILL.md) | (express) | `<change>` | Express lane for a **small, reversible, unambiguous** change: one-line contract → TDD build → scoped prove → review-lite → ship, no full artifact tree. **Significance gate first**: auth / migration / public-API / destructive / multi-slice / ambiguous → escalates to `/rite-spec`. Triggers: "quick fix", "small change", "tiny tweak", "just do X". | the change + codebase | code + commit (optional `brief.md` / `evidence.md`) |
 | [`/rite-frame`](../pack/.claude/skills/rite-frame/SKILL.md) | lens | `[ask \| diff]` | Pre-flight + self-audit lens for ad-hoc work the lifecycle gates never see: **FRAME** turns an imperative ask into a falsifiable success criterion + verify command before code; **AUDIT** checks a raw diff against the four LLM coding failure modes (silent assumption / overcomplication / out-of-scope edit / unverifiable goal). Top of `/rite-quick` or before a plain "just do X". | the ask / a raw diff | success criterion + verify command (inline) |
 | [`/rite-adopt`](../pack/.claude/skills/rite-adopt/SKILL.md) | onboard | `[path or area to adopt] [+ what you want to build next]` | Reverse-derive the existing baseline and next objective; propose any durable project guidance in the nearest native instruction file. | codebase + project instructions | workspace spec/state artifacts + optional guidance proposal |

package/docs/engine/workspace-schema.md

@@ -21,7 +21,7 @@ budgets, IDs, and read order live in
 .devrites/
   ACTIVE
   AFK                         # optional run-mode sentinel
-  CHECKPOINT                  # optional local WIP checkpoint sentinel
+  CHECKPOINT                  # reserved path; not a commit gate
   principles.md               # ratified project invariants
   specs/                      # living capability Markdown, maintained by skills
   work/

package/docs/flow.md

@@ -304,8 +304,10 @@ Each workspace-operating lifecycle skill reads durable state from
 `.devrites/work/<feature-slug>/` before acting and reports the owning create or
 selection command when no workspace is active. Utility and on-ramp skills use
 their own stated preconditions. The optional `.devrites/AFK` sentinel sits
-beside `ACTIVE` and toggles the session-level run mode; `.devrites/CHECKPOINT`
-separately enables eligible local WIP checkpoint commits.
+beside `ACTIVE` and toggles the session-level run mode. Local `WIP(<slug>):`
+checkpoints land after independent review and fail-on-red proof are green, not
+when a wright returns; `.devrites/CHECKPOINT` is a reserved
+path, not a gate.
 
 ```mermaid
 erDiagram

package/docs/skills.md

@@ -222,7 +222,7 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 
 | Skill | What It Does | Use When |
 |---|---|---|
-| [`rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | Runs the lifecycle unattended (spec → clarify → … → seal → ship), choosing the recommended option at each soft gate and recording the rationale in `decisions.md`.<br>A vague prompt gets one up-front spec/clarify window; after CLEAR it does not iterate per phase.<br>It pauses only for genuine product/scope/policy decisions, irreversible risk, human-only access, NO-GO, or budget exhaustion.<br>Objective red checks use bounded technical recovery, including cold-resume from retained one-shot evidence and one-time migration of stale missing-writer stops when an upgraded contract supplies the first supported writer. That migration applies once; the first real materializer failure is attempt one under normal bounded recovery. Internal `NEEDS_REPLAN` and new agent-owned review findings stay caller-owned backward edges, not user-facing stops. Spending an action authorization blocks another real execution, not offline repair.<br>Default stops at Seal GO. `--ship` (alias `--yolo`) reaches Ship preflight but still requires a fresh literal `GO` and native approval. | "Autocomplete", "do the whole thing", "run the full cycle", "one-shot this feature". |
+| [`rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | Runs the lifecycle unattended (spec → clarify → … → seal → ship), choosing the recommended option at each soft gate and recording the rationale in `decisions.md`.<br>A vague prompt gets one up-front spec/clarify window; after CLEAR it does not iterate per phase.<br>It pauses only for irreversible risk, blocking/escalating gates, human-only access, or NO-GO — not temper expand, validating gates, or default slice/agent/time/review-queue caps.<br>Objective red checks use bounded technical recovery, including cold-resume from retained one-shot evidence and one-time migration of stale missing-writer stops when an upgraded contract supplies the first supported writer. That migration applies once; the first real materializer failure is attempt one under normal bounded recovery. Internal `NEEDS_REPLAN` and new agent-owned review findings stay caller-owned backward edges, not user-facing stops. Spending an action authorization blocks another real execution, not offline repair.<br>Default stops at Seal GO. `--ship` (alias `--yolo`) reaches Ship preflight but still requires a fresh literal `GO` and native approval. | "Autocomplete", "do the whole thing", "run the full cycle", "one-shot this feature". |
 | [`rite-zoom-out`](../pack/.claude/skills/rite-zoom-out/SKILL.md) | Map the modules, callers, callees, and decisions in an unfamiliar area using the project's domain glossary. | Explicit-only: `/rite-zoom-out` / `/rite zoom-out`. |
 | [`rite-prototype`](../pack/.claude/skills/rite-prototype/SKILL.md) | Throwaway code answering ONE design question: logic harness OR 2 to 4 UI variations on one route. | Explicit-only: `/rite-prototype` / `/rite prototype`. |
 | [`rite-handoff`](../pack/.claude/skills/rite-handoff/SKILL.md) | Compact chat session → handoff doc. References existing `.devrites/work/<slug>/` artifacts by path. | Explicit-only: `/rite-handoff` / `/rite handoff`. |

package/docs/usage.md

@@ -69,7 +69,7 @@ Project-root sentinel (outside the workspace):
 | File | Created by | Holds |
 |---|---|---|
 | `.devrites/AFK` | you (presence = AFK mode active) | optional YAML: `max_slices`, `notify`, `allow_gates`. Empty file = AFK with defaults. See [`pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md`](../pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md). |
-| `.devrites/CHECKPOINT` | you or `/rite-autocomplete` (presence = checkpoint mode) | empty sentinel. When set, `/rite-build` commits each proven slice local-only as `WIP(<slug>)` so a crash mid-build loses neither source nor reasoning; after literal `GO`, `/rite-ship` collapses an eligible disclosed WIP run into the feature commit. See [`pack/.claude/skills/rite-build/reference/checkpoint.md`](../pack/.claude/skills/rite-build/reference/checkpoint.md). |
+| `.devrites/CHECKPOINT` | unused as a gate | reserved path (not a candidate). After Independent Build review and fail-on-red proof are green (not when a wright returns), `/rite-build` / `/rite-prove` / `/rite-polish` / `/rite-review` land a local `WIP(<slug>): <imperative summary>` commit (serial: checkpoint git recipe or no-op if nothing staged; parallel: `devrites-engine parallel integrate`); `/rite-ship` later collapses an eligible WIP run. See [`pack/.claude/skills/rite-build/reference/checkpoint.md`](../pack/.claude/skills/rite-build/reference/checkpoint.md). |
 
 The shape of this directory is also documented in
 [`flow.md` § Workspace state model](flow.md#7-workspace-state-model).
@@ -368,7 +368,7 @@ full list.
 ## 11) Full unattended lifecycle: `/rite-autocomplete`
 
 ```text
-/rite-autocomplete "add CSV export for admins" --max-slices 8
+/rite-autocomplete "add CSV export for admins"
   → vague idea → runs devrites-interview, then /rite-spec + /rite-clarify in
     the only interactive window
   → Decision coverage: CLEAR → arms AFK, then drives: /rite-temper →
@@ -384,17 +384,18 @@ You: GO                        # → commit, optional approved push/tag/PR, then
 
 Add `--ship` (alias `--yolo`) to continue through `/rite-ship` preflight.
 Autocomplete discloses the exact Git plan, then still stops for a fresh literal
-`GO` and native host approval. It also pauses for genuine product/scope/policy
-decisions, irreversible risk, human-only access/actions, a NO-GO, exhausted
-`max_slices`, or low confidence. Objective red checks use bounded recovery
-instead. Args:
+`GO` and native host approval. It also pauses for irreversible risk, human-only access/actions, blocking or
+escalating gates, a NO-GO, or low confidence — not for temper expand, validating
+gates, `--max-slices`, or default slice/agent/time/review-queue caps.
+Objective red checks use bounded recovery instead. Args:
 `[idea] [--ship|--yolo] [--max-slices N] [--full] [--cross-model]`.
 Optional flags are inactive unless their exact token occurs in the invocation;
-`--max-slices` requires one positive base-10 integer. `--full` selects the Full
+`--max-slices` requires one positive base-10 integer and does not cap this run.
+`--full` selects the Full
 execution profile, and `--cross-model` arms Vet's second opinion.
-Autocomplete never rewrites an existing `.devrites/AFK`. After Vet fixes the
-pending-slice count, it stores the lower effective budget in `state.md`; an
-existing remaining counter can only stay the same or decrease.
+Autocomplete never rewrites an existing `.devrites/AFK`. After Vet it seeds
+remaining from the pending-slice count and ignores leftover remaining and
+`--max-slices`.
 
 ## Checking in
 

package/engine/internal/parallel/git.go

@@ -211,6 +211,10 @@ func mergeFFOnly(repo, commit string) error {
 	return err
 }
 
+func commitSubject(repo, rev string) (string, error) {
+	return git(repo, "log", "-1", "--format=%s", rev)
+}
+
 func cherryPickNoCommit(repo, fromExclusive, toInclusive string) error {
 	_, err := git(repo, "cherry-pick", "-n", fromExclusive+".."+toInclusive)
 	return err
@@ -219,3 +223,7 @@ func cherryPickNoCommit(repo, fromExclusive, toInclusive string) error {
 func cherryPickAbort(repo string) {
 	_, _ = git(repo, "cherry-pick", "--abort")
 }
+
+func cherryPickQuit(repo string) {
+	_, _ = git(repo, "cherry-pick", "--quit")
+}

package/engine/internal/parallel/ops.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"regexp"
 	"sort"
 	"strings"
 
@@ -285,10 +286,8 @@ func integrateLocked(opts IntegrateOpts) (tip string, lease *Lease, err error) {
 	}
 
 	union := make([]string, 0, len(lease.Slices))
-	ids := make([]string, 0, len(lease.Slices))
 	for _, sl := range lease.Slices {
 		union = append(union, sl.Paths...)
-		ids = append(ids, sl.ID)
 	}
 	if opts.ApplyToControl {
 		// FF into control must not silently absorb or clobber the user's
@@ -381,14 +380,19 @@ func integrateLocked(opts IntegrateOpts) (tip string, lease *Lease, err error) {
 
 		if err := cherryPickNoCommit(stageWT, base, tc); err != nil {
 			cherryPickAbort(stageWT)
-			return fail(fmt.Errorf("squash apply failed for slice %s: %w", sl.ID, err))
+			return fail(fmt.Errorf("apply failed for slice %s: %w", sl.ID, err))
 		}
+		subj, err := commitSubject(opts.Root, tc)
+		if err != nil {
+			return fail(fmt.Errorf("transfer subject for %s: %w", sl.ID, err))
+		}
+		if _, err = stagePathsAndCommit(stageWT, controlCommitMessage(opts.Slug, subj), sl.Paths); err != nil {
+			return fail(fmt.Errorf("control commit for %s: %w", sl.ID, err))
+		}
+		cherryPickQuit(stageWT)
 	}
-
-	msg := fmt.Sprintf("WIP(%s): parallel batch %s (%s)\n\n[devrites-context]\nslices: %s\nbase: %s",
-		opts.Slug, lease.BatchID, strings.Join(ids, ", "), strings.Join(ids, ", "), base)
-	if tip, err = stagePathsAndCommit(stageWT, msg, union); err != nil {
-		return fail(fmt.Errorf("squash commit: %w", err))
+	if tip, err = headSHA(stageWT); err != nil {
+		return fail(fmt.Errorf("integrate tip: %w", err))
 	}
 	if err := removeWorktree(opts.Root, stageWT); err != nil {
 		if _, statErr := os.Stat(stageWT); statErr == nil {
@@ -414,12 +418,36 @@ func integrateLocked(opts IntegrateOpts) (tip string, lease *Lease, err error) {
 	} else if err := ensureControlAtBase(opts.Root, base); err != nil {
 		return fail(err)
 	}
-	// Without --apply-to-control the lease stays running: the squash commit
-	// lives only on the integrate branch, and a running lease keeps a
-	// non-forced cleanup from discarding the refs that hold it.
+	// Without --apply-to-control the lease stays running: the integrate
+	// commits live only on the integrate branch, and a running lease keeps a
+	// non-forced cleanup from discarding the refs that hold them.
 	return tip, lease, nil
 }
 
+var (
+	sliceTaskID       = regexp.MustCompile(`(?i)\bSLICE-\d+\b`)
+	sliceProcessMark  = regexp.MustCompile(`(?i)\bthis slice\b|\bslice\s+\d+\b`)
+	existingWIPPrefix = regexp.MustCompile(`(?i)^WIP\([^)]+\):\s*`)
+)
+
+// controlCommitMessage is the local unpushed subject/body landed on control.
+// Ship collapse still keys off the WIP(<slug>): prefix; the rest is a human
+// summary with DevRites process marks stripped (SLICE-###, "this slice",
+// "slice N"). Ordinary English such as "array slice" is left intact.
+func controlCommitMessage(slug, transferSubject string) string {
+	prefix := fmt.Sprintf("WIP(%s): ", slug)
+	line := strings.TrimSpace(strings.SplitN(transferSubject, "\n", 2)[0])
+	line = existingWIPPrefix.ReplaceAllString(line, "")
+	line = sliceTaskID.ReplaceAllString(line, "")
+	line = sliceProcessMark.ReplaceAllString(line, "")
+	line = strings.TrimSpace(strings.Trim(line, ":-"))
+	line = strings.Join(strings.Fields(line), " ")
+	if line == "" {
+		line = "land proven work"
+	}
+	return prefix + line + "\n\n[devrites-context]\n"
+}
+
 func pathListsEqual(a, b []string) bool {
 	if len(a) != len(b) {
 		return false
@@ -470,7 +498,7 @@ func salvageSlice(sl LeaseSlice, batchID string) (string, error) {
 		return "", nil
 	}
 	return stagePathsAndCommit(sl.WorktreePath,
-		fmt.Sprintf("devrites: salvage %s WIP (%s)", sl.ID, batchID), sl.Paths)
+		fmt.Sprintf("devrites: salvage WIP (%s)", batchID), sl.Paths)
 }
 
 // Cleanup removes worker worktrees and clears the lease. A complete batch

package/engine/internal/parallel/ops_test.go

@@ -19,7 +19,7 @@ func commitIn(t *testing.T, wt, file, marker string) string {
 		t.Fatal(err)
 	}
 	gitOk(t, wt, "add", file)
-	gitOk(t, wt, "commit", "-m", "slice "+marker)
+	gitOk(t, wt, "commit", "-m", "WIP(demo-feature): add "+marker+" helper")
 	return gitOk(t, wt, "rev-parse", "HEAD")
 }
 
@@ -426,3 +426,31 @@ func TestCleanupWarnsOnFailedBranchCleanup(t *testing.T) {
 		t.Fatalf("cleanup should still clear the lease, got %v", err)
 	}
 }
+
+func TestControlCommitMessage(t *testing.T) {
+	t.Parallel()
+	got := controlCommitMessage("admin-report", "WIP(admin-report): SLICE-003 add CSV export")
+	wantPrefix := "WIP(admin-report): add CSV export\n"
+	if !strings.HasPrefix(got, wantPrefix) {
+		t.Fatalf("subject %q want prefix %q", got, wantPrefix)
+	}
+	if strings.Contains(got, "SLICE-") || strings.Contains(strings.ToLower(got), "slice-003") {
+		t.Fatalf("message still names a slice id: %q", got)
+	}
+	got = controlCommitMessage("admin-report", "WIP(other): complete slice 3")
+	if !strings.HasPrefix(got, "WIP(admin-report): complete\n") {
+		t.Fatalf("foreign WIP prefix / slice N: %q", got)
+	}
+	got = controlCommitMessage("admin-report", "add this slice CSV")
+	if !strings.HasPrefix(got, "WIP(admin-report): add CSV\n") {
+		t.Fatalf("this slice: %q", got)
+	}
+	got = controlCommitMessage("admin-report", "keep array slice helper")
+	if !strings.HasPrefix(got, "WIP(admin-report): keep array slice helper\n") {
+		t.Fatalf("ordinary English stripped: %q", got)
+	}
+	got = controlCommitMessage("admin-report", "SLICE-001")
+	if !strings.HasPrefix(got, "WIP(admin-report): land proven work\n") {
+		t.Fatalf("empty summary after strip: %q", got)
+	}
+}

package/engine/internal/parallel/parallel_test.go

@@ -216,6 +216,13 @@ func TestCleanupSalvagesAbortedWork(t *testing.T) {
 	if body := gitOk(t, repo, "show", sb.Commit+":src/b_new.go"); !strings.Contains(body, "Bnew") {
 		t.Fatalf("salvaged file content missing: %q", body)
 	}
+	subj := gitOk(t, repo, "log", "-1", "--format=%s", sb.Commit)
+	if strings.Contains(subj, "slice-b") || strings.Contains(subj, "SLICE-") {
+		t.Fatalf("salvage subject names a slice id: %q", subj)
+	}
+	if !strings.HasPrefix(subj, "devrites: salvage WIP (") {
+		t.Fatalf("salvage subject %q", subj)
+	}
 
 	// Worktrees removed, lease cleared, kept branches still resolve.
 	for _, wt := range []string{wtA, wtB, wtC} {
@@ -375,14 +382,14 @@ func TestIntegrateDivergentSiblings(t *testing.T) {
 		t.Fatal(err)
 	}
 	gitOk(t, wtA, "add", "src/a.go")
-	gitOk(t, wtA, "commit", "-m", "slice-a green")
+	gitOk(t, wtA, "commit", "-m", "WIP(demo-feature): add A helper")
 	tcA := gitOk(t, wtA, "rev-parse", "HEAD")
 
 	if err := os.WriteFile(filepath.Join(wtB, "src", "b.go"), []byte("package main\n\nfunc B() {}\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	gitOk(t, wtB, "add", "src/b.go")
-	gitOk(t, wtB, "commit", "-m", "slice-b green")
+	gitOk(t, wtB, "commit", "-m", "WIP(demo-feature): add B helper")
 	tcB := gitOk(t, wtB, "rev-parse", "HEAD")
 
 	if _, err := RecordGreen(repo, slug, "slice-a", tcA); err != nil {
@@ -406,12 +413,17 @@ func TestIntegrateDivergentSiblings(t *testing.T) {
 	if head != tip {
 		t.Fatalf("control head %s want tip %s", head, tip)
 	}
-	if n := gitOk(t, repo, "rev-list", "--count", base+"..HEAD"); n != "1" {
-		t.Fatalf("control should gain exactly one squash commit, got %s", n)
+	if n := gitOk(t, repo, "rev-list", "--count", base+"..HEAD"); n != "2" {
+		t.Fatalf("control should gain one commit per sibling, got %s", n)
 	}
-	subj := gitOk(t, repo, "log", "-1", "--format=%s")
-	if !strings.HasPrefix(subj, "WIP(demo-feature):") {
-		t.Fatalf("squash subject %q missing WIP(demo-feature): prefix", subj)
+	log := gitOk(t, repo, "log", "--format=%s", base+"..HEAD")
+	for _, subj := range strings.Split(log, "\n") {
+		if !strings.HasPrefix(subj, "WIP(demo-feature):") {
+			t.Fatalf("control subject %q missing WIP(demo-feature): prefix", subj)
+		}
+		if strings.Contains(strings.ToUpper(subj), "SLICE-") {
+			t.Fatalf("control subject %q still names a slice id", subj)
+		}
 	}
 	a := mustRead(t, filepath.Join(repo, "src", "a.go"))
 	b := mustRead(t, filepath.Join(repo, "src", "b.go"))
@@ -428,7 +440,7 @@ func TestIntegrateDivergentSiblings(t *testing.T) {
 }
 
 // TestIntegrateWithoutApplyKeepsLeaseRunning proves a flag-less integrate
-// stages the squash commit on the integrate branch but leaves the lease
+// stages the per-sibling commits on the integrate branch but leaves the lease
 // running and control at base, so a later non-forced cleanup cannot discard
 // the only refs holding the integrated tree.
 func TestIntegrateWithoutApplyKeepsLeaseRunning(t *testing.T) {
@@ -441,7 +453,7 @@ func TestIntegrateWithoutApplyKeepsLeaseRunning(t *testing.T) {
 		t.Fatal(err)
 	}
 	if tip == "" || tip == base {
-		t.Fatalf("expected staged squash tip, got %s", tip)
+		t.Fatalf("expected staged integrate tip, got %s", tip)
 	}
 	if lease.Status != StatusRunning {
 		t.Fatalf("status=%s want running without --apply-to-control", lease.Status)
@@ -451,13 +463,13 @@ func TestIntegrateWithoutApplyKeepsLeaseRunning(t *testing.T) {
 	}
 	ibranch := IntegrateBranchName(slug, batch)
 	if got := gitOk(t, repo, "rev-parse", ibranch); got != tip {
-		t.Fatalf("integrate branch %s want squash tip %s", got, tip)
+		t.Fatalf("integrate branch %s want integrate tip %s", got, tip)
 	}
 	if _, err := Cleanup(repo, slug, false); err == nil {
 		t.Fatal("cleanup on running lease must refuse without --force")
 	}
 	// Forced cleanup salvages then removes; the integrate branch holds the
-	// squash tip, so it is kept and reported rather than deleted.
+	// integrate tip, so it is kept and reported rather than deleted.
 	if _, err := Cleanup(repo, slug, true); err != nil {
 		t.Fatal(err)
 	}
@@ -468,7 +480,7 @@ func TestIntegrateWithoutApplyKeepsLeaseRunning(t *testing.T) {
 
 // TestIntegrateFailedLeaseRepairsAndRetries proves integrate-failed is not a
 // dead end: a repaired transfer re-records on the failed lease and a retried
-// integrate completes into one squash commit on control.
+// integrate completes into one control commit per sibling.
 func TestIntegrateFailedLeaseRepairsAndRetries(t *testing.T) {
 	repo, base := setupRepo(t)
 	slug, batch := "demo-feature", "batch1"
@@ -506,8 +518,8 @@ func TestIntegrateFailedLeaseRepairsAndRetries(t *testing.T) {
 	} else if lease.Status != StatusComplete {
 		t.Fatalf("status=%s want complete", lease.Status)
 	}
-	if n := gitOk(t, repo, "rev-list", "--count", base+"..HEAD"); n != "1" {
-		t.Fatalf("expected one squash commit on control, got %s", n)
+	if n := gitOk(t, repo, "rev-list", "--count", base+"..HEAD"); n != "2" {
+		t.Fatalf("expected one control commit per sibling, got %s", n)
 	}
 }
 

package/pack/.claude/agents/devrites-slice-wright.md

@@ -31,16 +31,20 @@ the target stack's idiom. Never plan, choose scope, design, or perform independe
 8. **Isolated worktree transfer is explicit.** Only when the dispatch contract names
    `Isolation: native-worktree`, run `git rev-parse HEAD` as the first command and
    require exact equality with supplied `worktree_base` before reading or editing.
-   Mismatch returns a gap with no write. After green proof, create one local, unpushed
-   transfer commit. Never push, merge, rebase, or remove the worktree. Without that
-   exact mode, do not commit.
+   Mismatch returns a gap with no write. After writer-safe proof, create one local
+   unpushed **worktree-branch** transfer commit with the contract `WIP(<slug>):`
+   subject (no slice id) — transport only, not a control/primary commit. Never push,
+   merge, rebase, or remove the worktree. Without that exact mode, do not commit.
 
 ## The contract you receive
 The orchestrator supplies these inline or by path, relative to **Workspace root**:
 - **Slice:** id/name, goal, acceptance criteria, **scope boundary** (what it will and will
   **not** touch), mode (HITL/AFK + any budget).
 - **Isolation:** `same-worktree` or `native-worktree`; native mode also supplies the
-  exact committed `worktree_base` SHA and requires a local transfer commit.
+  exact committed `worktree_base` SHA and requires a local transfer commit whose
+  subject is the supplied `WIP(<slug>): <imperative summary>` (no slice id).
+  Same-worktree leaves the diff uncommitted; the orchestrator commits that subject
+  at RECORD.
 - **Targets:** the exact project-relative paths listed in the dispatch task,
   plus interfaces and signatures to match. Your return cannot widen this set.
 - **Context to read yourself:** the relevant owning sections of `spec.md`, `plan.md`, `decisions.md`, `assumptions.md`,
@@ -97,6 +101,8 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
      `$devrites-source-driven` on Codex. Verify the fact in installed source,
      official documentation, or context7 for current upstream behavior, then include
      that source in the result. Never invent an API.
+   - **No process residue.** Do not put `SLICE-###`, slice numbers, or "this slice"
+     in product source, tests, comments, or filenames.
 4. **VERIFY (fail-on-red).** Run writer-safe tests/types/lint. Report required
    build/browser/E2E as `not-run` (root-owned, artifact-producing gates), and only
    when the exact command, cwd, and prerequisites already appear in the unchanged
@@ -118,9 +124,11 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
    in-scope gaps together, rerun affected proof, and report remaining gaps. Self-check
    never replaces independent review; green tests do not prove all possible cases.
 5. **TRANSFER when isolated.** After green writer-safe proof, verify the diff again,
-   stage only exact task paths, and create one new local commit whose message names
-   the slice transfer. Record its SHA. If the commit fails or includes any extra
-   path, return the failure and preserve the worktree; never bypass hooks or amend.
+   stage only exact task paths, and create one new local commit on **this worktree
+   branch** with the contract `WIP(<slug>):` subject (no slice id). Record its SHA.
+   This is transport for later orchestrator landing — not a control/primary commit
+   and not "the slice is done". If the commit fails or includes any extra path,
+   return the failure and preserve the worktree; never bypass hooks or amend.
    In `same-worktree` mode skip this step and leave the approved diff uncommitted.
 6. **RETURN** the structured artifact (below) and stop.
 
@@ -197,8 +205,9 @@ human-owned choices. Never silently ship a known gap.
 ## Tools / read-write mode
 
 Write code/tests only at exact contract paths; no `.devrites/` bookkeeping. Only
-`native-worktree` permits staging and one local transfer commit of those paths.
-All other Git mutation and remote actions remain forbidden.
+`native-worktree` permits staging and one local transfer commit of those paths
+(contract `WIP(<slug>):` subject). All other Git mutation and remote actions
+remain forbidden.
 
 ## Composition
 

package/pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -110,8 +110,8 @@ candidate manifest to cover the whole recorded chain — run
   qualify; no recorded next entry, or the cap/review-queue bound reached, stops
   with the winning reason.
 - Milestones are **not** shipped: they stay sealed and unarchived in `.devrites/work/`
-  with `Next step: /rite-ship` preserved. Per-slice `WIP(<slug>)` checkpoints still
-  land locally ([checkpoint.md](../../../rite-build/reference/checkpoint.md)), so the tree
+  with `Next step: /rite-ship` preserved. Local `WIP(<slug>):` checkpoints still
+  land ([checkpoint.md](../../../rite-build/reference/checkpoint.md)), so the tree
   stays clean and crash-safe.
 - Git stays human-gated. The release ship is one disclosed plan, one literal `GO`, and
   one native approval; it collapses the sequence's `WIP` commits into the single

package/pack/.claude/skills/rite-autocomplete/SKILL.md

@@ -9,7 +9,7 @@ user-invocable: true
 
 Run every phase after one clarification window. Irreversible-risk,
 blocking/escalating,<!-- pack-scan-ignore: negated statement: gates are NOT disabled -->
-NO-GO, resource, and human-owned gates still pause. Use the Standard native
+and NO-GO still pause. Use the Standard native
 profile by default and Full for high-risk scope or explicit `--full`; see
 [`orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md).
 
@@ -48,20 +48,19 @@ executable controller/harness/bundle bytes or a missing writer, read
 - Every exact causal fingerprint gets at most three no-progress corrections.
   Closing one is progress; a distinct Critical/Important invariant has its own
   budget. Lower severity cannot prolong recovery.
-- Enforce `--max-slices`, the AFK sentinel, review queue, and native
-  agent/token/cost/time limits before every phase or dispatch. Count failed,
-  malformed, and unavailable leaf calls. At the review cap, permit only work
-  that reduces the queue.
+- Do not stop on `--max-slices`, sentinel `max_slices`, `max_agents`,
+  `max_minutes`, or `max_review_queue`. Count failed, malformed, and
+  unavailable leaf calls.
 - Parse flags only from this invocation. `--ship`, `--yolo`, `--max-slices`,
   `--parallel`, `--full`, and `--cross-model` activate only as exact standalone
   tokens in `$ARGUMENTS`; examples or earlier messages can never arm them.
   `--max-slices` must occur once and be followed by a positive base-10 integer;
   `--parallel` must occur once and be followed by a base-10 integer in `1`–`10`.
   Missing, repeated, malformed, or conflicting values stop before any write.
-- Temper always runs after Clarify. Unattended mode auto-applies only
-  `hold-rigor` and `reduce-to-MVP`; any `expand` or added acceptance pauses.
+- Temper always runs after Clarify. Auto-apply the recommended mode, including
+  `expand` and extra acceptance; record the ADR and fold via Spec Drift Guard.
+  Irreversible-risk still pauses.
 - Vet every plan. Cross-model is off unless the current invocation arms it.
-  Never auto-grow accepted scope.
 
 ## Workflow
 
@@ -77,7 +76,7 @@ executable controller/harness/bundle bytes or a missing writer, read
    from chat. After compaction or a resumed session, read `.devrites/ACTIVE`, then
    the `state.md` cursor, `questions.md`, `decisions.md`, and `test-plan.md`/`evidence.md`.
    Normalize current arguments to idea, `ship_preflight: yes|no`,
-   `max_slices: N|default`, `parallel: N|default`, `profile: standard|full`,
+   `max_slices: unlimited`, `parallel: N|default`, `profile: standard|full`,
    and `cross_model: yes|no`.
    **Completion:** normalized state is unambiguous and no sentinel or workspace file has been written.
 2. **Specify and clarify.** Run `devrites-interview`, `/rite-spec`, and
@@ -85,7 +84,7 @@ executable controller/harness/bundle bytes or a missing writer, read
    AFK. **Completion:** `Decision coverage: CLEAR` is durable.
 3. **Arm AFK once.** Apply the loop's
    [one-write AFK contract](reference/loop.md#arm-afk-once): preserve valid
-   existing bytes or create the bounded advisory-only sentinel once; never
+   existing bytes or create the sentinel once (`allow_gates: [advisory, validating]`); never
    rewrite it after Vet. Preserve an existing sentinel byte-for-byte.
    **Completion:** a valid read-only AFK sentinel exists.
 4. **Drive phases.** Follow [the loop](reference/loop.md): `/rite-spec` →
@@ -103,7 +102,7 @@ executable controller/harness/bundle bytes or a missing writer, read
    [stop-conditions.md](reference/stop-conditions.md). A `blocked` label alone is not a stop condition:
    route agent-owned red results through bounded recovery.
    Red gates block forward advancement and enter caller-owned recovery. Stop on
-   hard risk, human-owned blocking/escalating/NO-GO, resource exhaustion, or the
+   hard risk, human-owned blocking/escalating/NO-GO, or the
    exact fingerprint's proven exhaustion. Technical exhaustion records terminal
    `Next step: none`, never a routine phase command. **Completion:** no stop is active, or its cursor and reason are durable.
 6. **Seal boundary.** Without a ship flag, stop at Seal GO with `/rite-ship` —
@@ -116,8 +115,8 @@ executable controller/harness/bundle bytes or a missing writer, read
 
 ## Reply and resume
 
-HITL Build returns after one slice; explicit valid AFK may chain only green
-slices within every cap. One Autocomplete invocation owns all internal
+HITL Build returns after one slice; Autocomplete ignores `--max-slices` and
+keeps chaining pending slices. One Autocomplete invocation owns all internal
 backtracking. Context pressure, compaction, or a nested completion footer does
 not create a stop; persist and resume the cursor.
 
@@ -129,5 +128,5 @@ spec <done|stopped> · clarify <clear|stopped> · temper <done|stopped> · defin
 ```
 
 Final state is `Shipped`, `Stopped`, `Awaiting human`, `NO-GO`, or `GO`; do not
-write a narrative recap. Require a clean or accepted baseline, arm checkpoint
-mode, and never auto-pass a red gate.
+write a narrative recap. Require a clean or accepted baseline, land a local
+unpushed checkpoint after each green check, and never auto-pass a red gate.

package/pack/.claude/skills/rite-autocomplete/reference/decision-policy.md

@@ -36,6 +36,5 @@ not pick the option that's merely easiest to implement.
 
 ## When a choice is NOT autocomplete's to make
 
-Human-owned contract, data-model, security, and product choices are not discretionary.
-Use owning elicitation/safety gates and the topology marked action. Autocomplete
-answers *how*, never *what to build* beyond the settled interview.
+Human-owned blocking/escalating, irreversible-risk, and access stay human.
+Recommended temper `expand` auto-applies; do not invent product intent.