devrites 6.9.3 → 6.9.4

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [6.9.4](https://github.com/ViktorsBaikers/DevRites/compare/v6.9.3...v6.9.4) (2026-10-19)
+
+### Fixed
+
+* **devrites:** hold evidence gaps to proportionality ([#135](https://github.com/ViktorsBaikers/DevRites/issues/135)) ([275d260](https://github.com/ViktorsBaikers/DevRites/commit/275d260d03bde41c548eec770119034cadfa5947))
+
 ## [6.9.3](https://github.com/ViktorsBaikers/DevRites/compare/v6.9.2...v6.9.3) (2026-10-18)
 
 ### Fixed

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v6.9.3`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v6.9.3): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v6.9.4`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v6.9.4): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 

package/pack/.claude/skills/devrites-lib/reference/standards/agents.md

@@ -133,7 +133,12 @@ Basis: <files read · commands run to reach this finding>
 - **`no-findings`:** `No-findings:` names checks and inspected evidence. Bare
   pass, empty list, or “looks good” is malformed.
 - **`gap`:** names missing/unreadable/stale input; skipped/failed required check;
-  tool/reviewer failure; or another limit. Required gaps block.
+  tool/reviewer failure; or another limit. Required gaps block. A reviewer gap
+  that asks for more evidence without showing a defect is required only when it
+  quotes the anchor that demands that evidence, as Proportionality does: a spec ID,
+  an owner decision, or a shipped standard rule. Without one, root logs it
+  `Deferred: <claim> — no anchor`. Advisory gaps follow
+  [security.md § Reachability sets severity](security.md#reachability-sets-severity).
 - **Transport failure is not a finding.** A read-only leaf aborted, timed out, lost,
   or with host-rejected output is `gap` quoting the host error. Re-dispatch one fresh
   child with the same brief and read-set — never a resume of the failed child. The

package/pack/.claude/skills/devrites-lib/reference/standards/security.md

@@ -120,6 +120,12 @@ as source evidence. Missing reachability or control evidence is
 `needs_validation`, not a confirmed vulnerability or a clean bill of health.
 Required unresolved evidence blocks proof and Seal. Dead or unshipped paths
 need their actual exposure stated; hypothetical future wiring is not impact.
+Per-advisory applicability is required only for a component that untrusted input
+reaches through a trust boundary the feature has. For any other component, a
+recorded reachability disposition (its role, the boundaries checked, and the
+evidence) closes its advisories. "No fixed version" alone never means unaffected.
+**Failing case:** Seal stays NO-GO for rounds on per-CVE applicability of no-fix OS
+packages in a dev image that no untrusted input reaches.
 
 ## Architecture-level signals
 

package/pack/generated/claude/skills/devrites-lib/reference/standards/agents.md

@@ -133,7 +133,12 @@ Basis: <files read · commands run to reach this finding>
 - **`no-findings`:** `No-findings:` names checks and inspected evidence. Bare
   pass, empty list, or “looks good” is malformed.
 - **`gap`:** names missing/unreadable/stale input; skipped/failed required check;
-  tool/reviewer failure; or another limit. Required gaps block.
+  tool/reviewer failure; or another limit. Required gaps block. A reviewer gap
+  that asks for more evidence without showing a defect is required only when it
+  quotes the anchor that demands that evidence, as Proportionality does: a spec ID,
+  an owner decision, or a shipped standard rule. Without one, root logs it
+  `Deferred: <claim> — no anchor`. Advisory gaps follow
+  [security.md § Reachability sets severity](security.md#reachability-sets-severity).
 - **Transport failure is not a finding.** A read-only leaf aborted, timed out, lost,
   or with host-rejected output is `gap` quoting the host error. Re-dispatch one fresh
   child with the same brief and read-set — never a resume of the failed child. The

package/pack/generated/claude/skills/devrites-lib/reference/standards/security.md

@@ -120,6 +120,12 @@ as source evidence. Missing reachability or control evidence is
 `needs_validation`, not a confirmed vulnerability or a clean bill of health.
 Required unresolved evidence blocks proof and Seal. Dead or unshipped paths
 need their actual exposure stated; hypothetical future wiring is not impact.
+Per-advisory applicability is required only for a component that untrusted input
+reaches through a trust boundary the feature has. For any other component, a
+recorded reachability disposition (its role, the boundaries checked, and the
+evidence) closes its advisories. "No fixed version" alone never means unaffected.
+**Failing case:** Seal stays NO-GO for rounds on per-CVE applicability of no-fix OS
+packages in a dev image that no untrusted input reaches.
 
 ## Architecture-level signals
 

package/pack/generated/codex/skills/devrites-lib/reference/standards/agents.md

@@ -133,7 +133,12 @@ Basis: <files read · commands run to reach this finding>
 - **`no-findings`:** `No-findings:` names checks and inspected evidence. Bare
   pass, empty list, or “looks good” is malformed.
 - **`gap`:** names missing/unreadable/stale input; skipped/failed required check;
-  tool/reviewer failure; or another limit. Required gaps block.
+  tool/reviewer failure; or another limit. Required gaps block. A reviewer gap
+  that asks for more evidence without showing a defect is required only when it
+  quotes the anchor that demands that evidence, as Proportionality does: a spec ID,
+  an owner decision, or a shipped standard rule. Without one, root logs it
+  `Deferred: <claim> — no anchor`. Advisory gaps follow
+  [security.md § Reachability sets severity](security.md#reachability-sets-severity).
 - **Transport failure is not a finding.** A read-only leaf aborted, timed out, lost,
   or with host-rejected output is `gap` quoting the host error. Re-dispatch one fresh
   child with the same brief and read-set — never a resume of the failed child. The

package/pack/generated/codex/skills/devrites-lib/reference/standards/security.md

@@ -120,6 +120,12 @@ as source evidence. Missing reachability or control evidence is
 `needs_validation`, not a confirmed vulnerability or a clean bill of health.
 Required unresolved evidence blocks proof and Seal. Dead or unshipped paths
 need their actual exposure stated; hypothetical future wiring is not impact.
+Per-advisory applicability is required only for a component that untrusted input
+reaches through a trust boundary the feature has. For any other component, a
+recorded reachability disposition (its role, the boundaries checked, and the
+evidence) closes its advisories. "No fixed version" alone never means unaffected.
+**Failing case:** Seal stays NO-GO for rounds on per-CVE applicability of no-fix OS
+packages in a dev image that no untrusted input reaches.
 
 ## Architecture-level signals
 

package/pack/generated/devin/skills/devrites-lib/reference/standards/agents.md

@@ -133,7 +133,12 @@ Basis: <files read · commands run to reach this finding>
 - **`no-findings`:** `No-findings:` names checks and inspected evidence. Bare
   pass, empty list, or “looks good” is malformed.
 - **`gap`:** names missing/unreadable/stale input; skipped/failed required check;
-  tool/reviewer failure; or another limit. Required gaps block.
+  tool/reviewer failure; or another limit. Required gaps block. A reviewer gap
+  that asks for more evidence without showing a defect is required only when it
+  quotes the anchor that demands that evidence, as Proportionality does: a spec ID,
+  an owner decision, or a shipped standard rule. Without one, root logs it
+  `Deferred: <claim> — no anchor`. Advisory gaps follow
+  [security.md § Reachability sets severity](security.md#reachability-sets-severity).
 - **Transport failure is not a finding.** A read-only leaf aborted, timed out, lost,
   or with host-rejected output is `gap` quoting the host error. Re-dispatch one fresh
   child with the same brief and read-set — never a resume of the failed child. The

package/pack/generated/devin/skills/devrites-lib/reference/standards/security.md

@@ -120,6 +120,12 @@ as source evidence. Missing reachability or control evidence is
 `needs_validation`, not a confirmed vulnerability or a clean bill of health.
 Required unresolved evidence blocks proof and Seal. Dead or unshipped paths
 need their actual exposure stated; hypothetical future wiring is not impact.
+Per-advisory applicability is required only for a component that untrusted input
+reaches through a trust boundary the feature has. For any other component, a
+recorded reachability disposition (its role, the boundaries checked, and the
+evidence) closes its advisories. "No fixed version" alone never means unaffected.
+**Failing case:** Seal stays NO-GO for rounds on per-CVE applicability of no-fix OS
+packages in a dev image that no untrusted input reaches.
 
 ## Architecture-level signals
 

package/pack/generated/omp/skills/devrites-lib/reference/standards/agents.md

@@ -133,7 +133,12 @@ Basis: <files read · commands run to reach this finding>
 - **`no-findings`:** `No-findings:` names checks and inspected evidence. Bare
   pass, empty list, or “looks good” is malformed.
 - **`gap`:** names missing/unreadable/stale input; skipped/failed required check;
-  tool/reviewer failure; or another limit. Required gaps block.
+  tool/reviewer failure; or another limit. Required gaps block. A reviewer gap
+  that asks for more evidence without showing a defect is required only when it
+  quotes the anchor that demands that evidence, as Proportionality does: a spec ID,
+  an owner decision, or a shipped standard rule. Without one, root logs it
+  `Deferred: <claim> — no anchor`. Advisory gaps follow
+  [security.md § Reachability sets severity](security.md#reachability-sets-severity).
 - **Transport failure is not a finding.** A read-only leaf aborted, timed out, lost,
   or with host-rejected output is `gap` quoting the host error. Re-dispatch one fresh
   child with the same brief and read-set — never a resume of the failed child. The

package/pack/generated/omp/skills/devrites-lib/reference/standards/security.md

@@ -120,6 +120,12 @@ as source evidence. Missing reachability or control evidence is
 `needs_validation`, not a confirmed vulnerability or a clean bill of health.
 Required unresolved evidence blocks proof and Seal. Dead or unshipped paths
 need their actual exposure stated; hypothetical future wiring is not impact.
+Per-advisory applicability is required only for a component that untrusted input
+reaches through a trust boundary the feature has. For any other component, a
+recorded reachability disposition (its role, the boundaries checked, and the
+evidence) closes its advisories. "No fixed version" alone never means unaffected.
+**Failing case:** Seal stays NO-GO for rounds on per-CVE applicability of no-fix OS
+packages in a dev image that no untrusted input reaches.
 
 ## Architecture-level signals
 

package/pack/generated/pi/skills/devrites-lib/reference/standards/agents.md

@@ -133,7 +133,12 @@ Basis: <files read · commands run to reach this finding>
 - **`no-findings`:** `No-findings:` names checks and inspected evidence. Bare
   pass, empty list, or “looks good” is malformed.
 - **`gap`:** names missing/unreadable/stale input; skipped/failed required check;
-  tool/reviewer failure; or another limit. Required gaps block.
+  tool/reviewer failure; or another limit. Required gaps block. A reviewer gap
+  that asks for more evidence without showing a defect is required only when it
+  quotes the anchor that demands that evidence, as Proportionality does: a spec ID,
+  an owner decision, or a shipped standard rule. Without one, root logs it
+  `Deferred: <claim> — no anchor`. Advisory gaps follow
+  [security.md § Reachability sets severity](security.md#reachability-sets-severity).
 - **Transport failure is not a finding.** A read-only leaf aborted, timed out, lost,
   or with host-rejected output is `gap` quoting the host error. Re-dispatch one fresh
   child with the same brief and read-set — never a resume of the failed child. The

package/pack/generated/pi/skills/devrites-lib/reference/standards/security.md

@@ -120,6 +120,12 @@ as source evidence. Missing reachability or control evidence is
 `needs_validation`, not a confirmed vulnerability or a clean bill of health.
 Required unresolved evidence blocks proof and Seal. Dead or unshipped paths
 need their actual exposure stated; hypothetical future wiring is not impact.
+Per-advisory applicability is required only for a component that untrusted input
+reaches through a trust boundary the feature has. For any other component, a
+recorded reachability disposition (its role, the boundaries checked, and the
+evidence) closes its advisories. "No fixed version" alone never means unaffected.
+**Failing case:** Seal stays NO-GO for rounds on per-CVE applicability of no-fix OS
+packages in a dev image that no untrusted input reaches.
 
 ## Architecture-level signals
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "6.9.3",
+  "version": "6.9.4",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, pi, and Devin CLI",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",