devrites 6.10.0 → 7.0.0

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.0.0](https://github.com/ViktorsBaikers/DevRites/compare/v6.10.0...v7.0.0) (2026-10-20)
+
+### ⚠ BREAKING CHANGES
+
+* **devrites:** a timed-out gate keeps the output it printed
+
+### Added
+
+* **no-release:** make codebase-memory-mcp the one code index ([#142](https://github.com/ViktorsBaikers/DevRites/issues/142)) ([d269904](https://github.com/ViktorsBaikers/DevRites/commit/d269904f8107bb5e669264bf53865ce070e4fa0a))
+* **no-release:** measure cost and reviewer yield before speed changes ([#145](https://github.com/ViktorsBaikers/DevRites/issues/145)) ([14742aa](https://github.com/ViktorsBaikers/DevRites/commit/14742aa68a0885a27902f06ea88c2316d7f55c65))
+* **no-release:** move root bookkeeping into the engine, check at Vet ([#147](https://github.com/ViktorsBaikers/DevRites/issues/147)) ([99bdbc8](https://github.com/ViktorsBaikers/DevRites/commit/99bdbc8d820491cef2e580b184d26173c558753d))
+* **no-release:** state writers, fewer AFK stops, lifecycle benchmark ([#143](https://github.com/ViktorsBaikers/DevRites/issues/143)) ([c6d4f29](https://github.com/ViktorsBaikers/DevRites/commit/c6d4f29aa340bce2b72577cc36f6f19296afe5df))
+* **no-release:** trim leaf context bundles without dropping rules ([#146](https://github.com/ViktorsBaikers/DevRites/issues/146)) ([61fab54](https://github.com/ViktorsBaikers/DevRites/commit/61fab546701f9387dcab5a58171303c8e71aba90))
+
+### Fixed
+
+* **devrites:** a timed-out gate keeps the output it printed ([903c276](https://github.com/ViktorsBaikers/DevRites/commit/903c2762e31d6d97c32564ff028016919935e022))
+* **no-release:** a plan item is never a Proportionality anchor ([#144](https://github.com/ViktorsBaikers/DevRites/issues/144)) ([722ace6](https://github.com/ViktorsBaikers/DevRites/commit/722ace6ee42bc82c2d2d7bb76ca955445655a9be))
+
 ## [6.10.0](https://github.com/ViktorsBaikers/DevRites/compare/v6.9.6...v6.10.0) (2026-10-19)
 
 ### Added

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v6.10.0`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v6.10.0): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.0.0`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.0.0): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -442,7 +442,10 @@ prints the setting to add. Once you edit one the installer created, it is
 yours: update, uninstall, and `--force` leave it in place. On Devin CLI, dispatch goes through
 `run_subagent` with the exact `devrites-<role>` profile, and a missing profile
 stops for HITL instead of substituting `subagent_general`. Profiles load when a
-session starts, so reopen the project after installing.
+session starts, so reopen the project after installing. pi-subagents refuses a
+child whose `tools:` names a tool it cannot load, so pi agents list only Pi's
+built-in tools; grant extension tools on one machine with
+`subagents.agentOverrides.<agent>.tools` in Pi settings.
 
 DevRites is installed through npm or the Bash bootstrap. It is not distributed
 through Claude Code or Codex plugin stores.
@@ -484,8 +487,9 @@ and, when performance is measurable, targets LCP ≤ 2.5 s, INP ≤ 200 ms, and
 CLS ≤ 0.1. Full-stack work starts with the API and data contract, then builds
 a vertical slice through the UI.
 
-DevRites works without extra tools. When available, codegraph or graphify can
-answer structural questions,
+DevRites works without extra tools. When available,
+[codebase-memory-mcp](https://github.com/DeusData/codebase-memory-mcp) answers
+structural questions (callers, blast radius, diff impact),
 [ego-lite](https://github.com/citrolabs/ego-lite), browser-harness, or
 [Playwright MCP](https://github.com/microsoft/playwright-mcp) can collect
 browser evidence (tried in that order), and Chrome DevTools MCP can add Lighthouse and performance

package/SECURITY.md

@@ -214,7 +214,7 @@ Unrelated Git variables are preserved. Go and shell parity is covered by
 DevRites vendors no third-party code (see `NOTICE.md`). It runs through the
 external host selected by the user (Claude Code, Codex, omp, pi, or Devin CLI)
 and is independent of, and not affiliated with or endorsed by, any of these
-hosts or their makers. Codegraph, graphify, ego-lite, browser-harness, and
+hosts or their makers. codebase-memory-mcp, ego-lite, browser-harness, and
 Playwright MCP are optional user-selected tools that DevRites calls through
 their documented interfaces rather than bundling them.
 

package/docs/adr/0038-engine-flags-unattributed-root-edits.md

@@ -0,0 +1,67 @@
+# ADR-0038: The engine flags unattributed root edits
+
+- **Status:** Accepted
+- **Date:** 2026-10-20
+- **Narrows:** the ADR-0018 clause "There is no compatibility command or replacement enforcement layer", for root-edit attribution only
+
+## Context
+
+ADR-0018 made the root's read-only rule and the wright's exact-path scope
+instruction-backed and removed the engine's Git-backed reconcile window. ADR-0035
+then took the Claude root out of plan mode, so no host now has a technical guard on
+root edits. `check diff-scope` runs only when a wright returns and checks only that
+wright's allowlist: it blames the wright for a root edit, and it never sees an edit
+made after a slice's last wright.
+
+In four `/rite-autocomplete` sessions on a downstream project, the root made 34
+successful product edits outside `.devrites/`, and 33 of them had no open claim.
+One deleted file was first taken for owner work. Fixing that cost an owner
+decision, a restore wright, and a dropped workaround.
+
+## Decision
+
+- The engine keeps `<feature>/tree-baseline.json`: dirty product paths (git
+  status, outside `.devrites/` and `.scratch/`; gitignored files never appear)
+  mapped to the `check diff-scope` fingerprint. The first `dispatch open` writes
+  it, and that dirt counts as accepted user work. The return that completes a
+  wright wave, in any phase, takes in the wave's slice write sets and claim paths. Paths
+  that are no longer dirty keep their recorded fingerprint, so collapsing a
+  checkpoint commit back into the work tree flags nothing.
+- `dispatch open`, `next` and `check candidate` exit `3` when a dirty product
+  path has a fingerprint that differs from the baseline and no live claim or
+  in-flight wright wave covers it. The message names the paths and both
+  remedies. Each finding writes an `unattributed-edit` row to `metrics.jsonl`.
+- Remedies need no human stop. The root routes the path through a bounded
+  wright: a wright wave (Build or Polish) whose `--claim` or slice write set
+  names the path may open. When the evidence shows owner work, gate output, a
+  returned wright outside a dispatch wave, or a protocol-sanctioned root write
+  (Polish ADR promotion, `DESIGN.md`), the root records
+  it with `dispatch <slug> attribute --reason <evidence> --path <path>`, which
+  logs the reason and takes the path into the baseline.
+- The engine never reverts, restores, or deletes a file.
+- A workspace without `tree-baseline.json`, a root that is not a project's
+  `.devrites/`, or a project outside git is never blocked.
+- No hook and no private Git ref; the tripwire takes no Git snapshot (the
+  ref-free tree object that `check windows --since-dispatch` records per build
+  wright wave is a separate read aid). Exact-path wright scope stays
+  instruction-backed plus `check diff-scope`, as ADR-0018 decided.
+
+## Alternatives considered
+
+| Option | Why not |
+|---|---|
+| PreToolUse hook on root edits | The measured failures ran on a host the hook would not cover. Hooks bring back the payload coupling that ADR-0015 and ADR-0018 removed, and ADR-0016 found child hooks bypassed. |
+| Git-backed snapshot refs | ADR-0018 removed private Git snapshot state. Workspace JSON plus `git status` reads are enough. |
+| Engine restores flagged paths | It cannot tell owner work from root edits, so a restore could destroy owner work. |
+| Keep instructions only | The downstream evidence shows the instruction alone does not hold on an autocomplete root. |
+
+## Consequences
+
+- A root edit is flagged at the root's next `dispatch open`, `next` or `check
+  candidate`, not first at seal or by a later session.
+- Known limit: while a wright runs, the engine cannot tell a root edit from a
+  wright edit on a path that wright owns. It also cannot tell owner edits from
+  root edits. Hence the attribution remedy, never a revert.
+- A root commit that bypasses the checkpoint protocol hides an edit from the
+  tripwire. Review and seal still read the full diff.
+- `engine/internal/lib/treebaseline_test.go` guards the decision.

package/docs/adr/README.md

@@ -63,7 +63,7 @@ architecture; per-feature `decisions.md` files stay scoped to that feature.
 | [0015](0015-read-only-root-native-orchestration.md) | Read-only root with native host orchestration | Accepted; Codex root/writer clauses superseded by 0017; exact-path/hook/reconcile clauses superseded by 0018; Claude root plan mode superseded by 0035 | `engine/internal/install/install_test.go`, `tests/codex-agent-generation-test.sh` |
 | [0016](0016-codex-writer-fail-closed.md) | Codex source writing fails closed | Superseded by 0017 | historical |
 | [0017](0017-native-codex-writer-agent.md) | Native Codex writer-agent execution | Accepted; exact-path/reconcile clauses superseded by 0018; Claude root plan mode superseded by 0035 | `tests/codex-agent-generation-test.sh`, `tests/codex-generator-test.sh`, `tests/codex-runtime-smoke.sh` |
-| [0018](0018-native-sandbox-instruction-writer-boundary.md) | Native sandbox and instruction writer boundary | Accepted in part; native sandbox/writer boundary retained, superseded clauses resolved by 0022 | `engine/internal/install/install_test.go`, `tests/codex-agent-generation-test.sh` |
+| [0018](0018-native-sandbox-instruction-writer-boundary.md) | Native sandbox and instruction writer boundary | Accepted in part; native sandbox/writer boundary retained, superseded clauses resolved by 0022; no-replacement-enforcement clause narrowed by 0038 for root-edit attribution; ref-free per-wave tree snapshot for `check windows --since-dispatch` | `engine/internal/install/install_test.go`, `tests/codex-agent-generation-test.sh` |
 | [0019](0019-native-boundary-with-deterministic-gates.md) | Native boundary with deterministic gates | Accepted in part; semantic gates superseded by 0022, native writer and fresh approval retained | `engine/internal/gate/gate_test.go` |
 | [0020](0020-thin-engine-native-orchestration-boundary.md) | Thin engine and native host orchestration | Accepted in part; engine-surface/migration scope superseded by 0022, native orchestration retained | `tests/native-orchestration-contract-test.sh`, `engine/root_routing_test.go` |
 | [0021](0021-observable-workspace-compatibility.md) | Observable and reversible workspace compatibility | Superseded by 0022 | historical |
@@ -83,3 +83,4 @@ architecture; per-feature `decisions.md` files stay scoped to that feature.
 | [0035](0035-claude-root-leaves-plan-mode.md) | The Claude root no longer runs in plan mode | Accepted; supersedes the Claude root plan-mode clauses of 0015/0017 | `tests/native-orchestration-contract-test.sh`, `engine/internal/install/install_test.go` |
 | [0036](0036-archive-recall-is-a-read-time-query.md) | Archive recall is a read-time query | Accepted; consistent with 0014/0022 (no engine index or store) | `engine/internal/lib/recall_test.go` |
 | [0037](0037-autocomplete-lands-local-checkpoints.md) | Autocomplete lands local checkpoints and self-resolves own scratch | Accepted; supersedes the ADR-0022 local-commit approval clause | `tests/authority-drift-test.sh` |
+| [0038](0038-engine-flags-unattributed-root-edits.md) | The engine flags unattributed root edits | Accepted; narrows the ADR-0018 no-replacement-enforcement clause for root-edit attribution | `engine/internal/lib/treebaseline_test.go` |

package/docs/cli.md

@@ -22,14 +22,17 @@ devrites-engine uninstall [flags]
 devrites-engine check candidate <slug>
 devrites-engine check readiness <slug>
 devrites-engine check readiness --emit-binding <slug>
+devrites-engine check preconditions <slug> [--slice SLICE-###] [--timeout N]
 devrites-engine check seal <slug>
 devrites-engine check slice <slug> <SLICE-ID>
-devrites-engine check diff-scope <slug> --allow <csv>|--allow-file <path>
+devrites-engine check diff-scope <slug> --allow <csv>|--allow-file <path> [--worktree|--staged|--base <ref>] [--snapshot|--baseline] [--verbose]
+devrites-engine check perturb <slug> --patch <file> --expect <test-name> --gate <G-ID> [--timeout N]
 devrites-engine check task-graph <slug>
 devrites-engine check regression <slug> [--update]
 devrites-engine check drift <slug> [--record]
-devrites-engine check windows <slug> [--worktree|--staged|--base <ref>]
+devrites-engine check windows <slug> [--worktree|--staged|--base <ref>|--since-dispatch <wave>]
 devrites-engine check dup [slug] [--all|--worktree|--staged|--base <ref>]
+devrites-engine check anchors <slug> <return-file> [--skills-root <dir>]
 devrites-engine check skill-trust <path>
 devrites-engine check path-disjoint [<json-file>|-]
 devrites-engine check indexes [--root <dir>]
@@ -39,12 +42,14 @@ devrites-engine observe summary <slug>
 devrites-engine orient <slug>
 devrites-engine observe slice <slug> <SLICE-ID>
 devrites-engine next [slug]
-devrites-engine handoff [slug]
+devrites-engine handoff [slug] [--resume]
 devrites-engine recall --paths <p1,p2,...> [--limit n]
-devrites-engine context [slug] (--phase <p>|--skill <name>) [--role <r>]
+devrites-engine context [slug] (--phase <p>|--skill <name>) [--role <r>] [--whole]
 devrites-engine metrics record <slug> --phase <p> --event <e>
 devrites-engine metrics summary [slug]
-devrites-engine dispatch <slug> <open|start|seal|return|status|abandon>
+devrites-engine dispatch <slug> <open|start|seal|return|status|abandon|attribute>
+devrites-engine candidate freeze <slug> --wave <w> (--slice <SLICE-ID>|--paths <path>...) [--base <ref>]
+devrites-engine packet <slug> --wave <w> --phase <p> --role <r> [--slice <SLICE-ID>] [--recheck] [--checks <G-ID,...>] [--focus <file>]
 devrites-engine parallel <subcommand>
 devrites-engine gates <subcommand> <slug>
 devrites-engine claim <add|release|list|check>
@@ -120,6 +125,9 @@ self-contained updater.
   once `eng-review.md` is required, its exact stable Build-input binding.
 - `check readiness --emit-binding <slug>` renders the exact stable Build-input
   binding for Vet to record after semantic review.
+- `check preconditions <slug>` runs the preflight rows whose `Run at` is `vet`
+  (`--slice <SLICE>` runs that slice's `pre-dispatch` rows) and records a
+  candidate-bound transcript per row; exit 3 on failure.
 - `check seal <slug>` checks final required files, open human gates, and the
   `tasks.md` slice graph. Once those files are complete, it verifies the stable
   readiness binding; only after that aggregate check passes does it verify that
@@ -150,6 +158,9 @@ self-contained updater.
   Read-only: nothing is installed or executed. Skills use it to cite real
   commands in `gates.md` `CHECK` lines and proof steps instead of invented
   ones; unresolved slots print `unresolved` rather than guessing.
+- `check anchors <slug> <return-file>` anchors each Critical/Important row's
+  quote at its cited `file:line` and its `breaks` quote; Unverified or Deferred
+  rows exit `3` and never drive a repair round.
 - `check dup [slug] [--all|--worktree|--staged|--base <ref>]` reports advisory
   near-duplicate code clusters that survive comment stripping, literal
   collapsing, and identifier renaming. Diff modes mark units overlapping
@@ -209,7 +220,9 @@ or CI.
 `gates` operates the `gates.md` ledger inside a feature workspace: one gate per
 required outcome, runnable (`CHECK`+`EXPECT`, optional `CWD`) or manual
 (`EVIDENCE` only). Subcommands: `scaffold`, `status`, `run`, `reverify`,
-`lint`, `attest <id> <note>`, `abandon <id> <why>`.
+`lint`, `precheck --worktree <path>` (the wright's pre-return run of `RUN: writer`
+gates and `check windows`; writes no ledger, EVIDENCE line or transcript, though `check windows` still logs its metric; never evidence), `attest <id> <note>`,
+`abandon <id> <why>`.
 
 A runnable gate executes only when its `(CHECK, CWD)` pair exactly matches a
 `test-plan.md` `## Build-entry preflight` row. Passing writes

package/docs/command-map.md

@@ -41,11 +41,11 @@ The Go surface is intentionally closed and deterministic:
 
 | Lane | Commands | Owner |
 |---|---|---|
-| Candidate and deterministic checks | `check candidate`, `check readiness [--emit-binding]`, `check seal`, `check slice <slug> <SLICE-ID>`, `check task-graph`, `check regression <slug> [--update]`, `check drift <slug> [--record]`, `check windows <slug>`, `check dup`, `check path-disjoint`, `parallel select`, `check skill-trust`, `check indexes`, `detect commands [--root <dir>] [--json]` | Candidate validates/hashes the strict project manifest; readiness checks phase files, the required `tasks.md` slice graph, or emits the vetted Build-input binding; seal checks final files/open gates, that graph and binding, then exact candidate bindings. `check slice` preflights one slice before wright dispatch — contract present, exact Writer allowlist paths, `Satisfies` AC ids resolvable, bounded scope — so a malformed slice fails before a writer context is spent. `check indexes` reports install manifest and optional code-index directory presence as JSON. `parallel select` returns the greedy path-disjoint subset ≤ cap from the supplied ready slices. `check regression` compares current workspace progress against the durable `regression-baseline.json` high-water mark and `--update` ratchets it at a checkpoint, so a lost slice, unchecked criterion, or reopened question fails closed instead of passing silently. `check windows` scans the feature diff for newly introduced deferral markers (TODO/FIXME/skipped test/stub idioms) and fails when any lacks a `windows.md` waiver row — silent deferrals block the seal. `check dup` reports advisory near-duplicate clusters that survive renaming (normalized token shingles, transitive clusters, distance-boosted rank, `*`-marked diff overlap, stable content hashes, `.devrites/dup-ignore` dismissal ledger) — leads for reviewer triage, never a gate. `check drift` attributes readiness-input drift to the exact artifact: `--record` snapshots per-input SHA-256 digests into `readiness-inputs.json` under the feature lock, and a later compare names each `changed`/`missing`/`added` input (falling back to the aggregate `eng-review.md` binding plus mtime candidates when no baseline exists) so a stale-binding repair starts at the right file — advisory, never a gate. `detect commands` resolves the repository's own test/lint/vet/build commands (Makefile targets, then `package.json` scripts, then language-manifest fallbacks, plus the lockfile-derived package manager) so `gates.md` `CHECK` lines and proof steps cite real wiring instead of invented commands — read-only, no installs, no execution. |
+| Candidate and deterministic checks | `check candidate`, `check readiness [--emit-binding]`, `check preconditions <slug> [--slice <SLICE-ID>]`, `check seal`, `check slice <slug> <SLICE-ID>`, `check task-graph`, `check regression <slug> [--update]`, `check drift <slug> [--record]`, `check windows <slug>`, `check dup`, `check path-disjoint`, `parallel select`, `check skill-trust`, `check indexes`, `detect commands [--root <dir>] [--json]` | Candidate validates/hashes the strict project manifest; readiness checks phase files, the required `tasks.md` slice graph, or emits the vetted Build-input binding; `check preconditions` runs the `test-plan.md` preflight rows whose `Run at` is `vet` (or `pre-dispatch <SLICE>`) with candidate-bound transcripts; seal checks final files/open gates, that graph and binding, then exact candidate bindings. `check slice` preflights one slice before wright dispatch — contract present, exact Writer allowlist paths, `Satisfies` AC ids resolvable, bounded scope — so a malformed slice fails before a writer context is spent. `check indexes` reports install manifest and optional code-index directory presence as JSON. `parallel select` returns the greedy path-disjoint subset ≤ cap from the supplied ready slices, or with `--from-plan` from tasks.md slices whose dependencies state.md checks built. `check regression` compares current workspace progress against the durable `regression-baseline.json` high-water mark and `--update` ratchets it at a checkpoint, so a lost slice, unchecked criterion, or reopened question fails closed instead of passing silently. `check windows` scans the feature diff for newly introduced deferral markers (TODO/FIXME/skipped test/stub idioms) and fails when any lacks a `windows.md` waiver row — silent deferrals block the seal. `check dup` reports advisory near-duplicate clusters that survive renaming (normalized token shingles, transitive clusters, distance-boosted rank, `*`-marked diff overlap, stable content hashes, `.devrites/dup-ignore` dismissal ledger) — leads for reviewer triage, never a gate. `check drift` attributes readiness-input drift to the exact artifact: `--record` snapshots per-input SHA-256 digests into `readiness-inputs.json` under the feature lock, and a later compare names each `changed`/`missing`/`added` input (falling back to the aggregate `eng-review.md` binding plus mtime candidates when no baseline exists) so a stale-binding repair starts at the right file — advisory, never a gate. `detect commands` resolves the repository's own test/lint/vet/build commands (Makefile targets, then `package.json` scripts, then language-manifest fallbacks, plus the lockfile-derived package manager) so `gates.md` `CHECK` lines and proof steps cite real wiring instead of invented commands — read-only, no installs, no execution. |
 | Workspace observation | `observe summary`, `orient`, `observe slice <slug> <SLICE-ID>`, `next`, `handoff` | JSON workspace snapshot for agents (cursor, task graph, `artifact_budgets`, `bulk_files`); `orient` is an alias for `observe summary`. `observe slice` prints one `SLICE-###` section of `tasks.md` so Build reads a slice, not the file. `next` prints the minimal remaining lifecycle path plus advisory skips (e.g. clarify at zero open questions). `handoff` emits the deterministic resume record (cursor, `awaiting_human`, blocking question gates, ledger reduction with unmet/stale ids, dead ends, read-next order) — the `/rite-handoff` spine and compaction-fallback entry. |
-| Context packets, dispatch waves, metrics, claims, notes | `context [slug] (--phase <p> \| --skill <name>) [--role <r>] [--trigger a,b]`, `dispatch <slug> <open\|start\|seal\|return\|status\|abandon>`, `metrics record`, `metrics summary`, `claim <add\|release\|list\|check>`, `note <add\|list\|check\|rm>` | `context` emits one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest — a dispatch target reads it instead of selecting files; `--skill` works without a workspace when `--out` is given. `dispatch` owns the launch-wave barrier (seal needs a handle per role; return needs seal) and auto-records dispatch/return metrics. `metrics` owns the append-only `metrics.jsonl` ledger. `claim` owns the append-only `.devrites/claims.jsonl` ledger — advisory, session-scoped file claims with TTL so concurrent same-tree sessions see each other's write intent before edits collide (conflict exits 3; never a substitute for one-writer-per-worktree). `note` owns the anchored `notes.md` ledger — notes bound to verbatim code quotes, regraded `exact`/`moved`/`stale`/`ambiguous`/`lost` as the code drifts; `check seal` refuses non-`exact` anchors. `check diff-scope` is the mechanical changed-paths ⊆ allowlist gate run before reviewer dispatch. |
-| Atomic workspace state | `state resolve`, `state merge-manifest`, `state apply-bundle <slug> <bundle.json>... [--dry-run]`, `state close`, `migrate [--dry-run] [--answer id=choice]` | Go owns answer/drop/batch resolution, the recorded predecessor-chain manifest union for a release milestone, the all-or-nothing apply of plan-drafter hunk bundles (base-hash pins, unique non-overlapping anchors, no lost IDs, no new task-graph or budget defect, no appended dated delta section), transactional close, and fail-closed v5 schema normalization. |
-| Acceptance ledger | `gates scaffold`, `gates status`, `gates run [--timeout N]`, `gates reverify [--timeout N]`, `gates lint [--strict]`, `gates attest <id> <note>`, `gates abandon <id> <why>` | Go owns the `gates.md` ledger: per-outcome gates whose runnable `CHECK`/`CWD` must exactly match a `test-plan.md` Build-entry preflight row, evidence bound to the gate definition digest (stale = unmet), `ABANDON:` handoffs, and oracle lint. Readiness/seal require a parse-clean, all-met ledger whenever `gates.md` is a required artifact. |
+| Context packets, dispatch waves, metrics, claims, notes | `context [slug] (--phase <p> \| --skill <name>) [--role <r>] [--trigger a,b]`, `dispatch <slug> <open\|start\|seal\|return\|status\|abandon>`, `candidate freeze`, `packet`, `metrics record`, `metrics summary`, `claim <add\|release\|list\|check>`, `note <add\|list\|check\|rm>` | `context` emits one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest — a dispatch target reads it instead of selecting files; `--skill` works without a workspace when `--out` is given. `dispatch` owns the launch-wave barrier (seal needs a handle per role; return needs seal; the last start seals; open --claim-session/--claim takes the wave's file claim, released by the completing return or abandon --release) and auto-records dispatch/return metrics. `candidate freeze` writes a wave's frozen `packets/<w>.diff` + `.sha256`; `packet` renders and lints one role's by-reference packet. `metrics` owns the append-only `metrics.jsonl` ledger. `claim` owns the append-only `.devrites/claims.jsonl` ledger — advisory, session-scoped file claims with TTL so concurrent same-tree sessions see each other's write intent before edits collide (conflict exits 3; never a substitute for one-writer-per-worktree). `note` owns the anchored `notes.md` ledger — notes bound to verbatim code quotes, regraded `exact`/`moved`/`stale`/`ambiguous`/`lost` as the code drifts; `check seal` refuses non-`exact` anchors. `check diff-scope` is the mechanical changed-paths ⊆ allowlist gate run before reviewer dispatch. |
+| Atomic workspace state | `state resolve`, `state merge-manifest`, `state apply-bundle <slug> <bundle.json>... [--dry-run]`, `state set <slug> key=value... [--unset key]`, `state append <slug> <ledger.md> --heading <text> --body-file <path\|->`, `state close`, `migrate [--dry-run] [--answer id=choice]` | Go owns answer/drop/batch resolution, the recorded predecessor-chain manifest union for a release milestone, the all-or-nothing apply of plan-drafter hunk bundles (base-hash pins, unique non-overlapping anchors, no lost IDs, no new task-graph or budget defect, no appended dated delta section), cursor writes (known phase, engine-owned schema, no return-cursor overwrite; an AFK pause names auto-pickable questions), append-only ledger sections that refuse a duplicate heading, transactional close, and fail-closed v5 schema normalization. |
+| Acceptance ledger | `gates scaffold`, `gates status`, `gates run [--timeout N]`, `gates reverify [--timeout N]`, `gates lint [--strict]`, `gates precheck <slug> --worktree <path>`, `gates attest <id> <note>`, `gates abandon <id> <why>` | Go owns the `gates.md` ledger: per-outcome gates whose runnable `CHECK`/`CWD` must exactly match a `test-plan.md` Build-entry preflight row, evidence bound to the gate definition digest (stale = unmet), `ABANDON:` handoffs, oracle lint, and the wright's never-evidence `precheck` of `RUN: writer` gates. Readiness/seal require a parse-clean, all-met ledger whenever `gates.md` is a required artifact. |
 | Security | `secret-scan` | `/rite-ship`, safe hooks, or an operator scans staged blobs, stdin, or touched files. |
 | Install/operator | `install`, `update`, `uninstall`, `version` | Direct update acquires latest; npm/bootstrap may supply local candidates; the engine performs manifest-owned local changes. |
 | Native policy | no engine command | Skills/root own spec grammar re-read, qid allocation, Clarify cursor edits, AFK/recovery accounting, and read-only `/rite-doctor`. |
@@ -111,7 +111,7 @@ See [`cli.md`](cli.md).
 | [`/rite-adopt`](../pack/.claude/skills/rite-adopt/SKILL.md) | onboard | `[path or area to adopt] [+ what you want to build next]` | Reverse-derive the existing baseline and next objective; propose any durable project guidance in the nearest native instruction file. | codebase + project instructions | workspace spec/state artifacts + optional guidance proposal |
 | [`/rite-status`](../pack/.claude/skills/rite-status/SKILL.md) | status | `[slug]` | Active feature: phase, run mode, status, persisted next action, evidence, questions, drift, risks, and handoff readiness. | direct workspace ledger/artifacts | none |
 | [`/rite-resolve`](../pack/.claude/skills/rite-resolve/SKILL.md) | resume | `<qid> "<answer>" \| --drop <qid> ["<reason>"] \| --batch <plain-text-file>` | Answer / drop / batch-resolve open `questions.md` entries; clears `state.md` `Awaiting human` and sets `Status: running`. Canonical writer for `status: open → answered`. | `questions.md` + `state.md` | `questions.md`, `state.md` |
-| [`/rite-zoom-out`](../pack/.claude/skills/rite-zoom-out/SKILL.md) | utility | `[symbol \| file \| area to map]` | One-pass structural map of an unfamiliar area (modules, in-callers, out-calls, decisions) in project vocabulary. Prefers codegraph/graphify. | codebase + ADRs/CONTEXT.md | none |
+| [`/rite-zoom-out`](../pack/.claude/skills/rite-zoom-out/SKILL.md) | utility | `[symbol \| file \| area to map]` | One-pass structural map of an unfamiliar area (modules, in-callers, out-calls, decisions) in project vocabulary. Prefers codebase-memory-mcp. | codebase + ADRs/CONTEXT.md | none |
 | [`/rite-prototype`](../pack/.claude/skills/rite-prototype/SKILL.md) | utility | `[question]` | Throwaway code answering ONE design question. Logic harness OR 2 to 4 UI variations on one route. Captures verdict to `decisions.md`. | spec / surrounding code | prototype scratch + `decisions.md` |
 | [`/rite-handoff`](../pack/.claude/skills/rite-handoff/SKILL.md) | utility | `[next-session-focus]` | Compacts the chat into a handoff doc. Syncs chat-only context into workspace canonical files. References existing artifacts by path. | chat + workspace | `handoff.md` + sync into canonical files |
 | [`/rite-learn`](../pack/.claude/skills/rite-learn/SKILL.md) | utility | `["<lesson>"]` | Review native memory plus verified archive/ADR evidence; propose one durable instruction or ADR update for human approval. | native memory + reviewed Markdown | approved existing instruction/ADR only |
@@ -210,22 +210,24 @@ index is in
 | Performance requirement or suspected regression | `devrites-audit perf` (+ `devrites-performance-reviewer`) |
 | Failing tests / build / runtime / browser checks | `devrites-debug-recovery` |
 | Slice crosses a boundary or defines a public interface | `devrites-api-interface` |
-| Explicit `/rite-zoom-out` / `$rite-zoom-out` | read-only structural map (uses codegraph/graphify) |
+| Explicit `/rite-zoom-out` / `$rite-zoom-out` | read-only structural map (uses codebase-memory-mcp) |
 | Every defined plan before build; "engineering review", "review the architecture", "lock in the plan", "test coverage check" | `/rite-vet` (+ `devrites-plan-reviewer`; depth scales to stakes, never skipped; always in `/rite-autocomplete`) |
 
-## Code-graph integration
-
-These skills prefer a code-intelligence index (`codegraph_*` or
-`graphify-out/`) when available and fall back to file reads:
-
-- `/rite-spec`, `/rite-clarify`, `/rite-define`, `/rite-plan`: placement / impact / callers during investigation and decision coverage
-- `/rite-vet`: reuse-vs-rebuild, blast-radius, and placement-realism checks during the scope challenge + architecture axis
-- `/rite-build`: `touched-files.md` + impact when loading slice context
-- `/rite-review`: blast-radius checks on the diff
-- `/rite-seal`: final blast-radius check
-- `devrites-doubt`: "where does this claim reach" via `codegraph_impact` / `codegraph_callers`
-- `/rite-zoom-out`: `codegraph_context` + `codegraph_explore`
-- `devrites-frontend-craft`: component / token lookups
+## Code-index integration
+
+The one supported code index is
+[codebase-memory-mcp](https://github.com/DeusData/codebase-memory-mcp). The
+routes, preflight, coverage rule, and host access live in
+[`code-index.md`](../pack/.claude/skills/devrites-lib/reference/standards/code-index.md);
+without the index, skills fall back to LSP and file reads:
+
+- `/rite-spec`, `/rite-clarify`, `/rite-define`, `/rite-plan`: `get_architecture`, `search_graph` (reuse), `trace_path` (callers, impact)
+- `/rite-vet`, `/rite-temper`: reuse-vs-rebuild, blast-radius, and placement-realism checks
+- `/rite-build`: affected set via `trace_path` before edits; `detect_changes` against the slice path list after
+- `/rite-review`, `/rite-seal`: `detect_changes` blast radius on the diff
+- `devrites-doubt`: "where does this claim reach" via `trace_path`
+- `/rite-zoom-out`: `get_architecture` + `trace_path`
+- `devrites-frontend-craft`: component lookups via `search_graph`
 
 ## Interactions (typical flow)
 

package/docs/engine/commands.md

@@ -11,37 +11,44 @@ workflow strategy.
 | `install [flags]` | Install manifest-owned host artifacts and the optional shared binary. |
 | `update [flags]` | Refresh an existing managed installation. |
 | `uninstall [flags]` | Remove managed artifacts while preserving runtime workspace state. |
-| `check candidate <slug>` | Validate the strict manifest and compute the content-bound project-candidate identity. Exits `3` when the manifest omits a path the feature's `WIP(<slug>):` checkpoint commits changed (net from the feature base to HEAD). |
-| `check readiness <slug>` | Check target-Phase files, open human gates from Clarify onward, the `tasks.md` slice graph when that artifact is required, canonical `AC-###` presence in `tasks.md`/`test-plan.md` when those artifacts are required, and the current stable Build-input binding when applicable. |
+| `check candidate <slug>` | Validate the strict manifest and compute the content-bound project-candidate identity. Exits `3` when the manifest omits a path the feature's `WIP(<slug>):` checkpoint commits changed (net from the feature base to HEAD). Also exits `3` with `unattributed root edit: <paths>` while the feature's `tree-baseline.json` tripwire flags a product path (ADR-0038; see `dispatch`). |
+| `check readiness <slug>` | Check target-Phase files, open human gates from Clarify onward, the `tasks.md` slice graph when that artifact is required, canonical `AC-###` presence in `tasks.md`/`test-plan.md` when those artifacts are required, and the current stable Build-input binding when applicable. Leaving Vet with a `Run at` column, a slice whose `Files likely touched`/`Writer allowlist` names a dependency manifest or lockfile needs a `dependency-dry-run SLICE-###` row at `vet` with a passing transcript. |
 | `check readiness --emit-binding <slug>` | Render the exact stable Build-input binding for Vet to record after review. |
-| `check seal <slug>` | Check files required by target Phase `seal`, open human gates, the `tasks.md` slice graph, canonical `AC-###` presence when `tasks.md`/`test-plan.md` are required, the stable Build-input binding, and exact candidate bindings. |
+| `check preconditions <slug> [--slice SLICE-###] [--timeout N]` | Run the `test-plan.md` Build-entry preflight rows whose optional `Run at` cell is `vet` (with `--slice`, `pre-dispatch <SLICE>`); `action` rows and rows without the cell never run. Writes one candidate-bound transcript per row under `references/gates/preflight-*/`; a row passes on exit 0. Exit `3` on any failure or an invalid `Run at` value. |
+| `check seal <slug>` | Check files required by target Phase `seal`, open human gates, the `tasks.md` slice graph, canonical `AC-###` presence when `tasks.md`/`test-plan.md` are required, the stable Build-input binding, and exact candidate bindings. `check readiness` and `check seal` also block a `scripts/` test driver that a tasks.md Writer allowlist plans or touched-files.md lists when no gates.md `CHECK` runs it and no `Driver waiver: <path> — DEC-### <reason>` line cites a recorded decision; waived drivers print as `note: unexecuted driver (waived by DEC-###): <path>` lines, on pass or block. |
 | `check path-disjoint [--root <dir>] [<json-file> | -]` | Verify slice path sets are pairwise disjoint. |
-| `parallel select --cap <1-10> [--root <dir>] [--slug <slug>] [<json-file> | -]` | Choose the greedy path-disjoint subset ≤ cap from supplied ready slices. With `--slug` and a running lease, the lease's not-yet-landed slices hold cap slots and paths, and only new picks print. |
+| `parallel select --cap <1-10> [--root <dir>] [--slug <slug>] [--from-plan \| <json-file> \| -]` | Choose the greedy path-disjoint subset ≤ cap from supplied ready slices, or with `--from-plan` (needs `--slug`) from the plan: tasks.md slices whose dependencies state.md checks `built`, with Writer allowlist (else Files likely touched) paths plus the nearest manifest/lockfile when `External dependencies:` is not none. With `--slug` and a running lease, the lease's not-yet-landed slices hold cap slots and paths, slices it names are never picked, and only new picks print. |
 | `parallel <create\|add\|integrate\|cleanup\|status\|abort\|lease-read\|lease-write\|lease-clear\|record-green>` | Deterministic parallel worktree leases, integration, and cleanup for parallel writer batches. A lease is a pipeline: `integrate --slice <id> --apply-to-control` lands one green sibling onto control (refusing if anything but this lease moved control), and `add` starts new path-disjoint siblings from the current control tip while others still run. |
 | `check task-graph <slug>` | Validate `tasks.md` slice dependency graph for cycles, unknown deps, malformed tokens, duplicate IDs, missing `Dependencies`, and `depends_on` mismatch. Prints a non-blocking `ADVISORY size:` line (and records a `size-advisory` metric) for each slice with 12+ Writer allowlist files and no `Size rationale:`. A `Dependencies` ID may carry a `(via <interface>)` suffix (empty or unclosed is a malformed token); prints a non-blocking `ADVISORY edge:` line (and records an `edge-advisory` metric) for each edge with no via, or whose via text is not a case-insensitive substring of the dependency's `Consumes / Produces:`. Prints `schedule: <n> slices in <r> build rounds at cap 10` (the `/rite-build` batch selection replayed over each slice's Writer allowlist, else Files likely touched; omitted when a slice has no path) and a non-blocking `ADVISORY hub:` line (top five; records a `hub-advisory` metric) for each path, compared case-folded, that three or more slices without `Serial rationale:` write. Advisories print only when the graph is valid. |
 | `check regression <slug> [--update]` | Compare the workspace's structural progress facts (phase ordinal, checked ACs, met/abandoned gates, done slices, resolved questions, present artifacts) against the recorded `regression-baseline.json` high-water mark; `--update` ratchets the baseline forward under the feature lock and prints each blessed regression. |
 | `check drift <slug> [--record]` | Attribute readiness-input changes to the exact artifact. `--record` writes the per-input `readiness-inputs.json` digest baseline under the feature lock; without it the workspace diffs current inputs against that baseline (or falls back to the aggregate binding recorded in `eng-review.md`). Advisory: exit `0` on drift; a corrupt baseline exits `3`. A `test-plan.md` change limited to exact `Workflow Artifact reviewed identity: <64hex>` lines is reported as `reviewed-identity-only` (ADR-0034). `--record` also stores each slice's proof bytes (its `tasks.md` block plus the `test-plan.md` lines naming it); both modes print `ADVISORY proportion:` for a slice whose proof grew over 2x since that baseline or carries over 3x the median proof per AC. |
-| `check windows <slug> [--worktree\|--staged\|--base <ref>]` | Fail on deferral and bar-lowering markers the change introduces without a waiver row in the workspace's `windows.md`: added TODO/FIXME/XXX/HACK, skipped/focused-test and stub idioms, checker suppressions, one-line empty catch; removed `deleted-test` files and net `removed-assertion` lines in remaining test files. |
+| `check windows <slug> [--worktree\|--staged\|--base <ref>\|--since-dispatch <wave>]` | Fail on deferral and bar-lowering markers the change introduces without a waiver row in the workspace's `windows.md`: added TODO/FIXME/XXX/HACK, skipped/focused-test and stub idioms, checker suppressions, one-line empty catch; removed `deleted-test` files and net `removed-assertion` lines in remaining test files. `--since-dispatch <wave>` reports only `deleted-test`/`removed-assertion` against the work-tree snapshot (`tree` in `dispatch.json`) recorded when that build wright wave opened, untracked files included; it takes no `--cwd` and records the `windows-since` metric. |
 | `check dup [slug] [--all\|--worktree\|--staged\|--base <ref>] [--min-lines n] [--threshold f] [--ignore-file <path>] [--limit n] [--exclude <csv>]` | Report near-duplicate code clusters that survive comment stripping, literal collapsing, and identifier renaming — token-shingle matches chained into segments, clustered transitively, ranked with bounded path/line-distance boosts. Diff modes mark units overlapping changed hunks with `*`; stable content-derived cluster hashes let `.devrites/dup-ignore` dismissals survive line moves but resurface on structural edits. Staged mode reads index blobs and excludes untracked files. Bounded heuristic: successful scans/leads exit `0`; usage, unavailable input, and partial scans exit `2`. |
+| `check anchors <slug> <return-file> [--skills-root <dir>]` | Deterministic quote anchoring for one reviewer return (agents.md § Result admission). For each Critical/Important `Finding:` row (list markers and bold tolerated), it anchors the backticked observed quote at the cited `path:line[-line]`, looking in the workspace first, then the project, never outside either. Exact match → `anchored`. Exactly one other line → `relocated <cited> -> path:N`. Otherwise → `Unverified: <row> — anchor lost\|ambiguous`; this also covers a missing file:line or quote, or a quote under 8 characters. The `breaks "<quote>"` must appear in spec.md/decisions.md (spec ID) or in the named shipped standard under the skills root (`--skills-root` for host installs). No breaks quote → `Deferred: <row> — no spec anchor`. Prints the candidate digest and records an `anchors` metrics event. Exit `0` all anchored, `3` any Unverified/Deferred row (never drives a repair round), `2` usage or unreadable input. |
 | `check slice <slug> <SLICE-ID>` | Pre-dispatch lint of one slice's wright contract: contract present, exact Writer allowlist paths, resolvable `Satisfies` AC ids, bounded scope. Same non-blocking size advisory as `check task-graph`, plus the `check drift` proportion advisory for that slice. |
-| `check diff-scope <slug> --allow <csv>\|--allow-file <path> [--worktree\|--staged\|--base <ref>]` | Verify the changed-path set stays inside the declared allowlist; the mechanical gate run before reviewer dispatch. |
+| `check diff-scope <slug> --allow <csv>\|--allow-file <path> [--worktree\|--staged\|--base <ref>] [--baseline] [--verbose]`, `check diff-scope <slug> --snapshot` | Verify the changed-path set stays inside the declared allowlist; the mechanical gate run before reviewer dispatch. `--snapshot` records the mode and SHA-256 of every currently changed path in `<feature>/diff-scope-baseline.json` (an engine machine file, never reported); run it before writer dispatch. `--baseline` drops a changed path whose fingerprint still matches, printing `preexisting (unchanged)`; a baselined path whose bytes or mode changed, or a new path, still blocks; a run with only preexisting changes is an empty diff; a missing baseline exits `2`. More than 20 violations print grouped by the first two path segments (count plus 3 examples, at most 20 groups); `--verbose` lists every path. Exit codes are unchanged. |
+| `check perturb <slug> --patch <file> --expect <test-name> --gate <G-ID> [--timeout N]` | Safe-perturbation probe (testing.md § Safe perturbation). Copies the candidate (HEAD plus every touched-files.md manifest row, at the project's prefix below the git toplevel) into a detached temporary worktree, requires it to hash to the `check candidate` digest, applies the wright-supplied mutant patch (toplevel-relative paths), and runs the gate's CHECK only when it is an approved test-plan.md preflight row. RED counts only when a runner FAIL line (go test, pytest, cargo test, jest/vitest) names `--expect`; build/setup failure, timeout, exit 0 (survivor), or a RED naming only other tests is `cannot_verify`. Reverts the patch, requires the copy back at the candidate digest and the gate GREEN (exit 0 plus EXPECT), and requires the checkout candidate unchanged. Writes `<feature>/evidence/perturb/<gate>-<digest12>-aN.log`. Never mutates the checkout. Exit `0` verified, `3` cannot_verify or refused, `2` usage. |
 | `check skill-trust <path>` | Scan one skill/agent Markdown file for structural trust violations. |
-| `check indexes [--root <dir>]` | Report install manifest and code-index presence as JSON. |
-| `observe summary <slug>` | Emit sanitized JSON workspace summary from one retained observation. `task_graph.ok` is true iff `task_graph.problems` is empty; `problems` lists cycle, unknown-dep, malformed-token, duplicate-id, and missing-`Dependencies` blockers. `inflight_waves` lists dispatch waves still `open` or `sealed`, with their pending roles. |
+| `check indexes [--root <dir>]` | Report install manifest and in-repo code-index artifact presence (`.codebase-memory/`) as JSON. codebase-memory-mcp normally indexes into its central store, so its `index_status` is authoritative. |
+| `observe summary <slug>` | Emit a sanitized workspace summary, as one compact JSON line, from one retained observation. `task_graph.ok` is true iff `task_graph.problems` is empty; `problems` lists cycle, unknown-dep, malformed-token, duplicate-id, and missing-`Dependencies` blockers. `inflight_waves` lists dispatch waves still `open` or `sealed`, with their pending roles. |
 | `orient <slug>` | Alias for `observe summary`. |
 | `observe slice <slug> <SLICE-ID>` | Print one `SLICE-###` section of `tasks.md` so Build reads a slice, not the file. |
-| `next [slug]` | Print the minimal remaining lifecycle path plus advisory skips. |
-| `handoff [slug]` | Emit the deterministic resume record: cursor fields, `awaiting_human`, open `questions.md` gate kinds, the `gates.md` reduction with unmet/stale/abandoned ids, `decisions.md` dead ends, missing required files, and the canonical read-next order. Read-only; the `/rite-handoff` spine and the compaction-fallback entry point. |
+| `next [slug]` | Print the minimal remaining lifecycle path plus advisory skips; in Build also `eligible_now:`, `batch:` and the `select-command:` (`parallel select --root <project> --slug <slug> --cap N --from-plan`, N = AFK max_parallel else 10) that reproduces the batch. Prints `blocked: unattributed root edit: ...` after `open-questions:` and exits `3` while the ADR-0038 tripwire flags a product path; the rest of the output still prints. |
+| `handoff [slug] [--resume]` | Emit the deterministic resume record: cursor fields, `awaiting_human`, open `questions.md` gate kinds, the `gates.md` reduction with unmet/stale/abandoned ids, `decisions.md` dead ends, in-flight dispatch waves (`inflight_wave:` lines: phase, state, pending roles, slices), missing required files, and the canonical read-next order. Read-only unless `--resume`, which appends one `resume` event (role root) to `metrics.jsonl`; `metrics summary` then reports minutes from each resume to the next dispatch. The `/rite-handoff` spine and the compaction-fallback entry point. |
 | `recall --paths <p1,p2,...> [--limit n]` | Read-time query over `.devrites/archive/`: list archived features whose `touched-files.md` candidate manifest covers a queried project-relative path (exact or directory prefix, case-folded), ranked by overlap count, then newest archive-directory mtime, then slug (default 10 features). Each feature prints up to 8 `archive/<slug>/<file>:<line>` pointers, then `+N more`: `decisions.md` `DEC-###` entries and `## Carry-forward constraints` bullets whose `Files:` overlap (or a constraint naming no files), plus `review.md`/`seal.md`/`drift.md` lines that mention a queried path; fenced examples are ignored. Never writes, caches, or indexes (no metric either); symlinked archive entries are refused. An unreadable archive file prints `unreadable:` and the scan continues. Exit `0` (including `recall: no archive`), `1` invalid archive directory, `2` usage. |
-| `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--slice <SLICE-ID>] [--trigger a,b]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. A bundle without `--role` (the root's own read) gives over-budget artifacts as by-reference indexes; a `--role` bundle leads with the role's agent contract and names the manifest's `rootOnly` paths instead of inlining them. `--slice` inlines that slice's `tasks.md` block and turns each over-budget artifact, and each artifact over 16 KiB except `spec.md`, into a by-reference index (path, SHA-256, headings, line hits for every ID the block cites); repeat `--slice` for several slices; an unknown slice exits `3`. |
-| `dispatch <slug> <open\|start\|seal\|return\|status\|abandon>` | Launch-wave barrier for parallel dispatch: seal needs a handle per role, return needs seal; start/return auto-record metrics. A build wave with a wright role needs `--slice <SLICE-ID>` per slice, and a slice-bound vet wave takes it too; a reviewer, auditor, or test-analyst wave needs `--packet <file>` and `open` exits `3` on a packet that seeds a conclusion (gate `*-PASS` token, `no-findings`, an `Outcome:`/`Counts:` line, an "already passed" claim, or zero Critical/Important counts); a Review or Seal reviewer wave also exits `3` unless the packet names an existing non-empty `.diff`/`.patch` file and the manifest covers every checkpointed path; every 5 rounds of either kind on one slice, `open` exits `3` until `--reslice-review <DRIFT-ID>` names an unused `drift.md` `## <DRIFT-ID>` heading for that slice. `open` also warns when an earlier wave for the same slice never returned. |
+| `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--slice <SLICE-ID>] [--recheck <inventory>] [--trigger a,b] [--inline-contract] [--whole]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. A root `--phase build\|autocomplete` bundle (no `--role`, no `--slice`) defaults to `--slice <active_slice>` while the state.md cursor phase is `build` and active_slice names a slice present in tasks.md (prints `scope: slice SLICE-### (auto from state.md) ...`); `--whole` opts out. Every bundle opens, after its header comments, with a table of contents: one `L<start>-<end> <section label>` line per `===== label =====` section, giving its exact line range in the bundle file. A bundle without `--role` (the root's own read) gives over-budget artifacts as by-reference indexes; a `--role` bundle leads with the role's agent contract and names the manifest's `rootOnly` paths instead of inlining them. When the contract resolves under `.claude/agents`, `.omp/agents`, or `.codex/agents` (the host loads it as the agent's system prompt), the bundle writes one header line naming its path, size, and SHA-256 instead of the body; other layouts (pi, devin, unknown) and `--inline-contract` (only with `--role`) inline the body, and a missing contract still exits `3`. Inside inlined files, a `--role` bundle replaces each `<!-- root-only -->`…`<!-- /root-only -->` block with a one-line stub naming the omitted heading, and does the same for each `<!-- model-surface -->` block unless the role is `security-auditor`, the feature has an `ai-spec.md`, or `spec.md`/`plan.md`/`tasks.md`/`design-brief.md` are absent or (outside the spec template's `AI-SPEC annex`) name a model, agent, RAG, or tool surface; an unbalanced or headingless marker exits `2`. `--slice` inlines that slice's `tasks.md` block and turns each over-budget artifact, and each artifact over 16 KiB except `spec.md`, into a by-reference index (path, SHA-256, headings, line hits for every ID the block cites); repeat `--slice` for several slices; an unknown slice exits `3`. In phase `build`, a `--role` bundle other than `slice-wright` without `--slice` exits `3` (`unscoped build reviewer bundle`). `--recheck <inventory>` (phase `build`, with `--role` and `--slice`; path relative to the workspace) writes `<phase>-<role>.<slice>.recheck.bundle.md`: the inventory file and `core.md` inline whole, every other non-`rootOnly` pack file becomes a by-reference index (path, SHA-256, headings with line numbers) followed by each section the inventory cites as `<file>.md § <heading>`; workspace handling matches `--slice`. A missing or empty inventory exits `2`. First reviews, full-inventory rechecks, Vet, `/rite-review`, and Seal do not use it. |
+| `dispatch <slug> <open\|start\|seal\|return\|status\|abandon\|attribute>` | Launch-wave barrier for parallel dispatch: seal needs a handle per role, return needs seal; the start that gives the last role its handle seals the wave, and an explicit seal on a sealed wave is a no-op; `open --claim-session <id> --claim <path>... [--claim-ttl <minutes>]` records one file claim for the wave in claims.jsonl and exits `3`, creating no wave and no claim, while a live foreign session holds an overlapping path; the return that completes the wave releases that claim; `abandon --release` releases it on any other host-confirmed terminal path (a stop or a refused launch); re-opening an abandoned wave inherits its kept claim or, with new claim flags, replaces and releases it; claim flags apply to open only and `--release` to abandon only; start/return auto-record metrics, `return --outcome findings|no-findings|gap` records the role's Outcome line, and `abandon` records its reason, so `metrics summary` shows per-role yield and lost waves. Bare `status` prints every open, sealed, or abandoned wave and folds complete waves into one `N complete wave(s) (use --all)` line; `--all` lists every wave; it still exits nonzero while any wave is open or sealed. For a reviewer, auditor, or test-analyst role, `return --result <file>` stores the return verbatim as `packets/<wave>-<role>.return.md` (exit `3` if that file exists), derives the outcome from its `Outcome:`/`Counts:` head (a malformed or inconsistent head records `gap` with a warning, never `no-findings`), exits `3` when an explicit `--outcome` disagrees, and records each `Finding:` row's `role|slice|file|section|severity` key, so `metrics summary` adds per-role `resolution: resolved re-raised open late` counts. A `--result` file that already is that `packets/` path is kept as the stored return. A build wave with a wright role needs `--slice <SLICE-ID>` per slice, and a slice-bound vet wave takes it too; a reviewer-only wave (for example a Build slice review) may take it, uncapped, so its `Finding:` keys name that slice; a reviewer, auditor, or test-analyst wave needs `--packet <file>` and `open` exits `3` on a packet that seeds a conclusion (gate `*-PASS` token, `no-findings`, an `Outcome:`/`Counts:` line, an "already passed" claim, or zero Critical/Important counts) or tells the agent to read an installed `agents/devrites-*.md`/`.toml` role contract (on the line or under a "Read …" heading or label; canonical `pack/` paths excepted), and a wright wave's `--contract` gets the same role-contract check; a Review or Seal reviewer wave also exits `3` unless the packet names an existing non-empty `.diff`/`.patch` file and the manifest covers every checkpointed path; every 5 rounds of either kind on one slice, `open` exits `3` until `--reslice-review <DRIFT-ID>` names an unused `drift.md` `## <DRIFT-ID>` heading for that slice. `open` also warns when an earlier wave for the same slice never returned. Under `.devrites/AFK` max_parallel >= 2, a first-round build wright wave narrower than the `parallel select --from-plan` batch exits `3` (printing the batch, the command and the parallel-batch lifecycle) until evidence.md records `serial: <skipped ids> — <reason>`; repair rounds, lease siblings and HITL runs are never refused. A build wright `--contract` must name `gates precheck` under `Writer-safe checks:` when gates.md has a `RUN: writer` gate. `open` exits `3` when a `--role` names no pack agent in a project-level install (a `.<lane>` suffix is allowed), and lints a reviewer packet against the wave's roles, so a recheck may name its own role's fingerprint. Root-edit tripwire (ADR-0038): the first `open` records `<feature>/tree-baseline.json`, which maps dirty product paths outside `.devrites/` and `.scratch/` to their mode plus SHA-256, accepted as user work. The return that completes a wright wave (any phase) adds its slice write sets and claim paths. `open` exits `3` with `unattributed root edit: <paths>` while a dirty product path differs from that baseline and no live claim or in-flight wright wave covers it, unless the new wright wave covers the path through `--claim` or a slice write set. `attribute --reason <evidence> --path <path>...` records owner work, gate output, a standalone wright, or a sanctioned root write for flagged paths only. Each finding writes an `unattributed-edit` metrics row. The engine never reverts a file, and a workspace without the baseline is never blocked. |
+| `candidate freeze <slug> --wave <w> (--slice <SLICE-ID> \| --paths <path>...) [--base <ref>]` | Writes packets/<w>.diff (tracked changes vs base, default HEAD, plus untracked files as /dev/null diffs) and packets/<w>.sha256 (base, diff digest, per-file sha256, aggregate check-candidate digest); never replaces a wave's frozen candidate with a different one. |
+| `packet <slug> --wave <w> --phase <p> --role <r> [--slice <SLICE-ID>] [--recheck] [--checks <G-ID,...>] [--focus <file>]` | Renders one reviewer/auditor/test-analyst or same-worktree slice-wright by-reference packet (packets/<w>.<role>.md, or packets/<w>.contract.md for a wright) naming the context bundle (the .recheck bundle with `--recheck`) and frozen diff. It copies packets/<w>.sha256 (header rows only when large), resolves `--checks` through gates.md and approved preflight rows (adding `gates precheck` for `RUN: writer` gates), and accepts only anchored `--focus` rows (a doubt-reviewer's 1-3 row claim is required). It runs the dispatch open lints on a draft and never replaces a prior packet with a refused one (exit `3`). |
 | `metrics record <slug> --phase <p> --event <e> [--role r] [--bytes n] [--note s]` | Append an event to the workspace's `metrics.jsonl` ledger. |
-| `metrics summary [slug] [--by-slice]` | Reduce `metrics.jsonl` into a per-phase roll-up. `--by-slice` reads `dispatch.json` instead: per slice, build wright rounds, slice-bound Vet rechecks, and agent-minutes (role start to `returned_at`; abandoned waves excluded). |
-| `claim <add\|release\|list\|check>` | Advisory session-scoped file claims in `.devrites/claims.jsonl` (append-only). `add` records intent to write a path set with a TTL (1–240 min, default 30); a live claim by another session exits `3` and names the holder. `release` appends a release event owned by the claiming session. `list` shows live claims (`--all` includes expired/released); a claim whose holding session has provably exited on this host shows `dead` and no longer conflicts. `check` is the read-only preflight for a path set. Coordination aid only — never a substitute for one-writer-per-worktree. |
+| `metrics summary [slug] [--by-slice]` | Reduce `metrics.jsonl` into a per-phase roll-up. `--by-slice` reads `dispatch.json` instead: per slice, build wright rounds, slice-bound Vet rechecks, and agent-minutes (role start to `returned_at`; abandoned waves excluded). When the ledger has `resume` events it adds `resumes count=N minutes_to_dispatch=...` (each resume timed to the next `dispatch` event; `none` when another resume came first, `open` when none followed). |
+| `claim <add\|release\|list\|check>` | Advisory session-scoped file claims in `.devrites/claims.jsonl` (append-only). `add` records intent to write a path set with a TTL (1–240 min, default 30); a live claim by another session exits `3` and names the holder. `release` appends a release event owned by the claiming session. `list` shows every unreleased claim (live, expired, dead) plus one `N released (use --all)` count; `--all` includes released rows; a claim whose holding session has provably exited on this host shows `dead` and no longer conflicts. `check` is the read-only preflight for a path set. Coordination aid only — never a substitute for one-writer-per-worktree. |
 | `note <add\|list\|check\|rm> <slug> ...` | Anchored workspace notes in `notes.md`: `add <slug> <subject> <quote> <title> [body]` binds a note to a verbatim quote in one repository file and assigns `NOTE-###`; `list` and `check` regrade each anchor `exact`/`moved`/`stale`/`ambiguous`/`lost` by searching the repo for the quote (dependency and workspace trees excluded); `check --repair` rewrites a `moved` subject to its new file; `rm` deletes by ID. `check seal` refuses a malformed `notes.md` and any non-`exact` anchor. |
-| `gates <scaffold\|status\|run\|reverify\|lint\|attest\|abandon> <slug>` | Operate the `gates.md` acceptance ledger: seed per-AC gates, execute runnable gates bound to `test-plan.md` preflight rows, attest manual gates, and reduce to `all-met`/`not-met`/`handoff`/`malformed`. A gate with `INPUTS:` records its files' content digest and is reused by `run` and `reverify` while they are unchanged. `run`/`reverify --transcripts` writes a redacted, candidate-bound transcript per executed or reused gate under `references/gates/<gate-id>/`. |
+| `gates <scaffold\|status\|run\|reverify\|lint\|precheck\|attest\|abandon> <slug>` | Operate the `gates.md` acceptance ledger: seed per-AC gates, execute runnable gates bound to `test-plan.md` preflight rows, attest manual gates, and reduce to `all-met`/`not-met`/`handoff`/`malformed`. A gate with `INPUTS:` records its files' content digest and is reused by `run` and `reverify` while they are unchanged. `run`/`reverify --transcripts` writes a redacted, candidate-bound transcript per executed or reused gate under `references/gates/<gate-id>/`. `precheck <slug> --worktree <path>` runs every `RUN: writer` gate and `check windows` against the wright's worktree, prints PASS/FAIL per gate id, exits `3` on any FAIL or on a malformed ledger, and writes no ledger, EVIDENCE line or transcript (`check windows` still appends its metric event); its output is never evidence. |
 | `state resolve <qid> "<answer>"` | Resolve an open question and update `questions.md` plus `state.md` atomically. |
 | `state merge-manifest <slug> [pred...]` | Fold the recorded predecessor chain's manifests into the release candidate manifest. |
+| `state set <slug> <key>=<value>... [--unset <key>]...` | Write `state.md` cursor fields all-or-nothing under the feature lock. Refuses an unknown `phase`, the engine-owned `schema` row, a pipe or line break in a value, and an overwrite of a saved `return_phase`/`return_next_action`. Setting `status=awaiting_human` under `.devrites/AFK` prints each open question the sentinel's `allow_gates` auto-picks. |
+| `state append <slug> <ledger.md> --heading "<text>" --body-file <path\|->` | Append one `## <heading>` section to `assumptions.md`, `decisions.md`, `drift.md`, `evidence.md`, or `questions.md` atomically. Refuses a heading that already exists outside fenced code and a body line that opens another `#`/`##` section; for a new `questions.md` `q-` entry, also refuses a non-open status, a missing or unknown gate, a raised_at that is not a full RFC 3339 timestamp, options outside 2-4 concrete choices plus the closing "Something else" escape hatch, `(Recommended)` on any option but 1, and `proposed:` without a `(Recommended)` option 1 (or option 1 without `proposed:`); question or entry length is advisory only; reports an advisory when the ledger passes its line budget, and blocks (exit 3, nothing written) when a ledger other than evidence.md would land at or above 1.5x its line or byte budget without a covering `Budget override: <=N lines; <reason>` (N at most 2x the line budget). |
 | `state close <slug>` | Archive a shipped workspace and clear matching `ACTIVE`. |
 | `migrate <slug> [--dry-run] [--answer id=choice]` | Normalize a pre-v5 workspace to the current schema; fail-closed, one-shot. |
 | `secret-scan [--staged] [--stdin] [slug]` | Scan exact staged blobs, stdin, or touched regular files for credential material. |

package/docs/usage.md

@@ -82,7 +82,7 @@ The shape of this directory is also documented in
 You: I want some kind of reporting thing for admins.
 
 /rite-spec admin-usage-report
-  → investigates deeply (codegraph/graphify): current behavior, placement,
+  → investigates deeply (codebase-memory-mcp when installed): current behavior, placement,
     what it resolves
   → asks you one question at a time, each with options + a best guess,
     until gaps are closed
@@ -274,8 +274,8 @@ Other modes: `quieter` · `distill` · `harden`.
   → returns a map: the area in 1 sentence (project's vocabulary), modules in
     scope, callers in / calls out, ADR / decisions.md entries touching the
     area, smallest sensible change-scope.
-  → uses codegraph_context + codegraph_explore if available; falls back to
-    Grep + Read otherwise.
+  → uses codebase-memory get_architecture + trace_path if available; falls
+    back to Grep + Read otherwise.
 ```
 
 ## 8) Mid-flight handoff

package/engine/commands.go

@@ -34,7 +34,7 @@ func rootModeFor(command string, args []string) rootMode {
 		return rootLenient
 	case "state":
 		switch subcommand {
-		case "resolve", "merge-manifest", "apply-bundle", "close":
+		case "resolve", "merge-manifest", "apply-bundle", "set", "append", "close":
 			return rootStrict
 		}
 		return rootUnused
@@ -42,14 +42,19 @@ func rootModeFor(command string, args []string) rootMode {
 		return rootStrictUsage
 	case "check":
 		switch subcommand {
-		case "candidate", "readiness", "seal", "task-graph", "diff-scope", "slice", "regression", "windows", "drift":
+		case "candidate", "readiness", "preconditions", "seal", "task-graph", "diff-scope", "slice", "regression", "windows", "drift", "anchors", "perturb":
 			return rootStrictUsage
 		case "indexes", "dup":
 			return rootLenient
 		}
 		return rootUnused
-	case "orient", "next", "context", "metrics", "dispatch", "handoff", "note":
+	case "orient", "next", "context", "metrics", "dispatch", "handoff", "note", "packet":
 		return rootStrictUsage
+	case "candidate":
+		if subcommand == "freeze" {
+			return rootStrictUsage
+		}
+		return rootUnused
 	case "claim":
 		switch subcommand {
 		case "add", "release":