devrites 6.0.1 → 6.0.3

package/engine/internal/release/release.go

@@ -16,7 +16,6 @@ import (
 	"net/netip"
 	"net/url"
 	"os"
-	"os/exec"
 	"path"
 	"path/filepath"
 	"regexp"
@@ -98,7 +97,7 @@ func Acquire(ctx context.Context, repository, tag string) (Candidate, func(), er
 	bundleName := "devrites-" + tag + ".tar.gz"
 	bundleURL := base + "/" + bundleName
 	bundlePath := filepath.Join(tmp, bundleName)
-	if err := downloadVerified(ctx, bundleURL, bundlePath, bundleName, 0o644, repository); err != nil {
+	if err := downloadVerified(ctx, bundleURL, bundlePath, bundleName, 0o644); err != nil {
 		return fail(fmt.Errorf("download release bundle: %w", err))
 	}
 	source, err := extractBundle(bundlePath, tmp, tag)
@@ -108,7 +107,7 @@ func Acquire(ctx context.Context, repository, tag string) (Candidate, func(), er
 
 	engineURL := base + "/" + binaryName
 	enginePath := filepath.Join(tmp, binaryName)
-	if err := downloadVerified(ctx, engineURL, enginePath, binaryName, 0o755, repository); err != nil {
+	if err := downloadVerified(ctx, engineURL, enginePath, binaryName, 0o755); err != nil {
 		return fail(fmt.Errorf("download engine binary: %w", err))
 	}
 	return Candidate{
@@ -185,7 +184,7 @@ func fetchJSON(ctx context.Context, rawURL string, out any) error {
 	return nil
 }
 
-func downloadVerified(ctx context.Context, rawURL, destination, filename string, mode fs.FileMode, repository string) error {
+func downloadVerified(ctx context.Context, rawURL, destination, filename string, mode fs.FileMode) error {
 	if err := download(ctx, rawURL, destination, maxAssetBytes, mode); err != nil {
 		return err
 	}
@@ -223,15 +222,6 @@ func downloadVerified(ctx context.Context, rawURL, destination, filename string,
 	if !strings.EqualFold(hex.EncodeToString(hash.Sum(nil)), hex.EncodeToString(want)) {
 		return fmt.Errorf("checksum mismatch for %s", filename)
 	}
-	signer := repository + "/.github/workflows/ci.yml@refs/heads/main"
-	// #nosec G204 -- fixed gh argv; repository is matched by repositoryPattern (leading alphanumeric, so never a flag) in Acquire and destination is an absolute path under the engine-created temp dir
-	cmd := exec.CommandContext(ctx, "gh", "attestation", "verify", destination, "--repo", repository, "--signer-workflow", signer)
-	if _, err := cmd.CombinedOutput(); err != nil {
-		if errors.Is(err, exec.ErrNotFound) {
-			return errors.New("gh (GitHub CLI) is required and must be authenticated for attestation verification")
-		}
-		return fmt.Errorf("attestation verification failed for %s: %w", filename, err)
-	}
 	return nil
 }
 

package/engine/internal/release/release_test.go

@@ -33,7 +33,9 @@ func TestLatestAndAcquireVerifiedRelease(t *testing.T) {
 		bundleName: bundle,
 		binaryName: engine,
 	}
-	installAttestationStandIn(t, bundle, engine)
+	if runtime.GOOS == "windows" {
+		t.Skip("positive-control engine is a shell script")
+	}
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/repos/owner/repo/releases/latest" {
 			_, _ = fmt.Fprintf(w, `{"tag_name":%q}`, tag)
@@ -81,12 +83,12 @@ func TestLatestAndAcquireVerifiedRelease(t *testing.T) {
 	cmd := exec.Command(candidate.EnginePath)
 	cmd.Env = append(os.Environ(), "MARKER="+marker)
 	if err := cmd.Run(); err == nil {
-		t.Fatal("attested engine exited successfully; want positive-control exit 23")
+		t.Fatal("acquired engine exited successfully; want positive-control exit 23")
 	} else if exit, ok := err.(*exec.ExitError); !ok || exit.ExitCode() != 23 {
-		t.Fatalf("attested engine exit = %v, want 23", err)
+		t.Fatalf("acquired engine exit = %v, want 23", err)
 	}
 	if got, err := os.ReadFile(marker); err != nil || string(got) != "success" {
-		t.Fatalf("attested engine marker = %q, %v", got, err)
+		t.Fatalf("acquired engine marker = %q, %v", got, err)
 	}
 	cleanup()
 	if _, err := os.Stat(root); !os.IsNotExist(err) {
@@ -111,199 +113,6 @@ func TestValidTag(t *testing.T) {
 	}
 }
 
-func TestAcquireRejectsOriginSubstitution(t *testing.T) {
-	const tag = "v4.1.0"
-	trusted := testBundle(t, tag, map[string]string{
-		"package.json": `{"version":"4.1.0"}`,
-		"pack/generated/claude/skills/rite/SKILL.md": "rite\n",
-	})
-	attacker := testBundle(t, tag, map[string]string{
-		"package.json": `{"version":"4.1.0"}`,
-		"pack/generated/claude/skills/rite/SKILL.md": "attacker\n",
-	})
-	binaryName, err := platformBinaryName()
-	if err != nil {
-		t.Skip(err)
-	}
-	installAttestationStandIn(t, trusted, []byte("trusted engine"))
-	assets := map[string][]byte{"devrites-" + tag + ".tar.gz": attacker, binaryName: []byte("attacker engine")}
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		name := filepath.Base(r.URL.Path)
-		assetName := strings.TrimSuffix(name, ".sha256")
-		asset, ok := assets[assetName]
-		if !ok {
-			http.NotFound(w, r)
-			return
-		}
-		if strings.HasSuffix(name, ".sha256") {
-			_, _ = fmt.Fprintf(w, "%x  %s\n", sha256.Sum256(asset), assetName)
-			return
-		}
-		_, _ = w.Write(asset)
-	}))
-	defer server.Close()
-	oldWeb := webBaseURL
-	webBaseURL = server.URL
-	t.Cleanup(func() { webBaseURL = oldWeb })
-
-	_, _, err = Acquire(context.Background(), "owner/repo", tag)
-	if err == nil || !strings.Contains(err.Error(), "attestation verification failed") {
-		t.Fatalf("Acquire error = %v, want attestation refusal despite a matching origin checksum", err)
-	}
-}
-
-func TestAcquireRejectsSingleAssetSubstitution(t *testing.T) {
-	const tag = "v4.1.0"
-	files := map[string]string{
-		"package.json": `{"version":"4.1.0"}`,
-		"pack/generated/claude/skills/rite/SKILL.md": "rite\n",
-	}
-	trustedBundle := testBundle(t, tag, files)
-	files["pack/generated/claude/skills/rite/SKILL.md"] = "attacker\n"
-	attackerBundle := testBundle(t, tag, files)
-	trustedEngine, attackerEngine := []byte("trusted engine"), []byte("attacker engine")
-	binaryName, err := platformBinaryName()
-	if err != nil {
-		t.Skip(err)
-	}
-	for _, tc := range []struct {
-		name, refusedAsset string
-		bundle, engine     []byte
-	}{
-		{"engine only", binaryName, trustedBundle, attackerEngine},
-		{"bundle only", "devrites-" + tag + ".tar.gz", attackerBundle, trustedEngine},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			installAttestationStandIn(t, trustedBundle, trustedEngine)
-			assets := map[string][]byte{"devrites-" + tag + ".tar.gz": tc.bundle, binaryName: tc.engine}
-			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				name := filepath.Base(r.URL.Path)
-				assetName := strings.TrimSuffix(name, ".sha256")
-				asset, ok := assets[assetName]
-				if !ok {
-					http.NotFound(w, r)
-					return
-				}
-				if strings.HasSuffix(name, ".sha256") {
-					_, _ = fmt.Fprintf(w, "%x  %s\n", sha256.Sum256(asset), assetName)
-					return
-				}
-				_, _ = w.Write(asset)
-			}))
-			defer server.Close()
-			oldWeb := webBaseURL
-			webBaseURL = server.URL
-			t.Cleanup(func() { webBaseURL = oldWeb })
-
-			_, cleanup, err := Acquire(context.Background(), "owner/repo", tag)
-			if err == nil {
-				cleanup()
-				t.Fatal("Acquire accepted a release with one unattested asset")
-			}
-			want := "attestation verification failed for " + tc.refusedAsset
-			if !strings.Contains(err.Error(), want) {
-				t.Fatalf("Acquire error = %v, want %q", err, want)
-			}
-		})
-	}
-}
-
-func installAttestationStandIn(t *testing.T, trusted ...[]byte) {
-	t.Helper()
-	if runtime.GOOS == "windows" {
-		t.Skip("attestation stand-in and positive-control engine are shell scripts")
-	}
-	dir := t.TempDir()
-	var hashes strings.Builder
-	for _, data := range trusted {
-		fmt.Fprintf(&hashes, "%x\n", sha256.Sum256(data))
-	}
-	allowed := filepath.Join(dir, "allowed-digests")
-	if err := os.WriteFile(allowed, []byte(hashes.String()), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	gh := filepath.Join(dir, "gh")
-	script := `#!/bin/sh
-[ "$1" = attestation ] && [ "$2" = verify ] && [ "$4" = --repo ] && [ "$5" = owner/repo ] && [ "$6" = --signer-workflow ] && [ "$7" = owner/repo/.github/workflows/ci.yml@refs/heads/main ] || exit 64
-got=$(shasum -a 256 "$3" | awk '{print $1}') || exit 65
-grep -Fxq "$got" "$ATTESTED_DIGESTS"
-`
-	if err := os.WriteFile(gh, []byte(script), 0o700); err != nil {
-		t.Fatal(err)
-	}
-	t.Setenv("PATH", dir+string(os.PathListSeparator)+os.Getenv("PATH"))
-	t.Setenv("ATTESTED_DIGESTS", allowed)
-}
-
-func TestAttestationStandInIsStrict(t *testing.T) {
-	trusted := []byte("trusted engine")
-	installAttestationStandIn(t, trusted, []byte("other"))
-	dir := t.TempDir()
-	good := filepath.Join(dir, "good")
-	bad := filepath.Join(dir, "bad")
-	if err := os.WriteFile(good, trusted, 0o600); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(bad, []byte("attacker engine"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	const signer = "owner/repo/.github/workflows/ci.yml@refs/heads/main"
-	run := func(file, repo, workflow string) error {
-		return exec.Command("gh", "attestation", "verify", file, "--repo", repo, "--signer-workflow", workflow).Run()
-	}
-	if err := run(good, "owner/repo", signer); err != nil {
-		t.Fatalf("stand-in rejected the pinned request: %v", err)
-	}
-	if run(good, "other/repo", signer) == nil {
-		t.Error("stand-in accepted a wrong repo")
-	}
-	if run(good, "owner/repo", "owner/repo/.github/workflows/other.yml@refs/heads/main") == nil {
-		t.Error("stand-in accepted a wrong signer workflow")
-	}
-	if run(bad, "owner/repo", signer) == nil {
-		t.Error("stand-in accepted an unattested digest")
-	}
-}
-
-func TestAcquireRejectsMissingAttestationVerifier(t *testing.T) {
-	const tag = "v4.1.0"
-	binaryName, err := platformBinaryName()
-	if err != nil {
-		t.Skip(err)
-	}
-	assets := map[string][]byte{
-		"devrites-" + tag + ".tar.gz": testBundle(t, tag, map[string]string{
-			"package.json": `{"version":"4.1.0"}`,
-			"pack/generated/claude/skills/rite/SKILL.md": "rite\n",
-		}),
-		binaryName: []byte("engine"),
-	}
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		name := filepath.Base(r.URL.Path)
-		assetName := strings.TrimSuffix(name, ".sha256")
-		asset, ok := assets[assetName]
-		if !ok {
-			http.NotFound(w, r)
-			return
-		}
-		if strings.HasSuffix(name, ".sha256") {
-			_, _ = fmt.Fprintf(w, "%x  %s\n", sha256.Sum256(asset), assetName)
-			return
-		}
-		_, _ = w.Write(asset)
-	}))
-	defer server.Close()
-	oldWeb := webBaseURL
-	webBaseURL = server.URL
-	t.Cleanup(func() { webBaseURL = oldWeb })
-	t.Setenv("PATH", t.TempDir())
-
-	_, _, err = Acquire(context.Background(), "owner/repo", tag)
-	if err == nil || !strings.Contains(err.Error(), "gh (GitHub CLI) is required") {
-		t.Fatalf("Acquire error = %v, want refusal when gh is not installed", err)
-	}
-}
-
 func TestAcquireRejectsChecksumMismatch(t *testing.T) {
 	const tag = "v4.1.0"
 	bundleName := "devrites-" + tag + ".tar.gz"

package/engine/main.go

@@ -48,11 +48,11 @@ Usage:
   devrites-engine orient <slug>            Alias for observe summary
   devrites-engine next [slug]              Print the minimal remaining lifecycle path with advisory skips
   devrites-engine handoff [slug]           Emit the deterministic resume record (cursor, blocking gates, ledger, dead ends)
-  devrites-engine context [slug] (--phase <p> | --skill <name>) [--role <r>] [--trigger a,b]
+  devrites-engine context [slug] (--phase <p> | --skill <name>) [--role <r>] [--slice <id>] [--trigger a,b]
                                          Emit one deduplicated read-set bundle for a phase, skill, or dispatch role
   devrites-engine metrics record <slug> --phase <p> --event <e> [--role r] [--bytes n] [--note s]
   devrites-engine metrics summary [slug]   Summarize the per-feature metrics.jsonl event ledger
-  devrites-engine dispatch <slug> <sub>    Launch-wave barrier for parallel dispatch: open/start/seal/return/status/abandon
+  devrites-engine dispatch <slug> <sub>    Launch-wave barrier for parallel dispatch: open/start/seal/return/status/abandon (build wright waves: --slice, round cap)
   devrites-engine claim <add|release|list|check>   Advisory session-scoped file claims for same-tree concurrent sessions (.devrites/claims.jsonl)
   devrites-engine note <subcommand> <slug>         Anchored workspace notes bound to verbatim code quotes; drift regrades them (notes.md)
   devrites-engine observe slice <slug> <SLICE-ID>  Print one SLICE-### section of tasks.md

package/install.sh

@@ -13,8 +13,6 @@ DEVRITES_REPO="${DEVRITES_REPO:-ViktorsBaikers/DevRites}"
 DEVRITES_REF="${DEVRITES_REF:-}"
 
 BOOTSTRAP_DIR=""
-RUN_JOB=""
-RUN_WATCH=""
 BOOTSTRAP_MAX_METADATA=1048576
 BOOTSTRAP_MAX_SIDECAR=4096
 BOOTSTRAP_MAX_ARCHIVE=67108864
@@ -140,114 +138,6 @@ verify_sha256() {
   [ -n "$want" ] && [ -n "$got" ] && [ "$got" = "$want" ]
 }
 
-# Runs a command for at most $1 seconds with output discarded. Past the limit it
-# is sent SIGTERM and, if it is still alive two seconds later, SIGKILL. A command
-# stopped this way sets RUN_TIMED_OUT=1 and returns 124; any other failure keeps
-# the command's own status, so a crash is never mistaken for a timeout. Same
-# watchdog idea as scripts/install-lib.sh dr_run_bounded, which is not available
-# until the bundle is verified and extracted. The timeout marker lives in
-# $BOOTSTRAP_DIR, which the EXIT trap removes, so a run without that directory
-# fails closed; stop_bounded ends a command and watchdog still in flight when the
-# bootstrap is interrupted.
-run_bounded() {
-  limit="$1"; shift
-  RUN_TIMED_OUT=0
-  [ -n "$BOOTSTRAP_DIR" ] || return 125
-  fired="$(mktemp "$BOOTSTRAP_DIR/bound.XXXXXX" 2>/dev/null)" || return 125
-  "$@" >/dev/null 2>&1 </dev/null &
-  job=$!
-  RUN_JOB=$job
-  {
-    trap 'kill "$nap"; exit 0' TERM
-    sleep "$limit" & nap=$!; wait "$nap"
-    kill -0 "$job" || exit 0
-    echo 1 >"$fired"
-    kill "$job"
-    sleep 2 & nap=$!; wait "$nap"
-    kill -9 "$job"
-  } >/dev/null 2>&1 </dev/null &
-  watch=$!
-  RUN_WATCH=$watch
-  wait "$job" 2>/dev/null
-  rc=$?
-  kill "$watch" >/dev/null 2>&1
-  wait "$watch" 2>/dev/null
-  RUN_JOB=""; RUN_WATCH=""
-  if [ "$rc" -ne 0 ] && [ -s "$fired" ]; then
-    RUN_TIMED_OUT=1
-    rc=124
-  fi
-  rm -f "$fired"
-  return "$rc"
-}
-
-stop_bounded() {
-  # A signal can land after a job is forked but before its PID is recorded, so
-  # every background job is ended, not only the recorded ones. run_bounded is the
-  # only place this script backgrounds anything.
-  for pid in $(jobs -p); do
-    [ "$pid" = "$RUN_WATCH" ] || kill -9 "$pid" >/dev/null 2>&1
-  done
-  [ -z "$RUN_WATCH" ] || kill "$RUN_WATCH" >/dev/null 2>&1
-  RUN_JOB=""; RUN_WATCH=""
-}
-
-# The checksum sidecar above travels with the tarball it vouches for: it is
-# fetched from "$url.sha256", one suffix away from the artifact's own origin. An
-# attacker who substitutes the release origin therefore supplies both the
-# payload and a digest that matches it, and the digest check passes. The
-# release job already mints the proof that does not travel with the artifact --
-# a build-provenance attestation signed by that job's OIDC identity and bound to
-# the artifact digest (.github/workflows/ci.yml, 'Attest release artifacts').
-# Verify it here, pinned to the repository and to the signer workflow, so an
-# attestation minted by any other workflow in this repository is rejected too.
-#
-# There is deliberately no bypass for a missing verifier: without gh there is no
-# proof of origin, and the sidecar is not a substitute for one.
-#
-# The lookup is bounded: DEVRITES_ATTEST_TIMEOUT is a whole number of seconds
-# (1 to 99999, default 120). Anything else is ignored with a warning and the
-# default applies, so a bad value can never remove the bound. The follow-up
-# `gh auth status` is bounded by 30 seconds or that limit, whichever is shorter.
-# A timeout, a crash and a plain rejection each fail closed and are reported as
-# what they are.
-verify_attestation() {
-  file="$1"
-  signer="$DEVRITES_REPO/.github/workflows/ci.yml@refs/heads/main"
-  ATTESTATION_FAILURE=""
-  if ! command -v gh >/dev/null 2>&1; then
-    ATTESTATION_FAILURE="attestation verification failed: gh (GitHub CLI) is required and was not found"
-    return 1
-  fi
-  attest_limit=120
-  case "${DEVRITES_ATTEST_TIMEOUT:-}" in
-  "") ;;
-  *[!0-9]* | 0* | [0-9][0-9][0-9][0-9][0-9][0-9]*)
-    echo "warning: ignoring invalid DEVRITES_ATTEST_TIMEOUT '$DEVRITES_ATTEST_TIMEOUT' (expected whole seconds, 1 to 99999); using $attest_limit" >&2
-    ;;
-  *) attest_limit="$DEVRITES_ATTEST_TIMEOUT" ;;
-  esac
-  auth_limit=30
-  [ "$attest_limit" -lt "$auth_limit" ] && auth_limit="$attest_limit"
-  verify_rc=0
-  run_bounded "$attest_limit" gh attestation verify "$file" --repo "$DEVRITES_REPO" \
-    --signer-workflow "$signer" || verify_rc=$?
-  if [ "$verify_rc" -ne 0 ]; then
-    if [ "$RUN_TIMED_OUT" -eq 1 ]; then
-      ATTESTATION_FAILURE="attestation verification timed out after ${attest_limit}s; check connectivity or raise DEVRITES_ATTEST_TIMEOUT and retry"
-    elif [ "$verify_rc" -ge 128 ]; then
-      ATTESTATION_FAILURE="attestation verification failed: gh exited with status $verify_rc"
-    elif run_bounded "$auth_limit" gh auth status; then
-      ATTESTATION_FAILURE="attestation verification failed: no build provenance from $signer"
-    elif [ "$RUN_TIMED_OUT" -eq 1 ]; then
-      ATTESTATION_FAILURE="attestation verification timed out: gh auth status did not answer within ${auth_limit}s; check connectivity or raise DEVRITES_ATTEST_TIMEOUT and retry"
-    else
-      ATTESTATION_FAILURE="attestation verification failed: gh is not authenticated (attestation lookup requires a GitHub login); run 'gh auth login' and retry"
-    fi
-    return 1
-  fi
-}
-
 preflight_archive() {
   archive_path="$1"
   tag="$2"
@@ -324,7 +214,7 @@ bootstrap_bundle() {
     exit 1
   }
   umask "$old_umask"
-  trap 'stop_bounded; exit 1' HUP INT TERM
+  trap 'exit 1' HUP INT TERM
   trap 'rm -rf "$BOOTSTRAP_DIR"' EXIT
   if [ -n "$DEVRITES_REF" ]; then
     tag="$(normalize_release_tag "$DEVRITES_REF")" || {
@@ -361,11 +251,6 @@ bootstrap_bundle() {
     echo "error: release $tag asset $asset: checksum failed." >&2
     exit 1
   }
-  verify_attestation "$archive" || {
-    rm -f "$archive" "$sidecar"
-    echo "error: release $tag asset $asset: ${ATTESTATION_FAILURE:-attestation verification failed}." >&2
-    exit 1
-  }
   uncompressed="$BOOTSTRAP_DIR/devrites-$tag.tar"
   bounded_decompress "$archive" "$uncompressed" "$BOOTSTRAP_MAX_UNCOMPRESSED" || {
     rm -f "$archive" "$sidecar"

package/pack/.claude/agents/devrites-slice-wright.md

@@ -138,7 +138,9 @@ Stay inside the exact project-relative paths listed in the dispatch task.
 return an `Escalation`** when:
 - the slice is **underspecified**, the **plan looks wrong**, or requirements, code,
   and tests conflict;
-- the slice needs a **new dependency** or a **second design system**;
+- the slice needs a **new dependency** or a **second design system**, or a planned
+  package fails to install or resolve (report the failure; never retry under a
+  similar or alternative package name);
 - the work requires an unapproved product/security-policy choice, public API break,
   external-service contract change, destructive live migration, or filesystem
   destruction outside the workspace. A path allowlist alone does not approve those

package/pack/.claude/skills/devrites-debug-recovery/reference/hypotheses.md

@@ -3,6 +3,12 @@
 Generate **3-5 ranked hypotheses** *before* testing any of them.
 Single-hypothesis generation anchors on the first plausible idea.
 
+**Check past root causes first.** Search `.devrites/archive/*/evidence.md` with
+native file search for the failure's error text, symbol, and file names. A hit
+whose recorded correct hypothesis matches enters the ranked list with its
+recurrence noted; it is still tested, never assumed. No archive or no hit →
+skip silently.
+
 Each hypothesis must be **falsifiable**: state the prediction it makes.
 
 > Format: *"If <X> is the cause, then <changing Y> will make the failure

package/pack/.claude/skills/devrites-lib/reference/parallel-dispatch.md

@@ -36,6 +36,7 @@ If the candidate diff has no matching surfaces, record
 2. Build each reviewer's read-set once with
    `devrites-engine context <slug> --phase <p> --role <role> --trigger <set>` and
    hand the bundle path as the packet's source list instead of a file roster.
+   Build roles add `--slice <SLICE-ID>` (slice-scoped, slice-named bundle).
    Evaluate the skill's trigger conditions and pass each that fires — a role's
    Trigger column maps to manifest names: `security-auditor` → `security`,
    `frontend-reviewer` → `ui`/`frontend`, `performance-reviewer` → `performance`.

package/pack/.claude/skills/devrites-lib/reference/standards/README.md

@@ -59,7 +59,7 @@ topic's owner.
 | `architecture-health.md` | An audit needs a whole-codebase structural score from a code index — coupling, cohesion, cycles, god files, orphans, depth. |
 | `assumption-checkpoints.md` | Scope generalizes an existing boundary: a second case, a newly optional field, or a constant turned parameter. |
 | `debug-recovery.md` | Waiting on async readiness (server start, job completion, browser signal) needs a bounded condition-based poll. |
-| `windows.md` | A deferral marker (TODO/FIXME/skipped test/stub) is introduced or waived — the `check windows` ledger and grammar. |
+| `windows.md` | A deferral or bar-lowering marker (TODO/FIXME/skipped test/stub/suppression/removed test) is introduced or waived — the `check windows` ledger and grammar. |
 | `glossary.md` | A DevRites term is unclear; resolve it once here instead of inferring. |
 
 The table is a load trigger, not an exemption. [`core.md` § Rule summary](core.md#rule-summary-load-the-full-file-when-in-scope)

package/pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -357,6 +357,8 @@ access, safety and irreversible-action boundaries independently stop work.
   renaming/splitting an unchanged cause does not. Suggestion/Nit/FYI cannot extend
   recovery. Initial discovery and expected test-first RED are not corrections;
   total rounds, re-batches and distinct-finding counts never exhaust recovery.
+  Every 5 Build wright rounds on one slice, the next first needs a reslice review
+  ([`wright-dispatch.md`](../../../rite-build/reference/wright-dispatch.md#run)).
 - **Rechecks are scoped; late findings never reopen the round.** *Late* applies only
   from a phase's **second** review pass (Vet 1b, Build's recheck after the first repair,
   Review step 7); an initial pass has no late findings and every supported finding is

package/pack/.claude/skills/devrites-lib/reference/standards/code-review.md

@@ -30,6 +30,9 @@ If it does not, do not merge it.
    no justification), stripped assertions, deleted or skipped tests, and new
    unimplemented stubs or `throw`-only placeholders. Each names what it lowers and
    needs a recorded reason in the diff or `decisions.md`; unexplained is a finding.
+   `devrites-engine check windows` flags the mechanical subset (suppressions,
+   skip/focus, stubs, empty catch, deleted tests, stripped assertions) against
+   `windows.md` waivers; loosened thresholds remain this sweep's judgment.
 3. **Correctness:** logic, edge cases, error paths, race conditions, wrong assumptions. For branching or boundary changes, run the [`edge-case trace`](edge-case-trace.md): relevant probe classes, fixed-set siblings, real wiring, negative intent, and deletion contracts with an evidence disposition.
 4. **Readability:** names, function size, control flow, intent obvious without the author.
 5. **Architecture:** right seam, coupling/cohesion, fits existing patterns, no premature

package/pack/.claude/skills/devrites-lib/reference/standards/glossary.md

@@ -35,6 +35,6 @@
 | Standards | The rule files in this directory; `core.md` is always-on, the rest load on trigger (`README.md` table). |
 | Transfer commit | The isolated wright's local unpushed `WIP(<slug>):` transport commit; never the control-branch checkpoint. |
 | Trigger | A named conditional read-set in a `loads:` manifest (e.g. `tdd`, `applicability`, `ui`); engine fails closed on unknown names. |
-| Windows ledger | `windows.md`: one waiver row per deferral marker the change introduces; `check windows` fails on unwaived hits. [`windows.md`](windows.md). |
+| Windows ledger | `windows.md`: one waiver row per deferral or bar-lowering marker the change introduces; `check windows` fails on unwaived hits. [`windows.md`](windows.md). |
 | Workflow Artifact | A Vet-ready, root-authored executable file under `.devrites/work/<slug>/`; [`workflow-artifacts.md`](workflow-artifacts.md). |
 | Wright | `devrites-slice-wright`: the sole product source/test writer under a path-bounded contract. |

package/pack/.claude/skills/devrites-lib/reference/standards/security.md

@@ -96,6 +96,7 @@ On any security-relevant error: deny, roll back; never default to allow or half-
 - Install reproducibly from a committed lockfile (`npm ci` / frozen); never resolving installs in CI. Hand-editing lockfiles bypasses review.
 - Distrust install scripts (`postinstall` runs arbitrary code) — review before adding; prefer `--ignore-scripts`.
 - Typosquats are a delivery vector: confirm exact name/publisher, not install success.
+  After a failed install, never try a similarly named package; report the failure.
 - A CI/release change names the SLSA build provenance level it claims and where the build runs; a claimed level with no verified provenance attestation is `cannot_verify`, not a pass.
 
 ## Trust boundary (three tiers)

package/pack/.claude/skills/devrites-lib/reference/standards/windows.md

@@ -1,7 +1,9 @@
 # Windows — the deferral ledger
 
 > Applies when: a change introduces a deferral marker (TODO, FIXME, XXX, HACK,
-> a skipped test, a stub body) or `windows.md` waivers are authored or judged.
+> a skipped or focused test, a stub body), lowers the bar (a checker
+> suppression, an empty catch, a deleted test file, stripped assertions), or
+> `windows.md` waivers are authored or judged.
 
 `windows.md` is the broken-windows ledger. A review finding can describe a new
 `TODO`, a skipped test, or a stubbed body; this artifact makes the register
@@ -24,7 +26,8 @@ Optional until a marker is introduced: a feature with no new markers needs no
   that marker. Five new TODOs in one file need five rows — a blanket row
   cannot cover them.
 - `marker token` is the literal marker the checker reported (`TODO`, `t.Skip(`,
-  `NotImplementedError`, `panic("TODO`, …).
+  `NotImplementedError`, `panic("TODO`, `it.only(`, `eslint-disable`, `noqa`,
+  `nolint`, `#nosec`, `empty-catch`, `deleted-test`, `removed-assertion`, …).
 - `reason` must be non-empty and should name the follow-up owner or slice; a
   row with an empty reason warns and waives nothing.
 - Rows never suppress coverage — they explain it. Reviewers still judge
@@ -39,8 +42,13 @@ devrites-engine check windows <slug> [--worktree|--staged|--base <ref>]
 Exit `0` when no marker is introduced or every hit is waived; `3` when any
 introduced marker lacks a waiver or the workspace/ledger is unreadable; `2`
 on usage errors. It parses the unified diff (`-U0`), treats untracked files as
-wholly new in `--worktree`, and ignores binary files, deletions, and
+wholly new in `--worktree`, and ignores binary files, non-test deletions, and
 `.devrites/` paths; `--staged` and `--base` cover the tracked diff only.
+Removals are file-level hits: a deleted test file is `deleted-test`, and a test
+file that remains but loses assertion lines on net is `removed-assertion`
+(moving an assertion within the file is not a loss; a git-detected rename is
+not a deletion). Loosened thresholds have no deterministic signal and stay a
+review judgment ([`code-review.md`](code-review.md) § Bar integrity).
 
 ## Reviewer posture
 

package/pack/.claude/skills/devrites-lib/reference/workspace-artifact-schema.md

@@ -64,7 +64,7 @@ accept safe legacy basenames. Ordinary phases never rename them.
 | `review.md` | reconciled Review verdict: `## Spec` and `## Code review` accounts, deferred-finding labels/actions, drift | 240 lines |
 | `seal.md` | seal preflight, exact reviewer roster accounts, GO/NO-GO verdict and disclosures | 200 lines |
 | `ai-spec.md` | model/RAG/agent/eval/LLM-output scope for AI surfaces | 160 lines |
-| `windows.md` | deferral-marker waiver ledger: one `- path | marker | reason` row per introduced marker; `check windows` fails on unwaived hits | 120 lines |
+| `windows.md` | deferral/bar-lowering waiver ledger: one `- path | marker | reason` row per introduced marker; `check windows` fails on unwaived hits | 120 lines |
 | `notes.md` | `NOTE-###` anchored notes — rationale/warnings bound to a verbatim quote in one repository file; `note check` regrades anchors and drift blocks seal | 160 lines |
 
 For visual pairs load only matching [playbooks](visual-playbooks/index.md); use
@@ -230,7 +230,10 @@ Done condition: <checkable, exhaustive completion criterion>
 `depends_on` is the machine-readable mirror of `Dependencies`; keep the sets
 identical and cycle-free. `Gate`, `SLA`, and `Checkpoint` are required for HITL
 slices; use `none` when they do not apply. Complexity above 3 triggers reslicing
-unless the stated reason makes the boundary irreducible.
+unless the stated reason makes the boundary irreducible. A Writer allowlist of 12+
+files prints an engine `ADVISORY size:` line (`check task-graph`, `check slice`;
+never blocking): split it acceptance-preserving, or add `Size rationale:` naming
+the inseparable capability.
 
 ## Read next by phase
 

package/pack/.claude/skills/rite-build/SKILL.md

@@ -5,7 +5,7 @@ argument-hint: "[--parallel N] [slice number or name]"
 user-invocable: true
 ---
 
-<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/standards/agents.md","rite-build/reference/phase-contract.md","rite-build/reference/one-slice-cycle.md","rite-build/reference/wright-dispatch.md","rite-build/reference/checkpoint.md","rite-build/reference/spec-drift-guard.md","rite-build/reference/output.md","rite-build/reference/anti-patterns.md"],"triggers":{"afk":["rite-build/reference/afk-discipline.md","devrites-lib/reference/standards/afk-hitl.md","rite-build/reference/checkpoint-protocol.md"],"applicability":["devrites-lib/reference/standards/repository-topology.md","devrites-lib/reference/standards/data-integrity.md","devrites-lib/reference/standards/integration-reliability.md"],"coding":["devrites-lib/reference/standards/coding-style.md"],"debug-recovery":["devrites-lib/reference/standards/debug-recovery.md"],"dod":["devrites-lib/reference/standards/definition-of-done.md"],"errors":["devrites-lib/reference/standards/error-handling.md"],"frontend":["rite-build/reference/frontend-trigger.md"],"parallel":["rite-build/reference/parallel-batch.md"],"patterns":["devrites-lib/reference/standards/patterns.md"],"principles":["devrites-lib/reference/standards/principles.md"],"security":["devrites-lib/reference/standards/security.md"],"tdd":["rite-build/reference/tdd.md","devrites-lib/reference/standards/testing.md"],"workflow-artifacts":["devrites-lib/reference/standards/workflow-artifacts.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","strategy.md"],"workspaceByRole":{"code-reviewer":["spec.md","plan.md","tasks.md","test-plan.md","architecture.md","decisions.md","state.md"],"doubt-reviewer":["spec.md","plan.md","tasks.md","state.md","decisions.md"],"slice-wright":["brief.md","spec.md","architecture.md","plan.md","tasks.md","test-plan.md","state.md","decisions.md","assumptions.md","questions.md"],"test-analyst":["spec.md","tasks.md","test-plan.md","state.md"]}} -->
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/standards/agents.md","rite-build/reference/phase-contract.md","rite-build/reference/one-slice-cycle.md","rite-build/reference/wright-dispatch.md","rite-build/reference/checkpoint.md","rite-build/reference/spec-drift-guard.md","rite-build/reference/output.md","rite-build/reference/anti-patterns.md"],"rootOnly":["rite-build/reference/phase-contract.md","rite-build/reference/wright-dispatch.md","rite-build/reference/checkpoint.md","rite-build/reference/output.md","rite-build/reference/afk-discipline.md","rite-build/reference/checkpoint-protocol.md","rite-build/reference/parallel-batch.md","devrites-lib/reference/standards/afk-hitl.md","devrites-lib/reference/standards/workflow-artifacts.md"],"triggers":{"afk":["rite-build/reference/afk-discipline.md","devrites-lib/reference/standards/afk-hitl.md","rite-build/reference/checkpoint-protocol.md"],"applicability":["devrites-lib/reference/standards/repository-topology.md","devrites-lib/reference/standards/data-integrity.md","devrites-lib/reference/standards/integration-reliability.md"],"coding":["devrites-lib/reference/standards/coding-style.md"],"debug-recovery":["devrites-lib/reference/standards/debug-recovery.md"],"dod":["devrites-lib/reference/standards/definition-of-done.md"],"errors":["devrites-lib/reference/standards/error-handling.md"],"frontend":["rite-build/reference/frontend-trigger.md"],"parallel":["rite-build/reference/parallel-batch.md"],"patterns":["devrites-lib/reference/standards/patterns.md"],"principles":["devrites-lib/reference/standards/principles.md"],"security":["devrites-lib/reference/standards/security.md"],"tdd":["rite-build/reference/tdd.md","devrites-lib/reference/standards/testing.md"],"workflow-artifacts":["devrites-lib/reference/standards/workflow-artifacts.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","strategy.md"],"workspaceByRole":{"code-reviewer":["spec.md","plan.md","tasks.md","test-plan.md","architecture.md","decisions.md","state.md"],"doubt-reviewer":["spec.md","plan.md","tasks.md","state.md","decisions.md"],"slice-wright":["brief.md","spec.md","architecture.md","plan.md","tasks.md","test-plan.md","state.md","decisions.md","assumptions.md","questions.md"],"test-analyst":["spec.md","tasks.md","test-plan.md","state.md"]}} -->
 > Read-set manifest: `devrites-engine context <slug> --phase build` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 

package/pack/.claude/skills/rite-build/reference/one-slice-cycle.md

@@ -21,8 +21,9 @@ DISPATCH  → hand the slice contract to devrites-slice-wright (fresh context).
 (DOUBT)   → orchestrator, on return: devrites-doubt each non-trivial decision the wright stood up
             — dispatch the initial read-only reviews of distinct decisions in parallel
             (independent claims, fresh contexts); wright fixes stay serial — writers share files
-PROVE     → root: required build/browser/E2E, then returned-diff/path review; fail-on-red
-            (red/gap → repair wright, then re-review/re-prove; do not commit yet)
+PROVE     → root, concurrent with the reviews on the same frozen candidate:
+            required build/browser/E2E, then returned-diff/path recheck; fail-on-red
+            (red/gap → repair wright, then re-review and re-prove; do not commit yet)
 RECORD    → orchestrator: after green verification, update state.md/evidence.md and
             upsert the authoritative candidate manifest from the actual scoped diff
 (CHECKPOINT) → only now, with review+proof green: local WIP(<slug>): <imperative summary>

package/pack/.claude/skills/rite-build/reference/parallel-batch.md

@@ -94,13 +94,15 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    <id>`; a malformed contract is dropped from the batch and recorded as a
    gap, not dispatched.
 2. Write lease; freeze `B=HEAD`; `parallel create` worktrees.
-3. Dispatch ≤10 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`).
+3. Dispatch ≤10 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`;
+   one `--slice` per sibling on the wave).
 4. Inspect each returned path list, cumulative diff from `B`, transfer identity,
    and required result fields against the immutable contract. Reject malformed,
    stale, or out-of-scope work. Apply
    [independent Build review](phase-contract.md#independent-build-review): first
-   full inventory, then bounded owning-role rechecks after repairs. Gap or
-   Critical/Important → `gap`; else approved proof → `green|red|gap`.
+   full inventory, then bounded owning-role rechecks after repairs. Run approved
+   proof in the same window as that review. Gap or Critical/Important → `gap`;
+   else proof → `green|red|gap`.
    Reviewer fan-out for a batch is itself batched under
    [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md#scale-limits)
    (≈4 concurrent read-only reviewers, 8 only with disjoint paths), and `max_agents`