devrites 7.0.2 → 7.0.3

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.0.3](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.2...v7.0.3) (2026-10-21)
+
+### Changed
+
+* **no-release:** move the Go toolchain to go1.27.3 ([#155](https://github.com/ViktorsBaikers/DevRites/issues/155)) ([293da70](https://github.com/ViktorsBaikers/DevRites/commit/293da70c8c4b4de8ed22caababa7914594c1ff9b))
+
+### Fixed
+
+* **devrites:** freeze and probe a parallel sibling in its worktree ([#156](https://github.com/ViktorsBaikers/DevRites/issues/156)) ([e959804](https://github.com/ViktorsBaikers/DevRites/commit/e959804721f291db3b489eb30988792c5ab3c3fb))
+* **no-release:** check anchors blocks prose-only blocker returns ([#154](https://github.com/ViktorsBaikers/DevRites/issues/154)) ([0807fe2](https://github.com/ViktorsBaikers/DevRites/commit/0807fe2f92100188616110beb037d81e752ee1b8))
+* **no-release:** traceability progress cells no longer stale readiness ([#153](https://github.com/ViktorsBaikers/DevRites/issues/153)) ([7465b3e](https://github.com/ViktorsBaikers/DevRites/commit/7465b3eaaf180718015dfdab3d0af96579ab5b85))
+
 ## [7.0.2](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.1...v7.0.2) (2026-10-20)
 
 ### Fixed

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.0.2`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.0.2): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.0.3`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.0.3): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 

package/docs/adr/0027-content-bound-build-readiness.md

@@ -83,3 +83,13 @@ every canonical `AC-###` ID in `spec.md`'s Acceptance criteria section to appear
 as a literal substring in `tasks.md`. When `test-plan.md` is required, the same
 IDs must appear there. This is identity presence, not semantic coverage. Guard:
 `engine/internal/state/acceptance_test.go`.
+
+## Amendment (2026-10-21)
+
+Build and Prove fill `traceability.md`'s Evidence and Status cells as evidence
+lands, and those cells are Build-mutable evidence projections that Vet does not
+approve. The binding therefore hashes `traceability.md` with every cell under an
+`Evidence` or `Status` table header blanked; every other byte stays bound. A
+binding line recorded over the raw bytes still verifies in `check readiness`
+while the inputs are unchanged, and `check drift` reports a change confined to those cells as
+`progress-only`. Guard: `engine/internal/gate/readiness_binding_test.go`.

package/docs/cli.md

@@ -26,7 +26,7 @@ devrites-engine check preconditions <slug> [--slice SLICE-###] [--timeout N]
 devrites-engine check seal <slug>
 devrites-engine check slice <slug> <SLICE-ID>
 devrites-engine check diff-scope <slug> --allow <csv>|--allow-file <path> [--worktree|--staged|--base <ref>] [--snapshot|--baseline] [--verbose]
-devrites-engine check perturb <slug> --patch <file> --expect <test-name> --gate <G-ID> [--timeout N]
+devrites-engine check perturb <slug> --patch <file> --expect <test-name> --gate <G-ID> [--timeout N] [--worktree <path> --slice <SLICE-ID>]
 devrites-engine check task-graph <slug>
 devrites-engine check regression <slug> [--update]
 devrites-engine check drift <slug> [--record]
@@ -48,7 +48,7 @@ devrites-engine context [slug] (--phase <p>|--skill <name>) [--role <r>] [--whol
 devrites-engine metrics record <slug> --phase <p> --event <e>
 devrites-engine metrics summary [slug]
 devrites-engine dispatch <slug> <open|start|seal|return|status|abandon|attribute>
-devrites-engine candidate freeze <slug> --wave <w> (--slice <SLICE-ID>|--paths <path>...) [--base <ref>]
+devrites-engine candidate freeze <slug> --wave <w> (--slice <SLICE-ID>|--paths <path>...) [--base <ref>] [--worktree <path>]
 devrites-engine packet <slug> --wave <w> --phase <p> --role <r> [--slice <SLICE-ID>] [--recheck] [--checks <G-ID,...>] [--focus <file>]
 devrites-engine parallel <subcommand>
 devrites-engine gates <subcommand> <slug>
@@ -160,7 +160,8 @@ self-contained updater.
   ones; unresolved slots print `unresolved` rather than guessing.
 - `check anchors <slug> <return-file>` anchors each Critical/Important row's
   quote at its cited `file:line` and its `breaks` quote; Unverified or Deferred
-  rows exit `3` and never drive a repair round.
+  rows exit `3` and never drive a repair round. A `Counts:` head declaring more
+  Critical/Important findings than there are `Finding:` rows also exits `3`.
 - `check dup [slug] [--all|--worktree|--staged|--base <ref>]` reports advisory
   near-duplicate code clusters that survive comment stripping, literal
   collapsing, and identifier renaming. Diff modes mark units overlapping

package/docs/engine/commands.md

@@ -24,10 +24,10 @@ workflow strategy.
 | `check drift <slug> [--record]` | Attribute readiness-input changes to the exact artifact. `--record` writes the per-input `readiness-inputs.json` digest baseline under the feature lock; without it the workspace diffs current inputs against that baseline (or falls back to the aggregate binding recorded in `eng-review.md`). Advisory: exit `0` on drift; a corrupt baseline exits `3`. A `test-plan.md` change limited to exact `Workflow Artifact reviewed identity: <64hex>` lines is reported as `reviewed-identity-only` (ADR-0034). `--record` also stores each slice's proof bytes (its `tasks.md` block plus the `test-plan.md` lines naming it); both modes print `ADVISORY proportion:` for a slice whose proof grew over 2x since that baseline or carries over 3x the median proof per AC. |
 | `check windows <slug> [--worktree\|--staged\|--base <ref>\|--since-dispatch <wave>]` | Fail on deferral and bar-lowering markers the change introduces without a waiver row in the workspace's `windows.md`: added TODO/FIXME/XXX/HACK, skipped/focused-test and stub idioms, checker suppressions, one-line empty catch; removed `deleted-test` files and net `removed-assertion` lines in remaining test files. `--since-dispatch <wave>` reports only `deleted-test`/`removed-assertion` against the work-tree snapshot (`tree` in `dispatch.json`) recorded when that build wright wave opened, untracked files included; it takes no `--cwd` and records the `windows-since` metric. |
 | `check dup [slug] [--all\|--worktree\|--staged\|--base <ref>] [--min-lines n] [--threshold f] [--ignore-file <path>] [--limit n] [--exclude <csv>]` | Report near-duplicate code clusters that survive comment stripping, literal collapsing, and identifier renaming — token-shingle matches chained into segments, clustered transitively, ranked with bounded path/line-distance boosts. Diff modes mark units overlapping changed hunks with `*`; stable content-derived cluster hashes let `.devrites/dup-ignore` dismissals survive line moves but resurface on structural edits. Staged mode reads index blobs and excludes untracked files. Bounded heuristic: successful scans/leads exit `0`; usage, unavailable input, and partial scans exit `2`. |
-| `check anchors <slug> <return-file> [--skills-root <dir>]` | Deterministic quote anchoring for one reviewer return (agents.md § Result admission). For each Critical/Important `Finding:` row (list markers and bold tolerated), it anchors the backticked observed quote at the cited `path:line[-line]`, looking in the workspace first, then the project, never outside either. Exact match → `anchored`. Exactly one other line → `relocated <cited> -> path:N`. Otherwise → `Unverified: <row> — anchor lost\|ambiguous`; this also covers a missing file:line or quote, or a quote under 8 characters. The `breaks "<quote>"` must appear in spec.md/decisions.md (spec ID) or in the named shipped standard under the skills root (`--skills-root` for host installs). No breaks quote → `Deferred: <row> — no spec anchor`. Prints the candidate digest and records an `anchors` metrics event. Exit `0` all anchored, `3` any Unverified/Deferred row (never drives a repair round), `2` usage or unreadable input. |
+| `check anchors <slug> <return-file> [--skills-root <dir>]` | Deterministic quote anchoring for one reviewer return (agents.md § Result admission). For each Critical/Important `Finding:` row (list markers and bold tolerated), it anchors the backticked observed quote at the cited `path:line[-line]`, looking in the workspace first, then the project, never outside either. Exact match → `anchored`. Exactly one other line → `relocated <cited> -> path:N`. Otherwise → `Unverified: <row> — anchor lost\|ambiguous`; this also covers a missing file:line or quote, or a quote under 8 characters. The `breaks "<quote>"` must appear in spec.md/decisions.md (spec ID) or in the named shipped standard under the skills root (`--skills-root` for host installs). No breaks quote → `Deferred: <row> — no spec anchor`. Prints the candidate digest and records an `anchors` metrics event. Exit `0` all anchored, `3` any Unverified/Deferred row (never drives a repair round) or a `Counts:` head declaring more Critical/Important findings than `Finding:` rows, `2` usage or unreadable input. |
 | `check slice <slug> <SLICE-ID>` | Pre-dispatch lint of one slice's wright contract: contract present, exact Writer allowlist paths, resolvable `Satisfies` AC ids, bounded scope. Same non-blocking size advisory as `check task-graph`, plus the `check drift` proportion advisory for that slice. |
 | `check diff-scope <slug> --allow <csv>\|--allow-file <path> [--worktree\|--staged\|--base <ref>] [--baseline] [--verbose]`, `check diff-scope <slug> --snapshot` | Verify the changed-path set stays inside the declared allowlist; the mechanical gate run before reviewer dispatch. `--snapshot` records the mode and SHA-256 of every currently changed path in `<feature>/diff-scope-baseline.json` (an engine machine file, never reported); run it before writer dispatch. `--baseline` drops a changed path whose fingerprint still matches, printing `preexisting (unchanged)`; a baselined path whose bytes or mode changed, or a new path, still blocks; a run with only preexisting changes is an empty diff; a missing baseline exits `2`. More than 20 violations print grouped by the first two path segments (count plus 3 examples, at most 20 groups); `--verbose` lists every path. Exit codes are unchanged. |
-| `check perturb <slug> --patch <file> --expect <test-name> --gate <G-ID> [--timeout N]` | Safe-perturbation probe (testing.md § Safe perturbation). Copies the candidate (HEAD plus every touched-files.md manifest row, at the project's prefix below the git toplevel) into a detached temporary worktree, requires it to hash to the `check candidate` digest, applies the wright-supplied mutant patch (toplevel-relative paths), and runs the gate's CHECK only when it is an approved test-plan.md preflight row. RED counts only when a runner FAIL line (go test, pytest, cargo test, jest/vitest) names `--expect`; build/setup failure, timeout, exit 0 (survivor), or a RED naming only other tests is `cannot_verify`. Reverts the patch, requires the copy back at the candidate digest and the gate GREEN (exit 0 plus EXPECT), and requires the checkout candidate unchanged. Writes `<feature>/evidence/perturb/<gate>-<digest12>-aN.log`. Never mutates the checkout. Exit `0` verified, `3` cannot_verify or refused, `2` usage. |
+| `check perturb <slug> --patch <file> --expect <test-name> --gate <G-ID> [--timeout N] [--worktree <path> --slice <SLICE-ID>]` | Safe-perturbation probe (testing.md § Safe perturbation). Copies the candidate (HEAD plus every touched-files.md manifest row, at the project's prefix below the git toplevel) into a detached temporary worktree, requires it to hash to the `check candidate` digest, applies the wright-supplied mutant patch (toplevel-relative paths), and runs the gate's CHECK only when it is an approved test-plan.md preflight row. RED counts only when a runner FAIL line (go test, pytest, cargo test, jest/vitest) names `--expect`; build/setup failure, timeout, exit 0 (survivor), or a RED naming only other tests is `cannot_verify`. Reverts the patch, requires the copy back at the candidate digest and the gate GREEN (exit 0 plus EXPECT), and requires the checkout candidate unchanged. Writes `<feature>/evidence/perturb/<gate>-<digest12>-aN.log`. Never mutates the checkout. `--worktree <path> --slice <SLICE-ID>` (both or neither) probes a linked worktree of the same repository instead (a parallel sibling, checked as for `candidate freeze --worktree`): its HEAD plus the slice's tasks.md write set, hashed as `candidate freeze` does, with `--patch` resolved against the worktree; the transcript stays under the control workspace. Exit `0` verified, `3` cannot_verify or refused, `2` usage. |
 | `check skill-trust <path>` | Scan one skill/agent Markdown file for structural trust violations. |
 | `check indexes [--root <dir>]` | Report install manifest and in-repo code-index artifact presence (`.codebase-memory/`) as JSON. codebase-memory-mcp normally indexes into its central store, so its `index_status` is authoritative. |
 | `observe summary <slug>` | Emit a sanitized workspace summary, as one compact JSON line, from one retained observation. `task_graph.ok` is true iff `task_graph.problems` is empty; `problems` lists cycle, unknown-dep, malformed-token, duplicate-id, and missing-`Dependencies` blockers. `inflight_waves` lists dispatch waves still `open` or `sealed`, with their pending roles. |
@@ -38,7 +38,7 @@ workflow strategy.
 | `recall --paths <p1,p2,...> [--limit n]` | Read-time query over `.devrites/archive/`: list archived features whose `touched-files.md` candidate manifest covers a queried project-relative path (exact or directory prefix, case-folded), ranked by overlap count, then newest archive-directory mtime, then slug (default 10 features). Each feature prints up to 8 `archive/<slug>/<file>:<line>` pointers, then `+N more`: `decisions.md` `DEC-###` entries and `## Carry-forward constraints` bullets whose `Files:` overlap (or a constraint naming no files), plus `review.md`/`seal.md`/`drift.md` lines that mention a queried path; fenced examples are ignored. Never writes, caches, or indexes (no metric either); symlinked archive entries are refused. An unreadable archive file prints `unreadable:` and the scan continues. Exit `0` (including `recall: no archive`), `1` invalid archive directory, `2` usage. |
 | `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--slice <SLICE-ID>] [--recheck <inventory>] [--trigger a,b] [--inline-contract] [--whole]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. A root `--phase build\|autocomplete` bundle (no `--role`, no `--slice`) defaults to `--slice <active_slice>` while the state.md cursor phase is `build` and active_slice names a slice present in tasks.md (prints `scope: slice SLICE-### (auto from state.md) ...`); `--whole` opts out. Every bundle opens, after its header comments, with a table of contents: one `L<start>-<end> <section label>` line per `===== label =====` section, giving its exact line range in the bundle file. A bundle without `--role` (the root's own read) gives over-budget artifacts as by-reference indexes; a `--role` bundle leads with the role's agent contract and names the manifest's `rootOnly` paths instead of inlining them. When the contract resolves under `.claude/agents`, `.omp/agents`, or `.codex/agents` (the host loads it as the agent's system prompt), the bundle writes one header line naming its path, size, and SHA-256 instead of the body; other layouts (pi, devin, unknown) and `--inline-contract` (only with `--role`) inline the body, and a missing contract still exits `3`. Inside inlined files, a `--role` bundle replaces each `<!-- root-only -->`…`<!-- /root-only -->` block with a one-line stub naming the omitted heading, and does the same for each `<!-- model-surface -->` block unless the role is `security-auditor`, the feature has an `ai-spec.md`, or `spec.md`/`plan.md`/`tasks.md`/`design-brief.md` are absent or (outside the spec template's `AI-SPEC annex`) name a model, agent, RAG, or tool surface; an unbalanced or headingless marker exits `2`. `--slice` inlines that slice's `tasks.md` block and turns each over-budget artifact, and each artifact over 16 KiB except `spec.md`, into a by-reference index (path, SHA-256, headings, line hits for every ID the block cites); repeat `--slice` for several slices; an unknown slice exits `3`. In phase `build`, a `--role` bundle other than `slice-wright` without `--slice` exits `3` (`unscoped build reviewer bundle`). `--recheck <inventory>` (phase `build`, with `--role` and `--slice`; path relative to the workspace) writes `<phase>-<role>.<slice>.recheck.bundle.md`: the inventory file and `core.md` inline whole, every other non-`rootOnly` pack file becomes a by-reference index (path, SHA-256, headings with line numbers) followed by each section the inventory cites as `<file>.md § <heading>`; workspace handling matches `--slice`. A missing or empty inventory exits `2`. First reviews, full-inventory rechecks, Vet, `/rite-review`, and Seal do not use it. |
 | `dispatch <slug> <open\|start\|seal\|return\|status\|abandon\|attribute>` | Launch-wave barrier for parallel dispatch: seal needs a handle per role, return needs seal; the start that gives the last role its handle seals the wave, and an explicit seal on a sealed wave is a no-op; `open --claim-session <id> --claim <path>... [--claim-ttl <minutes>]` records one file claim for the wave in claims.jsonl and exits `3`, creating no wave and no claim, while a live foreign session holds an overlapping path; the return that completes the wave releases that claim; `abandon --release` releases it on any other host-confirmed terminal path (a stop or a refused launch); re-opening an abandoned wave inherits its kept claim or, with new claim flags, replaces and releases it; claim flags apply to open only and `--release` to abandon only; start/return auto-record metrics, `return --outcome findings|no-findings|gap` records the role's Outcome line, and `abandon` records its reason, so `metrics summary` shows per-role yield and lost waves. Bare `status` prints every open, sealed, or abandoned wave and folds complete waves into one `N complete wave(s) (use --all)` line; `--all` lists every wave; it still exits nonzero while any wave is open or sealed. For a reviewer, auditor, or test-analyst role, `return --result <file>` stores the return verbatim as `packets/<wave>-<role>.return.md` (exit `3` if that file exists), derives the outcome from its `Outcome:`/`Counts:` head (a malformed or inconsistent head records `gap` with a warning, never `no-findings`), exits `3` when an explicit `--outcome` disagrees, and records each `Finding:` row's `role|slice|file|section|severity` key, so `metrics summary` adds per-role `resolution: resolved re-raised open late` counts. A `--result` file that already is that `packets/` path is kept as the stored return. A build wave with a wright role needs `--slice <SLICE-ID>` per slice, and a slice-bound vet wave takes it too; a reviewer-only wave (for example a Build slice review) may take it, uncapped, so its `Finding:` keys name that slice; a reviewer, auditor, or test-analyst wave needs `--packet <file>` and `open` exits `3` on a packet that seeds a conclusion (gate `*-PASS` token, `no-findings`, an `Outcome:`/`Counts:` line, an "already passed" claim, or zero Critical/Important counts) or tells the agent to read an installed `agents/devrites-*.md`/`.toml` role contract (on the line or under a "Read …" heading or label; canonical `pack/` paths excepted), and a wright wave's `--contract` gets the same role-contract check; a Review or Seal reviewer wave also exits `3` unless the packet names an existing non-empty `.diff`/`.patch` file and the manifest covers every checkpointed path; every 5 rounds of either kind on one slice, `open` exits `3` until `--reslice-review <DRIFT-ID>` names an unused `drift.md` `## <DRIFT-ID>` heading for that slice. `open` also warns when an earlier wave for the same slice never returned. Under `.devrites/AFK` max_parallel >= 2, a first-round build wright wave narrower than the `parallel select --from-plan` batch exits `3` (printing the batch, the command and the parallel-batch lifecycle) until evidence.md records `serial: <skipped ids> — <reason>`; repair rounds, lease siblings and HITL runs are never refused. A build wright `--contract` must name `gates precheck` under `Writer-safe checks:` when gates.md has a `RUN: writer` gate. `open` exits `3` when a `--role` names no pack agent in a project-level install (a `.<lane>` suffix is allowed), and lints a reviewer packet against the wave's roles, so a recheck may name its own role's fingerprint. Root-edit tripwire (ADR-0038): the first `open` records `<feature>/tree-baseline.json`, which maps dirty product paths outside `.devrites/` and `.scratch/` to their mode plus SHA-256, accepted as user work. The return that completes a wright wave (any phase) adds its slice write sets and claim paths. `open` exits `3` with `unattributed root edit: <paths>` while a dirty product path differs from that baseline and no live claim or in-flight wright wave covers it, unless the new wright wave covers the path through `--claim` or a slice write set. `attribute --reason <evidence> --path <path>...` records owner work, gate output, a standalone wright, or a sanctioned root write for flagged paths only. Each finding writes an `unattributed-edit` metrics row. The engine never reverts a file, and a workspace without the baseline is never blocked. |
-| `candidate freeze <slug> --wave <w> (--slice <SLICE-ID> \| --paths <path>...) [--base <ref>]` | Writes packets/<w>.diff (tracked changes vs base, default HEAD, plus untracked files as /dev/null diffs) and packets/<w>.sha256 (base, diff digest, per-file sha256, aggregate check-candidate digest); never replaces a wave's frozen candidate with a different one. |
+| `candidate freeze <slug> --wave <w> (--slice <SLICE-ID> \| --paths <path>...) [--base <ref>] [--worktree <path>]` | Writes packets/<w>.diff (tracked changes vs base, default HEAD, plus untracked files as /dev/null diffs) and packets/<w>.sha256 (base, diff digest, per-file sha256, aggregate check-candidate digest); never replaces a wave's frozen candidate with a different one. `--worktree <path>` (requires `--base`) reads the same path set from a parallel sibling's linked worktree before it lands: the path must be a symlink-free worktree top level that `git worktree list` names, shares the control repository, and is neither a submodule nor the control checkout. It exits `3` on uncommitted path-set changes there and adds a `head <sha>` row naming the worktree HEAD (the transfer commit); packets stay in the control workspace. |
 | `packet <slug> --wave <w> --phase <p> --role <r> [--slice <SLICE-ID>] [--recheck] [--checks <G-ID,...>] [--focus <file>]` | Renders one reviewer/auditor/test-analyst or same-worktree slice-wright by-reference packet (packets/<w>.<role>.md, or packets/<w>.contract.md for a wright) naming the context bundle (the .recheck bundle with `--recheck`) and frozen diff. It copies packets/<w>.sha256 (header rows only when large), resolves `--checks` through gates.md and approved preflight rows (adding `gates precheck` for `RUN: writer` gates), and accepts only anchored `--focus` rows (a doubt-reviewer's 1-3 row claim is required). It runs the dispatch open lints on a draft and never replaces a prior packet with a refused one (exit `3`). |
 | `metrics record <slug> --phase <p> --event <e> [--role r] [--bytes n] [--note s]` | Append an event to the workspace's `metrics.jsonl` ledger. |
 | `metrics summary [slug] [--by-slice]` | Reduce `metrics.jsonl` into a per-phase roll-up. `--by-slice` reads `dispatch.json` instead: per slice, build wright rounds, slice-bound Vet rechecks, and agent-minutes (role start to `returned_at`; abandoned waves excluded). When the ledger has `resume` events it adds `resumes count=N minutes_to_dispatch=...` (each resume timed to the next `dispatch` event; `none` when another resume came first, `open` when none followed). |

package/docs/engine/workspace-schema.md

@@ -69,7 +69,9 @@ identity binds raw bytes for `spec.md`, `decision-coverage.md`,
 `architecture.md`, `plan.md`, `tasks.md`, `traceability.md`, and
 `test-plan.md`; it also binds presence or absence and bytes for optional
 `strategy.md`, `design-brief.md`, `ai-spec.md`, and project-root
-`.devrites/principles.md`. It excludes Build-mutable ledgers and evidence.
+`.devrites/principles.md`. It excludes Build-mutable ledgers and evidence. Cells under a `traceability.md` table's `Evidence` or `Status`
+header are blanked before hashing, so recording progress there does not stale
+the binding.
 
 Each input is limited to 1 MiB and the aggregate to 8 MiB; symlinks and
 non-regular files fail closed. Ordinary readiness verifies the binding whenever

package/engine/go.mod

@@ -2,4 +2,4 @@ module github.com/devrites/devrites
 
 go 1.26
 
-toolchain go1.27.2
+toolchain go1.27.3

package/engine/help.go

@@ -24,7 +24,7 @@ const (
   check slice <slug> <SLICE-ID>
   check diff-scope <slug> --allow <csv> | --allow-file <path> [--worktree|--staged|--base <ref>] [--allow-empty] [--baseline] [--verbose] [--cwd <dir>]
   check diff-scope <slug> --snapshot [--worktree|--staged|--base <ref>] [--cwd <dir>]
-  check perturb <slug> --patch <file> --expect <test-name> --gate <G-ID> [--timeout N]
+  check perturb <slug> --patch <file> --expect <test-name> --gate <G-ID> [--timeout N] [--worktree <path> --slice <SLICE-ID>]
   check skill-trust <path>
   check indexes [--root <dir>]
   check regression <slug> [--update]

package/engine/internal/gate/readiness_binding.go

@@ -49,6 +49,10 @@ func ReadinessBinding(root, slug string) (string, error) {
 }
 
 func readinessBindingFromObservation(observation *state.WorkspaceObservation) (string, error) {
+	return bindReadinessInputs(observation, true)
+}
+
+func bindReadinessInputs(observation *state.WorkspaceObservation, blankProgress bool) (string, error) {
 	digest := sha256.New()
 	writeReadinessField(digest, readinessBindingDomain)
 	writeReadinessField(digest, readinessBindingVersion)
@@ -58,6 +62,9 @@ func readinessBindingFromObservation(observation *state.WorkspaceObservation) (s
 		if err != nil {
 			return "", err
 		}
+		if blankProgress && input.logical == "traceability.md" {
+			content = withoutProgressCells(content)
+		}
 		writeReadinessField(digest, string(input.logical))
 		if present {
 			writeReadinessField(digest, "present")
@@ -110,6 +117,12 @@ func verifyReadinessBinding(observation *state.WorkspaceObservation) (string, er
 	if err != nil {
 		return "", err
 	}
+	// A line recorded over the raw bytes, before progress cells were blanked,
+	// still verifies while those bytes are unchanged.
+	legacy, err := bindReadinessInputs(observation, false)
+	if err != nil {
+		return "", err
+	}
 	fact, ok := observation.Fact("eng-review.md")
 	if !ok || fact.State() == state.ArtifactAbsent {
 		return expected, errors.New("readiness input eng-review.md is missing")
@@ -130,7 +143,7 @@ func verifyReadinessBinding(observation *state.WorkspaceObservation) (string, er
 			continue
 		}
 		attempts++
-		if line == expected {
+		if line == expected || line == legacy {
 			matches++
 		}
 	}
@@ -150,7 +163,7 @@ type ReadinessInputDigest struct {
 	SHA256  string `json:"sha256,omitempty"`
 	// Normalized is test-plan.md's digest without its reviewed-identity lines,
 	// so drift can prove a Workflow Artifact byte correction changed nothing
-	// else Vet approved.
+	// else Vet approved, or traceability.md's digest without progress cells.
 	Normalized string `json:"normalized,omitempty"`
 }
 
@@ -187,9 +200,13 @@ func ReadinessInputDigests(root, slug string) ([]ReadinessInputDigest, string, e
 		if present {
 			sum := sha256.Sum256(content)
 			entry.SHA256 = hex.EncodeToString(sum[:])
-			if input.logical == "test-plan.md" {
+			switch input.logical {
+			case "test-plan.md":
 				normalized := sha256.Sum256(withoutReviewedIdentity(content))
 				entry.Normalized = hex.EncodeToString(normalized[:])
+			case "traceability.md":
+				normalized := sha256.Sum256(withoutProgressCells(content))
+				entry.Normalized = hex.EncodeToString(normalized[:])
 			}
 		}
 		digests = append(digests, entry)
@@ -197,6 +214,83 @@ func ReadinessInputDigests(root, slug string) ([]ReadinessInputDigest, string, e
 	return digests, binding, nil
 }
 
+// progressColumns name the traceability.md columns Build and Prove fill in as
+// evidence lands. Vet approves the rows, not their progress, so the binding
+// blanks these cells and keeps every other cell byte-exact.
+var progressColumns = map[string]bool{"evidence": true, "status": true}
+
+var delimiterCellRE = regexp.MustCompile(`^\s*:?-+:?\s*$`)
+
+// withoutProgressCells blanks every Evidence and Status cell in the Markdown
+// tables of content. A table is the header row, its delimiter row, and the
+// table rows that follow.
+func withoutProgressCells(content []byte) []byte {
+	lines := strings.Split(string(content), "\n")
+	var blank []int
+	for i, line := range lines {
+		prefix, cells, ok := tableCells(line)
+		switch {
+		case !ok:
+			blank = nil
+		case i+1 < len(lines) && delimiterRow(lines[i+1]):
+			blank = nil
+			for c, cell := range cells {
+				if progressColumns[strings.ToLower(strings.TrimSpace(cell))] {
+					blank = append(blank, c)
+				}
+			}
+		case len(blank) > 0 && !delimiterRow(line):
+			for _, c := range blank {
+				if c < len(cells) {
+					cells[c] = ""
+				}
+			}
+			lines[i] = prefix + "|" + strings.Join(cells, "|") + "|"
+		}
+	}
+	return []byte(strings.Join(lines, "\n"))
+}
+
+// tableCells splits a Markdown table row on its unescaped pipes. prefix is the
+// indentation before the first pipe.
+func tableCells(line string) (prefix string, cells []string, ok bool) {
+	trimmed := strings.TrimRight(strings.TrimSuffix(line, "\r"), " \t")
+	start := strings.Index(trimmed, "|")
+	if start < 0 || strings.TrimSpace(trimmed[:start]) != "" {
+		return "", nil, false
+	}
+	var cell strings.Builder
+	for i := start + 1; i < len(trimmed); i++ {
+		switch {
+		case trimmed[i] == '\\' && i+1 < len(trimmed) && trimmed[i+1] == '|':
+			cell.WriteString(`\|`)
+			i++
+		case trimmed[i] == '|':
+			cells = append(cells, cell.String())
+			cell.Reset()
+		default:
+			cell.WriteByte(trimmed[i])
+		}
+	}
+	if cell.Len() > 0 {
+		cells = append(cells, cell.String())
+	}
+	return trimmed[:start], cells, true
+}
+
+func delimiterRow(line string) bool {
+	_, cells, ok := tableCells(line)
+	if !ok || len(cells) == 0 {
+		return false
+	}
+	for _, cell := range cells {
+		if !delimiterCellRE.MatchString(cell) {
+			return false
+		}
+	}
+	return true
+}
+
 func readinessDiagnosticError(diagnostic state.ArtifactDiagnostic) error {
 	prefix := fmt.Sprintf("readiness input %s is %s (%s); ", diagnostic.Path, diagnostic.State, diagnostic.Code)
 	repair := diagnosticRepair(diagnostic.Code)

package/engine/internal/lib/anchors.go

@@ -108,6 +108,12 @@ func RunCheckAnchors(root string, args []string, stdout, stderr io.Writer) int {
 	summary := fmt.Sprintf("anchored=%d relocated=%d unverified=%d deferred=%d",
 		counts["anchored"], counts["relocated"], counts["Unverified"], counts["Deferred"])
 	recordMetricNote(root, slug, cursorPhase(root, slug), "anchors", "", summary)
+	// A head that declares more blockers than there are Finding: rows means
+	// rows were written as prose; zero parsed rows must not read as clean.
+	if declared := declaredBlockers(string(raw)); declared > rows {
+		fmt.Fprintf(stdout, "check anchors: BLOCKED: Counts declares %d Critical/Important but %d are Finding: rows; rewrite each as a Finding: row and rerun\n", declared, rows)
+		return 3
+	}
 	if counts["Unverified"]+counts["Deferred"] > 0 {
 		fmt.Fprintf(stdout, "check anchors: BLOCKED: %d Critical/Important rows, %s; Unverified and Deferred rows never drive a repair round\n", rows, summary)
 		return 3
@@ -116,6 +122,26 @@ func RunCheckAnchors(root string, args []string, stdout, stderr io.Writer) int {
 	return 0
 }
 
+// declaredBlockers sums the critical and important entries of the return's
+// first Counts: line, or 0 when there is none.
+func declaredBlockers(text string) int {
+	for _, line := range strings.Split(text, "\n") {
+		rest, ok := strings.CutPrefix(strings.TrimSpace(line), "Counts:")
+		if !ok {
+			continue
+		}
+		total := 0
+		for _, field := range strings.Fields(rest) {
+			if m := countRE.FindStringSubmatch(field); m != nil && (m[1] == "critical" || m[1] == "important") {
+				n, _ := strconv.Atoi(m[2])
+				total += n
+			}
+		}
+		return total
+	}
+	return 0
+}
+
 // row classifies one blocker row: anchored, relocated, Unverified or Deferred.
 func (a anchorer) row(cells []string) (status, detail string) {
 	if len(cells) < 3 {

package/engine/internal/lib/drift.go

@@ -132,7 +132,14 @@ func compareDrift(workspace, baselinePath string, digests []gate.ReadinessInputD
 	if !hasBaseline {
 		return compareDriftFallback(workspace, binding, stdout)
 	}
-	diffs := diffInputs(baseline.Inputs, digests)
+	var diffs []driftDiff
+	for _, d := range diffInputs(baseline.Inputs, digests) {
+		if d.Kind == "progress-only" {
+			fmt.Fprintf(stdout, "check drift: %s progress-only — only Evidence/Status cells moved; no re-vet needed\n", d.Path)
+			continue
+		}
+		diffs = append(diffs, d)
+	}
 	if len(diffs) == 0 && baseline.Binding == binding {
 		fmt.Fprintf(stdout, "check drift: none (baseline %s)\n", baseline.RecordedAt)
 		return 0
@@ -215,6 +222,9 @@ func diffInputs(base, current []gate.ReadinessInputDigest) []driftDiff {
 			kind := "changed"
 			if b.Normalized != "" && b.Normalized == c.Normalized {
 				kind = "reviewed-identity-only"
+				if b.Path == "traceability.md" {
+					kind = "progress-only"
+				}
 			}
 			diffs = append(diffs, driftDiff{Path: b.Path, Kind: kind})
 		}

package/engine/internal/lib/packet_freeze.go

@@ -12,11 +12,12 @@ import (
 	"strings"
 
 	"github.com/devrites/devrites/internal/devritespaths"
+	"github.com/devrites/devrites/internal/parallel"
 	"github.com/devrites/devrites/internal/state"
 )
 
 // CandidateFreezeUsage is the help and usage-error text for `candidate freeze`.
-const CandidateFreezeUsage = `usage: devrites-engine candidate freeze <slug> --wave <w> (--slice <SLICE-ID> | --paths <path>...) [--base <ref>]
+const CandidateFreezeUsage = `usage: devrites-engine candidate freeze <slug> --wave <w> (--slice <SLICE-ID> | --paths <path>...) [--base <ref>] [--worktree <path>]
 
 Freezes one review candidate. It writes packets/<w>.diff (the path set's
 tracked changes against --base, default HEAD, plus each untracked file as a
@@ -24,7 +25,10 @@ tracked changes against --base, default HEAD, plus each untracked file as a
 sha256, and the aggregate candidate digest under the check candidate domain
 and bounds). --slice takes that slice's Writer allowlist (else Files likely
 touched) from tasks.md. A wave's frozen candidate is never replaced by a
-different one; freeze a changed candidate under a new wave.
+different one; freeze a changed candidate under a new wave. --worktree reads
+the path set from a linked worktree of this repository (a parallel sibling)
+instead of the checkout, requires --base, refuses uncommitted path-set
+changes, and records that worktree's HEAD (the transfer commit) as head.
 `
 
 // packetNameRE bounds a wave, role, phase, or slice used in a packets/ or
@@ -34,7 +38,7 @@ var packetNameRE = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$`)
 // RunCandidateFreeze implements `candidate freeze`: the producer of the frozen
 // .diff a Review or Seal reviewer packet must name.
 func RunCandidateFreeze(root string, args []string, stdout, stderr io.Writer) int {
-	var wave, slice, base string
+	var wave, slice, base, worktree string
 	var paths, positional []string
 	for i := 0; i < len(args); i++ {
 		value := argAt(args, i+1)
@@ -45,6 +49,8 @@ func RunCandidateFreeze(root string, args []string, stdout, stderr io.Writer) in
 			slice = value
 		case "--base":
 			base = value
+		case "--worktree":
+			worktree = value
 		case "--paths":
 			for i+1 < len(args) && !strings.HasPrefix(args[i+1], "-") {
 				i++
@@ -61,7 +67,7 @@ func RunCandidateFreeze(root string, args []string, stdout, stderr io.Writer) in
 		}
 		i++
 	}
-	if len(positional) != 1 || !packetNameRE.MatchString(wave) || (slice == "") == (len(paths) == 0) {
+	if len(positional) != 1 || !packetNameRE.MatchString(wave) || (slice == "") == (len(paths) == 0) || (worktree != "" && base == "") {
 		fmt.Fprint(stderr, CandidateFreezeUsage)
 		return 2
 	}
@@ -75,16 +81,16 @@ func RunCandidateFreeze(root string, args []string, stdout, stderr io.Writer) in
 		return fail(err)
 	}
 	if slice != "" {
-		raw, err := readWorkspaceArtifact(root, slug, "tasks.md")
-		if err != nil {
+		if paths, err = slicePaths(root, slug, slice); err != nil {
 			return fail(err)
 		}
-		writes, _ := sliceWritePaths(raw, ParseTaskGraph(raw))
-		if paths = writes[slice]; len(paths) == 0 {
-			return fail(fmt.Errorf("slice %s names no Writer allowlist or Files likely touched in tasks.md", slice))
-		}
 	}
 	project := projectDir(root)
+	if worktree != "" {
+		if project, err = checkedWorktree(root, worktree); err != nil {
+			return fail(err)
+		}
+	}
 	rows, err := freezeRows(project, paths)
 	if err != nil {
 		return fail(err)
@@ -99,12 +105,24 @@ func RunCandidateFreeze(root string, args []string, stdout, stderr io.Writer) in
 	if len(diff) == 0 {
 		return fail(errors.New("the path set has no change against the base; there is no candidate to freeze"))
 	}
+	head := ""
+	if worktree != "" {
+		// Review binds to the transfer commit, so the frozen tree must be exactly it.
+		dirty, commit, err := freezeDiff(project, "HEAD", rows)
+		if err != nil {
+			return fail(err)
+		}
+		if len(dirty) != 0 {
+			return fail(errors.New("the worktree has uncommitted changes on the path set; the frozen candidate must be its HEAD transfer commit"))
+		}
+		head = "head " + commit + "\n"
+	}
 	digest, err := hashCandidate(project, rows)
 	if err != nil {
 		return fail(err)
 	}
 	var sums strings.Builder
-	fmt.Fprintf(&sums, "%s %s\nbase %s\ndiff %x packets/%s.diff\n", candidateDigestDomain, candidateDigestVersion, baseCommit, sha256.Sum256(diff), wave)
+	fmt.Fprintf(&sums, "%s %s\nbase %s\n%sdiff %x packets/%s.diff\n", candidateDigestDomain, candidateDigestVersion, baseCommit, head, sha256.Sum256(diff), wave)
 	for _, row := range rows {
 		if row.state != "present" {
 			fmt.Fprintf(&sums, "file absent %s\n", row.path)
@@ -139,6 +157,84 @@ func RunCandidateFreeze(root string, args []string, stdout, stderr io.Writer) in
 	return 0
 }
 
+// slicePaths is the slice's tasks.md write set: Writer allowlist, else Files
+// likely touched.
+func slicePaths(root, slug, slice string) ([]string, error) {
+	raw, err := readWorkspaceArtifact(root, slug, "tasks.md")
+	if err != nil {
+		return nil, err
+	}
+	writes, _ := sliceWritePaths(raw, ParseTaskGraph(raw))
+	if len(writes[slice]) == 0 {
+		return nil, fmt.Errorf("slice %s names no Writer allowlist or Files likely touched in tasks.md", slice)
+	}
+	return writes[slice], nil
+}
+
+// checkedWorktree returns the project's directory inside path, a linked
+// worktree of the control checkout's repository: path itself, plus the
+// project's prefix below the git toplevel. It refuses a symlinked component, a
+// directory that is not a worktree's top level, a submodule, another
+// repository, a path git does not list as a worktree, and the control checkout.
+func checkedWorktree(root, path string) (string, error) {
+	abs, err := filepath.Abs(path)
+	if err != nil {
+		return "", err
+	}
+	if err := refuseSymlinkedPath(abs); err != nil {
+		return "", err
+	}
+	out, err := runGitCommand(projectDir(root), nil, "rev-parse", "--path-format=absolute", "--git-common-dir", "--show-toplevel", "--show-prefix")
+	if err != nil {
+		return "", err
+	}
+	control := strings.Split(strings.TrimSuffix(string(out), "\n"), "\n")
+	if len(control) != 3 {
+		return "", fmt.Errorf("git rev-parse printed %q for the control checkout", out)
+	}
+	out, err = runGitCommand(abs, nil, "rev-parse", "--path-format=absolute", "--git-common-dir", "--show-toplevel", "--show-superproject-working-tree")
+	got := strings.Split(strings.TrimSpace(string(out)), "\n")
+	switch {
+	case err != nil:
+		return "", fmt.Errorf("worktree %s is not a git worktree: %w", abs, err)
+	case len(got) != 2:
+		return "", fmt.Errorf("worktree %s is inside a submodule", abs)
+	case !sameDir(got[0], control[0]):
+		return "", fmt.Errorf("worktree %s belongs to another repository", abs)
+	case !sameDir(got[1], abs):
+		return "", fmt.Errorf("worktree %s is not a worktree's top level", abs)
+	case sameDir(abs, control[1]):
+		return "", fmt.Errorf("worktree %s is the control checkout, not a linked worktree", abs)
+	}
+	registered, err := parallel.RegisteredWorktrees(control[1])
+	if err != nil {
+		return "", err
+	}
+	if !registered[abs] {
+		return "", fmt.Errorf("worktree %s is not listed by git worktree list", abs)
+	}
+	project := filepath.Join(abs, filepath.FromSlash(control[2]))
+	return project, refuseSymlinkedPath(project)
+}
+
+// sameDir reports whether a and b name one existing directory, whatever their
+// spelling.
+func sameDir(a, b string) bool {
+	ai, aerr := os.Stat(a)
+	bi, berr := os.Stat(b)
+	return aerr == nil && berr == nil && ai.IsDir() && os.SameFile(ai, bi)
+}
+
+// refuseSymlinkedPath refuses an absolute path any component of which is a
+// symlink (or that does not exist).
+func refuseSymlinkedPath(abs string) error {
+	resolved, err := filepath.EvalSymlinks(abs)
+	if err == nil && resolved != abs {
+		err = fmt.Errorf("worktree %s has a symlinked component (it resolves to %s)", abs, resolved)
+	}
+	return err
+}
+
 // freezeRows normalizes, deduplicates, and sorts the path set, marking each
 // row present or deleted (absent) as hashCandidate expects.
 func freezeRows(project string, paths []string) ([]candidateRow, error) {

package/engine/internal/lib/perturb.go

@@ -22,7 +22,7 @@ import (
 )
 
 // PerturbUsage is the help and usage-error text for `check perturb`.
-const PerturbUsage = `usage: devrites-engine check perturb <slug> --patch <file> --expect <test-name> --gate <G-ID> [--timeout N]
+const PerturbUsage = `usage: devrites-engine check perturb <slug> --patch <file> --expect <test-name> --gate <G-ID> [--timeout N] [--worktree <path> --slice <SLICE-ID>]
 
 Runs one safe-perturbation probe without touching the checkout. It copies the
 current candidate (HEAD plus every touched-files.md manifest row) into a
@@ -34,8 +34,10 @@ test, jest/vitest) names --expect; a build or setup failure, a timeout, exit 0
 (the mutant survived), or a RED naming only other tests is cannot_verify. It
 then reverts the patch, requires the copy back at the candidate digest and the
 gate GREEN (exit 0 plus EXPECT), and requires the checkout candidate unchanged.
-The transcript is written under evidence/perturb/. Exit 0 verified; exit 3
-cannot_verify or refused.
+The transcript is written under evidence/perturb/. --worktree probes a linked
+worktree of this repository (a parallel sibling) instead: its HEAD plus the
+--slice write set from tasks.md, with --patch resolved against it. Exit 0
+verified; exit 3 cannot_verify or refused.
 `
 
 const perturbOutputTail = 64 << 10
@@ -65,7 +67,7 @@ type perturbProbe struct {
 // RunCheckPerturb implements `check perturb`: an engine-run, candidate-bound
 // safe-perturbation probe (testing.md § Safe perturbation).
 func RunCheckPerturb(root string, args []string, stdout, stderr io.Writer) int {
-	var patchArg, expect, gateID string
+	var patchArg, expect, gateID, worktree, slice string
 	var positional []string
 	timeout := acceptance.DefaultTimeout
 	for i := 0; i < len(args); i++ {
@@ -77,6 +79,10 @@ func RunCheckPerturb(root string, args []string, stdout, stderr io.Writer) int {
 			expect = strings.TrimSpace(value)
 		case "--gate":
 			gateID = value
+		case "--worktree":
+			worktree = value
+		case "--slice":
+			slice = value
 		case "--timeout":
 			n, err := strconv.Atoi(value)
 			if err != nil || n <= 0 {
@@ -94,7 +100,7 @@ func RunCheckPerturb(root string, args []string, stdout, stderr io.Writer) int {
 		}
 		i++
 	}
-	if len(positional) != 1 || patchArg == "" || expect == "" || gateID == "" {
+	if len(positional) != 1 || patchArg == "" || expect == "" || gateID == "" || (worktree == "") != (slice == "") {
 		fmt.Fprint(stderr, PerturbUsage)
 		return 2
 	}
@@ -107,7 +113,19 @@ func RunCheckPerturb(root string, args []string, stdout, stderr io.Writer) int {
 	if err != nil {
 		return refuse(err)
 	}
-	identity, err := loadCandidateIdentity(root, slug)
+	project := projectDir(root)
+	load := func() (candidateIdentity, error) { return loadCandidateIdentity(root, slug) }
+	if worktree != "" {
+		if project, err = checkedWorktree(root, worktree); err != nil {
+			return refuse(err)
+		}
+		paths, err := slicePaths(root, slug, slice)
+		if err != nil {
+			return refuse(err)
+		}
+		load = func() (candidateIdentity, error) { return pathSetIdentity(project, paths) }
+	}
+	identity, err := load()
 	if err != nil {
 		return refuse(err)
 	}
@@ -115,7 +133,6 @@ func RunCheckPerturb(root string, args []string, stdout, stderr io.Writer) int {
 	if err != nil {
 		return refuse(err)
 	}
-	project := projectDir(root)
 	patchPath := patchArg
 	if !filepath.IsAbs(patchPath) {
 		patchPath = filepath.Join(project, filepath.FromSlash(patchPath))
@@ -130,7 +147,7 @@ func RunCheckPerturb(root string, args []string, stdout, stderr io.Writer) int {
 
 	probe := runPerturbProbe(project, identity, gate, patch, expect, timeout)
 	after := "unavailable"
-	if current, err := loadCandidateIdentity(root, slug); err != nil {
+	if current, err := load(); err != nil {
 		after += ": " + oneLine(err.Error())
 	} else {
 		after = current.digest
@@ -152,6 +169,20 @@ func RunCheckPerturb(root string, args []string, stdout, stderr io.Writer) int {
 	return 0
 }
 
+// pathSetIdentity validates and hashes the path set in project, as candidate
+// freeze does, for a candidate that has no manifest.
+func pathSetIdentity(project string, paths []string) (candidateIdentity, error) {
+	rows, err := freezeRows(project, paths)
+	if err == nil {
+		err = validateCandidateRows(project, rows)
+	}
+	if err != nil {
+		return candidateIdentity{}, err
+	}
+	digest, err := hashCandidate(project, rows)
+	return candidateIdentity{digest: digest, rows: rows}, err
+}
+
 // perturbGate returns the live runnable gate id, refusing a CHECK/CWD that is
 // not an approved test-plan.md preflight row: a probe never runs unvetted code.
 func perturbGate(root, slug, id string) (*acceptance.Gate, error) {

package/engine/internal/parallel/git.go

@@ -236,6 +236,9 @@ func registeredWorktrees(repo string) (map[string]bool, error) {
 	return set, nil
 }
 
+// RegisteredWorktrees is registeredWorktrees for callers outside the package.
+func RegisteredWorktrees(repo string) (map[string]bool, error) { return registeredWorktrees(repo) }
+
 func resolvedPath(p string) string {
 	if r, err := filepath.EvalSymlinks(p); err == nil {
 		return r

package/engine/main.go

@@ -48,7 +48,7 @@ Usage:
                                          Report near-duplicate code clusters that survive renaming (advisory)
   devrites-engine check anchors <slug> <return-file> [--skills-root <dir>]
                                          Anchor each Critical/Important row's quotes; Unverified or Deferred rows exit 3
-  devrites-engine check perturb <slug> --patch <file> --expect <test-name> --gate <G-ID> [--timeout N]
+  devrites-engine check perturb <slug> --patch <file> --expect <test-name> --gate <G-ID> [--timeout N] [--worktree <path> --slice <SLICE-ID>]
                                          Run one mutant patch against a candidate copy; RED must name --expect
   devrites-engine observe summary <slug>   Emit sanitized JSON workspace summary
   devrites-engine orient <slug>            Alias for observe summary
@@ -60,7 +60,7 @@ Usage:
                                          Emit one deduplicated read-set bundle for a phase, skill, or dispatch role
   devrites-engine metrics record <slug> --phase <p> --event <e> [--role r] [--bytes n] [--note s]
   devrites-engine metrics summary [slug] [--by-slice]  Summarize the metrics ledger, or per-slice rounds and agent-minutes
-  devrites-engine candidate freeze <slug> --wave <w> (--slice <SLICE-ID> | --paths <path>...) [--base <ref>]
+  devrites-engine candidate freeze <slug> --wave <w> (--slice <SLICE-ID> | --paths <path>...) [--base <ref>] [--worktree <path>]
                                          Freeze a review candidate to packets/<w>.diff + packets/<w>.sha256
   devrites-engine packet <slug> --wave <w> --phase <p> --role <r> [--slice <SLICE-ID>] [--recheck] [--checks <G-ID,...>] [--focus <file>]
                                          Render and lint one role's by-reference dispatch packet

package/pack/.claude/skills/rite-build/reference/parallel-batch.md

@@ -105,10 +105,13 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    precondition is dropped from the batch and recorded as a gap, not dispatched.
 2. Write lease; freeze `B=HEAD`; `parallel create` worktrees.
 3. Dispatch ≤10 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`;
-   one `--slice` per sibling on the wave).
+   one `--slice` per sibling on the wave). A linked worktree has no `.devrites`:
+   tell each wright to run `gates precheck` with `DEVRITES_ROOT=<control>/.devrites`.
 4. Inspect each returned path list, cumulative diff from `B`, transfer identity,
    and required result fields against the immutable contract. Reject malformed,
-   stale, or out-of-scope work. Apply
+   stale, or out-of-scope work. Freeze and probe the sibling in its worktree:
+   `candidate freeze <slug> --wave <w> --slice <id> --base <B> --worktree <worktree_path>`,
+   `check perturb ... --worktree <worktree_path> --slice <id>`. Apply
    [independent Build review](phase-contract.md#independent-build-review): first
    full inventory, then bounded owning-role rechecks after repairs. Run approved
    proof in the same window as that review. Gap or Critical/Important → `gap`;

package/pack/generated/claude/skills/rite-build/reference/parallel-batch.md

@@ -105,10 +105,13 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    precondition is dropped from the batch and recorded as a gap, not dispatched.
 2. Write lease; freeze `B=HEAD`; `parallel create` worktrees.
 3. Dispatch ≤10 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`;
-   one `--slice` per sibling on the wave).
+   one `--slice` per sibling on the wave). A linked worktree has no `.devrites`:
+   tell each wright to run `gates precheck` with `DEVRITES_ROOT=<control>/.devrites`.
 4. Inspect each returned path list, cumulative diff from `B`, transfer identity,
    and required result fields against the immutable contract. Reject malformed,
-   stale, or out-of-scope work. Apply
+   stale, or out-of-scope work. Freeze and probe the sibling in its worktree:
+   `candidate freeze <slug> --wave <w> --slice <id> --base <B> --worktree <worktree_path>`,
+   `check perturb ... --worktree <worktree_path> --slice <id>`. Apply
    [independent Build review](phase-contract.md#independent-build-review): first
    full inventory, then bounded owning-role rechecks after repairs. Run approved
    proof in the same window as that review. Gap or Critical/Important → `gap`;

package/pack/generated/codex/skills/rite-build/reference/parallel-batch.md

@@ -105,10 +105,13 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    precondition is dropped from the batch and recorded as a gap, not dispatched.
 2. Write lease; freeze `B=HEAD`; `parallel create` worktrees.
 3. Dispatch ≤10 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`;
-   one `--slice` per sibling on the wave).
+   one `--slice` per sibling on the wave). A linked worktree has no `.devrites`:
+   tell each wright to run `gates precheck` with `DEVRITES_ROOT=<control>/.devrites`.
 4. Inspect each returned path list, cumulative diff from `B`, transfer identity,
    and required result fields against the immutable contract. Reject malformed,
-   stale, or out-of-scope work. Apply
+   stale, or out-of-scope work. Freeze and probe the sibling in its worktree:
+   `candidate freeze <slug> --wave <w> --slice <id> --base <B> --worktree <worktree_path>`,
+   `check perturb ... --worktree <worktree_path> --slice <id>`. Apply
    [independent Build review](phase-contract.md#independent-build-review): first
    full inventory, then bounded owning-role rechecks after repairs. Run approved
    proof in the same window as that review. Gap or Critical/Important → `gap`;

package/pack/generated/devin/skills/rite-build/reference/parallel-batch.md

@@ -105,10 +105,13 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    precondition is dropped from the batch and recorded as a gap, not dispatched.
 2. Write lease; freeze `B=HEAD`; `parallel create` worktrees.
 3. Dispatch ≤10 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`;
-   one `--slice` per sibling on the wave).
+   one `--slice` per sibling on the wave). A linked worktree has no `.devrites`:
+   tell each wright to run `gates precheck` with `DEVRITES_ROOT=<control>/.devrites`.
 4. Inspect each returned path list, cumulative diff from `B`, transfer identity,
    and required result fields against the immutable contract. Reject malformed,
-   stale, or out-of-scope work. Apply
+   stale, or out-of-scope work. Freeze and probe the sibling in its worktree:
+   `candidate freeze <slug> --wave <w> --slice <id> --base <B> --worktree <worktree_path>`,
+   `check perturb ... --worktree <worktree_path> --slice <id>`. Apply
    [independent Build review](phase-contract.md#independent-build-review): first
    full inventory, then bounded owning-role rechecks after repairs. Run approved
    proof in the same window as that review. Gap or Critical/Important → `gap`;

package/pack/generated/omp/skills/rite-build/reference/parallel-batch.md

@@ -105,10 +105,13 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    precondition is dropped from the batch and recorded as a gap, not dispatched.
 2. Write lease; freeze `B=HEAD`; `parallel create` worktrees.
 3. Dispatch ≤10 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`;
-   one `--slice` per sibling on the wave).
+   one `--slice` per sibling on the wave). A linked worktree has no `.devrites`:
+   tell each wright to run `gates precheck` with `DEVRITES_ROOT=<control>/.devrites`.
 4. Inspect each returned path list, cumulative diff from `B`, transfer identity,
    and required result fields against the immutable contract. Reject malformed,
-   stale, or out-of-scope work. Apply
+   stale, or out-of-scope work. Freeze and probe the sibling in its worktree:
+   `candidate freeze <slug> --wave <w> --slice <id> --base <B> --worktree <worktree_path>`,
+   `check perturb ... --worktree <worktree_path> --slice <id>`. Apply
    [independent Build review](phase-contract.md#independent-build-review): first
    full inventory, then bounded owning-role rechecks after repairs. Run approved
    proof in the same window as that review. Gap or Critical/Important → `gap`;

package/pack/generated/pi/skills/rite-build/reference/parallel-batch.md

@@ -105,10 +105,13 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    precondition is dropped from the batch and recorded as a gap, not dispatched.
 2. Write lease; freeze `B=HEAD`; `parallel create` worktrees.
 3. Dispatch ≤10 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`;
-   one `--slice` per sibling on the wave).
+   one `--slice` per sibling on the wave). A linked worktree has no `.devrites`:
+   tell each wright to run `gates precheck` with `DEVRITES_ROOT=<control>/.devrites`.
 4. Inspect each returned path list, cumulative diff from `B`, transfer identity,
    and required result fields against the immutable contract. Reject malformed,
-   stale, or out-of-scope work. Apply
+   stale, or out-of-scope work. Freeze and probe the sibling in its worktree:
+   `candidate freeze <slug> --wave <w> --slice <id> --base <B> --worktree <worktree_path>`,
+   `check perturb ... --worktree <worktree_path> --slice <id>`. Apply
    [independent Build review](phase-contract.md#independent-build-review): first
    full inventory, then bounded owning-role rechecks after repairs. Run approved
    proof in the same window as that review. Gap or Critical/Important → `gap`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "7.0.2",
+  "version": "7.0.3",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, pi, and Devin CLI",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",