devrites 7.0.4 → 7.0.6

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.0.6](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.5...v7.0.6) (2026-10-22)
+
+### Fixed
+
+* **devrites:** close every slice's write set at Vet ([#160](https://github.com/ViktorsBaikers/DevRites/issues/160)) ([dce9587](https://github.com/ViktorsBaikers/DevRites/commit/dce9587c61660e1ae59c1bd5a0a8afd6de423575))
+
+## [7.0.5](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.4...v7.0.5) (2026-10-22)
+
+### Fixed
+
+* **devrites:** catch Build-entry slice defects at Vet ([#158](https://github.com/ViktorsBaikers/DevRites/issues/158)) ([34b65b7](https://github.com/ViktorsBaikers/DevRites/commit/34b65b7d819c308b46dc609d215ff698315b4b44))
+* **devrites:** clear expiring audit exceptions and Windows race flake ([#159](https://github.com/ViktorsBaikers/DevRites/issues/159)) ([0e6a85a](https://github.com/ViktorsBaikers/DevRites/commit/0e6a85a7726d80b6e259a68975bf2892ad621a51))
+
 ## [7.0.4](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.3...v7.0.4) (2026-10-21)
 
 ### Fixed

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.0.4`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.0.4): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.0.6`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.0.6): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 

package/docs/cli.md

@@ -122,7 +122,9 @@ self-contained updater.
 
 - `check readiness <slug>` verifies the files required to leave the workspace's
   current phase, the `tasks.md` slice graph once that artifact is required, and,
-  once `eng-review.md` is required, its exact stable Build-input binding.
+  once `eng-review.md` is required, its exact stable Build-input binding. Leaving
+  Vet, it also runs the Build-entry `check slice` contract on every slice
+  `state.md` does not check built, except a deferred `Satisfies: none` slice.
 - `check readiness --emit-binding <slug>` renders the exact stable Build-input
   binding for Vet to record after semantic review.
 - `check preconditions <slug>` runs the preflight rows whose `Run at` is `vet`
@@ -221,8 +223,8 @@ or CI.
 `gates` operates the `gates.md` ledger inside a feature workspace: one gate per
 required outcome, runnable (`CHECK`+`EXPECT`, optional `CWD`) or manual
 (`EVIDENCE` only). Subcommands: `scaffold`, `status`, `run`, `reverify`,
-`lint`, `precheck --worktree <path>` (the wright's pre-return run of `RUN: writer`
-gates and `check windows`; writes no ledger, EVIDENCE line or transcript, though `check windows` still logs its metric; never evidence), `attest <id> <note>`,
+`lint`, `precheck --worktree <path> [--slice <SLICE-ID>]` (the wright's pre-return run of `RUN: writer`
+gates and `check windows`; `--slice` skips a gate only other unbuilt slices own; writes no ledger, EVIDENCE line or transcript, though `check windows` still logs its metric; never evidence), `attest <id> <note>`,
 `abandon <id> <why>`.
 
 A runnable gate executes only when its `(CHECK, CWD)` pair exactly matches a

package/docs/command-map.md

@@ -45,7 +45,7 @@ The Go surface is intentionally closed and deterministic:
 | Workspace observation | `observe summary`, `orient`, `observe slice <slug> <SLICE-ID>`, `next`, `handoff` | JSON workspace snapshot for agents (cursor, task graph, `artifact_budgets`, `bulk_files`); `orient` is an alias for `observe summary`. `observe slice` prints one `SLICE-###` section of `tasks.md` so Build reads a slice, not the file. `next` prints the minimal remaining lifecycle path plus advisory skips (e.g. clarify at zero open questions). `handoff` emits the deterministic resume record (cursor, `awaiting_human`, blocking question gates, ledger reduction with unmet/stale ids, dead ends, read-next order) — the `/rite-handoff` spine and compaction-fallback entry. |
 | Context packets, dispatch waves, metrics, claims, notes | `context [slug] (--phase <p> \| --skill <name>) [--role <r>] [--trigger a,b]`, `dispatch <slug> <open\|start\|seal\|return\|status\|abandon>`, `candidate freeze`, `packet`, `metrics record`, `metrics summary`, `claim <add\|release\|list\|check>`, `note <add\|list\|check\|rm>` | `context` emits one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest — a dispatch target reads it instead of selecting files; `--skill` works without a workspace when `--out` is given. `dispatch` owns the launch-wave barrier (seal needs a handle per role; return needs seal; the last start seals; open --claim-session/--claim takes the wave's file claim, released by the completing return or abandon --release) and auto-records dispatch/return metrics. `candidate freeze` writes a wave's frozen `packets/<w>.diff` + `.sha256`; `packet` renders and lints one role's by-reference packet. `metrics` owns the append-only `metrics.jsonl` ledger. `claim` owns the append-only `.devrites/claims.jsonl` ledger — advisory, session-scoped file claims with TTL so concurrent same-tree sessions see each other's write intent before edits collide (conflict exits 3; never a substitute for one-writer-per-worktree). `note` owns the anchored `notes.md` ledger — notes bound to verbatim code quotes, regraded `exact`/`moved`/`stale`/`ambiguous`/`lost` as the code drifts; `check seal` refuses non-`exact` anchors. `check diff-scope` is the mechanical changed-paths ⊆ allowlist gate run before reviewer dispatch. |
 | Atomic workspace state | `state resolve`, `state merge-manifest`, `state apply-bundle <slug> <bundle.json>... [--dry-run]`, `state set <slug> key=value... [--unset key]`, `state append <slug> <ledger.md> --heading <text> --body-file <path\|->`, `state close`, `migrate [--dry-run] [--answer id=choice]` | Go owns answer/drop/batch resolution, the recorded predecessor-chain manifest union for a release milestone, the all-or-nothing apply of plan-drafter hunk bundles (base-hash pins, unique non-overlapping anchors, no lost IDs, no new task-graph or budget defect, no appended dated delta section), cursor writes (known phase, engine-owned schema, no return-cursor overwrite; an AFK pause names auto-pickable questions), append-only ledger sections that refuse a duplicate heading, transactional close, and fail-closed v5 schema normalization. |
-| Acceptance ledger | `gates scaffold`, `gates status`, `gates run [--timeout N]`, `gates reverify [--timeout N]`, `gates lint [--strict]`, `gates precheck <slug> --worktree <path>`, `gates attest <id> <note>`, `gates abandon <id> <why>` | Go owns the `gates.md` ledger: per-outcome gates whose runnable `CHECK`/`CWD` must exactly match a `test-plan.md` Build-entry preflight row, evidence bound to the gate definition digest (stale = unmet), `ABANDON:` handoffs, oracle lint, and the wright's never-evidence `precheck` of `RUN: writer` gates. Readiness/seal require a parse-clean, all-met ledger whenever `gates.md` is a required artifact. |
+| Acceptance ledger | `gates scaffold`, `gates status`, `gates run [--timeout N]`, `gates reverify [--timeout N]`, `gates lint [--strict]`, `gates precheck <slug> --worktree <path> [--slice <SLICE-ID>]`, `gates attest <id> <note>`, `gates abandon <id> <why>` | Go owns the `gates.md` ledger: per-outcome gates whose runnable `CHECK`/`CWD` must exactly match a `test-plan.md` Build-entry preflight row, evidence bound to the gate definition digest (stale = unmet), `ABANDON:` handoffs, oracle lint, and the wright's never-evidence `precheck` of `RUN: writer` gates. Readiness/seal require a parse-clean, all-met ledger whenever `gates.md` is a required artifact. |
 | Security | `secret-scan` | `/rite-ship`, safe hooks, or an operator scans staged blobs, stdin, or touched files. |
 | Install/operator | `install`, `update`, `uninstall`, `version` | Direct update acquires latest; npm/bootstrap may supply local candidates; the engine performs manifest-owned local changes. |
 | Native policy | no engine command | Skills/root own spec grammar re-read, qid allocation, Clarify cursor edits, AFK/recovery accounting, and read-only `/rite-doctor`. |

package/docs/engine/commands.md

@@ -12,7 +12,7 @@ workflow strategy.
 | `update [flags]` | Refresh an existing managed installation. |
 | `uninstall [flags]` | Remove managed artifacts while preserving runtime workspace state. |
 | `check candidate <slug>` | Validate the strict manifest and compute the content-bound project-candidate identity. Exits `3` when the manifest omits a path the feature's `WIP(<slug>):` checkpoint commits changed (net from the feature base to HEAD). Also exits `3` with `unattributed root edit: <paths>` while the feature's `tree-baseline.json` tripwire flags a product path (ADR-0038; see `dispatch`). |
-| `check readiness <slug>` | Check target-Phase files, open human gates from Clarify onward, the `tasks.md` slice graph when that artifact is required, canonical `AC-###` presence in `tasks.md`/`test-plan.md` when those artifacts are required, and the current stable Build-input binding when applicable. Leaving Vet with a `Run at` column, a slice whose `Files likely touched`/`Writer allowlist` names a dependency manifest or lockfile needs a `dependency-dry-run SLICE-###` row at `vet` with a passing transcript. |
+| `check readiness <slug>` | Check target-Phase files, open human gates from Clarify onward, the `tasks.md` slice graph when that artifact is required, canonical `AC-###` presence in `tasks.md`/`test-plan.md` when those artifacts are required, and the current stable Build-input binding when applicable. Leaving Vet with a `Run at` column, a slice whose `Files likely touched`/`Writer allowlist` names a dependency manifest or lockfile needs a `dependency-dry-run SLICE-###` row at `vet` with a passing transcript. Leaving Vet, every slice `state.md` does not check built (a deferred `Satisfies: none` slice excepted) must also pass the Build-entry `check slice` contract; each failure prints one `invariant: slice-check:` line naming the slice and its exact `check slice` reason, to fix in `/rite-plan` before READY. |
 | `check readiness --emit-binding <slug>` | Render the exact stable Build-input binding for Vet to record after review. |
 | `check preconditions <slug> [--slice SLICE-###] [--timeout N]` | Run the `test-plan.md` Build-entry preflight rows whose optional `Run at` cell is `vet` (with `--slice`, `pre-dispatch <SLICE>`); `action` rows and rows without the cell never run. Writes one candidate-bound transcript per row under `references/gates/preflight-*/`; a row passes on exit 0. Exit `3` on any failure or an invalid `Run at` value. |
 | `check seal <slug>` | Check files required by target Phase `seal`, open human gates, the `tasks.md` slice graph, canonical `AC-###` presence when `tasks.md`/`test-plan.md` are required, the stable Build-input binding, and exact candidate bindings. `check readiness` and `check seal` also block a `scripts/` test driver that a tasks.md Writer allowlist plans or touched-files.md lists when no gates.md `CHECK` runs it and no `Driver waiver: <path> — DEC-### <reason>` line cites a recorded decision; waived drivers print as `note: unexecuted driver (waived by DEC-###): <path>` lines, on pass or block. |
@@ -44,7 +44,7 @@ workflow strategy.
 | `metrics summary [slug] [--by-slice]` | Reduce `metrics.jsonl` into a per-phase roll-up. `--by-slice` reads `dispatch.json` instead: per slice, build wright rounds, slice-bound Vet rechecks, and agent-minutes (role start to `returned_at`; abandoned waves excluded). When the ledger has `resume` events it adds `resumes count=N minutes_to_dispatch=...` (each resume timed to the next `dispatch` event; `none` when another resume came first, `open` when none followed). |
 | `claim <add\|release\|list\|check>` | Advisory session-scoped file claims in `.devrites/claims.jsonl` (append-only). `add` records intent to write a path set with a TTL (1–240 min, default 30); a live claim by another session exits `3` and names the holder. `release` appends a release event owned by the claiming session. `list` shows every unreleased claim (live, expired, dead) plus one `N released (use --all)` count; `--all` includes released rows; a claim whose holding session has provably exited on this host shows `dead` and no longer conflicts. `check` is the read-only preflight for a path set. Coordination aid only — never a substitute for one-writer-per-worktree. |
 | `note <add\|list\|check\|rm> <slug> ...` | Anchored workspace notes in `notes.md`: `add <slug> <subject> <quote> <title> [body]` binds a note to a verbatim quote in one repository file and assigns `NOTE-###`; `list` and `check` regrade each anchor `exact`/`moved`/`stale`/`ambiguous`/`lost` by searching the repo for the quote (dependency and workspace trees excluded); `check --repair` rewrites a `moved` subject to its new file; `rm` deletes by ID. `check seal` refuses a malformed `notes.md` and any non-`exact` anchor. |
-| `gates <scaffold\|status\|run\|reverify\|lint\|precheck\|attest\|abandon> <slug>` | Operate the `gates.md` acceptance ledger: seed per-AC gates, execute runnable gates bound to `test-plan.md` preflight rows, attest manual gates, and reduce to `all-met`/`not-met`/`handoff`/`malformed`. A gate with `INPUTS:` records its files' content digest and is reused by `run` and `reverify` while they are unchanged. `run`/`reverify --transcripts` writes a redacted, candidate-bound transcript per executed or reused gate under `references/gates/<gate-id>/`. `precheck <slug> --worktree <path>` runs every `RUN: writer` gate and `check windows` against the wright's worktree, prints PASS/FAIL per gate id, exits `3` on any FAIL or on a malformed ledger, and writes no ledger, EVIDENCE line or transcript (`check windows` still appends its metric event); its output is never evidence. |
+| `gates <scaffold\|status\|run\|reverify\|lint\|precheck\|attest\|abandon> <slug>` | Operate the `gates.md` acceptance ledger: seed per-AC gates, execute runnable gates bound to `test-plan.md` preflight rows, attest manual gates, and reduce to `all-met`/`not-met`/`handoff`/`malformed`. A gate with `INPUTS:` records its files' content digest and is reused by `run` and `reverify` while they are unchanged. `run`/`reverify --transcripts` writes a redacted, candidate-bound transcript per executed or reused gate under `references/gates/<gate-id>/`. `precheck <slug> --worktree <path> [--slice <SLICE-ID>]` runs every `RUN: writer` gate and `check windows` against the wright's worktree (with `--slice`, it prints `SKIP <gate-id>` for a gate whose id only other unbuilt slices name in `tasks.md`, since gate ids reuse `AC-###` ids; a gate no slice names still runs), prints PASS/FAIL per gate id, exits `3` on any FAIL or on a malformed ledger, and writes no ledger, EVIDENCE line or transcript (`check windows` still appends its metric event); its output is never evidence. |
 | `state resolve <qid> "<answer>"` | Resolve an open question and update `questions.md` plus `state.md` atomically. |
 | `state merge-manifest <slug> [pred...]` | Fold the recorded predecessor chain's manifests into the release candidate manifest. |
 | `state set <slug> <key>=<value>... [--unset <key>]...` | Write `state.md` cursor fields all-or-nothing under the feature lock. Refuses an unknown `phase`, the engine-owned `schema` row, a pipe or line break in a value, and an overwrite of a saved `return_phase`/`return_next_action`. Setting `status=awaiting_human` under `.devrites/AFK` prints each open question the sentinel's `allow_gates` auto-picks. |

package/engine/help.go

@@ -109,7 +109,7 @@ const (
   gates reverify <slug> [--timeout N] [--transcripts]  Re-execute every runnable gate, demoting stale passes
                                    (--transcripts: one redacted, candidate-bound file per gate in references/gates/)
   gates lint <slug> [--strict]     Audit oracle quality without executing
-  gates precheck <slug> --worktree <path>  Run RUN: writer gates + check windows in <path>; no ledger, EVIDENCE or transcript write (check windows logs its metric); never evidence
+  gates precheck <slug> --worktree <path> [--slice <SLICE-ID>]  Run RUN: writer gates + check windows in <path>; --slice skips gates owned only by other unbuilt slices; no ledger, EVIDENCE or transcript write (check windows logs its metric); never evidence
   gates attest <slug> <id> <note>  Record human evidence on a manual gate
   gates abandon <slug> <id> <why>  Record a terminal ABANDON handoff on a gate
 `

package/engine/internal/acceptance/cli.go

@@ -33,10 +33,11 @@ Subcommands:
                              (--transcripts writes one redacted, candidate-bound
                              file per gate under references/gates/<gate-id>/)
   lint <slug> [--strict]     Audit oracle quality without executing
-  precheck <slug> --worktree <path>
+  precheck <slug> --worktree <path> [--slice <SLICE-ID>]
                              Run every RUN: writer gate, then check windows, in
                              <path>; writes no ledger, EVIDENCE line or
-                             transcript (check windows still logs its metric)
+                             transcript (check windows still logs its metric);
+                             --slice skips gates owned only by other unbuilt slices
   attest <slug> <id> <note>  Record human evidence on a manual gate
   abandon <slug> <id> <why>  Record a terminal ABANDON handoff on a gate
 
@@ -373,18 +374,27 @@ func cmdLint(root string, args []string, stdout, stderr io.Writer) int {
 // lib.RunCheckWindows because acceptance cannot import lib (lib imports it).
 var WindowsCheck func(root string, args []string, stdout, stderr io.Writer) int
 
+// PrecheckSkips maps each writer gate id `gates precheck --slice` skips to the
+// unbuilt slices that own it; main wires it to lib.PrecheckSkips for the same
+// reason as WindowsCheck.
+var PrecheckSkips func(root, slug, slice string, gateIDs []string) (map[string]string, error)
+
 // cmdPrecheck is the wright's pre-return run of the `RUN: writer` gates and
 // `check windows` against its worktree. It reads gates.md but writes no
 // ledger, EVIDENCE line or transcript: nothing it prints is evidence, and the
-// root still runs every gate canonically.
+// root still runs every gate canonically. --slice skips the gates that only
+// other unbuilt slices own, whose capability the worktree cannot have yet.
 func cmdPrecheck(root string, args []string, stdout, stderr io.Writer) int {
-	const usage = "usage: devrites-engine gates precheck <slug> --worktree <path>"
-	var slug, worktree string
+	const usage = "usage: devrites-engine gates precheck <slug> --worktree <path> [--slice <SLICE-ID>]"
+	var slug, worktree, slice string
 	for i := 0; i < len(args); i++ {
 		switch {
 		case args[i] == "--worktree" && i+1 < len(args) && worktree == "":
 			worktree = args[i+1]
 			i++
+		case args[i] == "--slice" && i+1 < len(args) && slice == "":
+			slice = args[i+1]
+			i++
 		case strings.HasPrefix(args[i], "-") || slug != "":
 			fmt.Fprintln(stderr, usage)
 			return ExitUsage
@@ -392,7 +402,7 @@ func cmdPrecheck(root string, args []string, stdout, stderr io.Writer) int {
 			slug = args[i]
 		}
 	}
-	if slug == "" || worktree == "" {
+	if slug == "" || worktree == "" || (slice != "" && !state.ValidSliceID(slice)) {
 		fmt.Fprintln(stderr, usage)
 		return ExitUsage
 	}
@@ -426,9 +436,29 @@ func cmdPrecheck(root string, args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintln(stdout, "precheck: fail (not evidence; fix before returning)")
 		return ExitBlocked
 	}
+	writers := doc.WriterGates()
+	var skips map[string]string
+	if slice != "" {
+		if PrecheckSkips == nil {
+			fmt.Fprintln(stderr, "gates precheck: --slice is not wired into this engine")
+			return ExitBlocked
+		}
+		ids := make([]string, len(writers))
+		for i, gate := range writers {
+			ids[i] = gate.ID
+		}
+		if skips, err = PrecheckSkips(root, slug, slice, ids); err != nil {
+			fmt.Fprintf(stderr, "gates precheck: %v\n", err)
+			return ExitBlocked
+		}
+	}
 	failed := false
 	approved := loadTestPlan(testPlanPath)
-	for _, gate := range doc.WriterGates() {
+	for _, gate := range writers {
+		if owners := skips[gate.ID]; owners != "" {
+			fmt.Fprintf(stdout, "SKIP %s (owned by unbuilt %s, not %s)\n", gate.ID, owners, slice)
+			continue
+		}
 		expectation, expectErr := CompileExpect(gate.Expect)
 		switch {
 		case gate.Check == "":

package/engine/internal/lib/dispatch_contract.go

@@ -124,7 +124,7 @@ func lintWrightContractFor(root, slug, path string) error {
 		block = block[:loc[1]-1-loc[0]+end[0]]
 	}
 	if !strings.Contains(string(block), "gates precheck") {
-		return fmt.Errorf("wright contract %s: %s marks %s `RUN: writer`, so its `Writer-safe checks:` must include `devrites-engine gates precheck %s --worktree <path>`; the wright runs those rows and `check windows` and fixes failures before returning",
+		return fmt.Errorf("wright contract %s: %s marks %s `RUN: writer`, so its `Writer-safe checks:` must include `devrites-engine gates precheck %s --worktree <path> --slice <SLICE-ID>`; the wright runs those rows and `check windows` and fixes failures before returning",
 			path, acceptance.GatesFile, writers[0].ID, slug)
 	}
 	return nil

package/engine/internal/lib/packet.go

@@ -137,7 +137,7 @@ func RunPacket(root string, args []string, stdout, stderr io.Writer) int {
 			fmt.Fprintf(&b, "- %s\n", p)
 		}
 		if checks != "" {
-			lines, err := writerSafeChecks(root, slug, checks)
+			lines, err := writerSafeChecks(root, slug, slice, checks)
 			if err != nil {
 				return fail(err)
 			}
@@ -249,8 +249,8 @@ func frozenCandidate(workspace, wave string) (sums string, partial bool, err err
 
 // writerSafeChecks resolves each named gates.md gate to its CHECK, refusing an
 // unknown gate or a CHECK no approved test-plan.md preflight row vets, and adds
-// `gates precheck` when the ledger marks a gate `RUN: writer`.
-func writerSafeChecks(root, slug, ids string) (string, error) {
+// `gates precheck --slice <slice>` when the ledger marks a gate `RUN: writer`.
+func writerSafeChecks(root, slug, slice, ids string) (string, error) {
 	ledger, err := readWorkspaceArtifact(root, slug, acceptance.GatesFile)
 	if err != nil {
 		return "", fmt.Errorf("--checks: %w", err)
@@ -288,7 +288,7 @@ func writerSafeChecks(root, slug, ids string) (string, error) {
 		fmt.Fprintf(&rows, "- %s (cwd %s): `%s`\n", id, cwd, gate.Check)
 	}
 	if len(doc.WriterGates()) > 0 {
-		fmt.Fprintf(&rows, "- gates precheck (cwd repository root): `devrites-engine gates precheck %s --worktree .`\n", slug)
+		fmt.Fprintf(&rows, "- gates precheck (cwd repository root): `devrites-engine gates precheck %s --worktree . --slice %s`\n", slug, slice)
 	}
 	return "Writer-safe checks: " + strings.Join(names, ", ") + "\n" + rows.String(), nil
 }

package/engine/internal/lib/slicecheck.go

@@ -126,7 +126,55 @@ func RunCheckSlice(root string, args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stderr, "check slice: %s not found in tasks.md\n", sliceID)
 		return 3
 	}
+	spec, specErr := readWorkspaceArtifact(root, slug, "spec.md")
+	problems := sliceContractProblems(block, spec, specErr)
 
+	if n, over := sliceSizeAdvisory(block); over {
+		fmt.Fprintf(stdout, "check slice: ADVISORY size: %s has %d Writer allowlist files (>= %d); consider an acceptance-preserving split\n", sliceID, n, sliceFileAdvisory)
+	}
+	printProportion(root, slug, sliceID, stdout)
+	if len(problems) > 0 {
+		fmt.Fprintf(stdout, "check slice: %s BLOCKED\n", sliceID)
+		for _, p := range problems {
+			fmt.Fprintf(stdout, "  - %s\n", p)
+		}
+		return 3
+	}
+	allow, _ := fieldValue(sliceFields(block), "writer allowlist")
+	fmt.Fprintf(stdout, "check slice: %s ok (paths=%d acs=%d)\n", sliceID, len(parsePathList(allow)), len(sliceACRe.FindAllString(block, -1)))
+	return 0
+}
+
+// UnbuiltSliceProblems replays sliceContractProblems over every tasks.md slice
+// state.md does not check built, so Vet fails on the defects Build-entry
+// `check slice` would otherwise find one dispatch at a time. A deferred
+// `Satisfies: none` slice is never dispatched and is skipped.
+func UnbuiltSliceProblems(root, slug string) []string {
+	tasks, err := readWorkspaceArtifact(root, slug, "tasks.md")
+	if err != nil {
+		return []string{fmt.Sprintf("slice contracts cannot be checked: %v", err)}
+	}
+	built, err := builtSlices(root, slug)
+	if err != nil {
+		return []string{fmt.Sprintf("slice contracts cannot be checked: %v", err)}
+	}
+	spec, specErr := readWorkspaceArtifact(root, slug, "spec.md")
+	var problems []string
+	for _, s := range ParseTaskGraph(tasks).Slices {
+		block, _ := state.ExtractTaskSlice(tasks, s.ID)
+		if satisfies, _ := fieldValue(sliceFields(block), "satisfies"); built[sliceNumber(s.ID)] || strings.EqualFold(satisfies, "none") {
+			continue
+		}
+		for _, p := range sliceContractProblems(block, spec, specErr) {
+			problems = append(problems, fmt.Sprintf("%s would fail Build-entry `check slice`: %s; fix it in /rite-plan before READY", s.ID, p))
+		}
+	}
+	return problems
+}
+
+// sliceContractProblems returns every problem `check slice` blocks a slice's
+// dispatch on. Each reads only the slice block and spec.md, never build state.
+func sliceContractProblems(block string, spec []byte, specErr error) []string {
 	var problems []string
 	fields := sliceFields(block)
 
@@ -158,44 +206,28 @@ func RunCheckSlice(root string, args []string, stdout, stderr io.Writer) int {
 	acs := sliceACRe.FindAllString(block, -1)
 	if len(acs) == 0 {
 		problems = append(problems, "no AC-### coverage declared — every slice must satisfy acceptance criteria")
+	} else if specErr != nil {
+		problems = append(problems, fmt.Sprintf("spec.md unavailable — cannot verify %d AC reference(s)", len(acs)))
 	} else {
-		spec, specErr := readWorkspaceArtifact(root, slug, "spec.md")
-		if specErr != nil {
-			problems = append(problems, fmt.Sprintf("spec.md unavailable — cannot verify %d AC reference(s)", len(acs)))
-		} else {
-			specText := string(spec)
-			seen := map[string]bool{}
-			var unknown []string
-			for _, ac := range acs {
-				if seen[ac] {
-					continue
-				}
-				seen[ac] = true
-				if !strings.Contains(specText, ac) {
-					unknown = append(unknown, ac)
-				}
+		specText := string(spec)
+		seen := map[string]bool{}
+		var unknown []string
+		for _, ac := range acs {
+			if seen[ac] {
+				continue
 			}
-			for _, ac := range unknown {
-				problems = append(problems, fmt.Sprintf("%s is referenced but not declared in spec.md", ac))
+			seen[ac] = true
+			if !strings.Contains(specText, ac) {
+				unknown = append(unknown, ac)
 			}
 		}
+		for _, ac := range unknown {
+			problems = append(problems, fmt.Sprintf("%s is referenced but not declared in spec.md", ac))
+		}
 	}
 
 	if proof, ok := fieldValue(fields, "tests/proof", "tests", "proof"); !ok || proof == "" {
 		problems = append(problems, "Tests/proof field missing or empty — no evidence plan for the slice")
 	}
-
-	if n, over := sliceSizeAdvisory(block); over {
-		fmt.Fprintf(stdout, "check slice: ADVISORY size: %s has %d Writer allowlist files (>= %d); consider an acceptance-preserving split\n", sliceID, n, sliceFileAdvisory)
-	}
-	printProportion(root, slug, sliceID, stdout)
-	if len(problems) > 0 {
-		fmt.Fprintf(stdout, "check slice: %s BLOCKED\n", sliceID)
-		for _, p := range problems {
-			fmt.Fprintf(stdout, "  - %s\n", p)
-		}
-		return 3
-	}
-	fmt.Fprintf(stdout, "check slice: %s ok (paths=%d acs=%d)\n", sliceID, len(allowlist), len(acs))
-	return 0
+	return problems
 }

package/engine/internal/lib/taskgraph.go

@@ -116,6 +116,45 @@ func PlanReady(repoRoot, slug string) ([]parallel.SlicePaths, error) {
 	return planReady(filepath.Join(repoRoot, devritespaths.DevritesRootName), slug)
 }
 
+// PrecheckSkips maps each gate id `gates precheck --slice <slice>` skips to the
+// slices that own it. Gate ids reuse AC-### ids, so a gate's owners are the
+// tasks.md slices whose block names its id; it is skipped only when no owner is
+// slice or built. A gate no slice names still runs. root is the .devrites
+// directory.
+func PrecheckSkips(root, slug, slice string, gateIDs []string) (map[string]string, error) {
+	raw, err := readWorkspaceArtifact(root, slug, "tasks.md")
+	if err != nil {
+		return nil, err
+	}
+	if _, ok := state.ExtractTaskSlice(raw, slice); !ok {
+		return nil, fmt.Errorf("%s not found in tasks.md", slice)
+	}
+	built, err := builtSlices(root, slug)
+	if err != nil {
+		return nil, err
+	}
+	live := map[string]bool{}
+	owners := map[string][]string{}
+	for _, s := range ParseTaskGraph(raw).Slices {
+		block, _ := state.ExtractTaskSlice(raw, s.ID)
+		for _, ac := range sliceACRe.FindAllString(block, -1) {
+			switch {
+			case s.ID == slice || built[sliceNumber(s.ID)]:
+				live[ac] = true
+			case !slices.Contains(owners[ac], s.ID):
+				owners[ac] = append(owners[ac], s.ID)
+			}
+		}
+	}
+	skips := map[string]string{}
+	for _, id := range gateIDs {
+		if !live[id] && len(owners[id]) > 0 {
+			skips[id] = strings.Join(owners[id], ", ")
+		}
+	}
+	return skips, nil
+}
+
 // planReady lists, in plan order, the tasks.md slices state.md does not check
 // built whose dependencies it all checks built, each with its sliceWritePaths
 // plus its dependency manifest and lockfile when it declares external

package/engine/main.go

@@ -16,6 +16,7 @@ import (
 	"github.com/devrites/devrites/internal/overhaul"
 	"github.com/devrites/devrites/internal/parallel"
 	"github.com/devrites/devrites/internal/rootfacts"
+	"github.com/devrites/devrites/internal/state"
 	"github.com/devrites/devrites/internal/version"
 )
 
@@ -124,6 +125,8 @@ func init() {
 	parallel.PlanReady = lib.PlanReady
 	// `gates precheck` runs `check windows` through this hook for the same reason.
 	acceptance.WindowsCheck = lib.RunCheckWindows
+	// ...and `gates precheck --slice` learns which writer gates to skip.
+	acceptance.PrecheckSkips = lib.PrecheckSkips
 }
 
 // run is the testable entry point. It returns the process exit code.
@@ -329,6 +332,18 @@ func cmdGate(root string, kind gate.Kind, args []string, stdout, stderr io.Write
 		fmt.Fprintf(stderr, "devrites: %v\n", err)
 		return exitUsage
 	}
+	// Leaving Vet, every unbuilt slice must already pass Build-entry `check
+	// slice`. The gate package reads no workspace path itself, so the CLI
+	// composes this lib check onto its result, as seal does below.
+	if kind == gate.Readiness && result.Phase == state.PhaseVet && len(result.MissingFiles) == 0 {
+		for _, problem := range lib.UnbuiltSliceProblems(root, args[0]) {
+			result.StateProblems = append(result.StateProblems, "slice-check: "+problem)
+			if !result.Blocked {
+				result.Blocked = true
+				result.ReasonID = gate.ResultReasonID(kind, true)
+			}
+		}
+	}
 	if result.Blocked {
 		fmt.Fprint(stdout, result.Render())
 		return exitBlocked

package/pack/.claude/agents/devrites-plan-reviewer.md

@@ -72,6 +72,13 @@ line, and then assign the band. Do not choose a score and justify it afterward:
    speculate about micro-optimizations.
 6. **Reversibility & blast radius:** treat auth, migration, public API, and data
    model changes conservatively. Every destructive step needs a rollback.
+   Close every unbuilt slice's write set against the live tree: real callers and
+   consumers of what it changes (`trace_path` inbound), tests that exercise
+   behavior it changes or retires, build/runtime/config files and generated
+   outputs its result needs, and tooling it relies on must each be owned by that
+   slice or an earlier one. Each gap is a `kind: contract` row naming the exact
+   path and owning slice. **Failing case:** a slice that moves startup into a
+   constructor omits the `main.go` caller, found only at its Build entry.
 7. **Failure-mode coverage:** for each new codepath, find a realistic failure such
    as a timeout, nil value, race, or stale state. A silent failure with **no test AND
    no error handling** is a critical gap. For every consumptive action under

package/pack/.claude/agents/devrites-slice-wright.md

@@ -107,7 +107,8 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
      in product source, tests, comments, or filenames.
 4. **VERIFY (fail-on-red).** Run writer-safe tests/types/lint: `Tests/proof` plus
    tests of changed code; `## Feature gates` rows are root-owned, except that when the
-   contract lists `gates precheck` you run it on your worktree and fix every FAIL
+   contract lists `gates precheck --slice <SLICE-ID>` you run it on your worktree
+   (`SKIP` rows are gates of unbuilt slices) and fix every FAIL
    in your paths before returning; a FAIL you cannot fix there is an Escalation
    (its output is never evidence). Writer-safe means
    local and non-consumptive — syntax/type/lint, unit and self-check suites, and a

package/pack/.claude/skills/devrites-lib/reference/workspace-artifact-schema.md

@@ -6,6 +6,19 @@ cursor forms remain readable, but a cursor with no `schema` row needs
 `devrites-engine migrate <slug>` before the engine accepts it. `/rite-upgrade` audits
 without path/alias/format migration.
 
+## Contents
+
+- [Slug identity](#slug-identity)
+- [Required by phase](#required-by-phase)
+- [What each file owns](#what-each-file-owns)
+- [Candidate manifest and bindings](#candidate-manifest-and-bindings)
+- [Anchored notes](#anchored-notes)
+- [Native readiness ownership](#native-readiness-ownership)
+- [Canonical slice grammar](#canonical-slice-grammar)
+- [Read next by phase](#read-next-by-phase)
+- [Do not duplicate](#do-not-duplicate)
+- [ID contract](#id-contract)
+
 ## Slug identity
 
 New slugs derive from the objective: lowercase ASCII kebab-case matching
@@ -214,6 +227,7 @@ Consumes / Produces: <interfaces read and exposed>
 Known-Gotchas: <ordering hazards and framework footguns | none>
 Prior-slice learnings: <constraints learned earlier | none>
 Files likely touched: <real paths>
+Writer allowlist: <exact project-relative files the wright may edit (a superset of Files likely touched)>
 Tests/proof: <exact command + cwd + expected signal + prerequisites/provenance inputs>
 Browser proof required: <yes | no>
 Frontend craft required: <yes | no>

package/pack/.claude/skills/rite-build/reference/phase-contract.md

@@ -76,7 +76,9 @@ With a `test-plan.md` `## Feature gates` section, step 6 runs `Tests/proof` and
 other row; feature gates run once per parallel landing, on control, while worktree
 wrights continue. The next landing and Prove wait for them; red is a fingerprint
 against slices landed since the last green run. Serial same-worktree mode, and plans
-without the section, run every row each round.
+without the section, run every row each round. Run gate, benchmark and proof commands
+through the host's shell tool, never a code-evaluation subprocess, whose environment
+can lack the owner's exported variables.
 
 ## Independent Build review
 

package/pack/.claude/skills/rite-build/reference/wright-dispatch.md

@@ -65,7 +65,9 @@ worktrees stay forbidden.
    A target composed only of vetted executable workflow artifacts routes to the
    controlling root under
    [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
-   its rejection here is not a blocker.
+   its rejection here is not a blocker. Vet already closed the slice's write
+   set; re-check only consumers of files earlier slices changed since the
+   readiness binding, and fold a gap through `/rite-plan` before dispatch.
 2. Goal, verbatim acceptance, exclusions, context, `test-plan.md` proof
    commands, and applicable standards reach the wright through the slice bundle
    its contract names; only a native-worktree pilot contract adds the exact
@@ -87,8 +89,9 @@ worktrees stay forbidden.
    them: a wright that cannot execute writes blind and its failures surface a
    whole review round later. Only artifact-producing, consumptive, or full
    canonical feature gates stay root-owned; when `gates.md` has a `RUN: writer`
-   gate, the checks include `devrites-engine gates precheck <slug> --worktree <path>`
-   (those gates plus `check windows`; never evidence, root still runs every gate).
+   gate, the checks include `devrites-engine gates precheck <slug> --worktree <path> --slice <SLICE-ID>`
+   (those gates, minus ones only other unbuilt slices own, plus `check windows`;
+   never evidence, root still runs every gate).
 3. Run `devrites-engine check diff-scope <slug> --snapshot` before dispatch so
    unrelated work remains distinguishable (it fingerprints every dirty path). For an isolated pilot, also record committed base SHA and exact
    baseline status before asking the host for isolation. **Failing case:** paths that

package/pack/.claude/skills/rite-vet/SKILL.md

@@ -209,7 +209,10 @@ plan declares a root-authored executable workflow file, read
    `marker sweep:` line is recorded in `eng-review.md`; a kept hit blocks READY. Write phase/next step and emit one
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
-   must pass. A `sequence_lookahead: yes` workspace also records one
+   must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
+   READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
+   unbuilt slice's write set closed against the live tree (plan-reviewer
+   dimension 6), so frontier gaps fold in one Plan repair, not one per slice. A `sequence_lookahead: yes` workspace also records one
    `Predecessor readiness: <predecessor> <digest>` line from the predecessor's
    `--emit-binding` hex; readiness re-checks it. Record the per-input drift baseline alongside it:
    `devrites-engine check drift <slug> --record` — a later stale binding then

package/pack/generated/claude/agents/devrites-plan-reviewer.md

@@ -78,6 +78,13 @@ line, and then assign the band. Do not choose a score and justify it afterward:
    speculate about micro-optimizations.
 6. **Reversibility & blast radius:** treat auth, migration, public API, and data
    model changes conservatively. Every destructive step needs a rollback.
+   Close every unbuilt slice's write set against the live tree: real callers and
+   consumers of what it changes (`trace_path` inbound), tests that exercise
+   behavior it changes or retires, build/runtime/config files and generated
+   outputs its result needs, and tooling it relies on must each be owned by that
+   slice or an earlier one. Each gap is a `kind: contract` row naming the exact
+   path and owning slice. **Failing case:** a slice that moves startup into a
+   constructor omits the `main.go` caller, found only at its Build entry.
 7. **Failure-mode coverage:** for each new codepath, find a realistic failure such
    as a timeout, nil value, race, or stale state. A silent failure with **no test AND
    no error handling** is a critical gap. For every consumptive action under

package/pack/generated/claude/agents/devrites-slice-wright.md

@@ -107,7 +107,8 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
      in product source, tests, comments, or filenames.
 4. **VERIFY (fail-on-red).** Run writer-safe tests/types/lint: `Tests/proof` plus
    tests of changed code; `## Feature gates` rows are root-owned, except that when the
-   contract lists `gates precheck` you run it on your worktree and fix every FAIL
+   contract lists `gates precheck --slice <SLICE-ID>` you run it on your worktree
+   (`SKIP` rows are gates of unbuilt slices) and fix every FAIL
    in your paths before returning; a FAIL you cannot fix there is an Escalation
    (its output is never evidence). Writer-safe means
    local and non-consumptive — syntax/type/lint, unit and self-check suites, and a

package/pack/generated/claude/skills/devrites-lib/reference/workspace-artifact-schema.md

@@ -6,6 +6,19 @@ cursor forms remain readable, but a cursor with no `schema` row needs
 `devrites-engine migrate <slug>` before the engine accepts it. `/rite-upgrade` audits
 without path/alias/format migration.
 
+## Contents
+
+- [Slug identity](#slug-identity)
+- [Required by phase](#required-by-phase)
+- [What each file owns](#what-each-file-owns)
+- [Candidate manifest and bindings](#candidate-manifest-and-bindings)
+- [Anchored notes](#anchored-notes)
+- [Native readiness ownership](#native-readiness-ownership)
+- [Canonical slice grammar](#canonical-slice-grammar)
+- [Read next by phase](#read-next-by-phase)
+- [Do not duplicate](#do-not-duplicate)
+- [ID contract](#id-contract)
+
 ## Slug identity
 
 New slugs derive from the objective: lowercase ASCII kebab-case matching
@@ -214,6 +227,7 @@ Consumes / Produces: <interfaces read and exposed>
 Known-Gotchas: <ordering hazards and framework footguns | none>
 Prior-slice learnings: <constraints learned earlier | none>
 Files likely touched: <real paths>
+Writer allowlist: <exact project-relative files the wright may edit (a superset of Files likely touched)>
 Tests/proof: <exact command + cwd + expected signal + prerequisites/provenance inputs>
 Browser proof required: <yes | no>
 Frontend craft required: <yes | no>

package/pack/generated/claude/skills/rite-build/reference/phase-contract.md

@@ -76,7 +76,9 @@ With a `test-plan.md` `## Feature gates` section, step 6 runs `Tests/proof` and
 other row; feature gates run once per parallel landing, on control, while worktree
 wrights continue. The next landing and Prove wait for them; red is a fingerprint
 against slices landed since the last green run. Serial same-worktree mode, and plans
-without the section, run every row each round.
+without the section, run every row each round. Run gate, benchmark and proof commands
+through the host's shell tool, never a code-evaluation subprocess, whose environment
+can lack the owner's exported variables.
 
 ## Independent Build review
 

package/pack/generated/claude/skills/rite-build/reference/wright-dispatch.md

@@ -65,7 +65,9 @@ worktrees stay forbidden.
    A target composed only of vetted executable workflow artifacts routes to the
    controlling root under
    [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
-   its rejection here is not a blocker.
+   its rejection here is not a blocker. Vet already closed the slice's write
+   set; re-check only consumers of files earlier slices changed since the
+   readiness binding, and fold a gap through `/rite-plan` before dispatch.
 2. Goal, verbatim acceptance, exclusions, context, `test-plan.md` proof
    commands, and applicable standards reach the wright through the slice bundle
    its contract names; only a native-worktree pilot contract adds the exact
@@ -87,8 +89,9 @@ worktrees stay forbidden.
    them: a wright that cannot execute writes blind and its failures surface a
    whole review round later. Only artifact-producing, consumptive, or full
    canonical feature gates stay root-owned; when `gates.md` has a `RUN: writer`
-   gate, the checks include `devrites-engine gates precheck <slug> --worktree <path>`
-   (those gates plus `check windows`; never evidence, root still runs every gate).
+   gate, the checks include `devrites-engine gates precheck <slug> --worktree <path> --slice <SLICE-ID>`
+   (those gates, minus ones only other unbuilt slices own, plus `check windows`;
+   never evidence, root still runs every gate).
 3. Run `devrites-engine check diff-scope <slug> --snapshot` before dispatch so
    unrelated work remains distinguishable (it fingerprints every dirty path). For an isolated pilot, also record committed base SHA and exact
    baseline status before asking the host for isolation. **Failing case:** paths that

package/pack/generated/claude/skills/rite-vet/SKILL.md

@@ -211,7 +211,10 @@ plan declares a root-authored executable workflow file, read
    `marker sweep:` line is recorded in `eng-review.md`; a kept hit blocks READY. Write phase/next step and emit one
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
-   must pass. A `sequence_lookahead: yes` workspace also records one
+   must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
+   READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
+   unbuilt slice's write set closed against the live tree (plan-reviewer
+   dimension 6), so frontier gaps fold in one Plan repair, not one per slice. A `sequence_lookahead: yes` workspace also records one
    `Predecessor readiness: <predecessor> <digest>` line from the predecessor's
    `--emit-binding` hex; readiness re-checks it. Record the per-input drift baseline alongside it:
    `devrites-engine check drift <slug> --record` — a later stale binding then

package/pack/generated/codex/agents/devrites-plan-reviewer.toml

@@ -76,6 +76,13 @@ line, and then assign the band. Do not choose a score and justify it afterward:
    speculate about micro-optimizations.
 6. **Reversibility & blast radius:** treat auth, migration, public API, and data
    model changes conservatively. Every destructive step needs a rollback.
+   Close every unbuilt slice's write set against the live tree: real callers and
+   consumers of what it changes (`trace_path` inbound), tests that exercise
+   behavior it changes or retires, build/runtime/config files and generated
+   outputs its result needs, and tooling it relies on must each be owned by that
+   slice or an earlier one. Each gap is a `kind: contract` row naming the exact
+   path and owning slice. **Failing case:** a slice that moves startup into a
+   constructor omits the `main.go` caller, found only at its Build entry.
 7. **Failure-mode coverage:** for each new codepath, find a realistic failure such
    as a timeout, nil value, race, or stale state. A silent failure with **no test AND
    no error handling** is a critical gap. For every consumptive action under

package/pack/generated/codex/agents/devrites-slice-wright.toml

@@ -105,7 +105,8 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
      in product source, tests, comments, or filenames.
 4. **VERIFY (fail-on-red).** Run writer-safe tests/types/lint: `Tests/proof` plus
    tests of changed code; `## Feature gates` rows are root-owned, except that when the
-   contract lists `gates precheck` you run it on your worktree and fix every FAIL
+   contract lists `gates precheck --slice <SLICE-ID>` you run it on your worktree
+   (`SKIP` rows are gates of unbuilt slices) and fix every FAIL
    in your paths before returning; a FAIL you cannot fix there is an Escalation
    (its output is never evidence). Writer-safe means
    local and non-consumptive — syntax/type/lint, unit and self-check suites, and a

package/pack/generated/codex/skills/devrites-lib/reference/workspace-artifact-schema.md

@@ -6,6 +6,19 @@ cursor forms remain readable, but a cursor with no `schema` row needs
 `devrites-engine migrate <slug>` before the engine accepts it. `$rite-upgrade` audits
 without path/alias/format migration.
 
+## Contents
+
+- [Slug identity](#slug-identity)
+- [Required by phase](#required-by-phase)
+- [What each file owns](#what-each-file-owns)
+- [Candidate manifest and bindings](#candidate-manifest-and-bindings)
+- [Anchored notes](#anchored-notes)
+- [Native readiness ownership](#native-readiness-ownership)
+- [Canonical slice grammar](#canonical-slice-grammar)
+- [Read next by phase](#read-next-by-phase)
+- [Do not duplicate](#do-not-duplicate)
+- [ID contract](#id-contract)
+
 ## Slug identity
 
 New slugs derive from the objective: lowercase ASCII kebab-case matching
@@ -214,6 +227,7 @@ Consumes / Produces: <interfaces read and exposed>
 Known-Gotchas: <ordering hazards and framework footguns | none>
 Prior-slice learnings: <constraints learned earlier | none>
 Files likely touched: <real paths>
+Writer allowlist: <exact project-relative files the wright may edit (a superset of Files likely touched)>
 Tests/proof: <exact command + cwd + expected signal + prerequisites/provenance inputs>
 Browser proof required: <yes | no>
 Frontend craft required: <yes | no>

package/pack/generated/codex/skills/rite-build/reference/phase-contract.md

@@ -76,7 +76,9 @@ With a `test-plan.md` `## Feature gates` section, step 6 runs `Tests/proof` and
 other row; feature gates run once per parallel landing, on control, while worktree
 wrights continue. The next landing and Prove wait for them; red is a fingerprint
 against slices landed since the last green run. Serial same-worktree mode, and plans
-without the section, run every row each round.
+without the section, run every row each round. Run gate, benchmark and proof commands
+through the host's shell tool, never a code-evaluation subprocess, whose environment
+can lack the owner's exported variables.
 
 ## Independent Build review
 

package/pack/generated/codex/skills/rite-build/reference/wright-dispatch.md

@@ -65,7 +65,9 @@ worktrees stay forbidden.
    A target composed only of vetted executable workflow artifacts routes to the
    controlling root under
    [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
-   its rejection here is not a blocker.
+   its rejection here is not a blocker. Vet already closed the slice's write
+   set; re-check only consumers of files earlier slices changed since the
+   readiness binding, and fold a gap through `$rite-plan` before dispatch.
 2. Goal, verbatim acceptance, exclusions, context, `test-plan.md` proof
    commands, and applicable standards reach the wright through the slice bundle
    its contract names; only a native-worktree pilot contract adds the exact
@@ -87,8 +89,9 @@ worktrees stay forbidden.
    them: a wright that cannot execute writes blind and its failures surface a
    whole review round later. Only artifact-producing, consumptive, or full
    canonical feature gates stay root-owned; when `gates.md` has a `RUN: writer`
-   gate, the checks include `devrites-engine gates precheck <slug> --worktree <path>`
-   (those gates plus `check windows`; never evidence, root still runs every gate).
+   gate, the checks include `devrites-engine gates precheck <slug> --worktree <path> --slice <SLICE-ID>`
+   (those gates, minus ones only other unbuilt slices own, plus `check windows`;
+   never evidence, root still runs every gate).
 3. Run `devrites-engine check diff-scope <slug> --snapshot` before dispatch so
    unrelated work remains distinguishable (it fingerprints every dirty path). For an isolated pilot, also record committed base SHA and exact
    baseline status before asking the host for isolation. **Failing case:** paths that

package/pack/generated/codex/skills/rite-vet/SKILL.md

@@ -211,7 +211,10 @@ plan declares a root-authored executable workflow file, read
    `marker sweep:` line is recorded in `eng-review.md`; a kept hit blocks READY. Write phase/next step and emit one
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
-   must pass. A `sequence_lookahead: yes` workspace also records one
+   must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
+   READY needs each to pass (fix failures in `$rite-plan`). READY also needs every
+   unbuilt slice's write set closed against the live tree (plan-reviewer
+   dimension 6), so frontier gaps fold in one Plan repair, not one per slice. A `sequence_lookahead: yes` workspace also records one
    `Predecessor readiness: <predecessor> <digest>` line from the predecessor's
    `--emit-binding` hex; readiness re-checks it. Record the per-input drift baseline alongside it:
    `devrites-engine check drift <slug> --record` — a later stale binding then

package/pack/generated/devin/agents/devrites-plan-reviewer.md

@@ -80,6 +80,13 @@ line, and then assign the band. Do not choose a score and justify it afterward:
    speculate about micro-optimizations.
 6. **Reversibility & blast radius:** treat auth, migration, public API, and data
    model changes conservatively. Every destructive step needs a rollback.
+   Close every unbuilt slice's write set against the live tree: real callers and
+   consumers of what it changes (`trace_path` inbound), tests that exercise
+   behavior it changes or retires, build/runtime/config files and generated
+   outputs its result needs, and tooling it relies on must each be owned by that
+   slice or an earlier one. Each gap is a `kind: contract` row naming the exact
+   path and owning slice. **Failing case:** a slice that moves startup into a
+   constructor omits the `main.go` caller, found only at its Build entry.
 7. **Failure-mode coverage:** for each new codepath, find a realistic failure such
    as a timeout, nil value, race, or stale state. A silent failure with **no test AND
    no error handling** is a critical gap. For every consumptive action under

package/pack/generated/devin/agents/devrites-slice-wright.md

@@ -112,7 +112,8 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
      in product source, tests, comments, or filenames.
 4. **VERIFY (fail-on-red).** Run writer-safe tests/types/lint: `Tests/proof` plus
    tests of changed code; `## Feature gates` rows are root-owned, except that when the
-   contract lists `gates precheck` you run it on your worktree and fix every FAIL
+   contract lists `gates precheck --slice <SLICE-ID>` you run it on your worktree
+   (`SKIP` rows are gates of unbuilt slices) and fix every FAIL
    in your paths before returning; a FAIL you cannot fix there is an Escalation
    (its output is never evidence). Writer-safe means
    local and non-consumptive — syntax/type/lint, unit and self-check suites, and a

package/pack/generated/devin/skills/devrites-lib/reference/workspace-artifact-schema.md

@@ -6,6 +6,19 @@ cursor forms remain readable, but a cursor with no `schema` row needs
 `devrites-engine migrate <slug>` before the engine accepts it. `/rite-upgrade` audits
 without path/alias/format migration.
 
+## Contents
+
+- [Slug identity](#slug-identity)
+- [Required by phase](#required-by-phase)
+- [What each file owns](#what-each-file-owns)
+- [Candidate manifest and bindings](#candidate-manifest-and-bindings)
+- [Anchored notes](#anchored-notes)
+- [Native readiness ownership](#native-readiness-ownership)
+- [Canonical slice grammar](#canonical-slice-grammar)
+- [Read next by phase](#read-next-by-phase)
+- [Do not duplicate](#do-not-duplicate)
+- [ID contract](#id-contract)
+
 ## Slug identity
 
 New slugs derive from the objective: lowercase ASCII kebab-case matching
@@ -214,6 +227,7 @@ Consumes / Produces: <interfaces read and exposed>
 Known-Gotchas: <ordering hazards and framework footguns | none>
 Prior-slice learnings: <constraints learned earlier | none>
 Files likely touched: <real paths>
+Writer allowlist: <exact project-relative files the wright may edit (a superset of Files likely touched)>
 Tests/proof: <exact command + cwd + expected signal + prerequisites/provenance inputs>
 Browser proof required: <yes | no>
 Frontend craft required: <yes | no>

package/pack/generated/devin/skills/rite-build/reference/phase-contract.md

@@ -76,7 +76,9 @@ With a `test-plan.md` `## Feature gates` section, step 6 runs `Tests/proof` and
 other row; feature gates run once per parallel landing, on control, while worktree
 wrights continue. The next landing and Prove wait for them; red is a fingerprint
 against slices landed since the last green run. Serial same-worktree mode, and plans
-without the section, run every row each round.
+without the section, run every row each round. Run gate, benchmark and proof commands
+through the host's shell tool, never a code-evaluation subprocess, whose environment
+can lack the owner's exported variables.
 
 ## Independent Build review
 

package/pack/generated/devin/skills/rite-build/reference/wright-dispatch.md

@@ -65,7 +65,9 @@ worktrees stay forbidden.
    A target composed only of vetted executable workflow artifacts routes to the
    controlling root under
    [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
-   its rejection here is not a blocker.
+   its rejection here is not a blocker. Vet already closed the slice's write
+   set; re-check only consumers of files earlier slices changed since the
+   readiness binding, and fold a gap through `/rite-plan` before dispatch.
 2. Goal, verbatim acceptance, exclusions, context, `test-plan.md` proof
    commands, and applicable standards reach the wright through the slice bundle
    its contract names; only a native-worktree pilot contract adds the exact
@@ -87,8 +89,9 @@ worktrees stay forbidden.
    them: a wright that cannot execute writes blind and its failures surface a
    whole review round later. Only artifact-producing, consumptive, or full
    canonical feature gates stay root-owned; when `gates.md` has a `RUN: writer`
-   gate, the checks include `devrites-engine gates precheck <slug> --worktree <path>`
-   (those gates plus `check windows`; never evidence, root still runs every gate).
+   gate, the checks include `devrites-engine gates precheck <slug> --worktree <path> --slice <SLICE-ID>`
+   (those gates, minus ones only other unbuilt slices own, plus `check windows`;
+   never evidence, root still runs every gate).
 3. Run `devrites-engine check diff-scope <slug> --snapshot` before dispatch so
    unrelated work remains distinguishable (it fingerprints every dirty path). For an isolated pilot, also record committed base SHA and exact
    baseline status before asking the host for isolation. **Failing case:** paths that

package/pack/generated/devin/skills/rite-vet/SKILL.md

@@ -210,7 +210,10 @@ plan declares a root-authored executable workflow file, read
    `marker sweep:` line is recorded in `eng-review.md`; a kept hit blocks READY. Write phase/next step and emit one
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
-   must pass. A `sequence_lookahead: yes` workspace also records one
+   must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
+   READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
+   unbuilt slice's write set closed against the live tree (plan-reviewer
+   dimension 6), so frontier gaps fold in one Plan repair, not one per slice. A `sequence_lookahead: yes` workspace also records one
    `Predecessor readiness: <predecessor> <digest>` line from the predecessor's
    `--emit-binding` hex; readiness re-checks it. Record the per-input drift baseline alongside it:
    `devrites-engine check drift <slug> --record` — a later stale binding then

package/pack/generated/omp/agents/devrites-plan-reviewer.md

@@ -77,6 +77,13 @@ line, and then assign the band. Do not choose a score and justify it afterward:
    speculate about micro-optimizations.
 6. **Reversibility & blast radius:** treat auth, migration, public API, and data
    model changes conservatively. Every destructive step needs a rollback.
+   Close every unbuilt slice's write set against the live tree: real callers and
+   consumers of what it changes (`trace_path` inbound), tests that exercise
+   behavior it changes or retires, build/runtime/config files and generated
+   outputs its result needs, and tooling it relies on must each be owned by that
+   slice or an earlier one. Each gap is a `kind: contract` row naming the exact
+   path and owning slice. **Failing case:** a slice that moves startup into a
+   constructor omits the `main.go` caller, found only at its Build entry.
 7. **Failure-mode coverage:** for each new codepath, find a realistic failure such
    as a timeout, nil value, race, or stale state. A silent failure with **no test AND
    no error handling** is a critical gap. For every consumptive action under

package/pack/generated/omp/agents/devrites-slice-wright.md

@@ -105,7 +105,8 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
      in product source, tests, comments, or filenames.
 4. **VERIFY (fail-on-red).** Run writer-safe tests/types/lint: `Tests/proof` plus
    tests of changed code; `## Feature gates` rows are root-owned, except that when the
-   contract lists `gates precheck` you run it on your worktree and fix every FAIL
+   contract lists `gates precheck --slice <SLICE-ID>` you run it on your worktree
+   (`SKIP` rows are gates of unbuilt slices) and fix every FAIL
    in your paths before returning; a FAIL you cannot fix there is an Escalation
    (its output is never evidence). Writer-safe means
    local and non-consumptive — syntax/type/lint, unit and self-check suites, and a

package/pack/generated/omp/skills/devrites-lib/reference/workspace-artifact-schema.md

@@ -6,6 +6,19 @@ cursor forms remain readable, but a cursor with no `schema` row needs
 `devrites-engine migrate <slug>` before the engine accepts it. `/rite-upgrade` audits
 without path/alias/format migration.
 
+## Contents
+
+- [Slug identity](#slug-identity)
+- [Required by phase](#required-by-phase)
+- [What each file owns](#what-each-file-owns)
+- [Candidate manifest and bindings](#candidate-manifest-and-bindings)
+- [Anchored notes](#anchored-notes)
+- [Native readiness ownership](#native-readiness-ownership)
+- [Canonical slice grammar](#canonical-slice-grammar)
+- [Read next by phase](#read-next-by-phase)
+- [Do not duplicate](#do-not-duplicate)
+- [ID contract](#id-contract)
+
 ## Slug identity
 
 New slugs derive from the objective: lowercase ASCII kebab-case matching
@@ -214,6 +227,7 @@ Consumes / Produces: <interfaces read and exposed>
 Known-Gotchas: <ordering hazards and framework footguns | none>
 Prior-slice learnings: <constraints learned earlier | none>
 Files likely touched: <real paths>
+Writer allowlist: <exact project-relative files the wright may edit (a superset of Files likely touched)>
 Tests/proof: <exact command + cwd + expected signal + prerequisites/provenance inputs>
 Browser proof required: <yes | no>
 Frontend craft required: <yes | no>

package/pack/generated/omp/skills/rite-build/reference/phase-contract.md

@@ -76,7 +76,9 @@ With a `test-plan.md` `## Feature gates` section, step 6 runs `Tests/proof` and
 other row; feature gates run once per parallel landing, on control, while worktree
 wrights continue. The next landing and Prove wait for them; red is a fingerprint
 against slices landed since the last green run. Serial same-worktree mode, and plans
-without the section, run every row each round.
+without the section, run every row each round. Run gate, benchmark and proof commands
+through the host's shell tool, never a code-evaluation subprocess, whose environment
+can lack the owner's exported variables.
 
 ## Independent Build review
 

package/pack/generated/omp/skills/rite-build/reference/wright-dispatch.md

@@ -65,7 +65,9 @@ worktrees stay forbidden.
    A target composed only of vetted executable workflow artifacts routes to the
    controlling root under
    [`workflow-artifacts.md`](skill://devrites-lib/reference/standards/workflow-artifacts.md);
-   its rejection here is not a blocker.
+   its rejection here is not a blocker. Vet already closed the slice's write
+   set; re-check only consumers of files earlier slices changed since the
+   readiness binding, and fold a gap through `/rite-plan` before dispatch.
 2. Goal, verbatim acceptance, exclusions, context, `test-plan.md` proof
    commands, and applicable standards reach the wright through the slice bundle
    its contract names; only a native-worktree pilot contract adds the exact
@@ -87,8 +89,9 @@ worktrees stay forbidden.
    them: a wright that cannot execute writes blind and its failures surface a
    whole review round later. Only artifact-producing, consumptive, or full
    canonical feature gates stay root-owned; when `gates.md` has a `RUN: writer`
-   gate, the checks include `devrites-engine gates precheck <slug> --worktree <path>`
-   (those gates plus `check windows`; never evidence, root still runs every gate).
+   gate, the checks include `devrites-engine gates precheck <slug> --worktree <path> --slice <SLICE-ID>`
+   (those gates, minus ones only other unbuilt slices own, plus `check windows`;
+   never evidence, root still runs every gate).
 3. Run `devrites-engine check diff-scope <slug> --snapshot` before dispatch so
    unrelated work remains distinguishable (it fingerprints every dirty path). For an isolated pilot, also record committed base SHA and exact
    baseline status before asking the host for isolation. **Failing case:** paths that

package/pack/generated/omp/skills/rite-vet/SKILL.md

@@ -211,7 +211,10 @@ plan declares a root-authored executable workflow file, read
    `marker sweep:` line is recorded in `eng-review.md`; a kept hit blocks READY. Write phase/next step and emit one
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
-   must pass. A `sequence_lookahead: yes` workspace also records one
+   must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
+   READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
+   unbuilt slice's write set closed against the live tree (plan-reviewer
+   dimension 6), so frontier gaps fold in one Plan repair, not one per slice. A `sequence_lookahead: yes` workspace also records one
    `Predecessor readiness: <predecessor> <digest>` line from the predecessor's
    `--emit-binding` hex; readiness re-checks it. Record the per-input drift baseline alongside it:
    `devrites-engine check drift <slug> --record` — a later stale binding then

package/pack/generated/pi/agents/devrites-plan-reviewer.md

@@ -78,6 +78,13 @@ line, and then assign the band. Do not choose a score and justify it afterward:
    speculate about micro-optimizations.
 6. **Reversibility & blast radius:** treat auth, migration, public API, and data
    model changes conservatively. Every destructive step needs a rollback.
+   Close every unbuilt slice's write set against the live tree: real callers and
+   consumers of what it changes (`trace_path` inbound), tests that exercise
+   behavior it changes or retires, build/runtime/config files and generated
+   outputs its result needs, and tooling it relies on must each be owned by that
+   slice or an earlier one. Each gap is a `kind: contract` row naming the exact
+   path and owning slice. **Failing case:** a slice that moves startup into a
+   constructor omits the `main.go` caller, found only at its Build entry.
 7. **Failure-mode coverage:** for each new codepath, find a realistic failure such
    as a timeout, nil value, race, or stale state. A silent failure with **no test AND
    no error handling** is a critical gap. For every consumptive action under

package/pack/generated/pi/agents/devrites-slice-wright.md

@@ -106,7 +106,8 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
      in product source, tests, comments, or filenames.
 4. **VERIFY (fail-on-red).** Run writer-safe tests/types/lint: `Tests/proof` plus
    tests of changed code; `## Feature gates` rows are root-owned, except that when the
-   contract lists `gates precheck` you run it on your worktree and fix every FAIL
+   contract lists `gates precheck --slice <SLICE-ID>` you run it on your worktree
+   (`SKIP` rows are gates of unbuilt slices) and fix every FAIL
    in your paths before returning; a FAIL you cannot fix there is an Escalation
    (its output is never evidence). Writer-safe means
    local and non-consumptive — syntax/type/lint, unit and self-check suites, and a

package/pack/generated/pi/skills/devrites-lib/reference/workspace-artifact-schema.md

@@ -6,6 +6,19 @@ cursor forms remain readable, but a cursor with no `schema` row needs
 `devrites-engine migrate <slug>` before the engine accepts it. `/rite-upgrade` audits
 without path/alias/format migration.
 
+## Contents
+
+- [Slug identity](#slug-identity)
+- [Required by phase](#required-by-phase)
+- [What each file owns](#what-each-file-owns)
+- [Candidate manifest and bindings](#candidate-manifest-and-bindings)
+- [Anchored notes](#anchored-notes)
+- [Native readiness ownership](#native-readiness-ownership)
+- [Canonical slice grammar](#canonical-slice-grammar)
+- [Read next by phase](#read-next-by-phase)
+- [Do not duplicate](#do-not-duplicate)
+- [ID contract](#id-contract)
+
 ## Slug identity
 
 New slugs derive from the objective: lowercase ASCII kebab-case matching
@@ -214,6 +227,7 @@ Consumes / Produces: <interfaces read and exposed>
 Known-Gotchas: <ordering hazards and framework footguns | none>
 Prior-slice learnings: <constraints learned earlier | none>
 Files likely touched: <real paths>
+Writer allowlist: <exact project-relative files the wright may edit (a superset of Files likely touched)>
 Tests/proof: <exact command + cwd + expected signal + prerequisites/provenance inputs>
 Browser proof required: <yes | no>
 Frontend craft required: <yes | no>

package/pack/generated/pi/skills/rite-build/reference/phase-contract.md

@@ -76,7 +76,9 @@ With a `test-plan.md` `## Feature gates` section, step 6 runs `Tests/proof` and
 other row; feature gates run once per parallel landing, on control, while worktree
 wrights continue. The next landing and Prove wait for them; red is a fingerprint
 against slices landed since the last green run. Serial same-worktree mode, and plans
-without the section, run every row each round.
+without the section, run every row each round. Run gate, benchmark and proof commands
+through the host's shell tool, never a code-evaluation subprocess, whose environment
+can lack the owner's exported variables.
 
 ## Independent Build review
 

package/pack/generated/pi/skills/rite-build/reference/wright-dispatch.md

@@ -65,7 +65,9 @@ worktrees stay forbidden.
    A target composed only of vetted executable workflow artifacts routes to the
    controlling root under
    [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
-   its rejection here is not a blocker.
+   its rejection here is not a blocker. Vet already closed the slice's write
+   set; re-check only consumers of files earlier slices changed since the
+   readiness binding, and fold a gap through `/rite-plan` before dispatch.
 2. Goal, verbatim acceptance, exclusions, context, `test-plan.md` proof
    commands, and applicable standards reach the wright through the slice bundle
    its contract names; only a native-worktree pilot contract adds the exact
@@ -87,8 +89,9 @@ worktrees stay forbidden.
    them: a wright that cannot execute writes blind and its failures surface a
    whole review round later. Only artifact-producing, consumptive, or full
    canonical feature gates stay root-owned; when `gates.md` has a `RUN: writer`
-   gate, the checks include `devrites-engine gates precheck <slug> --worktree <path>`
-   (those gates plus `check windows`; never evidence, root still runs every gate).
+   gate, the checks include `devrites-engine gates precheck <slug> --worktree <path> --slice <SLICE-ID>`
+   (those gates, minus ones only other unbuilt slices own, plus `check windows`;
+   never evidence, root still runs every gate).
 3. Run `devrites-engine check diff-scope <slug> --snapshot` before dispatch so
    unrelated work remains distinguishable (it fingerprints every dirty path). For an isolated pilot, also record committed base SHA and exact
    baseline status before asking the host for isolation. **Failing case:** paths that

package/pack/generated/pi/skills/rite-vet/SKILL.md

@@ -211,7 +211,10 @@ plan declares a root-authored executable workflow file, read
    `marker sweep:` line is recorded in `eng-review.md`; a kept hit blocks READY. Write phase/next step and emit one
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
-   must pass. A `sequence_lookahead: yes` workspace also records one
+   must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
+   READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
+   unbuilt slice's write set closed against the live tree (plan-reviewer
+   dimension 6), so frontier gaps fold in one Plan repair, not one per slice. A `sequence_lookahead: yes` workspace also records one
    `Predecessor readiness: <predecessor> <digest>` line from the predecessor's
    `--emit-binding` hex; readiness re-checks it. Record the per-input drift baseline alongside it:
    `devrites-engine check drift <slug> --record` — a later stale binding then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "7.0.4",
+  "version": "7.0.6",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, pi, and Devin CLI",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",
@@ -90,7 +90,7 @@
     "@semantic-release/commit-analyzer": "14.0.0-beta.4",
     "@semantic-release/release-notes-generator": "15.0.0-beta.3",
     "@semantic-release/npm": {
-      "npm": "11.20.0"
+      "npm": "11.21.1"
     },
     "fast-uri": "3.1.8",
     "js-yaml": "4.3.2"