devrites 6.1.5 → 6.3.0

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [6.3.0](https://github.com/ViktorsBaikers/DevRites/compare/v6.2.0...v6.3.0) (2026-10-16)
+
+### Added
+
+* **devrites:** guard proof proportionality across phases ([#113](https://github.com/ViktorsBaikers/DevRites/issues/113)) ([2222b60](https://github.com/ViktorsBaikers/DevRites/commit/2222b60563bf28202d163406d27cf7182c6431f0))
+
+## [6.2.0](https://github.com/ViktorsBaikers/DevRites/compare/v6.1.5...v6.2.0) (2026-10-16)
+
+### Added
+
+* **devrites:** lint wright contracts at dispatch open ([#112](https://github.com/ViktorsBaikers/DevRites/issues/112)) ([391a931](https://github.com/ViktorsBaikers/DevRites/commit/391a9317dba9f00941ed29c48cc1f3f2ae8551c4))
+
 ## [6.1.5](https://github.com/ViktorsBaikers/DevRites/compare/v6.1.4...v6.1.5) (2026-10-16)
 
 ### Fixed

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v6.1.5`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v6.1.5): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v6.3.0`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v6.3.0): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 

package/docs/engine/commands.md

@@ -20,10 +20,10 @@ workflow strategy.
 | `parallel <create\|add\|integrate\|cleanup\|status\|abort\|lease-read\|lease-write\|lease-clear\|record-green>` | Deterministic parallel worktree leases, integration, and cleanup for parallel writer batches. A lease is a pipeline: `integrate --slice <id> --apply-to-control` lands one green sibling onto control (refusing if anything but this lease moved control), and `add` starts new path-disjoint siblings from the current control tip while others still run. |
 | `check task-graph <slug>` | Validate `tasks.md` slice dependency graph for cycles, unknown deps, malformed tokens, duplicate IDs, missing `Dependencies`, and `depends_on` mismatch. Prints a non-blocking `ADVISORY size:` line (and records a `size-advisory` metric) for each slice with 12+ Writer allowlist files and no `Size rationale:`. A `Dependencies` ID may carry a `(via <interface>)` suffix (empty or unclosed is a malformed token); prints a non-blocking `ADVISORY edge:` line (and records an `edge-advisory` metric) for each edge with no via, or whose via text is not a case-insensitive substring of the dependency's `Consumes / Produces:`. Prints `schedule: <n> slices in <r> build rounds at cap 10` (the `/rite-build` batch selection replayed over each slice's Writer allowlist, else Files likely touched; omitted when a slice has no path) and a non-blocking `ADVISORY hub:` line (top five; records a `hub-advisory` metric) for each path, compared case-folded, that three or more slices without `Serial rationale:` write. Advisories print only when the graph is valid. |
 | `check regression <slug> [--update]` | Compare the workspace's structural progress facts (phase ordinal, checked ACs, met/abandoned gates, done slices, resolved questions, present artifacts) against the recorded `regression-baseline.json` high-water mark; `--update` ratchets the baseline forward under the feature lock and prints each blessed regression. |
-| `check drift <slug> [--record]` | Attribute readiness-input changes to the exact artifact. `--record` writes the per-input `readiness-inputs.json` digest baseline under the feature lock; without it the workspace diffs current inputs against that baseline (or falls back to the aggregate binding recorded in `eng-review.md`). Advisory: exit `0` on drift; a corrupt baseline exits `3`. A `test-plan.md` change limited to exact `Workflow Artifact reviewed identity: <64hex>` lines is reported as `reviewed-identity-only` (ADR-0034). |
+| `check drift <slug> [--record]` | Attribute readiness-input changes to the exact artifact. `--record` writes the per-input `readiness-inputs.json` digest baseline under the feature lock; without it the workspace diffs current inputs against that baseline (or falls back to the aggregate binding recorded in `eng-review.md`). Advisory: exit `0` on drift; a corrupt baseline exits `3`. A `test-plan.md` change limited to exact `Workflow Artifact reviewed identity: <64hex>` lines is reported as `reviewed-identity-only` (ADR-0034). `--record` also stores each slice's proof bytes (its `tasks.md` block plus the `test-plan.md` lines naming it); both modes print `ADVISORY proportion:` for a slice whose proof grew over 2x since that baseline or carries over 3x the median proof per AC. |
 | `check windows <slug> [--worktree\|--staged\|--base <ref>]` | Fail on deferral and bar-lowering markers the change introduces without a waiver row in the workspace's `windows.md`: added TODO/FIXME/XXX/HACK, skipped/focused-test and stub idioms, checker suppressions, one-line empty catch; removed `deleted-test` files and net `removed-assertion` lines in remaining test files. |
 | `check dup [slug] [--all\|--worktree\|--staged\|--base <ref>] [--min-lines n] [--threshold f] [--ignore-file <path>] [--limit n] [--exclude <csv>]` | Report near-duplicate code clusters that survive comment stripping, literal collapsing, and identifier renaming — token-shingle matches chained into segments, clustered transitively, ranked with bounded path/line-distance boosts. Diff modes mark units overlapping changed hunks with `*`; stable content-derived cluster hashes let `.devrites/dup-ignore` dismissals survive line moves but resurface on structural edits. Staged mode reads index blobs and excludes untracked files. Bounded heuristic: successful scans/leads exit `0`; usage, unavailable input, and partial scans exit `2`. |
-| `check slice <slug> <SLICE-ID>` | Pre-dispatch lint of one slice's wright contract: contract present, exact Writer allowlist paths, resolvable `Satisfies` AC ids, bounded scope. Same non-blocking size advisory as `check task-graph`. |
+| `check slice <slug> <SLICE-ID>` | Pre-dispatch lint of one slice's wright contract: contract present, exact Writer allowlist paths, resolvable `Satisfies` AC ids, bounded scope. Same non-blocking size advisory as `check task-graph`, plus the `check drift` proportion advisory for that slice. |
 | `check diff-scope <slug> --allow <csv>\|--allow-file <path> [--worktree\|--staged\|--base <ref>]` | Verify the changed-path set stays inside the declared allowlist; the mechanical gate run before reviewer dispatch. |
 | `check skill-trust <path>` | Scan one skill/agent Markdown file for structural trust violations. |
 | `check indexes [--root <dir>]` | Report install manifest and code-index presence as JSON. |

package/engine/help.go

@@ -58,7 +58,7 @@ const (
   metrics record <slug> --phase <p> --event <e> [--role r] [--bytes n] [--note s]
   metrics summary [slug] [--by-slice]
 `
-	dispatchUsage  = `usage: devrites-engine dispatch <slug> <open|start|seal|return|status|abandon> [--phase p] [--wave w] [--role r] [--handle h] [--reason s] [--slice SLICE-###] [--reslice-review <DRIFT-ID>]`
+	dispatchUsage  = `usage: devrites-engine dispatch <slug> <open|start|seal|return|status|abandon> [--phase p] [--wave w] [--role r] [--handle h] [--reason s] [--slice SLICE-###] [--reslice-review <DRIFT-ID>] [--contract <file>]`
 	claimUsageText = `usage: devrites-engine claim <add|release|list|check> ...
 
   claim add --session <id> [--ttl <minutes>] [--reason <s>] <path>...

package/engine/internal/lib/dispatch.go

@@ -21,9 +21,9 @@ import (
 // fan-out cannot silently degrade to serial (open -> every role started ->
 // seal -> returns -> complete). start/return also auto-record metrics events.
 //
-//	devrites-engine dispatch <slug> <sub> [--phase p] [--wave w] [--role r] [--handle h] [--reason s] [--slice SLICE-###] [--reslice-review <DRIFT-ID>]
+//	devrites-engine dispatch <slug> <sub> [--phase p] [--wave w] [--role r] [--handle h] [--reason s] [--slice SLICE-###] [--reslice-review <DRIFT-ID>] [--contract <file>]
 
-const dispatchUsage = `usage: devrites-engine dispatch <slug> <open|start|seal|return|status|abandon> [--phase p] [--wave w] [--role r] [--handle h] [--reason s] [--slice SLICE-###] [--reslice-review <DRIFT-ID>]
+const dispatchUsage = `usage: devrites-engine dispatch <slug> <open|start|seal|return|status|abandon> [--phase p] [--wave w] [--role r] [--handle h] [--reason s] [--slice SLICE-###] [--reslice-review <DRIFT-ID>] [--contract <file>]
 
 Wave barrier for parallel agent dispatch: seal fails until every declared
 role has a distinct handle; return fails before seal. status --wave exits
@@ -117,7 +117,7 @@ func nowStamp() string { return time.Now().UTC().Format(time.RFC3339) }
 
 // RunDispatch implements the dispatch wave state machine.
 func RunDispatch(root string, args []string, stdout, stderr io.Writer) int {
-	var slug, sub, phase, wave, role, handle, reason, review string
+	var slug, sub, phase, wave, role, handle, reason, review, contract string
 	var roles, sliceIDs []string
 	var positional []string
 	for i := 0; i < len(args); i++ {
@@ -138,6 +138,8 @@ func RunDispatch(root string, args []string, stdout, stderr io.Writer) int {
 			sliceIDs = append(sliceIDs, value)
 		case "--reslice-review":
 			review = value
+		case "--contract":
+			contract = value
 		default:
 			if strings.HasPrefix(args[i], "-") {
 				fmt.Fprintf(stderr, "dispatch: unknown flag %q\n", args[i])
@@ -161,7 +163,7 @@ func RunDispatch(root string, args []string, stdout, stderr io.Writer) int {
 	// an update and strand the wave short of complete.
 	code := 0
 	if err := state.WithFeatureLock(root, slug, func() error {
-		code = dispatchLocked(root, slug, sub, phase, wave, role, handle, reason, roles, sliceIDs, review, stdout, stderr)
+		code = dispatchLocked(root, slug, sub, phase, wave, role, handle, reason, roles, sliceIDs, review, contract, stdout, stderr)
 		return nil
 	}); err != nil {
 		fmt.Fprintf(stderr, "dispatch: %v\n", err)
@@ -170,7 +172,7 @@ func RunDispatch(root string, args []string, stdout, stderr io.Writer) int {
 	return code
 }
 
-func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, roles, sliceIDs []string, review string, stdout, stderr io.Writer) int {
+func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, roles, sliceIDs []string, review, contract string, stdout, stderr io.Writer) int {
 	f, path, err := loadDispatch(root, slug)
 	if err != nil {
 		fmt.Fprintf(stderr, "dispatch: %v\n", err)
@@ -209,6 +211,11 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 		if code != 0 {
 			return code
 		}
+		if isBuildWrightWave(w) {
+			if err := lintWrightContract(contract); err != nil {
+				return fail("BLOCKED: %v", err)
+			}
+		}
 		f.Waves[wave] = w
 		if err := saveDispatch(path, f); err != nil {
 			return fail("%v", err)

package/engine/internal/lib/dispatch_contract.go

@@ -0,0 +1,51 @@
+package lib
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+// maxContractBytes bounds a wright contract read; packets stay <= 64 KiB.
+const maxContractBytes = 64 << 10
+
+var (
+	// writerSafeLineRE is the contract line that names the checks the wright
+	// itself runs before returning.
+	writerSafeLineRE = regexp.MustCompile(`(?im)^[\s>*#-]*writer-safe checks\s*:\s*\S`)
+	// forbidExecutionRE catches contract text that leaves the wright blind:
+	// "skip tests", "no tests/build", "do not run any checks", "run nothing".
+	forbidExecutionRE = regexp.MustCompile(`(?i)\bskip(?:s|ping)?\s+(?:all\s+|the\s+)?(?:builds?|lint|tests?|testing|checks?|formatters?)\b` +
+		`|\bno\s+(?:leaf\s+)?(?:tests?|test\s+commands?|builds?|lint|execution|checks?)\b` +
+		`|\b(?:do\s+not|don't|never)\s+run\s+(?:any\s+)?(?:tests?|checks?|builds?|lint|commands?)\b` +
+		`|\brun\s+nothing\b`)
+	// allowedAfterRE marks a forbid match that is about not weakening tests,
+	// not about skipping their execution ("no tests weakened or deleted").
+	allowedAfterRE = regexp.MustCompile(`(?i)^[\s/,a-z-]{0,24}\b(?:weaken|delet|remov|disabl|skipp|xfail|loosen)`)
+)
+
+// lintWrightContract refuses a build wright contract that forbids the wright's
+// own writer-safe verification or names none, so a blind round is rejected
+// before launch rather than discovered after the wright returns.
+func lintWrightContract(path string) error {
+	if path == "" {
+		return fmt.Errorf("a build wright wave needs --contract <file> holding the exact wright contract (with a `Writer-safe checks:` line)")
+	}
+	raw, err := readBoundedRegularFile(path, maxContractBytes)
+	if err != nil {
+		return fmt.Errorf("wright contract %s: %w", path, err)
+	}
+	for i, line := range strings.Split(string(raw), "\n") {
+		for _, loc := range forbidExecutionRE.FindAllStringIndex(line, -1) {
+			if allowedAfterRE.MatchString(line[loc[1]:]) {
+				continue
+			}
+			return fmt.Errorf("wright contract %s:%d forbids writer-safe execution (%q); the wright runs syntax/type/lint, unit and self-check suites and a narrow local smoke itself — list them under `Writer-safe checks:` and keep only artifact-producing, consumptive, or full canonical gates root-owned",
+				path, i+1, strings.TrimSpace(line[loc[0]:loc[1]]))
+		}
+	}
+	if !writerSafeLineRE.Match(raw) {
+		return fmt.Errorf("wright contract %s names no `Writer-safe checks:` line; list the syntax/type/lint, unit/self-check and narrow smoke commands the wright runs before returning", path)
+	}
+	return nil
+}

package/engine/internal/lib/drift.go

@@ -44,6 +44,8 @@ type driftBaseline struct {
 	RecordedAt string                      `json:"recorded_at"`
 	Binding    string                      `json:"binding"`
 	Inputs     []gate.ReadinessInputDigest `json:"inputs"`
+	// ProofBytes is each slice's proof size at Vet, for the growth advisory.
+	ProofBytes map[string]int `json:"proof_bytes,omitempty"`
 }
 
 // driftDiff is one input whose state differs from the baseline.
@@ -78,10 +80,16 @@ func RunCheckDrift(root string, args []string, stdout, stderr io.Writer) int {
 		return 2
 	}
 	baselinePath := filepath.Join(workspace, driftBaselineFile)
+	code := 0
 	if record {
-		return recordDriftBaseline(root, slug, baselinePath, digests, binding, stdout, stderr)
+		code = recordDriftBaseline(root, slug, baselinePath, digests, binding, stdout, stderr)
+	} else {
+		code = compareDrift(workspace, baselinePath, digests, binding, stdout, stderr)
 	}
-	return compareDrift(workspace, baselinePath, digests, binding, stdout, stderr)
+	if code == 0 {
+		printProportion(root, slug, "", stdout)
+	}
+	return code
 }
 
 // recordDriftBaseline writes the current per-input digests as the baseline.
@@ -91,6 +99,10 @@ func recordDriftBaseline(root, slug, baselinePath string, digests []gate.Readine
 		RecordedAt: time.Now().UTC().Format(time.RFC3339),
 		Binding:    binding,
 		Inputs:     digests,
+		ProofBytes: map[string]int{},
+	}
+	for id, w := range workspaceProofWeights(root, slug) {
+		baseline.ProofBytes[id] = w.Bytes
 	}
 	payload, err := json.MarshalIndent(baseline, "", "  ")
 	if err != nil {

package/engine/internal/lib/proportion.go

@@ -0,0 +1,130 @@
+package lib
+
+import (
+	"fmt"
+	"io"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strings"
+
+	"github.com/devrites/devrites/internal/devritespaths"
+	"github.com/devrites/devrites/internal/state"
+)
+
+// proportion.go: proof proportionality advisories. A slice whose proof keeps
+// growing after Vet, or that carries far more proof per acceptance criterion
+// than its siblings, is usually absorbing hardening no spec line asked for —
+// the cause of long vet↔plan and review↔repair loops. The advisory names the
+// slice so the root moves uncited rows into an optional slice instead of
+// repairing them; it never blocks.
+
+const (
+	// proofGrowthLimit is the growth factor since the Vet baseline that warns.
+	proofGrowthLimit = 2
+	// proofRatioLimit is how many times the median per-AC proof weight warns.
+	proofRatioLimit = 3
+	// proofRatioMinSlices is the sibling count below which a median means little.
+	proofRatioMinSlices = 3
+)
+
+// sliceWeight is one slice's proof size: its tasks.md block plus every
+// test-plan.md line that names it, and the distinct AC IDs its block cites.
+type sliceWeight struct {
+	Bytes int
+	ACs   int
+}
+
+// proofWeights measures every SLICE-### in tasks.md; a missing test-plan.md
+// counts as empty.
+func proofWeights(tasks, testPlan []byte) map[string]sliceWeight {
+	graph := ParseTaskGraph(tasks)
+	planLines := strings.Split(string(testPlan), "\n")
+	weights := make(map[string]sliceWeight, len(graph.Slices))
+	for _, s := range graph.Slices {
+		block, _ := state.ExtractTaskSlice(tasks, s.ID)
+		w := sliceWeight{Bytes: len(block)}
+		seen := map[string]bool{}
+		for _, ac := range sliceACRe.FindAllString(block, -1) {
+			seen[ac] = true
+		}
+		w.ACs = len(seen)
+		idRE := regexp.MustCompile(`\b` + regexp.QuoteMeta(s.ID) + `\b`)
+		for _, line := range planLines {
+			if idRE.MatchString(line) {
+				w.Bytes += len(line) + 1
+			}
+		}
+		weights[s.ID] = w
+	}
+	return weights
+}
+
+// proportionAdvisories compares current weights against the Vet baseline
+// (growth) and against sibling slices (per-AC ratio). only limits output to
+// one slice; empty means all.
+func proportionAdvisories(weights map[string]sliceWeight, baseline map[string]int, only string) []string {
+	var perAC []float64
+	for _, w := range weights {
+		if w.ACs > 0 {
+			perAC = append(perAC, float64(w.Bytes)/float64(w.ACs))
+		}
+	}
+	sort.Float64s(perAC)
+	median := 0.0
+	if len(perAC) >= proofRatioMinSlices {
+		median = perAC[len(perAC)/2]
+	}
+	ids := make([]string, 0, len(weights))
+	for id := range weights {
+		if only == "" || id == only {
+			ids = append(ids, id)
+		}
+	}
+	sort.Strings(ids)
+	const fix = "move proof rows that quote no AC/REQ/INV/PROH/DEC/EDGE line into an optional slice instead of repairing them"
+	var lines []string
+	for _, id := range ids {
+		w := weights[id]
+		if base := baseline[id]; base > 0 && w.Bytes > proofGrowthLimit*base {
+			lines = append(lines, fmt.Sprintf("ADVISORY proportion: %s proof grew %.1fx since the Vet baseline (%d -> %d bytes); %s",
+				id, float64(w.Bytes)/float64(base), base, w.Bytes, fix))
+		}
+		if median > 0 && w.ACs > 0 {
+			if ratio := float64(w.Bytes) / float64(w.ACs) / median; ratio > proofRatioLimit {
+				lines = append(lines, fmt.Sprintf("ADVISORY proportion: %s carries %d bytes of proof for %d AC(s), %.1fx the median slice; %s",
+					id, w.Bytes, w.ACs, ratio, fix))
+			}
+		}
+	}
+	return lines
+}
+
+// workspaceProofWeights reads tasks.md and test-plan.md for slug; nil when
+// tasks.md is unreadable, so the advisory stays silent rather than wrong.
+func workspaceProofWeights(root, slug string) map[string]sliceWeight {
+	tasks, err := readWorkspaceArtifact(root, slug, "tasks.md")
+	if err != nil {
+		return nil
+	}
+	testPlan, _ := readWorkspaceArtifact(root, slug, "test-plan.md")
+	return proofWeights(tasks, testPlan)
+}
+
+// printProportion writes the advisories for slug (one slice when only is set)
+// against the drift baseline's recorded proof sizes, when one exists.
+func printProportion(root, slug, only string, stdout io.Writer) {
+	weights := workspaceProofWeights(root, slug)
+	if weights == nil {
+		return
+	}
+	var recorded map[string]int
+	if workspace, err := devritespaths.ExistingFeatureDirChecked(root, slug); err == nil {
+		if base, ok, err := readDriftBaseline(filepath.Join(workspace, driftBaselineFile)); err == nil && ok {
+			recorded = base.ProofBytes
+		}
+	}
+	for _, line := range proportionAdvisories(weights, recorded, only) {
+		fmt.Fprintln(stdout, line)
+	}
+}

package/engine/internal/lib/slicecheck.go

@@ -188,6 +188,7 @@ func RunCheckSlice(root string, args []string, stdout, stderr io.Writer) int {
 	if n, over := sliceSizeAdvisory(block); over {
 		fmt.Fprintf(stdout, "check slice: ADVISORY size: %s has %d Writer allowlist files (>= %d); consider an acceptance-preserving split\n", sliceID, n, sliceFileAdvisory)
 	}
+	printProportion(root, slug, sliceID, stdout)
 	if len(problems) > 0 {
 		fmt.Fprintf(stdout, "check slice: %s BLOCKED\n", sliceID)
 		for _, p := range problems {

package/pack/.claude/agents/devrites-code-reviewer.md

@@ -155,7 +155,7 @@ Outcome: <findings | no-findings | gap>
 Counts: <n per severity or kind used in the rows below>
 Account: <admitted findings | No-findings | Gap per Result admission>
 Coverage: <files read fully | hunk-level | skipped: name — reason>
-Finding: <severity> conf <n> | <file:line> | <observed> | when <input/state/sequence> → <effect> | <minimum fix>
+Finding: <severity> conf <n> | <file:line> | <observed> | when <input/state/sequence> → <effect> | breaks <ID or standard §> "<quoted line>" | <minimum fix>
 Basis: <files read · commands run to reach this finding>
 Contract: <applicable | not-applicable> — <basis: both sides read · crossing test>
 Tests: <adequate? gaps>

package/pack/.claude/agents/devrites-plan-drafter.md

@@ -23,7 +23,9 @@ seams supplied by the orchestrator.
 Reuse existing seams and dependencies before proposing new ones. Build vertical
 slices in dependency order; put a hub file's shared edit in one seam slice
 ([slicing.md](../skills/rite-plan/reference/slicing.md#slice-independence)). Map every REQ and AC to a slice and executable proof,
-name rollback and failure paths; keep acceptance-changing proposals separate. Durable
+name rollback and failure paths; keep acceptance-changing proposals separate. Each proof
+row quotes the spec line or standard rule it proves (`Proves`); proof that proves none
+goes to `test-plan.md` `## Deferred hardening`, never into a slice. Durable
 proof commands must be portable repository commands, never host-local wrappers,
 user-specific absolute paths, or temporary proof trees.
 Reconcile `spec.md`'s applicability map against live evidence. When triggered, apply

package/pack/.claude/agents/devrites-plan-reviewer.md

@@ -112,7 +112,10 @@ criterion, slice, or proof.
   `convergence_pressure` eligibility mechanical. Tag every Critical/Important
   `kind: contract` (an implementer could build it differently and still pass the
   planned tests) or `kind: mechanism` (a named test can discriminate the wrong
-  implementation; propose that case as the fix, not new plan prose).
+  implementation; propose that case as the fix, not new plan prose). Each
+  Critical/Important also quotes the spec line (`AC`/`REQ`/`INV`/`PROH`/`DEC`/`EDGE`)
+  or standard rule it breaks; hardening no spec line asks for is a Suggestion
+  ([agents.md](../skills/devrites-lib/reference/standards/agents.md) § Result admission, Proportionality).
 - In a recheck, your verdict covers the listed fingerprints, the correction diff, and
   the dependents of each changed clause. Return an explicit correction-created
   regression verdict over the touched invariants and those dependents as

package/pack/.claude/skills/devrites-lib/reference/standards/agents.md

@@ -98,7 +98,7 @@ Each required reviewer/analyst/auditor starts with exactly one:
 ```text
 Outcome: <findings | no-findings | gap>
 Counts: <n per severity or kind used in the rows below>
-Finding: <severity> conf <n> | <file:line or artifact section> | <observed quote/result> | when <input/state/sequence> → <effect> | <minimum fix>
+Finding: <severity> conf <n> | <file:line or artifact section> | <observed quote/result> | when <input/state/sequence> → <effect> | breaks <ID or standard §> "<quoted line>" | <minimum fix>
 Basis: <files read · commands run to reach this finding>
 ```
 
@@ -108,6 +108,13 @@ Basis: <files read · commands run to reach this finding>
   A Critical/Important row carries `conf <n>` in its severity cell and writes impact
   as `when <input/state/sequence> → <effect>`; missing either, root admits it as
   `Unverified: <claim> — missing trigger` (stays `gap`).
+- **Proportionality:** a Critical/Important row's `breaks` quotes the line it violates:
+  a spec ID (`AC`/`REQ`/`INV`/`PROH`/`DEC`/`EDGE`) or a shipped standard rule
+  (`<standard>.md § <section>`: security, regression, principles). Root anchors the
+  quote like the `file:line` quote. No anchor, or one the defect does not break,
+  admits the row as Suggestion logged `Deferred: <claim> — no spec anchor` for an
+  optional follow-up slice; it never drives a repair round. Hardening no spec line
+  asks for is a Suggestion, however plausible.
 - **`no-findings`:** `No-findings:` names checks and inspected evidence. Bare
   pass, empty list, or “looks good” is malformed.
 - **`gap`:** names missing/unreadable/stale input; skipped/failed required check;

package/pack/.claude/skills/devrites-lib/reference/standards/loop-operations.md

@@ -112,6 +112,10 @@ armed AFK workspace whose exact scope, gates, and budgets permit it.
   run `devrites-engine check drift <slug>` before re-vetting: it names the
   exact input artifact that changed (or `missing`/`added`) since the recorded
   baseline, so the Spec Drift Guard or `/rite-vet` starts at the right file.
+- `check drift` and `check slice` print `ADVISORY proportion:` when a slice's proof
+  grew over 2x since the Vet baseline or carries over 3x the median proof per AC.
+  Repair by moving rows without a `Proves` spec line to `Deferred hardening`
+  ([agents.md](agents.md) § Result admission, Proportionality), not by adding proof.
 - Native notifications fire only after evidence and stop state are written.
 
 Use [`afk-hitl.md`](afk-hitl.md) for unattended authority and resource budgets,

package/pack/.claude/skills/rite-build/SKILL.md

@@ -29,8 +29,8 @@ Execute [`reference/phase-contract.md`](reference/phase-contract.md)
 [`reference/wright-dispatch.md`](reference/wright-dispatch.md).
 Every wright contract names the writer-safe checks the wright runs (syntax/type/lint,
 unit and self-check suites, a narrow local smoke) and never forbids them; only
-artifact-producing, consumptive, or full canonical gates stay root-owned.
-Prior contracts in `evidence.md` are not a template for this. **Failing case:** the
+artifact-producing, consumptive, or full canonical gates stay root-owned;
+`dispatch open --contract` refuses a contract that breaks this. Prior contracts in `evidence.md` are not a template for this. **Failing case:** the
 contract says "skip tests mid-flight; root runs them after return", and the wright
 returns three unit failures that a 20 s `go test` would have caught in-round.
 

package/pack/.claude/skills/rite-build/reference/one-slice-cycle.md

@@ -23,7 +23,9 @@ DISPATCH  → hand the slice contract to devrites-slice-wright (fresh context).
             (independent claims, fresh contexts); wright fixes stay serial — writers share files
 PROVE     → root, concurrent with the reviews on the same frozen candidate:
             required build/browser/E2E (narrow self-check/smoke first, full gate only
-            after it is green, long runs in the background), then returned-diff/path recheck; fail-on-red
+            after it is green, long runs in the background; cancel one still running once
+            review or proof sends the candidate back, keeping its partial output as
+            diagnostics), then returned-diff/path recheck; fail-on-red
             (red/gap → repair wright, then re-review and re-prove; do not commit yet)
 RECORD    → orchestrator: after green verification, update state.md/evidence.md and
             upsert the authoritative candidate manifest from the actual scoped diff

package/pack/.claude/skills/rite-build/reference/wright-dispatch.md

@@ -94,10 +94,14 @@ claim add --session <id> <task-paths>`; retain its returned `<claim-id>`, then r
 live foreign session releases the retained claim and stops the dispatch, per
 [`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
 is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
-Ask the host
-for the exact writer in fresh context and wait. Track it through the
-launch barrier — `devrites-engine dispatch <slug> open --phase build --wave
-<slice-id> --role slice-wright --slice <SLICE-ID>`, then `start` with the host handle, `seal`, and
+Write the exact contract, with its `Writer-safe checks:` line, to
+`packets/<wave>.contract.md` and hand the wright that text verbatim. Ask the host
+for the exact writer in fresh context; a repair round on the same slice whose
+returned wright the host can still continue goes to that wright on its existing
+handle instead, so it does not re-read the slice from scratch. Wait, and track it
+through the launch barrier — `devrites-engine dispatch <slug> open --phase build --wave
+<slice-id> --role slice-wright --slice <SLICE-ID> --contract <file>` (it refuses a
+contract that forbids writer-safe checks or names none), then `start` with the host handle, `seal`, and
 `return` on completion (auto-records dispatch/return metrics). Every 5 wright
 rounds on one slice, `open` blocks for a reslice review: propose an
 acceptance-preserving split (`root_no_change_analysis` → `FOLD` per

package/pack/.claude/skills/rite-define/SKILL.md

@@ -131,7 +131,9 @@ Pull these via `Read` when shaping the plan:
    expand this into repository-wide coverage.
 4. **Map coverage and wiring:** every `AC-###` spec acceptance criterion maps to ≥1 `SLICE-###`
    ([`acceptance-criteria.md`](../rite-spec/reference/acceptance-criteria.md)); no orphaned criteria, no slice without a
-   criterion. Lift covered/backstop `Edge Coverage` rows and resolved `Prohibitions (must-NOT)`
+   criterion. Every proof row quotes the spec line it proves (`Proves`); proof that proves
+   none goes to `test-plan.md` `## Deferred hardening`, never into a slice
+   ([artifacts.md](../rite-vet/reference/artifacts.md)). Lift covered/backstop `Edge Coverage` rows and resolved `Prohibitions (must-NOT)`
    rows into `traceability.md` and `test-plan.md`; unresolved rows get a gate/owner. Each
    `Existing behavior to preserve` row becomes a regression row whose current evidence is
    observed green on the unchanged baseline as a prerequisite of the first slice touching that

package/pack/.claude/skills/rite-vet/SKILL.md

@@ -207,7 +207,9 @@ plan declares a root-authored executable workflow file, read
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
    must pass. Record the per-input drift baseline alongside it:
    `devrites-engine check drift <slug> --record` — a later stale binding then
-   names the exact artifact that moved instead of "something changed". Technical failure records reproduction, not qid. Human gap awaits
+   names the exact artifact that moved instead of "something changed". An `ADVISORY
+   proportion:` line names a slice whose proof outgrew its ACs: move its rows without a
+   `Proves` spec line to `Deferred hardening` before READY, never deepen them. Technical failure records reproduction, not qid. Human gap awaits
    Clarify. Optional cross-model follows `reference/cross-model.md` (trigger `cross-model`).
 
    With READY, no pending remediation, and a valid technical return cursor,

package/pack/.claude/skills/rite-vet/reference/artifacts.md

@@ -126,9 +126,20 @@ prove only their named static criterion.
 <the ASCII code-paths + user-flows diagram from review-axes.md, with COVERAGE / GAPS / REGRESSIONS line>
 
 ## Per-gap test requirements
-| ID | Path / flow | Test file (match conventions) | Asserts (input → expected) | Kind | Slice | Priority |
-|---|---|---|---|---|---|---|
-| T1 | <path> | <path/to.test> | <empty list → 200 + []> | unit / E2E / eval | <slice> | P1 / **Regression-Critical** |
+| ID | Path / flow | Test file (match conventions) | Asserts (input → expected) | Kind | Slice | Priority | Proves |
+|---|---|---|---|---|---|---|---|
+| T1 | <path> | <path/to.test> | <empty list → 200 + []> | unit / E2E / eval | <slice> | P1 / **Regression-Critical** | <AC/REQ/INV/PROH/DEC/EDGE ID or standard § + quoted line> |
+
+Every row's `Proves` quotes the spec line or standard rule it proves. A row that proves
+none is plan-invented hardening: move it to `Deferred hardening`.
+
+## Deferred hardening
+| ID | Hardening | Why no spec line needs it | Promote by |
+|---|---|---|---|
+| D1 | <proof or mechanism> | <reason> | <the spec line an owner would add> |
+
+Deferred rows are an optional follow-up slice: not built, proven, or gating in this
+feature; this table is their follow-up record. Nothing is deleted.
 
 ## Interaction inventory (UI slices — every element + flow gets an asserting test)
 Enumerate every interactive element and user flow the feature exposes; one row each, none

package/pack/generated/claude/agents/devrites-code-reviewer.md

@@ -161,7 +161,7 @@ Outcome: <findings | no-findings | gap>
 Counts: <n per severity or kind used in the rows below>
 Account: <admitted findings | No-findings | Gap per Result admission>
 Coverage: <files read fully | hunk-level | skipped: name — reason>
-Finding: <severity> conf <n> | <file:line> | <observed> | when <input/state/sequence> → <effect> | <minimum fix>
+Finding: <severity> conf <n> | <file:line> | <observed> | when <input/state/sequence> → <effect> | breaks <ID or standard §> "<quoted line>" | <minimum fix>
 Basis: <files read · commands run to reach this finding>
 Contract: <applicable | not-applicable> — <basis: both sides read · crossing test>
 Tests: <adequate? gaps>

package/pack/generated/claude/agents/devrites-plan-drafter.md

@@ -23,7 +23,9 @@ seams supplied by the orchestrator.
 Reuse existing seams and dependencies before proposing new ones. Build vertical
 slices in dependency order; put a hub file's shared edit in one seam slice
 ([slicing.md](../skills/rite-plan/reference/slicing.md#slice-independence)). Map every REQ and AC to a slice and executable proof,
-name rollback and failure paths; keep acceptance-changing proposals separate. Durable
+name rollback and failure paths; keep acceptance-changing proposals separate. Each proof
+row quotes the spec line or standard rule it proves (`Proves`); proof that proves none
+goes to `test-plan.md` `## Deferred hardening`, never into a slice. Durable
 proof commands must be portable repository commands, never host-local wrappers,
 user-specific absolute paths, or temporary proof trees.
 Reconcile `spec.md`'s applicability map against live evidence. When triggered, apply

package/pack/generated/claude/agents/devrites-plan-reviewer.md

@@ -118,7 +118,10 @@ criterion, slice, or proof.
   `convergence_pressure` eligibility mechanical. Tag every Critical/Important
   `kind: contract` (an implementer could build it differently and still pass the
   planned tests) or `kind: mechanism` (a named test can discriminate the wrong
-  implementation; propose that case as the fix, not new plan prose).
+  implementation; propose that case as the fix, not new plan prose). Each
+  Critical/Important also quotes the spec line (`AC`/`REQ`/`INV`/`PROH`/`DEC`/`EDGE`)
+  or standard rule it breaks; hardening no spec line asks for is a Suggestion
+  ([agents.md](../skills/devrites-lib/reference/standards/agents.md) § Result admission, Proportionality).
 - In a recheck, your verdict covers the listed fingerprints, the correction diff, and
   the dependents of each changed clause. Return an explicit correction-created
   regression verdict over the touched invariants and those dependents as

package/pack/generated/claude/skills/devrites-lib/reference/standards/agents.md

@@ -98,7 +98,7 @@ Each required reviewer/analyst/auditor starts with exactly one:
 ```text
 Outcome: <findings | no-findings | gap>
 Counts: <n per severity or kind used in the rows below>
-Finding: <severity> conf <n> | <file:line or artifact section> | <observed quote/result> | when <input/state/sequence> → <effect> | <minimum fix>
+Finding: <severity> conf <n> | <file:line or artifact section> | <observed quote/result> | when <input/state/sequence> → <effect> | breaks <ID or standard §> "<quoted line>" | <minimum fix>
 Basis: <files read · commands run to reach this finding>
 ```
 
@@ -108,6 +108,13 @@ Basis: <files read · commands run to reach this finding>
   A Critical/Important row carries `conf <n>` in its severity cell and writes impact
   as `when <input/state/sequence> → <effect>`; missing either, root admits it as
   `Unverified: <claim> — missing trigger` (stays `gap`).
+- **Proportionality:** a Critical/Important row's `breaks` quotes the line it violates:
+  a spec ID (`AC`/`REQ`/`INV`/`PROH`/`DEC`/`EDGE`) or a shipped standard rule
+  (`<standard>.md § <section>`: security, regression, principles). Root anchors the
+  quote like the `file:line` quote. No anchor, or one the defect does not break,
+  admits the row as Suggestion logged `Deferred: <claim> — no spec anchor` for an
+  optional follow-up slice; it never drives a repair round. Hardening no spec line
+  asks for is a Suggestion, however plausible.
 - **`no-findings`:** `No-findings:` names checks and inspected evidence. Bare
   pass, empty list, or “looks good” is malformed.
 - **`gap`:** names missing/unreadable/stale input; skipped/failed required check;

package/pack/generated/claude/skills/devrites-lib/reference/standards/loop-operations.md

@@ -112,6 +112,10 @@ armed AFK workspace whose exact scope, gates, and budgets permit it.
   run `devrites-engine check drift <slug>` before re-vetting: it names the
   exact input artifact that changed (or `missing`/`added`) since the recorded
   baseline, so the Spec Drift Guard or `/rite-vet` starts at the right file.
+- `check drift` and `check slice` print `ADVISORY proportion:` when a slice's proof
+  grew over 2x since the Vet baseline or carries over 3x the median proof per AC.
+  Repair by moving rows without a `Proves` spec line to `Deferred hardening`
+  ([agents.md](agents.md) § Result admission, Proportionality), not by adding proof.
 - Native notifications fire only after evidence and stop state are written.
 
 Use [`afk-hitl.md`](afk-hitl.md) for unattended authority and resource budgets,

package/pack/generated/claude/skills/rite-build/SKILL.md

@@ -29,8 +29,8 @@ Execute [`reference/phase-contract.md`](reference/phase-contract.md)
 [`reference/wright-dispatch.md`](reference/wright-dispatch.md).
 Every wright contract names the writer-safe checks the wright runs (syntax/type/lint,
 unit and self-check suites, a narrow local smoke) and never forbids them; only
-artifact-producing, consumptive, or full canonical gates stay root-owned.
-Prior contracts in `evidence.md` are not a template for this. **Failing case:** the
+artifact-producing, consumptive, or full canonical gates stay root-owned;
+`dispatch open --contract` refuses a contract that breaks this. Prior contracts in `evidence.md` are not a template for this. **Failing case:** the
 contract says "skip tests mid-flight; root runs them after return", and the wright
 returns three unit failures that a 20 s `go test` would have caught in-round.
 

package/pack/generated/claude/skills/rite-build/reference/one-slice-cycle.md

@@ -23,7 +23,9 @@ DISPATCH  → hand the slice contract to devrites-slice-wright (fresh context).
             (independent claims, fresh contexts); wright fixes stay serial — writers share files
 PROVE     → root, concurrent with the reviews on the same frozen candidate:
             required build/browser/E2E (narrow self-check/smoke first, full gate only
-            after it is green, long runs in the background), then returned-diff/path recheck; fail-on-red
+            after it is green, long runs in the background; cancel one still running once
+            review or proof sends the candidate back, keeping its partial output as
+            diagnostics), then returned-diff/path recheck; fail-on-red
             (red/gap → repair wright, then re-review and re-prove; do not commit yet)
 RECORD    → orchestrator: after green verification, update state.md/evidence.md and
             upsert the authoritative candidate manifest from the actual scoped diff