devrites 6.8.1 → 6.9.0

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [6.9.0](https://github.com/ViktorsBaikers/DevRites/compare/v6.8.1...v6.9.0) (2026-10-18)
+
+### Added
+
+* **devrites:** write candidate-bound gate transcripts ([#131](https://github.com/ViktorsBaikers/DevRites/issues/131)) ([4e7f2ef](https://github.com/ViktorsBaikers/DevRites/commit/4e7f2ef8393754b53f794f9dfabdd7e69a5bd16c))
+
 ## [6.8.1](https://github.com/ViktorsBaikers/DevRites/compare/v6.8.0...v6.8.1) (2026-10-18)
 
 ### Fixed

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v6.8.1`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v6.8.1): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v6.9.0`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v6.9.0): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 

package/docs/engine/commands.md

@@ -39,7 +39,7 @@ workflow strategy.
 | `metrics summary [slug] [--by-slice]` | Reduce `metrics.jsonl` into a per-phase roll-up. `--by-slice` reads `dispatch.json` instead: per slice, build wright rounds, slice-bound Vet rechecks, and agent-minutes (role start to `returned_at`; abandoned waves excluded). |
 | `claim <add\|release\|list\|check>` | Advisory session-scoped file claims in `.devrites/claims.jsonl` (append-only). `add` records intent to write a path set with a TTL (1–240 min, default 30); a live claim by another session exits `3` and names the holder. `release` appends a release event owned by the claiming session. `list` shows live claims (`--all` includes expired/released); a claim whose holding session has provably exited on this host shows `dead` and no longer conflicts. `check` is the read-only preflight for a path set. Coordination aid only — never a substitute for one-writer-per-worktree. |
 | `note <add\|list\|check\|rm> <slug> ...` | Anchored workspace notes in `notes.md`: `add <slug> <subject> <quote> <title> [body]` binds a note to a verbatim quote in one repository file and assigns `NOTE-###`; `list` and `check` regrade each anchor `exact`/`moved`/`stale`/`ambiguous`/`lost` by searching the repo for the quote (dependency and workspace trees excluded); `check --repair` rewrites a `moved` subject to its new file; `rm` deletes by ID. `check seal` refuses a malformed `notes.md` and any non-`exact` anchor. |
-| `gates <scaffold\|status\|run\|reverify\|lint\|attest\|abandon> <slug>` | Operate the `gates.md` acceptance ledger: seed per-AC gates, execute runnable gates bound to `test-plan.md` preflight rows, attest manual gates, and reduce to `all-met`/`not-met`/`handoff`/`malformed`. A gate with `INPUTS:` records its files' content digest and is reused by `run` and `reverify` while they are unchanged. |
+| `gates <scaffold\|status\|run\|reverify\|lint\|attest\|abandon> <slug>` | Operate the `gates.md` acceptance ledger: seed per-AC gates, execute runnable gates bound to `test-plan.md` preflight rows, attest manual gates, and reduce to `all-met`/`not-met`/`handoff`/`malformed`. A gate with `INPUTS:` records its files' content digest and is reused by `run` and `reverify` while they are unchanged. `run`/`reverify --transcripts` writes a redacted, candidate-bound transcript per executed or reused gate under `references/gates/<gate-id>/`. |
 | `state resolve <qid> "<answer>"` | Resolve an open question and update `questions.md` plus `state.md` atomically. |
 | `state merge-manifest <slug> [pred...]` | Fold the recorded predecessor chain's manifests into the release candidate manifest. |
 | `state close <slug>` | Archive a shipped workspace and clear matching `ACTIVE`. |

package/engine/internal/acceptance/cli.go

@@ -26,8 +26,12 @@ const gatesUsage = `usage: devrites-engine gates <subcommand> <slug>
 Subcommands:
   scaffold <slug>            Create gates.md from spec.md AC ids (only when absent)
   status <slug>              Reduce the ledger without executing; exit 3 unless ALL MET
-  run <slug> [--timeout N]   Execute unmet runnable gates and record evidence
-  reverify <slug> [--timeout N]  Re-execute every runnable gate, demoting stale passes
+  run <slug> [--timeout N] [--transcripts]
+                             Execute unmet runnable gates and record evidence
+  reverify <slug> [--timeout N] [--transcripts]
+                             Re-execute every runnable gate, demoting stale passes
+                             (--transcripts writes one redacted, candidate-bound
+                             file per gate under references/gates/<gate-id>/)
   lint <slug> [--strict]     Audit oracle quality without executing
   attest <slug> <id> <note>  Record human evidence on a manual gate
   abandon <slug> <id> <why>  Record a terminal ABANDON handoff on a gate
@@ -216,7 +220,12 @@ func cmdRun(root string, args []string, reverify bool, stdout, stderr io.Writer)
 	var slug string
 	timeout := DefaultTimeout
 	positional := 0
+	transcripts := false
 	for i := 0; i < len(args); i++ {
+		if args[i] == "--transcripts" {
+			transcripts = true
+			continue
+		}
 		if args[i] == "--timeout" {
 			if i+1 >= len(args) {
 				fmt.Fprintf(stderr, "gates %s: --timeout requires seconds\n", verb)
@@ -232,21 +241,27 @@ func cmdRun(root string, args []string, reverify bool, stdout, stderr io.Writer)
 			continue
 		}
 		if strings.HasPrefix(args[i], "-") || positional > 0 {
-			fmt.Fprintf(stderr, "usage: devrites-engine gates %s <slug> [--timeout N]\n", verb)
+			fmt.Fprintf(stderr, "usage: devrites-engine gates %s <slug> [--timeout N] [--transcripts]\n", verb)
 			return ExitUsage
 		}
 		slug = args[i]
 		positional++
 	}
 	if slug == "" {
-		fmt.Fprintf(stderr, "usage: devrites-engine gates %s <slug> [--timeout N]\n", verb)
+		fmt.Fprintf(stderr, "usage: devrites-engine gates %s <slug> [--timeout N] [--transcripts]\n", verb)
 		return ExitUsage
 	}
-	_, ledgerPath, testPlanPath, project, err := featurePaths(root, slug)
+	work, ledgerPath, testPlanPath, project, err := featurePaths(root, slug)
 	if err != nil {
 		fmt.Fprintf(stderr, "gates %s: %v\n", verb, err)
 		return ExitBlocked
 	}
+	before := ""
+	if transcripts {
+		before = candidateLabel(root, slug)
+	}
+	var ran []GateResult
+	var ranDoc *Document
 
 	// The gates lock serializes check execution; the feature lock is held only
 	// to read inputs and per writeback, so dispatch and other workspace writers
@@ -270,7 +285,8 @@ func cmdRun(root string, args []string, reverify bool, stdout, stderr io.Writer)
 			}
 			return nil
 		}
-		for _, result := range RunGates(context.Background(), project, ledgerPath, doc, approved, reverify, timeout, featureLock) {
+		ran, ranDoc = RunGates(context.Background(), project, ledgerPath, doc, approved, reverify, timeout, featureLock), doc
+		for _, result := range ran {
 			switch {
 			case !result.Ran:
 				fmt.Fprintf(stdout, "gate %s: skipped (%s)\n", result.ID, result.Detail)
@@ -286,6 +302,16 @@ func cmdRun(root string, args []string, reverify bool, stdout, stderr io.Writer)
 		fmt.Fprintf(stderr, "gates %s: %v\n", verb, lockErr)
 		return ExitBlocked
 	}
+	if transcripts && ranDoc != nil {
+		paths, err := writeTranscripts(work, ranDoc, ran, before, candidateLabel(root, slug))
+		for _, path := range paths {
+			fmt.Fprintf(stdout, "transcript: %s\n", path)
+		}
+		if err != nil {
+			fmt.Fprintf(stderr, "gates %s: transcript: %v\n", verb, err)
+			return ExitBlocked
+		}
+	}
 	fmt.Fprintln(stdout, "---")
 	return reportStatus(slug, ledgerPath, testPlanPath, stdout, stderr)
 }

package/engine/internal/acceptance/run.go

@@ -30,6 +30,12 @@ type GateResult struct {
 	Detail    string // exit/match/timeout/approval diagnostic
 	Discarded bool   // result dropped: ledger changed under the run
 	WriteErr  error  // evidence writeback failed for a reason other than drift
+	Reused    bool   // met gate kept because its INPUTS are unchanged
+	Inputs    string // INPUTS content digest at run time, when declared
+	// Outcome, Started and Ended describe the execution this result judged;
+	// they are zero when the gate did not execute.
+	Outcome        RunOutcome
+	Started, Ended time.Time
 }
 
 var (
@@ -72,6 +78,7 @@ func ReadLedgerFile(ledgerPath string) (string, error) {
 func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, approved []ApprovedCommand, reverify bool, timeout time.Duration, writeLock func(func() error) error) []GateResult {
 	var results []GateResult
 	outcomes := map[string]RunOutcome{}
+	spans := map[string][2]time.Time{}
 	write := func(gate *Gate, evidence string, checked bool) error {
 		if writeLock == nil {
 			return writeResult(ledgerPath, gate, evidence, checked)
@@ -100,7 +107,7 @@ func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, appro
 			// A gate that declares INPUTS is reused, under run and reverify alike,
 			// exactly while the files it depends on are byte-identical; any change re-executes it.
 			if inputs != "" && inputs == recordedInputs(gate) {
-				results = append(results, GateResult{ID: gate.ID, Passed: true, Detail: "reused: inputs unchanged"})
+				results = append(results, GateResult{ID: gate.ID, Passed: true, Reused: true, Inputs: inputs, Detail: "reused: inputs unchanged"})
 				continue
 			}
 		}
@@ -120,9 +127,12 @@ func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, appro
 		key := gate.Check + "\x00" + cwd
 		outcome, ran := outcomes[key]
 		if !ran {
+			started := time.Now().UTC()
 			outcome = Execute(ctx, gate.Check, cwd, timeout)
 			outcomes[key] = outcome
+			spans[key] = [2]time.Time{started, time.Now().UTC()}
 		}
+		span := spans[key]
 		if outcome.Err == nil && outcome.ExitCode == 0 && expectation.Matches(outcome.Output) {
 			evidence := withInputs(FormatEvidence(gate, OutputDigest(outcome.Output), outcome.OutputBytes, time.Now().UTC().Format(time.RFC3339)), inputs)
 			writeErr := write(gate, evidence, true)
@@ -130,6 +140,7 @@ func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, appro
 				ID: gate.ID, Ran: true, Passed: true,
 				Discarded: errors.Is(writeErr, ErrOracleMoved), WriteErr: writeErr,
 				Detail: resultDetail(writeErr, "pass"),
+				Inputs: inputs, Outcome: outcome, Started: span[0], Ended: span[1],
 			})
 		} else {
 			writeErr := write(gate, "pending", false)
@@ -137,6 +148,7 @@ func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, appro
 				ID: gate.ID, Ran: true,
 				Discarded: errors.Is(writeErr, ErrOracleMoved), WriteErr: writeErr,
 				Detail: resultDetail(writeErr, failDetail(outcome, expectation)),
+				Inputs: inputs, Outcome: outcome, Started: span[0], Ended: span[1],
 			})
 		}
 	}

package/engine/internal/acceptance/transcript.go

@@ -0,0 +1,116 @@
+package acceptance
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/devrites/devrites/internal/secretpattern"
+)
+
+// CandidateDigest computes the feature's candidate identity. main wires it to
+// the candidate hash in package lib, which imports this package; nil reports
+// the identity as unavailable.
+var CandidateDigest func(root, slug string) (string, error)
+
+// maxTranscriptOutput caps the redacted output a transcript keeps.
+const maxTranscriptOutput = 1 << 20
+
+var unsafeNameRE = regexp.MustCompile(`[^A-Za-z0-9._-]`)
+
+func candidateLabel(root, slug string) string {
+	if CandidateDigest == nil {
+		return "unavailable: no candidate identity"
+	}
+	digest, err := CandidateDigest(root, slug)
+	if err != nil {
+		return "unavailable: " + oneLine(err.Error())
+	}
+	return digest
+}
+
+// writeTranscripts records one immutable file per executed or reused gate under
+// <work>/references/gates/<gate-id>/, binding the exact command, cwd, attempt,
+// exit, EXPECT verdict and redacted output to the candidate identity read
+// before and after the run. OUTPUT_SHA256 equals the ledger evidence digest.
+func writeTranscripts(work string, doc *Document, results []GateResult, before, after string) ([]string, error) {
+	gates := map[string]*Gate{}
+	for _, gate := range doc.Gates {
+		gates[gate.ID] = gate
+	}
+	prefix := "nodigest"
+	if len(before) >= 12 && !strings.HasPrefix(before, "unavailable") {
+		prefix = before[:12]
+	}
+	var paths []string
+	for _, result := range results {
+		gate := gates[result.ID]
+		if gate == nil || (!result.Ran && !result.Reused) {
+			continue
+		}
+		name := unsafeNameRE.ReplaceAllString(gate.ID, "_")
+		if name == "." || name == ".." {
+			name = "_"
+		}
+		dir := filepath.Join(work, "references", "gates", name)
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			return paths, err
+		}
+		var body strings.Builder
+		fmt.Fprintf(&body, "DEVRITES-GATE-TRANSCRIPT v1\nGATE: %s\nTITLE: %s\nCOMMAND: %s\nCWD: %s\n", gate.ID, gate.Title, gate.Check, valueOr(gate.Cwd, "."))
+		fmt.Fprintf(&body, "INPUTS: %s\nINPUTS_SHA256: %s\nCANDIDATE_BEFORE: %s\nCANDIDATE_AFTER: %s\n", valueOr(gate.Inputs, "none"), valueOr(result.Inputs, "none"), before, after)
+		var file string
+		if result.Reused {
+			file = filepath.Join(dir, prefix+"-reused.log")
+			fmt.Fprintf(&body, "RESULT: reused (inputs unchanged; not executed)\nPRIOR_EVIDENCE: %s\n", gate.Evidence)
+		} else {
+			attempt := 1
+			if entries, err := os.ReadDir(dir); err == nil {
+				for _, entry := range entries {
+					if strings.HasPrefix(entry.Name(), prefix+"-a") {
+						attempt++
+					}
+				}
+			}
+			file = filepath.Join(dir, fmt.Sprintf("%s-a%d.log", prefix, attempt))
+			output, masked := secretpattern.Redact(result.Outcome.Output)
+			truncated := len(output) > maxTranscriptOutput
+			if truncated {
+				output = output[:maxTranscriptOutput]
+			}
+			verdict := "fail"
+			if result.Passed {
+				verdict = "pass"
+			}
+			fmt.Fprintf(&body, "ATTEMPT: %d\nSTARTED: %s\nENDED: %s\nEXIT: %s\nEXPECT: %s\nRESULT: %s\n",
+				attempt, result.Started.Format(time.RFC3339Nano), result.Ended.Format(time.RFC3339Nano), exitLabel(result.Outcome), gate.Expect, verdict)
+			fmt.Fprintf(&body, "OUTPUT_SHA256: %s\nOUTPUT_BYTES: %d\nREDACTIONS: %d\nTRUNCATED: %t\n--- OUTPUT ---\n%s\n--- END OUTPUT ---\n",
+				OutputDigest(result.Outcome.Output), result.Outcome.OutputBytes, masked, truncated, output)
+		}
+		if err := os.WriteFile(file, []byte(body.String()), 0o644); err != nil {
+			return paths, err
+		}
+		paths = append(paths, file)
+	}
+	return paths, nil
+}
+
+func exitLabel(outcome RunOutcome) string {
+	switch {
+	case outcome.TimedOut:
+		return "timeout"
+	case outcome.Err != nil:
+		return "error: " + oneLine(outcome.Err.Error())
+	}
+	return fmt.Sprint(outcome.ExitCode)
+}
+
+func valueOr(value, fallback string) string {
+	if value == "" {
+		return fallback
+	}
+	return value
+}

package/engine/internal/lib/secretscan.go

@@ -8,10 +8,11 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"regexp"
 	"sort"
 	"strconv"
 	"strings"
+
+	"github.com/devrites/devrites/internal/secretpattern"
 )
 
 type secretFinding struct {
@@ -71,17 +72,7 @@ func (w *boundedSecretScanBuffer) Len() int {
 	return w.buffer.Len()
 }
 
-var secretPatterns = []struct {
-	sev, kind string
-	re        *regexp.Regexp
-}{
-	{"HIGH", "private-key", regexp.MustCompile(`-----BEGIN (RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----`)},
-	{"HIGH", "aws-secret", regexp.MustCompile(`(?i)aws(.{0,20})?(secret|access).{0,20}[=:]\s*['\"]?[A-Za-z0-9/+=]{30,}`)},
-	{"HIGH", "github-token", regexp.MustCompile(`gh[pousr]_[A-Za-z0-9_]{30,}`)},
-	{"HIGH", "slack-token", regexp.MustCompile(`xox[baprs]-[A-Za-z0-9-]{20,}`)},
-	{"MEDIUM", "generic-secret", regexp.MustCompile(`(?i)(api[_-]?key|token|secret|password)\s*[:=]\s*['\"][^'\"\n]{16,}['\"]`)},
-	{"LOW", "placeholder-secret", regexp.MustCompile(`(?i)(api[_-]?key|token|secret|password).{0,20}(example|changeme|placeholder|dummy)`)},
-}
+var secretPatterns = secretpattern.Patterns
 
 // SecretScan scans staged blobs, stdin, or touched files for credentials. HIGH exits 3.
 func SecretScan(root string, args []string, stdin io.Reader, stdout, stderr io.Writer) int {
@@ -253,12 +244,12 @@ func scanCountedSecrets(path string, content []byte, budget *secretScanBudget) (
 	var out []secretFinding
 	source := secretSourceLabel(path)
 	for _, pattern := range secretPatterns {
-		matches := pattern.re.FindAllIndex(content, budget.findingsRemaining+1)
+		matches := pattern.Re.FindAllIndex(content, budget.findingsRemaining+1)
 		if len(matches) > budget.findingsRemaining {
 			return nil, errSecretScanLimit
 		}
 		for _, match := range matches {
-			out = append(out, secretFinding{Severity: pattern.sev, Path: source, Kind: pattern.kind, Offset: match[0]})
+			out = append(out, secretFinding{Severity: pattern.Sev, Path: source, Kind: pattern.Kind, Offset: match[0]})
 		}
 		budget.findingsRemaining -= len(matches)
 	}
@@ -267,7 +258,7 @@ func scanCountedSecrets(path string, content []byte, budget *secretScanBudget) (
 
 func secretSourceLabel(path string) string {
 	for _, pattern := range secretPatterns {
-		if pattern.re.FindStringIndex(path) != nil {
+		if pattern.Re.FindStringIndex(path) != nil {
 			return "<redacted-path>"
 		}
 	}

package/engine/internal/secretpattern/secretpattern.go

@@ -0,0 +1,37 @@
+// Package secretpattern holds the credential patterns shared by the secret
+// scanner and the gate transcript writer, so both mask the same shapes.
+package secretpattern
+
+import "regexp"
+
+// Pattern is one credential shape with its scanner severity.
+type Pattern struct {
+	Sev, Kind string
+	Re        *regexp.Regexp
+}
+
+// Patterns are the credential shapes, most severe first.
+var Patterns = []Pattern{
+	{"HIGH", "private-key", regexp.MustCompile(`-----BEGIN (RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----`)},
+	{"HIGH", "aws-secret", regexp.MustCompile(`(?i)aws(.{0,20})?(secret|access).{0,20}[=:]\s*['\"]?[A-Za-z0-9/+=]{30,}`)},
+	{"HIGH", "github-token", regexp.MustCompile(`gh[pousr]_[A-Za-z0-9_]{30,}`)},
+	{"HIGH", "slack-token", regexp.MustCompile(`xox[baprs]-[A-Za-z0-9-]{20,}`)},
+	{"MEDIUM", "generic-secret", regexp.MustCompile(`(?i)(api[_-]?key|token|secret|password)\s*[:=]\s*['\"][^'\"\n]{16,}['\"]`)},
+	{"LOW", "placeholder-secret", regexp.MustCompile(`(?i)(api[_-]?key|token|secret|password).{0,20}(example|changeme|placeholder|dummy)`)},
+}
+
+// Redact masks every HIGH or MEDIUM match in text and returns the masked text
+// and the number of masks. LOW placeholders are not credentials and stay.
+func Redact(text string) (string, int) {
+	masked := 0
+	for _, pattern := range Patterns {
+		if pattern.Sev == "LOW" {
+			continue
+		}
+		text = pattern.Re.ReplaceAllStringFunc(text, func(string) string {
+			masked++
+			return "[REDACTED:" + pattern.Kind + "]"
+		})
+	}
+	return text, masked
+}

package/engine/main.go

@@ -99,6 +99,15 @@ func main() {
 	os.Exit(run(os.Args[1:], os.Stdin, os.Stdout, os.Stderr))
 }
 
+func init() {
+	// acceptance cannot import lib (lib imports it), so gate transcripts get
+	// the candidate identity through this hook.
+	acceptance.CandidateDigest = func(root, slug string) (string, error) {
+		digest, _, err := lib.CandidateIdentity(root, slug)
+		return digest, err
+	}
+}
+
 // run is the testable entry point. It returns the process exit code.
 func run(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 	if len(args) == 0 {

package/pack/.claude/agents/devrites-proof-runner.md

@@ -49,7 +49,12 @@ and only the orchestrator-supplied changed paths.
    named blocker, never a pass. Otherwise use `cannot_verify`.
 8. A manual gate whose `gates.md` note lacks the human's own words or source, is a
    placeholder, or was runnable at Vet is `cannot_verify` ([`gates.md`](../skills/devrites-lib/reference/standards/gates.md)).
-9. Recheck supplied before/after candidate identities. A mismatch or unexpected
+9. An engine transcript (`DEVRITES-GATE-TRANSCRIPT v1` under `references/gates/`)
+   is immutable proof of its COMMAND, CWD, ATTEMPT, EXIT and output for the
+   candidate in CANDIDATE_BEFORE/AFTER. A `-reused.log` proves a gate for the
+   current candidate only when its INPUTS_SHA256 equals that of the gate's latest
+   executed, passing transcript.
+10. Recheck supplied before/after candidate identities. A mismatch or unexpected
    repository mutation fails the side-effect boundary.
 
 ## Rules

package/pack/.claude/skills/devrites-lib/reference/standards/gates.md

@@ -55,7 +55,12 @@ execute unreviewed code.
 
 Execution contract: the command runs through the platform shell in the named
 directory with a bounded timeout; pass requires exit 0 **and** output matching
-EXPECT. Output is captured but never persisted — only its digest.
+EXPECT. Without `--transcripts`, output is captured but never persisted, only its
+digest. `--transcripts` writes one file per executed or reused gate under
+`references/gates/<gate-id>/`. Each file holds the command, cwd, attempt, times,
+exit, EXPECT verdict, the candidate digest read before and after the run, and the
+output with known credential shapes masked and capped at 1 MiB. Its
+`OUTPUT_SHA256` equals the ledger evidence digest.
 
 After Vet READY the runnable set is fixed: converting a runnable gate to manual,
 loosening EXPECT, changing CHECK or CWD, adding or narrowing INPUTS, or removing

package/pack/.claude/skills/rite-prove/SKILL.md

@@ -84,10 +84,13 @@ test changes.
    pass is `flaky` per [`testing.md`](../devrites-lib/reference/standards/testing.md#determinism-no-flaky-tests),
    never green. Static gates prove only their named
    static criterion.
-   Run the acceptance ledger: `devrites-engine gates run <slug>` executes every
-   unmet runnable gate against the same approved preflight rows and records
-   definition-bound evidence; `gates reverify <slug>` re-executes all of them
-   when any prior pass is in doubt. Attest manual gates with `gates attest
+   Run the acceptance ledger with `--transcripts`: `devrites-engine gates run <slug>
+   --transcripts` executes every unmet runnable gate against the same approved
+   preflight rows, records definition-bound evidence, and writes one redacted,
+   candidate-bound transcript per gate under `references/gates/<gate-id>/`;
+   `gates reverify <slug> --transcripts` re-executes all of them when any prior
+   pass is in doubt. Hand the proof runner those transcripts, never hand-built
+   logs. Attest manual gates with `gates attest
    <slug> <id> <note>` only against observed judgment whose note cites the
    human's own words or source; placeholder notes are unmet and an AFK run never
    self-attests. Only gates manual at Vet are attested; runnable-to-manual

package/pack/.claude/skills/rite-seal/SKILL.md

@@ -82,7 +82,9 @@ Follow [`reference/phase-contract.md`](reference/phase-contract.md)
    that is malformed, unmet,
    stale, unapproved, or abandoned — a seal-side `gates status` reading anything
    but `all-met` means Prove's evidence is not current; return there, never
-   attest past it. It likewise refuses a malformed `notes.md` or any anchor
+   attest past it. Before the Seal wave, run `devrites-engine gates reverify <slug>
+   --transcripts` on the frozen candidate, so every gate has a transcript bound to
+   this digest for the proof runner. It likewise refuses a malformed `notes.md` or any anchor
    graded other than `exact`: `devrites-engine note check <slug> --repair`
    re-anchors `moved` notes; `stale`/`ambiguous`/`lost` ones are corrected or
    removed before GO.

package/pack/generated/claude/agents/devrites-proof-runner.md

@@ -55,7 +55,12 @@ and only the orchestrator-supplied changed paths.
    named blocker, never a pass. Otherwise use `cannot_verify`.
 8. A manual gate whose `gates.md` note lacks the human's own words or source, is a
    placeholder, or was runnable at Vet is `cannot_verify` ([`gates.md`](../skills/devrites-lib/reference/standards/gates.md)).
-9. Recheck supplied before/after candidate identities. A mismatch or unexpected
+9. An engine transcript (`DEVRITES-GATE-TRANSCRIPT v1` under `references/gates/`)
+   is immutable proof of its COMMAND, CWD, ATTEMPT, EXIT and output for the
+   candidate in CANDIDATE_BEFORE/AFTER. A `-reused.log` proves a gate for the
+   current candidate only when its INPUTS_SHA256 equals that of the gate's latest
+   executed, passing transcript.
+10. Recheck supplied before/after candidate identities. A mismatch or unexpected
    repository mutation fails the side-effect boundary.
 
 ## Rules

package/pack/generated/claude/skills/devrites-lib/reference/standards/gates.md

@@ -55,7 +55,12 @@ execute unreviewed code.
 
 Execution contract: the command runs through the platform shell in the named
 directory with a bounded timeout; pass requires exit 0 **and** output matching
-EXPECT. Output is captured but never persisted — only its digest.
+EXPECT. Without `--transcripts`, output is captured but never persisted, only its
+digest. `--transcripts` writes one file per executed or reused gate under
+`references/gates/<gate-id>/`. Each file holds the command, cwd, attempt, times,
+exit, EXPECT verdict, the candidate digest read before and after the run, and the
+output with known credential shapes masked and capped at 1 MiB. Its
+`OUTPUT_SHA256` equals the ledger evidence digest.
 
 After Vet READY the runnable set is fixed: converting a runnable gate to manual,
 loosening EXPECT, changing CHECK or CWD, adding or narrowing INPUTS, or removing

package/pack/generated/claude/skills/rite-prove/SKILL.md

@@ -84,10 +84,13 @@ test changes.
    pass is `flaky` per [`testing.md`](../devrites-lib/reference/standards/testing.md#determinism-no-flaky-tests),
    never green. Static gates prove only their named
    static criterion.
-   Run the acceptance ledger: `devrites-engine gates run <slug>` executes every
-   unmet runnable gate against the same approved preflight rows and records
-   definition-bound evidence; `gates reverify <slug>` re-executes all of them
-   when any prior pass is in doubt. Attest manual gates with `gates attest
+   Run the acceptance ledger with `--transcripts`: `devrites-engine gates run <slug>
+   --transcripts` executes every unmet runnable gate against the same approved
+   preflight rows, records definition-bound evidence, and writes one redacted,
+   candidate-bound transcript per gate under `references/gates/<gate-id>/`;
+   `gates reverify <slug> --transcripts` re-executes all of them when any prior
+   pass is in doubt. Hand the proof runner those transcripts, never hand-built
+   logs. Attest manual gates with `gates attest
    <slug> <id> <note>` only against observed judgment whose note cites the
    human's own words or source; placeholder notes are unmet and an AFK run never
    self-attests. Only gates manual at Vet are attested; runnable-to-manual

package/pack/generated/claude/skills/rite-seal/SKILL.md

@@ -82,7 +82,9 @@ Follow [`reference/phase-contract.md`](reference/phase-contract.md)
    that is malformed, unmet,
    stale, unapproved, or abandoned — a seal-side `gates status` reading anything
    but `all-met` means Prove's evidence is not current; return there, never
-   attest past it. It likewise refuses a malformed `notes.md` or any anchor
+   attest past it. Before the Seal wave, run `devrites-engine gates reverify <slug>
+   --transcripts` on the frozen candidate, so every gate has a transcript bound to
+   this digest for the proof runner. It likewise refuses a malformed `notes.md` or any anchor
    graded other than `exact`: `devrites-engine note check <slug> --repair`
    re-anchors `moved` notes; `stale`/`ambiguous`/`lost` ones are corrected or
    removed before GO.

package/pack/generated/codex/agents/devrites-proof-runner.toml

@@ -53,7 +53,12 @@ and only the orchestrator-supplied changed paths.
    named blocker, never a pass. Otherwise use `cannot_verify`.
 8. A manual gate whose `gates.md` note lacks the human's own words or source, is a
    placeholder, or was runnable at Vet is `cannot_verify` ([`gates.md`](.agents/skills/devrites-lib/reference/standards/gates.md)).
-9. Recheck supplied before/after candidate identities. A mismatch or unexpected
+9. An engine transcript (`DEVRITES-GATE-TRANSCRIPT v1` under `references/gates/`)
+   is immutable proof of its COMMAND, CWD, ATTEMPT, EXIT and output for the
+   candidate in CANDIDATE_BEFORE/AFTER. A `-reused.log` proves a gate for the
+   current candidate only when its INPUTS_SHA256 equals that of the gate's latest
+   executed, passing transcript.
+10. Recheck supplied before/after candidate identities. A mismatch or unexpected
    repository mutation fails the side-effect boundary.
 
 ## Rules

package/pack/generated/codex/skills/devrites-lib/reference/standards/gates.md

@@ -55,7 +55,12 @@ execute unreviewed code.
 
 Execution contract: the command runs through the platform shell in the named
 directory with a bounded timeout; pass requires exit 0 **and** output matching
-EXPECT. Output is captured but never persisted — only its digest.
+EXPECT. Without `--transcripts`, output is captured but never persisted, only its
+digest. `--transcripts` writes one file per executed or reused gate under
+`references/gates/<gate-id>/`. Each file holds the command, cwd, attempt, times,
+exit, EXPECT verdict, the candidate digest read before and after the run, and the
+output with known credential shapes masked and capped at 1 MiB. Its
+`OUTPUT_SHA256` equals the ledger evidence digest.
 
 After Vet READY the runnable set is fixed: converting a runnable gate to manual,
 loosening EXPECT, changing CHECK or CWD, adding or narrowing INPUTS, or removing

package/pack/generated/codex/skills/rite-prove/SKILL.md

@@ -84,10 +84,13 @@ test changes.
    pass is `flaky` per [`testing.md`](../devrites-lib/reference/standards/testing.md#determinism-no-flaky-tests),
    never green. Static gates prove only their named
    static criterion.
-   Run the acceptance ledger: `devrites-engine gates run <slug>` executes every
-   unmet runnable gate against the same approved preflight rows and records
-   definition-bound evidence; `gates reverify <slug>` re-executes all of them
-   when any prior pass is in doubt. Attest manual gates with `gates attest
+   Run the acceptance ledger with `--transcripts`: `devrites-engine gates run <slug>
+   --transcripts` executes every unmet runnable gate against the same approved
+   preflight rows, records definition-bound evidence, and writes one redacted,
+   candidate-bound transcript per gate under `references/gates/<gate-id>/`;
+   `gates reverify <slug> --transcripts` re-executes all of them when any prior
+   pass is in doubt. Hand the proof runner those transcripts, never hand-built
+   logs. Attest manual gates with `gates attest
    <slug> <id> <note>` only against observed judgment whose note cites the
    human's own words or source; placeholder notes are unmet and an AFK run never
    self-attests. Only gates manual at Vet are attested; runnable-to-manual

package/pack/generated/codex/skills/rite-seal/SKILL.md

@@ -82,7 +82,9 @@ Follow [`reference/phase-contract.md`](reference/phase-contract.md)
    that is malformed, unmet,
    stale, unapproved, or abandoned — a seal-side `gates status` reading anything
    but `all-met` means Prove's evidence is not current; return there, never
-   attest past it. It likewise refuses a malformed `notes.md` or any anchor
+   attest past it. Before the Seal wave, run `devrites-engine gates reverify <slug>
+   --transcripts` on the frozen candidate, so every gate has a transcript bound to
+   this digest for the proof runner. It likewise refuses a malformed `notes.md` or any anchor
    graded other than `exact`: `devrites-engine note check <slug> --repair`
    re-anchors `moved` notes; `stale`/`ambiguous`/`lost` ones are corrected or
    removed before GO.

package/pack/generated/devin/agents/devrites-proof-runner.md

@@ -57,7 +57,12 @@ and only the orchestrator-supplied changed paths.
    named blocker, never a pass. Otherwise use `cannot_verify`.
 8. A manual gate whose `gates.md` note lacks the human's own words or source, is a
    placeholder, or was runnable at Vet is `cannot_verify` ([`gates.md`](../skills/devrites-lib/reference/standards/gates.md)).
-9. Recheck supplied before/after candidate identities. A mismatch or unexpected
+9. An engine transcript (`DEVRITES-GATE-TRANSCRIPT v1` under `references/gates/`)
+   is immutable proof of its COMMAND, CWD, ATTEMPT, EXIT and output for the
+   candidate in CANDIDATE_BEFORE/AFTER. A `-reused.log` proves a gate for the
+   current candidate only when its INPUTS_SHA256 equals that of the gate's latest
+   executed, passing transcript.
+10. Recheck supplied before/after candidate identities. A mismatch or unexpected
    repository mutation fails the side-effect boundary.
 
 ## Rules

package/pack/generated/devin/skills/devrites-lib/reference/standards/gates.md

@@ -55,7 +55,12 @@ execute unreviewed code.
 
 Execution contract: the command runs through the platform shell in the named
 directory with a bounded timeout; pass requires exit 0 **and** output matching
-EXPECT. Output is captured but never persisted — only its digest.
+EXPECT. Without `--transcripts`, output is captured but never persisted, only its
+digest. `--transcripts` writes one file per executed or reused gate under
+`references/gates/<gate-id>/`. Each file holds the command, cwd, attempt, times,
+exit, EXPECT verdict, the candidate digest read before and after the run, and the
+output with known credential shapes masked and capped at 1 MiB. Its
+`OUTPUT_SHA256` equals the ledger evidence digest.
 
 After Vet READY the runnable set is fixed: converting a runnable gate to manual,
 loosening EXPECT, changing CHECK or CWD, adding or narrowing INPUTS, or removing

package/pack/generated/devin/skills/rite-prove/SKILL.md

@@ -83,10 +83,13 @@ test changes.
    pass is `flaky` per [`testing.md`](../devrites-lib/reference/standards/testing.md#determinism-no-flaky-tests),
    never green. Static gates prove only their named
    static criterion.
-   Run the acceptance ledger: `devrites-engine gates run <slug>` executes every
-   unmet runnable gate against the same approved preflight rows and records
-   definition-bound evidence; `gates reverify <slug>` re-executes all of them
-   when any prior pass is in doubt. Attest manual gates with `gates attest
+   Run the acceptance ledger with `--transcripts`: `devrites-engine gates run <slug>
+   --transcripts` executes every unmet runnable gate against the same approved
+   preflight rows, records definition-bound evidence, and writes one redacted,
+   candidate-bound transcript per gate under `references/gates/<gate-id>/`;
+   `gates reverify <slug> --transcripts` re-executes all of them when any prior
+   pass is in doubt. Hand the proof runner those transcripts, never hand-built
+   logs. Attest manual gates with `gates attest
    <slug> <id> <note>` only against observed judgment whose note cites the
    human's own words or source; placeholder notes are unmet and an AFK run never
    self-attests. Only gates manual at Vet are attested; runnable-to-manual

package/pack/generated/devin/skills/rite-seal/SKILL.md

@@ -81,7 +81,9 @@ Follow [`reference/phase-contract.md`](reference/phase-contract.md)
    that is malformed, unmet,
    stale, unapproved, or abandoned — a seal-side `gates status` reading anything
    but `all-met` means Prove's evidence is not current; return there, never
-   attest past it. It likewise refuses a malformed `notes.md` or any anchor
+   attest past it. Before the Seal wave, run `devrites-engine gates reverify <slug>
+   --transcripts` on the frozen candidate, so every gate has a transcript bound to
+   this digest for the proof runner. It likewise refuses a malformed `notes.md` or any anchor
    graded other than `exact`: `devrites-engine note check <slug> --repair`
    re-anchors `moved` notes; `stale`/`ambiguous`/`lost` ones are corrected or
    removed before GO.

package/pack/generated/omp/agents/devrites-proof-runner.md

@@ -54,7 +54,12 @@ and only the orchestrator-supplied changed paths.
    named blocker, never a pass. Otherwise use `cannot_verify`.
 8. A manual gate whose `gates.md` note lacks the human's own words or source, is a
    placeholder, or was runnable at Vet is `cannot_verify` ([`gates.md`](skill://devrites-lib/reference/standards/gates.md)).
-9. Recheck supplied before/after candidate identities. A mismatch or unexpected
+9. An engine transcript (`DEVRITES-GATE-TRANSCRIPT v1` under `references/gates/`)
+   is immutable proof of its COMMAND, CWD, ATTEMPT, EXIT and output for the
+   candidate in CANDIDATE_BEFORE/AFTER. A `-reused.log` proves a gate for the
+   current candidate only when its INPUTS_SHA256 equals that of the gate's latest
+   executed, passing transcript.
+10. Recheck supplied before/after candidate identities. A mismatch or unexpected
    repository mutation fails the side-effect boundary.
 
 ## Rules

package/pack/generated/omp/skills/devrites-lib/reference/standards/gates.md

@@ -55,7 +55,12 @@ execute unreviewed code.
 
 Execution contract: the command runs through the platform shell in the named
 directory with a bounded timeout; pass requires exit 0 **and** output matching
-EXPECT. Output is captured but never persisted — only its digest.
+EXPECT. Without `--transcripts`, output is captured but never persisted, only its
+digest. `--transcripts` writes one file per executed or reused gate under
+`references/gates/<gate-id>/`. Each file holds the command, cwd, attempt, times,
+exit, EXPECT verdict, the candidate digest read before and after the run, and the
+output with known credential shapes masked and capped at 1 MiB. Its
+`OUTPUT_SHA256` equals the ledger evidence digest.
 
 After Vet READY the runnable set is fixed: converting a runnable gate to manual,
 loosening EXPECT, changing CHECK or CWD, adding or narrowing INPUTS, or removing

package/pack/generated/omp/skills/rite-prove/SKILL.md

@@ -84,10 +84,13 @@ test changes.
    pass is `flaky` per [`testing.md`](skill://devrites-lib/reference/standards/testing.md#determinism-no-flaky-tests),
    never green. Static gates prove only their named
    static criterion.
-   Run the acceptance ledger: `devrites-engine gates run <slug>` executes every
-   unmet runnable gate against the same approved preflight rows and records
-   definition-bound evidence; `gates reverify <slug>` re-executes all of them
-   when any prior pass is in doubt. Attest manual gates with `gates attest
+   Run the acceptance ledger with `--transcripts`: `devrites-engine gates run <slug>
+   --transcripts` executes every unmet runnable gate against the same approved
+   preflight rows, records definition-bound evidence, and writes one redacted,
+   candidate-bound transcript per gate under `references/gates/<gate-id>/`;
+   `gates reverify <slug> --transcripts` re-executes all of them when any prior
+   pass is in doubt. Hand the proof runner those transcripts, never hand-built
+   logs. Attest manual gates with `gates attest
    <slug> <id> <note>` only against observed judgment whose note cites the
    human's own words or source; placeholder notes are unmet and an AFK run never
    self-attests. Only gates manual at Vet are attested; runnable-to-manual

package/pack/generated/omp/skills/rite-seal/SKILL.md

@@ -82,7 +82,9 @@ Follow [`reference/phase-contract.md`](reference/phase-contract.md)
    that is malformed, unmet,
    stale, unapproved, or abandoned — a seal-side `gates status` reading anything
    but `all-met` means Prove's evidence is not current; return there, never
-   attest past it. It likewise refuses a malformed `notes.md` or any anchor
+   attest past it. Before the Seal wave, run `devrites-engine gates reverify <slug>
+   --transcripts` on the frozen candidate, so every gate has a transcript bound to
+   this digest for the proof runner. It likewise refuses a malformed `notes.md` or any anchor
    graded other than `exact`: `devrites-engine note check <slug> --repair`
    re-anchors `moved` notes; `stale`/`ambiguous`/`lost` ones are corrected or
    removed before GO.

package/pack/generated/pi/agents/devrites-proof-runner.md

@@ -55,7 +55,12 @@ and only the orchestrator-supplied changed paths.
    named blocker, never a pass. Otherwise use `cannot_verify`.
 8. A manual gate whose `gates.md` note lacks the human's own words or source, is a
    placeholder, or was runnable at Vet is `cannot_verify` ([`gates.md`](../skills/devrites-lib/reference/standards/gates.md)).
-9. Recheck supplied before/after candidate identities. A mismatch or unexpected
+9. An engine transcript (`DEVRITES-GATE-TRANSCRIPT v1` under `references/gates/`)
+   is immutable proof of its COMMAND, CWD, ATTEMPT, EXIT and output for the
+   candidate in CANDIDATE_BEFORE/AFTER. A `-reused.log` proves a gate for the
+   current candidate only when its INPUTS_SHA256 equals that of the gate's latest
+   executed, passing transcript.
+10. Recheck supplied before/after candidate identities. A mismatch or unexpected
    repository mutation fails the side-effect boundary.
 
 ## Rules

package/pack/generated/pi/skills/devrites-lib/reference/standards/gates.md

@@ -55,7 +55,12 @@ execute unreviewed code.
 
 Execution contract: the command runs through the platform shell in the named
 directory with a bounded timeout; pass requires exit 0 **and** output matching
-EXPECT. Output is captured but never persisted — only its digest.
+EXPECT. Without `--transcripts`, output is captured but never persisted, only its
+digest. `--transcripts` writes one file per executed or reused gate under
+`references/gates/<gate-id>/`. Each file holds the command, cwd, attempt, times,
+exit, EXPECT verdict, the candidate digest read before and after the run, and the
+output with known credential shapes masked and capped at 1 MiB. Its
+`OUTPUT_SHA256` equals the ledger evidence digest.
 
 After Vet READY the runnable set is fixed: converting a runnable gate to manual,
 loosening EXPECT, changing CHECK or CWD, adding or narrowing INPUTS, or removing

package/pack/generated/pi/skills/rite-prove/SKILL.md

@@ -84,10 +84,13 @@ test changes.
    pass is `flaky` per [`testing.md`](../devrites-lib/reference/standards/testing.md#determinism-no-flaky-tests),
    never green. Static gates prove only their named
    static criterion.
-   Run the acceptance ledger: `devrites-engine gates run <slug>` executes every
-   unmet runnable gate against the same approved preflight rows and records
-   definition-bound evidence; `gates reverify <slug>` re-executes all of them
-   when any prior pass is in doubt. Attest manual gates with `gates attest
+   Run the acceptance ledger with `--transcripts`: `devrites-engine gates run <slug>
+   --transcripts` executes every unmet runnable gate against the same approved
+   preflight rows, records definition-bound evidence, and writes one redacted,
+   candidate-bound transcript per gate under `references/gates/<gate-id>/`;
+   `gates reverify <slug> --transcripts` re-executes all of them when any prior
+   pass is in doubt. Hand the proof runner those transcripts, never hand-built
+   logs. Attest manual gates with `gates attest
    <slug> <id> <note>` only against observed judgment whose note cites the
    human's own words or source; placeholder notes are unmet and an AFK run never
    self-attests. Only gates manual at Vet are attested; runnable-to-manual

package/pack/generated/pi/skills/rite-seal/SKILL.md

@@ -82,7 +82,9 @@ Follow [`reference/phase-contract.md`](reference/phase-contract.md)
    that is malformed, unmet,
    stale, unapproved, or abandoned — a seal-side `gates status` reading anything
    but `all-met` means Prove's evidence is not current; return there, never
-   attest past it. It likewise refuses a malformed `notes.md` or any anchor
+   attest past it. Before the Seal wave, run `devrites-engine gates reverify <slug>
+   --transcripts` on the frozen candidate, so every gate has a transcript bound to
+   this digest for the proof runner. It likewise refuses a malformed `notes.md` or any anchor
    graded other than `exact`: `devrites-engine note check <slug> --repair`
    re-anchors `moved` notes; `stale`/`ambiguous`/`lost` ones are corrected or
    removed before GO.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "6.8.1",
+  "version": "6.9.0",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, pi, and Devin CLI",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",