devrites 7.0.5 → 7.0.7

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.0.7](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.6...v7.0.7) (2026-10-22)
+
+### Fixed
+
+* **devrites:** never defer a Vet write-set closure row as late ([#161](https://github.com/ViktorsBaikers/DevRites/issues/161)) ([1e71afa](https://github.com/ViktorsBaikers/DevRites/commit/1e71afa630be9f807aeb26aade1cb00407655734))
+
+## [7.0.6](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.5...v7.0.6) (2026-10-22)
+
+### Fixed
+
+* **devrites:** close every slice's write set at Vet ([#160](https://github.com/ViktorsBaikers/DevRites/issues/160)) ([dce9587](https://github.com/ViktorsBaikers/DevRites/commit/dce9587c61660e1ae59c1bd5a0a8afd6de423575))
+
 ## [7.0.5](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.4...v7.0.5) (2026-10-22)
 
 ### Fixed

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.0.5`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.0.5): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.0.7`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.0.7): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 

package/pack/.claude/agents/devrites-plan-reviewer.md

@@ -72,6 +72,13 @@ line, and then assign the band. Do not choose a score and justify it afterward:
    speculate about micro-optimizations.
 6. **Reversibility & blast radius:** treat auth, migration, public API, and data
    model changes conservatively. Every destructive step needs a rollback.
+   Close every unbuilt slice's write set against the live tree: real callers and
+   consumers of what it changes (`trace_path` inbound), tests that exercise
+   behavior it changes or retires, build/runtime/config files and generated
+   outputs its result needs, and tooling it relies on must each be owned by that
+   slice or an earlier one. Each gap is a `kind: contract` row naming the exact
+   path and owning slice. **Failing case:** a slice that moves startup into a
+   constructor omits the `main.go` caller, found only at its Build entry.
 7. **Failure-mode coverage:** for each new codepath, find a realistic failure such
    as a timeout, nil value, race, or stale state. A silent failure with **no test AND
    no error handling** is a critical gap. For every consumptive action under

package/pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -387,6 +387,9 @@ access, safety and irreversible-action boundaries independently stop work.
   next full-inventory gate (Vet `mechanism` → one `test-plan.md` proof row; Build →
   the `/rite-review` roster) — never by another repair round in this phase. Review
   closes every deferred row with a labeled verdict; Seal blocks on any without one.
+  A Vet write-set closure row (plan-reviewer dimension 6) is never late: it names
+  an unbuilt slice's missing path and folds in this phase's one Plan repair, since
+  deferring it only reopens Plan at that slice's Build entry.
   **Failing case:** round 4 finds three Important items on clauses untouched since
   round 1 and dispatches another repair.
 - **Recovery findings need a discriminator; recovery scope stays frozen.** While a

package/pack/.claude/skills/rite-build/reference/wright-dispatch.md

@@ -65,7 +65,9 @@ worktrees stay forbidden.
    A target composed only of vetted executable workflow artifacts routes to the
    controlling root under
    [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
-   its rejection here is not a blocker.
+   its rejection here is not a blocker. Vet already closed the slice's write
+   set; re-check only consumers of files earlier slices changed since the
+   readiness binding, and fold a gap through `/rite-plan` before dispatch.
 2. Goal, verbatim acceptance, exclusions, context, `test-plan.md` proof
    commands, and applicable standards reach the wright through the slice bundle
    its contract names; only a native-worktree pilot contract adds the exact

package/pack/.claude/skills/rite-vet/SKILL.md

@@ -210,7 +210,10 @@ plan declares a root-authored executable workflow file, read
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
    must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
-   READY needs each to pass (fix failures in `/rite-plan`). A `sequence_lookahead: yes` workspace also records one
+   READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
+   unbuilt slice's write set closed against the live tree (plan-reviewer
+   dimension 6), so frontier gaps fold in one Plan repair, not one per slice; an
+   affected recheck also closes every unbuilt slice and never defers a closure row. A `sequence_lookahead: yes` workspace also records one
    `Predecessor readiness: <predecessor> <digest>` line from the predecessor's
    `--emit-binding` hex; readiness re-checks it. Record the per-input drift baseline alongside it:
    `devrites-engine check drift <slug> --record` — a later stale binding then

package/pack/generated/claude/agents/devrites-plan-reviewer.md

@@ -78,6 +78,13 @@ line, and then assign the band. Do not choose a score and justify it afterward:
    speculate about micro-optimizations.
 6. **Reversibility & blast radius:** treat auth, migration, public API, and data
    model changes conservatively. Every destructive step needs a rollback.
+   Close every unbuilt slice's write set against the live tree: real callers and
+   consumers of what it changes (`trace_path` inbound), tests that exercise
+   behavior it changes or retires, build/runtime/config files and generated
+   outputs its result needs, and tooling it relies on must each be owned by that
+   slice or an earlier one. Each gap is a `kind: contract` row naming the exact
+   path and owning slice. **Failing case:** a slice that moves startup into a
+   constructor omits the `main.go` caller, found only at its Build entry.
 7. **Failure-mode coverage:** for each new codepath, find a realistic failure such
    as a timeout, nil value, race, or stale state. A silent failure with **no test AND
    no error handling** is a critical gap. For every consumptive action under

package/pack/generated/claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -387,6 +387,9 @@ access, safety and irreversible-action boundaries independently stop work.
   next full-inventory gate (Vet `mechanism` → one `test-plan.md` proof row; Build →
   the `/rite-review` roster) — never by another repair round in this phase. Review
   closes every deferred row with a labeled verdict; Seal blocks on any without one.
+  A Vet write-set closure row (plan-reviewer dimension 6) is never late: it names
+  an unbuilt slice's missing path and folds in this phase's one Plan repair, since
+  deferring it only reopens Plan at that slice's Build entry.
   **Failing case:** round 4 finds three Important items on clauses untouched since
   round 1 and dispatches another repair.
 - **Recovery findings need a discriminator; recovery scope stays frozen.** While a

package/pack/generated/claude/skills/rite-build/reference/wright-dispatch.md

@@ -65,7 +65,9 @@ worktrees stay forbidden.
    A target composed only of vetted executable workflow artifacts routes to the
    controlling root under
    [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
-   its rejection here is not a blocker.
+   its rejection here is not a blocker. Vet already closed the slice's write
+   set; re-check only consumers of files earlier slices changed since the
+   readiness binding, and fold a gap through `/rite-plan` before dispatch.
 2. Goal, verbatim acceptance, exclusions, context, `test-plan.md` proof
    commands, and applicable standards reach the wright through the slice bundle
    its contract names; only a native-worktree pilot contract adds the exact

package/pack/generated/claude/skills/rite-vet/SKILL.md

@@ -212,7 +212,10 @@ plan declares a root-authored executable workflow file, read
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
    must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
-   READY needs each to pass (fix failures in `/rite-plan`). A `sequence_lookahead: yes` workspace also records one
+   READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
+   unbuilt slice's write set closed against the live tree (plan-reviewer
+   dimension 6), so frontier gaps fold in one Plan repair, not one per slice; an
+   affected recheck also closes every unbuilt slice and never defers a closure row. A `sequence_lookahead: yes` workspace also records one
    `Predecessor readiness: <predecessor> <digest>` line from the predecessor's
    `--emit-binding` hex; readiness re-checks it. Record the per-input drift baseline alongside it:
    `devrites-engine check drift <slug> --record` — a later stale binding then

package/pack/generated/codex/agents/devrites-plan-reviewer.toml

@@ -76,6 +76,13 @@ line, and then assign the band. Do not choose a score and justify it afterward:
    speculate about micro-optimizations.
 6. **Reversibility & blast radius:** treat auth, migration, public API, and data
    model changes conservatively. Every destructive step needs a rollback.
+   Close every unbuilt slice's write set against the live tree: real callers and
+   consumers of what it changes (`trace_path` inbound), tests that exercise
+   behavior it changes or retires, build/runtime/config files and generated
+   outputs its result needs, and tooling it relies on must each be owned by that
+   slice or an earlier one. Each gap is a `kind: contract` row naming the exact
+   path and owning slice. **Failing case:** a slice that moves startup into a
+   constructor omits the `main.go` caller, found only at its Build entry.
 7. **Failure-mode coverage:** for each new codepath, find a realistic failure such
    as a timeout, nil value, race, or stale state. A silent failure with **no test AND
    no error handling** is a critical gap. For every consumptive action under

package/pack/generated/codex/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -387,6 +387,9 @@ access, safety and irreversible-action boundaries independently stop work.
   next full-inventory gate (Vet `mechanism` → one `test-plan.md` proof row; Build →
   the `$rite-review` roster) — never by another repair round in this phase. Review
   closes every deferred row with a labeled verdict; Seal blocks on any without one.
+  A Vet write-set closure row (plan-reviewer dimension 6) is never late: it names
+  an unbuilt slice's missing path and folds in this phase's one Plan repair, since
+  deferring it only reopens Plan at that slice's Build entry.
   **Failing case:** round 4 finds three Important items on clauses untouched since
   round 1 and dispatches another repair.
 - **Recovery findings need a discriminator; recovery scope stays frozen.** While a

package/pack/generated/codex/skills/rite-build/reference/wright-dispatch.md

@@ -65,7 +65,9 @@ worktrees stay forbidden.
    A target composed only of vetted executable workflow artifacts routes to the
    controlling root under
    [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
-   its rejection here is not a blocker.
+   its rejection here is not a blocker. Vet already closed the slice's write
+   set; re-check only consumers of files earlier slices changed since the
+   readiness binding, and fold a gap through `$rite-plan` before dispatch.
 2. Goal, verbatim acceptance, exclusions, context, `test-plan.md` proof
    commands, and applicable standards reach the wright through the slice bundle
    its contract names; only a native-worktree pilot contract adds the exact

package/pack/generated/codex/skills/rite-vet/SKILL.md

@@ -212,7 +212,10 @@ plan declares a root-authored executable workflow file, read
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
    must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
-   READY needs each to pass (fix failures in `$rite-plan`). A `sequence_lookahead: yes` workspace also records one
+   READY needs each to pass (fix failures in `$rite-plan`). READY also needs every
+   unbuilt slice's write set closed against the live tree (plan-reviewer
+   dimension 6), so frontier gaps fold in one Plan repair, not one per slice; an
+   affected recheck also closes every unbuilt slice and never defers a closure row. A `sequence_lookahead: yes` workspace also records one
    `Predecessor readiness: <predecessor> <digest>` line from the predecessor's
    `--emit-binding` hex; readiness re-checks it. Record the per-input drift baseline alongside it:
    `devrites-engine check drift <slug> --record` — a later stale binding then

package/pack/generated/devin/agents/devrites-plan-reviewer.md

@@ -80,6 +80,13 @@ line, and then assign the band. Do not choose a score and justify it afterward:
    speculate about micro-optimizations.
 6. **Reversibility & blast radius:** treat auth, migration, public API, and data
    model changes conservatively. Every destructive step needs a rollback.
+   Close every unbuilt slice's write set against the live tree: real callers and
+   consumers of what it changes (`trace_path` inbound), tests that exercise
+   behavior it changes or retires, build/runtime/config files and generated
+   outputs its result needs, and tooling it relies on must each be owned by that
+   slice or an earlier one. Each gap is a `kind: contract` row naming the exact
+   path and owning slice. **Failing case:** a slice that moves startup into a
+   constructor omits the `main.go` caller, found only at its Build entry.
 7. **Failure-mode coverage:** for each new codepath, find a realistic failure such
    as a timeout, nil value, race, or stale state. A silent failure with **no test AND
    no error handling** is a critical gap. For every consumptive action under

package/pack/generated/devin/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -387,6 +387,9 @@ access, safety and irreversible-action boundaries independently stop work.
   next full-inventory gate (Vet `mechanism` → one `test-plan.md` proof row; Build →
   the `/rite-review` roster) — never by another repair round in this phase. Review
   closes every deferred row with a labeled verdict; Seal blocks on any without one.
+  A Vet write-set closure row (plan-reviewer dimension 6) is never late: it names
+  an unbuilt slice's missing path and folds in this phase's one Plan repair, since
+  deferring it only reopens Plan at that slice's Build entry.
   **Failing case:** round 4 finds three Important items on clauses untouched since
   round 1 and dispatches another repair.
 - **Recovery findings need a discriminator; recovery scope stays frozen.** While a

package/pack/generated/devin/skills/rite-build/reference/wright-dispatch.md

@@ -65,7 +65,9 @@ worktrees stay forbidden.
    A target composed only of vetted executable workflow artifacts routes to the
    controlling root under
    [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
-   its rejection here is not a blocker.
+   its rejection here is not a blocker. Vet already closed the slice's write
+   set; re-check only consumers of files earlier slices changed since the
+   readiness binding, and fold a gap through `/rite-plan` before dispatch.
 2. Goal, verbatim acceptance, exclusions, context, `test-plan.md` proof
    commands, and applicable standards reach the wright through the slice bundle
    its contract names; only a native-worktree pilot contract adds the exact

package/pack/generated/devin/skills/rite-vet/SKILL.md

@@ -211,7 +211,10 @@ plan declares a root-authored executable workflow file, read
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
    must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
-   READY needs each to pass (fix failures in `/rite-plan`). A `sequence_lookahead: yes` workspace also records one
+   READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
+   unbuilt slice's write set closed against the live tree (plan-reviewer
+   dimension 6), so frontier gaps fold in one Plan repair, not one per slice; an
+   affected recheck also closes every unbuilt slice and never defers a closure row. A `sequence_lookahead: yes` workspace also records one
    `Predecessor readiness: <predecessor> <digest>` line from the predecessor's
    `--emit-binding` hex; readiness re-checks it. Record the per-input drift baseline alongside it:
    `devrites-engine check drift <slug> --record` — a later stale binding then

package/pack/generated/omp/agents/devrites-plan-reviewer.md

@@ -77,6 +77,13 @@ line, and then assign the band. Do not choose a score and justify it afterward:
    speculate about micro-optimizations.
 6. **Reversibility & blast radius:** treat auth, migration, public API, and data
    model changes conservatively. Every destructive step needs a rollback.
+   Close every unbuilt slice's write set against the live tree: real callers and
+   consumers of what it changes (`trace_path` inbound), tests that exercise
+   behavior it changes or retires, build/runtime/config files and generated
+   outputs its result needs, and tooling it relies on must each be owned by that
+   slice or an earlier one. Each gap is a `kind: contract` row naming the exact
+   path and owning slice. **Failing case:** a slice that moves startup into a
+   constructor omits the `main.go` caller, found only at its Build entry.
 7. **Failure-mode coverage:** for each new codepath, find a realistic failure such
    as a timeout, nil value, race, or stale state. A silent failure with **no test AND
    no error handling** is a critical gap. For every consumptive action under

package/pack/generated/omp/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -387,6 +387,9 @@ access, safety and irreversible-action boundaries independently stop work.
   next full-inventory gate (Vet `mechanism` → one `test-plan.md` proof row; Build →
   the `/rite-review` roster) — never by another repair round in this phase. Review
   closes every deferred row with a labeled verdict; Seal blocks on any without one.
+  A Vet write-set closure row (plan-reviewer dimension 6) is never late: it names
+  an unbuilt slice's missing path and folds in this phase's one Plan repair, since
+  deferring it only reopens Plan at that slice's Build entry.
   **Failing case:** round 4 finds three Important items on clauses untouched since
   round 1 and dispatches another repair.
 - **Recovery findings need a discriminator; recovery scope stays frozen.** While a

package/pack/generated/omp/skills/rite-build/reference/wright-dispatch.md

@@ -65,7 +65,9 @@ worktrees stay forbidden.
    A target composed only of vetted executable workflow artifacts routes to the
    controlling root under
    [`workflow-artifacts.md`](skill://devrites-lib/reference/standards/workflow-artifacts.md);
-   its rejection here is not a blocker.
+   its rejection here is not a blocker. Vet already closed the slice's write
+   set; re-check only consumers of files earlier slices changed since the
+   readiness binding, and fold a gap through `/rite-plan` before dispatch.
 2. Goal, verbatim acceptance, exclusions, context, `test-plan.md` proof
    commands, and applicable standards reach the wright through the slice bundle
    its contract names; only a native-worktree pilot contract adds the exact

package/pack/generated/omp/skills/rite-vet/SKILL.md

@@ -212,7 +212,10 @@ plan declares a root-authored executable workflow file, read
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
    must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
-   READY needs each to pass (fix failures in `/rite-plan`). A `sequence_lookahead: yes` workspace also records one
+   READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
+   unbuilt slice's write set closed against the live tree (plan-reviewer
+   dimension 6), so frontier gaps fold in one Plan repair, not one per slice; an
+   affected recheck also closes every unbuilt slice and never defers a closure row. A `sequence_lookahead: yes` workspace also records one
    `Predecessor readiness: <predecessor> <digest>` line from the predecessor's
    `--emit-binding` hex; readiness re-checks it. Record the per-input drift baseline alongside it:
    `devrites-engine check drift <slug> --record` — a later stale binding then

package/pack/generated/pi/agents/devrites-plan-reviewer.md

@@ -78,6 +78,13 @@ line, and then assign the band. Do not choose a score and justify it afterward:
    speculate about micro-optimizations.
 6. **Reversibility & blast radius:** treat auth, migration, public API, and data
    model changes conservatively. Every destructive step needs a rollback.
+   Close every unbuilt slice's write set against the live tree: real callers and
+   consumers of what it changes (`trace_path` inbound), tests that exercise
+   behavior it changes or retires, build/runtime/config files and generated
+   outputs its result needs, and tooling it relies on must each be owned by that
+   slice or an earlier one. Each gap is a `kind: contract` row naming the exact
+   path and owning slice. **Failing case:** a slice that moves startup into a
+   constructor omits the `main.go` caller, found only at its Build entry.
 7. **Failure-mode coverage:** for each new codepath, find a realistic failure such
    as a timeout, nil value, race, or stale state. A silent failure with **no test AND
    no error handling** is a critical gap. For every consumptive action under

package/pack/generated/pi/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -387,6 +387,9 @@ access, safety and irreversible-action boundaries independently stop work.
   next full-inventory gate (Vet `mechanism` → one `test-plan.md` proof row; Build →
   the `/rite-review` roster) — never by another repair round in this phase. Review
   closes every deferred row with a labeled verdict; Seal blocks on any without one.
+  A Vet write-set closure row (plan-reviewer dimension 6) is never late: it names
+  an unbuilt slice's missing path and folds in this phase's one Plan repair, since
+  deferring it only reopens Plan at that slice's Build entry.
   **Failing case:** round 4 finds three Important items on clauses untouched since
   round 1 and dispatches another repair.
 - **Recovery findings need a discriminator; recovery scope stays frozen.** While a

package/pack/generated/pi/skills/rite-build/reference/wright-dispatch.md

@@ -65,7 +65,9 @@ worktrees stay forbidden.
    A target composed only of vetted executable workflow artifacts routes to the
    controlling root under
    [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
-   its rejection here is not a blocker.
+   its rejection here is not a blocker. Vet already closed the slice's write
+   set; re-check only consumers of files earlier slices changed since the
+   readiness binding, and fold a gap through `/rite-plan` before dispatch.
 2. Goal, verbatim acceptance, exclusions, context, `test-plan.md` proof
    commands, and applicable standards reach the wright through the slice bundle
    its contract names; only a native-worktree pilot contract adds the exact

package/pack/generated/pi/skills/rite-vet/SKILL.md

@@ -212,7 +212,10 @@ plan declares a root-authored executable workflow file, read
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
    must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
-   READY needs each to pass (fix failures in `/rite-plan`). A `sequence_lookahead: yes` workspace also records one
+   READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
+   unbuilt slice's write set closed against the live tree (plan-reviewer
+   dimension 6), so frontier gaps fold in one Plan repair, not one per slice; an
+   affected recheck also closes every unbuilt slice and never defers a closure row. A `sequence_lookahead: yes` workspace also records one
    `Predecessor readiness: <predecessor> <digest>` line from the predecessor's
    `--emit-binding` hex; readiness re-checks it. Record the per-input drift baseline alongside it:
    `devrites-engine check drift <slug> --record` — a later stale binding then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "7.0.5",
+  "version": "7.0.7",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, pi, and Devin CLI",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",