devrites 7.0.10 → 7.0.12

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.0.12](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.11...v7.0.12) (2026-10-24)
+
+### Fixed
+
+* **devrites:** resolve nested standard citation paths ([#170](https://github.com/ViktorsBaikers/DevRites/issues/170)) ([05dc684](https://github.com/ViktorsBaikers/DevRites/commit/05dc684564b2541c36db5e479ae464417dfc56d8))
+* **no-release:** label writer contract reminder as advisory ([#169](https://github.com/ViktorsBaikers/DevRites/issues/169)) ([47f298e](https://github.com/ViktorsBaikers/DevRites/commit/47f298e977622587bacad8dfe72eeb159ce8a528))
+
+## [7.0.11](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.10...v7.0.11) (2026-10-24)
+
+### Fixed
+
+* **deps:** restore dependency audits with bounded exceptions ([#168](https://github.com/ViktorsBaikers/DevRites/issues/168)) ([89b4aa7](https://github.com/ViktorsBaikers/DevRites/commit/89b4aa733d2395c09f979757cde094f57daca822))
+* **devrites:** permit proof runner read-only inspection ([#167](https://github.com/ViktorsBaikers/DevRites/issues/167)) ([aa11b9e](https://github.com/ViktorsBaikers/DevRites/commit/aa11b9e889a67f11de943fa9d90bff9ed0fd6bf3))
+
 ## [7.0.10](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.9...v7.0.10) (2026-10-23)
 
 ### Fixed

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.0.10`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.0.10): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.0.12`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.0.12): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 

package/engine/internal/lib/anchors.go

@@ -217,14 +217,15 @@ func (a anchorer) breaks(cells []string) (status, detail string) {
 		_, size := utf8.DecodeRuneInString(cited[open:])
 		name, quote := cited[:open], cited[open+size:closing]
 		var paths []string
-		switch base := mdName(name); base {
-		case "":
+		file := mdName(name)
+		switch base := filepath.Base(file); {
+		case file == "":
 			paths = []string{filepath.Join(a.workspace, "spec.md"), filepath.Join(a.workspace, "decisions.md")}
-		case "spec.md", "decisions.md":
+		case base == "spec.md" || base == "decisions.md":
 			paths = []string{filepath.Join(a.workspace, base)}
 		default:
-			if skills, err := resolveSkillsRoot(a.root, a.skillsRoot); err == nil {
-				paths = []string{filepath.Join(skills, "devrites-lib", "reference", "standards", base)}
+			if path := a.standardPath(file); path != "" {
+				paths = []string{path}
 			}
 		}
 		var text []string
@@ -265,11 +266,46 @@ func (a anchorer) lines(rel string) ([]string, error) {
 	return nil, fmt.Errorf("%s is not a file under the workspace or project", rel)
 }
 
-// mdName is the base name of the first .md file a breaks anchor names, or "".
+func (a anchorer) standardPath(name string) string {
+	name = filepath.ToSlash(name)
+	if strings.Contains("/"+name+"/", "/../") || strings.ContainsRune(name, '\\') {
+		return ""
+	}
+	skills, err := resolveSkillsRoot(a.root, a.skillsRoot)
+	if err != nil {
+		return ""
+	}
+	standards, err := filepath.Abs(filepath.Join(skills, "devrites-lib", "reference", "standards"))
+	if err != nil {
+		return ""
+	}
+	full := name
+	if !filepath.IsAbs(full) {
+		full = filepath.Join(a.project, filepath.FromSlash(name))
+	}
+	if rel, err := filepath.Rel(standards, full); err != nil || !filepath.IsLocal(rel) {
+		if !filepath.IsLocal(name) {
+			return ""
+		}
+		full = filepath.Join(standards, filepath.FromSlash(name))
+	}
+	if !safepath.WithinResolved(full, standards) {
+		return ""
+	}
+	return full
+}
+
+// mdName is the first .md path a breaks anchor names, or "".
 func mdName(name string) string {
-	for _, field := range strings.Fields(strings.ReplaceAll(name, "`", " ")) {
-		if field = strings.TrimRight(field, ",;:"); strings.HasSuffix(field, ".md") {
-			return filepath.Base(field)
+	for i, part := range strings.Split(name, "`") {
+		fields := strings.Fields(part)
+		if i%2 == 1 {
+			fields = []string{part}
+		}
+		for _, field := range fields {
+			if field = strings.TrimRight(field, ",;:"); strings.HasSuffix(field, ".md") {
+				return field
+			}
 		}
 	}
 	return ""

package/engine/internal/lib/dispatch.go

@@ -773,7 +773,7 @@ func admitWrightRounds(root, slug string, f *dispatchFile, w *dispatchWave, revi
 		}
 	}
 	if kind == "wright" {
-		lines = append(lines, "dispatch: wright contract: name the writer-safe checks the wright runs (syntax/type/lint, unit and self-check suites, a narrow local smoke) and never forbid them; only artifact-producing, consumptive, or full canonical gates stay root-owned")
+		lines = append(lines, "dispatch: ADVISORY: wright contract reminder: name the writer-safe checks the wright runs (syntax/type/lint, unit and self-check suites, a narrow local smoke) and never forbid them; only artifact-producing, consumptive, or full canonical gates stay root-owned")
 	}
 	if len(overCap) == 0 {
 		if review != "" {

package/pack/.claude/agents/devrites-proof-runner.md

@@ -60,7 +60,7 @@ and only the orchestrator-supplied changed paths.
 ## Rules
 
 - Read-only: do not edit source, tests, `.devrites/**`, Git state, or dependencies.
-- Execute no command or external write. Invoke no agent and fix nothing.
+- Read-only local filesystem inspection and digest calculations are permitted. Execute no test, build, benchmark, gate, application or other effectful command; perform no external write. Invoke no agent and fix nothing.
 - Return a reproduction. Unavailable proof is `cannot_verify`, never pass.
 
 ## Output format

package/pack/generated/claude/agents/devrites-proof-runner.md

@@ -66,7 +66,7 @@ and only the orchestrator-supplied changed paths.
 ## Rules
 
 - Read-only: do not edit source, tests, `.devrites/**`, Git state, or dependencies.
-- Execute no command or external write. Invoke no agent and fix nothing.
+- Read-only local filesystem inspection and digest calculations are permitted. Execute no test, build, benchmark, gate, application or other effectful command; perform no external write. Invoke no agent and fix nothing.
 - Return a reproduction. Unavailable proof is `cannot_verify`, never pass.
 
 ## Output format

package/pack/generated/codex/agents/devrites-proof-runner.toml

@@ -64,7 +64,7 @@ and only the orchestrator-supplied changed paths.
 ## Rules
 
 - Read-only: do not edit source, tests, `.devrites/**`, Git state, or dependencies.
-- Execute no command or external write. Invoke no agent and fix nothing.
+- Read-only local filesystem inspection and digest calculations are permitted. Execute no test, build, benchmark, gate, application or other effectful command; perform no external write. Invoke no agent and fix nothing.
 - Return a reproduction. Unavailable proof is `cannot_verify`, never pass.
 
 ## Output format

package/pack/generated/devin/agents/devrites-proof-runner.md

@@ -68,7 +68,7 @@ and only the orchestrator-supplied changed paths.
 ## Rules
 
 - Read-only: do not edit source, tests, `.devrites/**`, Git state, or dependencies.
-- Execute no command or external write. Invoke no agent and fix nothing.
+- Read-only local filesystem inspection and digest calculations are permitted. Execute no test, build, benchmark, gate, application or other effectful command; perform no external write. Invoke no agent and fix nothing.
 - Return a reproduction. Unavailable proof is `cannot_verify`, never pass.
 
 ## Output format

package/pack/generated/omp/agents/devrites-proof-runner.md

@@ -65,7 +65,7 @@ and only the orchestrator-supplied changed paths.
 ## Rules
 
 - Read-only: do not edit source, tests, `.devrites/**`, Git state, or dependencies.
-- Execute no command or external write. Invoke no agent and fix nothing.
+- Read-only local filesystem inspection and digest calculations are permitted. Execute no test, build, benchmark, gate, application or other effectful command; perform no external write. Invoke no agent and fix nothing.
 - Return a reproduction. Unavailable proof is `cannot_verify`, never pass.
 
 ## Output format

package/pack/generated/pi/agents/devrites-proof-runner.md

@@ -66,7 +66,7 @@ and only the orchestrator-supplied changed paths.
 ## Rules
 
 - Read-only: do not edit source, tests, `.devrites/**`, Git state, or dependencies.
-- Execute no command or external write. Invoke no agent and fix nothing.
+- Read-only local filesystem inspection and digest calculations are permitted. Execute no test, build, benchmark, gate, application or other effectful command; perform no external write. Invoke no agent and fix nothing.
 - Return a reproduction. Unavailable proof is `cannot_verify`, never pass.
 
 ## Output format

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "7.0.10",
+  "version": "7.0.12",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, pi, and Devin CLI",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",
@@ -92,7 +92,7 @@
     "@semantic-release/npm": {
       "npm": "11.21.1"
     },
-    "fast-uri": "3.1.8",
+    "fast-uri": "3.1.9",
     "js-yaml": "4.3.2"
   }
 }