devrites 6.4.1 → 6.4.3

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [6.4.3](https://github.com/ViktorsBaikers/DevRites/compare/v6.4.2...v6.4.3) (2026-10-16)
+
+### Fixed
+
+* **devrites:** wrights use mktemp scratch and the edit tool ([#117](https://github.com/ViktorsBaikers/DevRites/issues/117)) ([0b274e8](https://github.com/ViktorsBaikers/DevRites/commit/0b274e8375445c61421390c5e69105695a8f9fad))
+
+## [6.4.2](https://github.com/ViktorsBaikers/DevRites/compare/v6.4.1...v6.4.2) (2026-10-16)
+
+### Changed
+
+* **devrites:** slim slice bundles; keep verdicts out of contracts ([#116](https://github.com/ViktorsBaikers/DevRites/issues/116)) ([d4cffbe](https://github.com/ViktorsBaikers/DevRites/commit/d4cffbe8a7980ec937ce0f8040bf9df10ae90065))
+
 ## [6.4.1](https://github.com/ViktorsBaikers/DevRites/compare/v6.4.0...v6.4.1) (2026-10-16)
 
 ### Fixed

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v6.4.1`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v6.4.1): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v6.4.3`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v6.4.3): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 

package/docs/engine/commands.md

@@ -33,7 +33,7 @@ workflow strategy.
 | `next [slug]` | Print the minimal remaining lifecycle path plus advisory skips. |
 | `handoff [slug]` | Emit the deterministic resume record: cursor fields, `awaiting_human`, open `questions.md` gate kinds, the `gates.md` reduction with unmet/stale/abandoned ids, `decisions.md` dead ends, missing required files, and the canonical read-next order. Read-only; the `/rite-handoff` spine and the compaction-fallback entry point. |
 | `recall --paths <p1,p2,...> [--limit n]` | Read-time query over `.devrites/archive/`: list archived features whose `touched-files.md` candidate manifest covers a queried project-relative path (exact or directory prefix, case-folded), ranked by overlap count, then newest archive-directory mtime, then slug (default 10 features). Each feature prints up to 8 `archive/<slug>/<file>:<line>` pointers, then `+N more`: `decisions.md` `DEC-###` entries and `## Carry-forward constraints` bullets whose `Files:` overlap (or a constraint naming no files), plus `review.md`/`seal.md`/`drift.md` lines that mention a queried path; fenced examples are ignored. Never writes, caches, or indexes (no metric either); symlinked archive entries are refused. An unreadable archive file prints `unreadable:` and the scan continues. Exit `0` (including `recall: no archive`), `1` invalid archive directory, `2` usage. |
-| `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--slice <SLICE-ID>] [--trigger a,b]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. A bundle without `--role` (the root's own read) gives over-budget artifacts as by-reference indexes; a `--role` bundle leads with the role's agent contract and names the manifest's `rootOnly` paths instead of inlining them. `--slice` inlines that slice's `tasks.md` block and turns each over-budget artifact into a by-reference index (path, SHA-256, headings, line hits for every ID the block cites); repeat `--slice` for several slices; an unknown slice exits `3`. |
+| `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--slice <SLICE-ID>] [--trigger a,b]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. A bundle without `--role` (the root's own read) gives over-budget artifacts as by-reference indexes; a `--role` bundle leads with the role's agent contract and names the manifest's `rootOnly` paths instead of inlining them. `--slice` inlines that slice's `tasks.md` block and turns each over-budget artifact, and each artifact over 16 KiB except `spec.md`, into a by-reference index (path, SHA-256, headings, line hits for every ID the block cites); repeat `--slice` for several slices; an unknown slice exits `3`. |
 | `dispatch <slug> <open\|start\|seal\|return\|status\|abandon>` | Launch-wave barrier for parallel dispatch: seal needs a handle per role, return needs seal; start/return auto-record metrics. A build wave with a wright role needs `--slice <SLICE-ID>` per slice, and a slice-bound vet wave takes it too; every 5 rounds of either kind on one slice, `open` exits `3` until `--reslice-review <DRIFT-ID>` names an unused `drift.md` `## <DRIFT-ID>` heading for that slice. `open` also warns when an earlier wave for the same slice never returned. |
 | `metrics record <slug> --phase <p> --event <e> [--role r] [--bytes n] [--note s]` | Append an event to the workspace's `metrics.jsonl` ledger. |
 | `metrics summary [slug] [--by-slice]` | Reduce `metrics.jsonl` into a per-phase roll-up. `--by-slice` reads `dispatch.json` instead: per slice, build wright rounds, slice-bound Vet rechecks, and agent-minutes (role start to `returned_at`; abandoned waves excluded). |

package/engine/internal/lib/context.go

@@ -46,8 +46,9 @@ Emits one deduplicated context bundle for a phase or standalone skill
 reads a single file. With --skill, slug may be omitted; then --out is
 required and no workspace section is included. --slice scopes the
 workspace section to one slice: tasks.md contributes that slice's block,
-and an artifact over its line/byte budget becomes a by-reference index
-(path, SHA-256, headings, and line hits for every ID the block cites).
+and an artifact over its line/byte budget or over 16 KiB (spec.md excepted)
+becomes a by-reference index (path, SHA-256, headings, and line hits for
+every ID the block cites).
 Repeat --slice for a recheck that spans several slices.
 `
 
@@ -348,9 +349,16 @@ func expandIncludes(abs string, data []byte) []byte {
 	})
 }
 
+// sliceInlineMaxBytes caps a workspace artifact inlined whole into a --slice
+// bundle. Planning budgets size a whole feature, not one slice's read; a
+// larger artifact goes by reference so the slice's agent reads only the
+// sections its block cites. spec.md, the acceptance source, stays whole.
+const sliceInlineMaxBytes = 16 << 10
+
 // writeSliceEntry writes one workspace artifact of a --slice or root bundle:
-// with a slice, tasks.md as the slice block plus a by-reference index; any
-// canonical artifact over its line/byte budget as a by-reference index;
+// with a slice, tasks.md as the slice block plus a by-reference index and any
+// other artifact but spec.md over sliceInlineMaxBytes as a by-reference index;
+// any canonical artifact over its line/byte budget as a by-reference index;
 // everything else whole.
 func writeSliceEntry(bundle *strings.Builder, project, abs, label, slice, block string, ids []citedID, seen map[string]bool) (loaded, byRef bool) {
 	if seen[abs] {
@@ -361,6 +369,8 @@ func writeSliceEntry(bundle *strings.Builder, project, abs, label, slice, block
 	if err == nil && name == "tasks.md" && slice != "" {
 		seen[abs] = true
 		fmt.Fprintf(bundle, "===== %s (%s block) =====\n%s\n", label, slice, block)
+	} else if err == nil && slice != "" && name != "spec.md" && len(data) > sliceInlineMaxBytes {
+		seen[abs] = true
 	} else if status, ok := state.ArtifactBudget(name, data); err != nil || !ok || !status.Over {
 		return writeContextEntry(bundle, abs, label, seen, false), false
 	} else {

package/pack/.claude/agents/devrites-slice-wright.md

@@ -119,6 +119,10 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
    loosening an assertion. A test that genuinely must change is an **Escalation**,
    not a quiet edit. The root inspects the returned diff and dedicated test
    analysis treats a weakened test as a Critical STOP.
+   **Scratch** for probes and copies is one fresh `mktemp -d` directory you own,
+   never a fixed name such as `/tmp/x`: writing a path you did not create is an
+   unproven overwrite and stops the run for the owner. Edit allowlisted files with
+   the edit tool; a blocked edit is a gap to report, never routed around.
    For non-trivial failure, invoke `devrites-debug-recovery` with the exact error,
    hypotheses, and dead ends. Caller and recovery share three no-progress attempts per
    exact causal fingerprint. Count only corrections whose recheck preserves the same

package/pack/.claude/skills/rite-build/reference/wright-dispatch.md

@@ -95,7 +95,9 @@ live foreign session releases the retained claim and stops the dispatch, per
 [`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
 is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
 Write the exact contract, with its `Writer-safe checks:` line, to
-`packets/<wave>.contract.md` and hand the wright that text verbatim. Ask the host
+`packets/<wave>.contract.md` and hand the wright that text verbatim. Reviewers read
+that file, so it states each defect to fix with its anchor, never a reviewer's verdict,
+count, or pass status ("code review is no-findings" voids the next review). Ask the host
 for the exact writer in fresh context; a repair round on the same slice whose
 returned wright the host can still continue goes to that wright on its existing
 handle instead, so it does not re-read the slice from scratch. Wait, and track it

package/pack/generated/claude/agents/devrites-slice-wright.md

@@ -119,6 +119,10 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
    loosening an assertion. A test that genuinely must change is an **Escalation**,
    not a quiet edit. The root inspects the returned diff and dedicated test
    analysis treats a weakened test as a Critical STOP.
+   **Scratch** for probes and copies is one fresh `mktemp -d` directory you own,
+   never a fixed name such as `/tmp/x`: writing a path you did not create is an
+   unproven overwrite and stops the run for the owner. Edit allowlisted files with
+   the edit tool; a blocked edit is a gap to report, never routed around.
    For non-trivial failure, invoke `devrites-debug-recovery` with the exact error,
    hypotheses, and dead ends. Caller and recovery share three no-progress attempts per
    exact causal fingerprint. Count only corrections whose recheck preserves the same

package/pack/generated/claude/skills/rite-build/reference/wright-dispatch.md

@@ -95,7 +95,9 @@ live foreign session releases the retained claim and stops the dispatch, per
 [`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
 is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
 Write the exact contract, with its `Writer-safe checks:` line, to
-`packets/<wave>.contract.md` and hand the wright that text verbatim. Ask the host
+`packets/<wave>.contract.md` and hand the wright that text verbatim. Reviewers read
+that file, so it states each defect to fix with its anchor, never a reviewer's verdict,
+count, or pass status ("code review is no-findings" voids the next review). Ask the host
 for the exact writer in fresh context; a repair round on the same slice whose
 returned wright the host can still continue goes to that wright on its existing
 handle instead, so it does not re-read the slice from scratch. Wait, and track it

package/pack/generated/codex/agents/devrites-slice-wright.toml

@@ -117,6 +117,10 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
    loosening an assertion. A test that genuinely must change is an **Escalation**,
    not a quiet edit. The root inspects the returned diff and dedicated test
    analysis treats a weakened test as a Critical STOP.
+   **Scratch** for probes and copies is one fresh `mktemp -d` directory you own,
+   never a fixed name such as `/tmp/x`: writing a path you did not create is an
+   unproven overwrite and stops the run for the owner. Edit allowlisted files with
+   the edit tool; a blocked edit is a gap to report, never routed around.
    For non-trivial failure, invoke `devrites-debug-recovery` with the exact error,
    hypotheses, and dead ends. Caller and recovery share three no-progress attempts per
    exact causal fingerprint. Count only corrections whose recheck preserves the same

package/pack/generated/codex/skills/rite-build/reference/wright-dispatch.md

@@ -95,7 +95,9 @@ live foreign session releases the retained claim and stops the dispatch, per
 [`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
 is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
 Write the exact contract, with its `Writer-safe checks:` line, to
-`packets/<wave>.contract.md` and hand the wright that text verbatim. Ask the host
+`packets/<wave>.contract.md` and hand the wright that text verbatim. Reviewers read
+that file, so it states each defect to fix with its anchor, never a reviewer's verdict,
+count, or pass status ("code review is no-findings" voids the next review). Ask the host
 for the exact writer in fresh context; a repair round on the same slice whose
 returned wright the host can still continue goes to that wright on its existing
 handle instead, so it does not re-read the slice from scratch. Wait, and track it

package/pack/generated/devin/agents/devrites-slice-wright.md

@@ -124,6 +124,10 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
    loosening an assertion. A test that genuinely must change is an **Escalation**,
    not a quiet edit. The root inspects the returned diff and dedicated test
    analysis treats a weakened test as a Critical STOP.
+   **Scratch** for probes and copies is one fresh `mktemp -d` directory you own,
+   never a fixed name such as `/tmp/x`: writing a path you did not create is an
+   unproven overwrite and stops the run for the owner. Edit allowlisted files with
+   the edit tool; a blocked edit is a gap to report, never routed around.
    For non-trivial failure, invoke `devrites-debug-recovery` with the exact error,
    hypotheses, and dead ends. Caller and recovery share three no-progress attempts per
    exact causal fingerprint. Count only corrections whose recheck preserves the same

package/pack/generated/devin/skills/rite-build/reference/wright-dispatch.md

@@ -95,7 +95,9 @@ live foreign session releases the retained claim and stops the dispatch, per
 [`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
 is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
 Write the exact contract, with its `Writer-safe checks:` line, to
-`packets/<wave>.contract.md` and hand the wright that text verbatim. Ask the host
+`packets/<wave>.contract.md` and hand the wright that text verbatim. Reviewers read
+that file, so it states each defect to fix with its anchor, never a reviewer's verdict,
+count, or pass status ("code review is no-findings" voids the next review). Ask the host
 for the exact writer in fresh context; a repair round on the same slice whose
 returned wright the host can still continue goes to that wright on its existing
 handle instead, so it does not re-read the slice from scratch. Wait, and track it

package/pack/generated/omp/agents/devrites-slice-wright.md

@@ -117,6 +117,10 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
    loosening an assertion. A test that genuinely must change is an **Escalation**,
    not a quiet edit. The root inspects the returned diff and dedicated test
    analysis treats a weakened test as a Critical STOP.
+   **Scratch** for probes and copies is one fresh `mktemp -d` directory you own,
+   never a fixed name such as `/tmp/x`: writing a path you did not create is an
+   unproven overwrite and stops the run for the owner. Edit allowlisted files with
+   the edit tool; a blocked edit is a gap to report, never routed around.
    For non-trivial failure, invoke `devrites-debug-recovery` with the exact error,
    hypotheses, and dead ends. Caller and recovery share three no-progress attempts per
    exact causal fingerprint. Count only corrections whose recheck preserves the same

package/pack/generated/omp/skills/rite-build/reference/wright-dispatch.md

@@ -95,7 +95,9 @@ live foreign session releases the retained claim and stops the dispatch, per
 [`agents.md`](skill://devrites-lib/reference/standards/agents.md). `.devrites/**`
 is never a task path; see [Workflow Artifact admission](skill://devrites-lib/reference/standards/workflow-artifacts.md).
 Write the exact contract, with its `Writer-safe checks:` line, to
-`packets/<wave>.contract.md` and hand the wright that text verbatim. Ask the host
+`packets/<wave>.contract.md` and hand the wright that text verbatim. Reviewers read
+that file, so it states each defect to fix with its anchor, never a reviewer's verdict,
+count, or pass status ("code review is no-findings" voids the next review). Ask the host
 for the exact writer in fresh context; a repair round on the same slice whose
 returned wright the host can still continue goes to that wright on its existing
 handle instead, so it does not re-read the slice from scratch. Wait, and track it

package/pack/generated/pi/agents/devrites-slice-wright.md

@@ -118,6 +118,10 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
    loosening an assertion. A test that genuinely must change is an **Escalation**,
    not a quiet edit. The root inspects the returned diff and dedicated test
    analysis treats a weakened test as a Critical STOP.
+   **Scratch** for probes and copies is one fresh `mktemp -d` directory you own,
+   never a fixed name such as `/tmp/x`: writing a path you did not create is an
+   unproven overwrite and stops the run for the owner. Edit allowlisted files with
+   the edit tool; a blocked edit is a gap to report, never routed around.
    For non-trivial failure, invoke `devrites-debug-recovery` with the exact error,
    hypotheses, and dead ends. Caller and recovery share three no-progress attempts per
    exact causal fingerprint. Count only corrections whose recheck preserves the same

package/pack/generated/pi/skills/rite-build/reference/wright-dispatch.md

@@ -95,7 +95,9 @@ live foreign session releases the retained claim and stops the dispatch, per
 [`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
 is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
 Write the exact contract, with its `Writer-safe checks:` line, to
-`packets/<wave>.contract.md` and hand the wright that text verbatim. Ask the host
+`packets/<wave>.contract.md` and hand the wright that text verbatim. Reviewers read
+that file, so it states each defect to fix with its anchor, never a reviewer's verdict,
+count, or pass status ("code review is no-findings" voids the next review). Ask the host
 for the exact writer in fresh context; a repair round on the same slice whose
 returned wright the host can still continue goes to that wright on its existing
 handle instead, so it does not re-read the slice from scratch. Wait, and track it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "6.4.1",
+  "version": "6.4.3",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, pi, and Devin CLI",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",