devrites 7.0.6 → 7.0.8

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.0.8](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.7...v7.0.8) (2026-10-22)
+
+### Fixed
+
+* **devrites:** wright contract lists the slice's tests/proof ([#162](https://github.com/ViktorsBaikers/DevRites/issues/162)) ([ce38f3c](https://github.com/ViktorsBaikers/DevRites/commit/ce38f3c850d32f9f614945dd9d6869dade85cf20))
+* **no-release:** except bundled npm ip-address advisory to 11-29 ([#163](https://github.com/ViktorsBaikers/DevRites/issues/163)) ([d558f28](https://github.com/ViktorsBaikers/DevRites/commit/d558f28cdacbdcd796e84e05589642c4485e0bb3))
+
+## [7.0.7](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.6...v7.0.7) (2026-10-22)
+
+### Fixed
+
+* **devrites:** never defer a Vet write-set closure row as late ([#161](https://github.com/ViktorsBaikers/DevRites/issues/161)) ([1e71afa](https://github.com/ViktorsBaikers/DevRites/commit/1e71afa630be9f807aeb26aade1cb00407655734))
+
 ## [7.0.6](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.5...v7.0.6) (2026-10-22)
 
 ### Fixed

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.0.6`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.0.6): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.0.8`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.0.8): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 

package/docs/engine/commands.md

@@ -39,7 +39,7 @@ workflow strategy.
 | `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--slice <SLICE-ID>] [--recheck <inventory>] [--trigger a,b] [--inline-contract] [--whole]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. A root `--phase build\|autocomplete` bundle (no `--role`, no `--slice`) defaults to `--slice <active_slice>` while the state.md cursor phase is `build` and active_slice names a slice present in tasks.md (prints `scope: slice SLICE-### (auto from state.md) ...`); `--whole` opts out. Every bundle opens, after its header comments, with a table of contents: one `L<start>-<end> <section label>` line per `===== label =====` section, giving its exact line range in the bundle file. A bundle without `--role` (the root's own read) gives over-budget artifacts as by-reference indexes; a `--role` bundle leads with the role's agent contract and names the manifest's `rootOnly` paths instead of inlining them. When the contract resolves under `.claude/agents`, `.omp/agents`, or `.codex/agents` (the host loads it as the agent's system prompt), the bundle writes one header line naming its path, size, and SHA-256 instead of the body; other layouts (pi, devin, unknown) and `--inline-contract` (only with `--role`) inline the body, and a missing contract still exits `3`. Inside inlined files, a `--role` bundle replaces each `<!-- root-only -->`…`<!-- /root-only -->` block with a one-line stub naming the omitted heading, and does the same for each `<!-- model-surface -->` block unless the role is `security-auditor`, the feature has an `ai-spec.md`, or `spec.md`/`plan.md`/`tasks.md`/`design-brief.md` are absent or (outside the spec template's `AI-SPEC annex`) name a model, agent, RAG, or tool surface; an unbalanced or headingless marker exits `2`. `--slice` inlines that slice's `tasks.md` block and turns each over-budget artifact, and each artifact over 16 KiB except `spec.md`, into a by-reference index (path, SHA-256, headings, line hits for every ID the block cites); repeat `--slice` for several slices; an unknown slice exits `3`. In phase `build`, a `--role` bundle other than `slice-wright` without `--slice` exits `3` (`unscoped build reviewer bundle`). `--recheck <inventory>` (phase `build`, with `--role` and `--slice`; path relative to the workspace) writes `<phase>-<role>.<slice>.recheck.bundle.md`: the inventory file and `core.md` inline whole, every other non-`rootOnly` pack file becomes a by-reference index (path, SHA-256, headings with line numbers) followed by each section the inventory cites as `<file>.md § <heading>`; workspace handling matches `--slice`. A missing or empty inventory exits `2`. First reviews, full-inventory rechecks, Vet, `/rite-review`, and Seal do not use it. |
 | `dispatch <slug> <open\|start\|seal\|return\|status\|abandon\|attribute>` | Launch-wave barrier for parallel dispatch: seal needs a handle per role, return needs seal; the start that gives the last role its handle seals the wave, and an explicit seal on a sealed wave is a no-op; `open --claim-session <id> --claim <path>... [--claim-ttl <minutes>]` records one file claim for the wave in claims.jsonl and exits `3`, creating no wave and no claim, while a live foreign session holds an overlapping path; the return that completes the wave releases that claim; `abandon --release` releases it on any other host-confirmed terminal path (a stop or a refused launch); re-opening an abandoned wave inherits its kept claim or, with new claim flags, replaces and releases it; claim flags apply to open only and `--release` to abandon only; start/return auto-record metrics, `return --outcome findings|no-findings|gap` records the role's Outcome line, and `abandon` records its reason, so `metrics summary` shows per-role yield and lost waves. Bare `status` prints every open, sealed, or abandoned wave and folds complete waves into one `N complete wave(s) (use --all)` line; `--all` lists every wave; it still exits nonzero while any wave is open or sealed. For a reviewer, auditor, or test-analyst role, `return --result <file>` stores the return verbatim as `packets/<wave>-<role>.return.md` (exit `3` if that file exists), derives the outcome from its `Outcome:`/`Counts:` head (a malformed or inconsistent head records `gap` with a warning, never `no-findings`), exits `3` when an explicit `--outcome` disagrees, and records each `Finding:` row's `role|slice|file|section|severity` key, so `metrics summary` adds per-role `resolution: resolved re-raised open late` counts. A `--result` file that already is that `packets/` path is kept as the stored return. A build wave with a wright role needs `--slice <SLICE-ID>` per slice, and a slice-bound vet wave takes it too; a reviewer-only wave (for example a Build slice review) may take it, uncapped, so its `Finding:` keys name that slice; a reviewer, auditor, or test-analyst wave needs `--packet <file>` and `open` exits `3` on a packet that seeds a conclusion (gate `*-PASS` token, `no-findings`, an `Outcome:`/`Counts:` line, an "already passed" claim, or zero Critical/Important counts) or tells the agent to read an installed `agents/devrites-*.md`/`.toml` role contract (on the line or under a "Read …" heading or label; canonical `pack/` paths excepted), and a wright wave's `--contract` gets the same role-contract check; a Review or Seal reviewer wave also exits `3` unless the packet names an existing non-empty `.diff`/`.patch` file and the manifest covers every checkpointed path; every 5 rounds of either kind on one slice, `open` exits `3` until `--reslice-review <DRIFT-ID>` names an unused `drift.md` `## <DRIFT-ID>` heading for that slice. `open` also warns when an earlier wave for the same slice never returned. Under `.devrites/AFK` max_parallel >= 2, a first-round build wright wave narrower than the `parallel select --from-plan` batch exits `3` (printing the batch, the command and the parallel-batch lifecycle) until evidence.md records `serial: <skipped ids> — <reason>`; repair rounds, lease siblings and HITL runs are never refused. A build wright `--contract` must name `gates precheck` under `Writer-safe checks:` when gates.md has a `RUN: writer` gate. `open` exits `3` when a `--role` names no pack agent in a project-level install (a `.<lane>` suffix is allowed), and lints a reviewer packet against the wave's roles, so a recheck may name its own role's fingerprint. Root-edit tripwire (ADR-0038): the first `open` records `<feature>/tree-baseline.json`, which maps dirty product paths outside `.devrites/` and `.scratch/` to their mode plus SHA-256, accepted as user work. The return that completes a wright wave (any phase) adds its slice write sets and claim paths. `open` exits `3` with `unattributed root edit: <paths>` while a dirty product path differs from that baseline and no live claim or in-flight wright wave covers it, unless the new wright wave covers the path through `--claim` or a slice write set. `attribute --reason <evidence> --path <path>...` records owner work, gate output, a standalone wright, or a sanctioned root write for flagged paths only. Each finding writes an `unattributed-edit` metrics row. The engine never reverts a file, and a workspace without the baseline is never blocked. |
 | `candidate freeze <slug> --wave <w> (--slice <SLICE-ID> \| --paths <path>...) [--base <ref>] [--worktree <path>]` | Writes packets/<w>.diff (tracked changes vs base, default HEAD, plus untracked files as /dev/null diffs) and packets/<w>.sha256 (base, diff digest, per-file sha256, aggregate check-candidate digest); never replaces a wave's frozen candidate with a different one. `--worktree <path>` (requires `--base`) reads the same path set from a parallel sibling's linked worktree before it lands: the path must be a symlink-free worktree top level that `git worktree list` names, shares the control repository, and is neither a submodule nor the control checkout. It exits `3` on uncommitted path-set changes there and adds a `head <sha>` row naming the worktree HEAD (the transfer commit); packets stay in the control workspace. |
-| `packet <slug> --wave <w> --phase <p> --role <r> [--slice <SLICE-ID>] [--recheck] [--checks <G-ID,...>] [--focus <file>]` | Renders one reviewer/auditor/test-analyst or same-worktree slice-wright by-reference packet (packets/<w>.<role>.md, or packets/<w>.contract.md for a wright) naming the context bundle (the .recheck bundle with `--recheck`) and frozen diff. It copies packets/<w>.sha256 (header rows only when large), resolves `--checks` through gates.md and approved preflight rows (adding `gates precheck` for `RUN: writer` gates), and accepts only anchored `--focus` rows (a doubt-reviewer's 1-3 row claim is required). It runs the dispatch open lints on a draft and never replaces a prior packet with a refused one (exit `3`). |
+| `packet <slug> --wave <w> --phase <p> --role <r> [--slice <SLICE-ID>] [--recheck] [--checks <G-ID,...>] [--focus <file>]` | Renders one reviewer/auditor/test-analyst or same-worktree slice-wright by-reference packet (packets/<w>.<role>.md, or packets/<w>.contract.md for a wright) naming the context bundle (the .recheck bundle with `--recheck`) and frozen diff. It copies packets/<w>.sha256 (header rows only when large), lists a wright slice's tasks.md `Tests/proof` as its first writer-safe check, resolves `--checks` through gates.md and approved preflight rows (adding `gates precheck` for `RUN: writer` gates), and accepts only anchored `--focus` rows (a doubt-reviewer's 1-3 row claim is required). It runs the dispatch open lints on a draft and never replaces a prior packet with a refused one (exit `3`). |
 | `metrics record <slug> --phase <p> --event <e> [--role r] [--bytes n] [--note s]` | Append an event to the workspace's `metrics.jsonl` ledger. |
 | `metrics summary [slug] [--by-slice]` | Reduce `metrics.jsonl` into a per-phase roll-up. `--by-slice` reads `dispatch.json` instead: per slice, build wright rounds, slice-bound Vet rechecks, and agent-minutes (role start to `returned_at`; abandoned waves excluded). When the ledger has `resume` events it adds `resumes count=N minutes_to_dispatch=...` (each resume timed to the next `dispatch` event; `none` when another resume came first, `open` when none followed). |
 | `claim <add\|release\|list\|check>` | Advisory session-scoped file claims in `.devrites/claims.jsonl` (append-only). `add` records intent to write a path set with a TTL (1–240 min, default 30); a live claim by another session exits `3` and names the holder. `release` appends a release event owned by the claiming session. `list` shows every unreleased claim (live, expired, dead) plus one `N released (use --all)` count; `--all` includes released rows; a claim whose holding session has provably exited on this host shows `dead` and no longer conflicts. `check` is the read-only preflight for a path set. Coordination aid only — never a substitute for one-writer-per-worktree. |

package/engine/internal/lib/packet.go

@@ -19,10 +19,11 @@ const PacketUsage = `usage: devrites-engine packet <slug> --wave <w> --phase <p>
 
 Renders one role's by-reference dispatch packet and runs the lints dispatch
 open runs on it; a refused packet is removed and the command exits 3. A
-wright role (needs --slice and --checks) writes a same-worktree
-packets/<w>.contract.md with the slice's Writer allowlist and each --checks
-gates.md gate's CHECK, which must be an approved test-plan.md Build-entry
-preflight row; a native-worktree pilot keeps its own contract. A reviewer
+wright role (needs --slice) writes a same-worktree packets/<w>.contract.md
+with the slice's Writer allowlist, its tasks.md Tests/proof as a writer-safe
+check, and each --checks gates.md gate's CHECK, which must be an approved
+test-plan.md Build-entry preflight row; a native-worktree pilot keeps its own
+contract. A reviewer
 role (*-reviewer, *-auditor, test-analyst) writes packets/<w>.<role>.md with
 its Outcome/Counts return head. Read first names the role's context bundle
 (run context first; --recheck names the build --recheck bundle) and
@@ -136,13 +137,11 @@ func RunPacket(root string, args []string, stdout, stderr io.Writer) int {
 		for _, p := range writes[slice] {
 			fmt.Fprintf(&b, "- %s\n", p)
 		}
-		if checks != "" {
-			lines, err := writerSafeChecks(root, slug, slice, checks)
-			if err != nil {
-				return fail(err)
-			}
-			b.WriteString("\n" + lines)
+		lines, err := writerSafeChecks(root, slug, slice, raw, checks)
+		if err != nil {
+			return fail(err)
 		}
+		b.WriteString("\n" + lines)
 	}
 	if candidate != "" {
 		source := "verbatim from"
@@ -247,24 +246,42 @@ func frozenCandidate(workspace, wave string) (sums string, partial bool, err err
 	return head.String(), true, nil
 }
 
-// writerSafeChecks resolves each named gates.md gate to its CHECK, refusing an
-// unknown gate or a CHECK no approved test-plan.md preflight row vets, and adds
-// `gates precheck --slice <slice>` when the ledger marks a gate `RUN: writer`.
-func writerSafeChecks(root, slug, slice, ids string) (string, error) {
+// writerSafeChecks lists the slice's own tasks.md Tests/proof first, so a
+// narrow package check never has to borrow a root-owned acceptance gate. It
+// then resolves each named gates.md gate to its CHECK, refusing an unknown gate
+// or a CHECK no approved test-plan.md preflight row vets, and adds `gates
+// precheck --slice <slice>` when the ledger marks a gate `RUN: writer`.
+func writerSafeChecks(root, slug, slice string, tasks []byte, ids string) (string, error) {
+	var names []string
+	var rows strings.Builder
+	block, _ := state.ExtractTaskSlice(tasks, slice)
+	if proof, _ := fieldValue(sliceFields(block), "tests/proof", "tests", "proof"); proof != "" {
+		names = append(names, slice+" Tests/proof")
+		fmt.Fprintf(&rows, "- %s Tests/proof (tasks.md): %s\n", slice, proof)
+	} else if ids == "" {
+		return "", fmt.Errorf("slice %s names no Tests/proof in tasks.md and --checks names no gate", slice)
+	}
 	ledger, err := readWorkspaceArtifact(root, slug, acceptance.GatesFile)
-	if err != nil {
-		return "", fmt.Errorf("--checks: %w", err)
+	if ids == "" && errors.Is(err, os.ErrNotExist) {
+		return "Writer-safe checks: " + strings.Join(names, ", ") + "\n" + rows.String(), nil
 	}
-	plan, err := readWorkspaceArtifact(root, slug, "test-plan.md")
 	if err != nil {
 		return "", fmt.Errorf("--checks: %w", err)
 	}
 	doc := acceptance.ParseLedger(string(ledger))
-	approved := acceptance.ApprovedCommands(plan)
-	var names []string
-	var rows strings.Builder
+	var approved []acceptance.ApprovedCommand
+	if ids != "" {
+		plan, err := readWorkspaceArtifact(root, slug, "test-plan.md")
+		if err != nil {
+			return "", fmt.Errorf("--checks: %w", err)
+		}
+		approved = acceptance.ApprovedCommands(plan)
+	}
 	for _, id := range strings.Split(ids, ",") {
 		id = strings.TrimSpace(id)
+		if id == "" {
+			continue
+		}
 		var gate *acceptance.Gate
 		for _, g := range doc.Gates {
 			if g.ID == id {

package/pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -387,6 +387,9 @@ access, safety and irreversible-action boundaries independently stop work.
   next full-inventory gate (Vet `mechanism` → one `test-plan.md` proof row; Build →
   the `/rite-review` roster) — never by another repair round in this phase. Review
   closes every deferred row with a labeled verdict; Seal blocks on any without one.
+  A Vet write-set closure row (plan-reviewer dimension 6) is never late: it names
+  an unbuilt slice's missing path and folds in this phase's one Plan repair, since
+  deferring it only reopens Plan at that slice's Build entry.
   **Failing case:** round 4 finds three Important items on clauses untouched since
   round 1 and dispatches another repair.
 - **Recovery findings need a discriminator; recovery scope stays frozen.** While a

package/pack/.claude/skills/rite-build/reference/wright-dispatch.md

@@ -84,11 +84,11 @@ worktrees stay forbidden.
    Quote, as a `--focus` row, every active `decisions.md` carry-forward constraint whose `Files:`
    overlap the task paths (or that names no files).
    A new path requires a new bounded contract; the wright cannot widen the task.
-   Name (`--checks` gate IDs) the writer-safe commands the wright must run (syntax/type/lint, unit and
-   self-check suites, a narrow local smoke of the changed path) and never forbid
-   them: a wright that cannot execute writes blind and its failures surface a
-   whole review round later. Only artifact-producing, consumptive, or full
-   canonical feature gates stay root-owned; when `gates.md` has a `RUN: writer`
+   The contract lists the slice's `Tests/proof` as writer-safe checks (syntax/type/lint,
+   unit and self-check suites, a narrow smoke of the changed path); `--checks` adds
+   gate IDs. Never forbid them: a blind wright's failures surface a review
+   round later. Artifact-producing, consumptive, or full canonical feature
+   gates stay root-owned, never in `--checks`; when `gates.md` has a `RUN: writer`
    gate, the checks include `devrites-engine gates precheck <slug> --worktree <path> --slice <SLICE-ID>`
    (those gates, minus ones only other unbuilt slices own, plus `check windows`;
    never evidence, root still runs every gate).
@@ -107,7 +107,7 @@ open with no wave and no claim and stops the dispatch, per
 [`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
 is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
 Render the contract with `devrites-engine packet <slug> --wave <wave> --phase build
---role slice-wright --slice <SLICE-ID> --checks <G-ID,...> [--focus <file>]` (it
+--role slice-wright --slice <SLICE-ID> [--checks <G-ID,...>] [--focus <file>]` (it
 writes the linted same-worktree `packets/<wave>.contract.md`; a native-worktree pilot
 writes its own contract with `Isolation`, `worktree_base`, and subject) and hand the wright that text verbatim. Reviewers read
 that file, so `--focus` rows state each defect to fix with its anchor, never a reviewer's verdict,

package/pack/.claude/skills/rite-vet/SKILL.md

@@ -212,7 +212,8 @@ plan declares a root-authored executable workflow file, read
    must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
    READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
    unbuilt slice's write set closed against the live tree (plan-reviewer
-   dimension 6), so frontier gaps fold in one Plan repair, not one per slice. A `sequence_lookahead: yes` workspace also records one
+   dimension 6), so frontier gaps fold in one Plan repair, not one per slice; an
+   affected recheck also closes every unbuilt slice and never defers a closure row. A `sequence_lookahead: yes` workspace also records one
    `Predecessor readiness: <predecessor> <digest>` line from the predecessor's
    `--emit-binding` hex; readiness re-checks it. Record the per-input drift baseline alongside it:
    `devrites-engine check drift <slug> --record` — a later stale binding then

package/pack/generated/claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -387,6 +387,9 @@ access, safety and irreversible-action boundaries independently stop work.
   next full-inventory gate (Vet `mechanism` → one `test-plan.md` proof row; Build →
   the `/rite-review` roster) — never by another repair round in this phase. Review
   closes every deferred row with a labeled verdict; Seal blocks on any without one.
+  A Vet write-set closure row (plan-reviewer dimension 6) is never late: it names
+  an unbuilt slice's missing path and folds in this phase's one Plan repair, since
+  deferring it only reopens Plan at that slice's Build entry.
   **Failing case:** round 4 finds three Important items on clauses untouched since
   round 1 and dispatches another repair.
 - **Recovery findings need a discriminator; recovery scope stays frozen.** While a

package/pack/generated/claude/skills/rite-build/reference/wright-dispatch.md

@@ -84,11 +84,11 @@ worktrees stay forbidden.
    Quote, as a `--focus` row, every active `decisions.md` carry-forward constraint whose `Files:`
    overlap the task paths (or that names no files).
    A new path requires a new bounded contract; the wright cannot widen the task.
-   Name (`--checks` gate IDs) the writer-safe commands the wright must run (syntax/type/lint, unit and
-   self-check suites, a narrow local smoke of the changed path) and never forbid
-   them: a wright that cannot execute writes blind and its failures surface a
-   whole review round later. Only artifact-producing, consumptive, or full
-   canonical feature gates stay root-owned; when `gates.md` has a `RUN: writer`
+   The contract lists the slice's `Tests/proof` as writer-safe checks (syntax/type/lint,
+   unit and self-check suites, a narrow smoke of the changed path); `--checks` adds
+   gate IDs. Never forbid them: a blind wright's failures surface a review
+   round later. Artifact-producing, consumptive, or full canonical feature
+   gates stay root-owned, never in `--checks`; when `gates.md` has a `RUN: writer`
    gate, the checks include `devrites-engine gates precheck <slug> --worktree <path> --slice <SLICE-ID>`
    (those gates, minus ones only other unbuilt slices own, plus `check windows`;
    never evidence, root still runs every gate).
@@ -107,7 +107,7 @@ open with no wave and no claim and stops the dispatch, per
 [`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
 is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
 Render the contract with `devrites-engine packet <slug> --wave <wave> --phase build
---role slice-wright --slice <SLICE-ID> --checks <G-ID,...> [--focus <file>]` (it
+--role slice-wright --slice <SLICE-ID> [--checks <G-ID,...>] [--focus <file>]` (it
 writes the linted same-worktree `packets/<wave>.contract.md`; a native-worktree pilot
 writes its own contract with `Isolation`, `worktree_base`, and subject) and hand the wright that text verbatim. Reviewers read
 that file, so `--focus` rows state each defect to fix with its anchor, never a reviewer's verdict,

package/pack/generated/claude/skills/rite-vet/SKILL.md

@@ -214,7 +214,8 @@ plan declares a root-authored executable workflow file, read
    must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
    READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
    unbuilt slice's write set closed against the live tree (plan-reviewer
-   dimension 6), so frontier gaps fold in one Plan repair, not one per slice. A `sequence_lookahead: yes` workspace also records one
+   dimension 6), so frontier gaps fold in one Plan repair, not one per slice; an
+   affected recheck also closes every unbuilt slice and never defers a closure row. A `sequence_lookahead: yes` workspace also records one
    `Predecessor readiness: <predecessor> <digest>` line from the predecessor's
    `--emit-binding` hex; readiness re-checks it. Record the per-input drift baseline alongside it:
    `devrites-engine check drift <slug> --record` — a later stale binding then

package/pack/generated/codex/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -387,6 +387,9 @@ access, safety and irreversible-action boundaries independently stop work.
   next full-inventory gate (Vet `mechanism` → one `test-plan.md` proof row; Build →
   the `$rite-review` roster) — never by another repair round in this phase. Review
   closes every deferred row with a labeled verdict; Seal blocks on any without one.
+  A Vet write-set closure row (plan-reviewer dimension 6) is never late: it names
+  an unbuilt slice's missing path and folds in this phase's one Plan repair, since
+  deferring it only reopens Plan at that slice's Build entry.
   **Failing case:** round 4 finds three Important items on clauses untouched since
   round 1 and dispatches another repair.
 - **Recovery findings need a discriminator; recovery scope stays frozen.** While a

package/pack/generated/codex/skills/rite-build/reference/wright-dispatch.md

@@ -84,11 +84,11 @@ worktrees stay forbidden.
    Quote, as a `--focus` row, every active `decisions.md` carry-forward constraint whose `Files:`
    overlap the task paths (or that names no files).
    A new path requires a new bounded contract; the wright cannot widen the task.
-   Name (`--checks` gate IDs) the writer-safe commands the wright must run (syntax/type/lint, unit and
-   self-check suites, a narrow local smoke of the changed path) and never forbid
-   them: a wright that cannot execute writes blind and its failures surface a
-   whole review round later. Only artifact-producing, consumptive, or full
-   canonical feature gates stay root-owned; when `gates.md` has a `RUN: writer`
+   The contract lists the slice's `Tests/proof` as writer-safe checks (syntax/type/lint,
+   unit and self-check suites, a narrow smoke of the changed path); `--checks` adds
+   gate IDs. Never forbid them: a blind wright's failures surface a review
+   round later. Artifact-producing, consumptive, or full canonical feature
+   gates stay root-owned, never in `--checks`; when `gates.md` has a `RUN: writer`
    gate, the checks include `devrites-engine gates precheck <slug> --worktree <path> --slice <SLICE-ID>`
    (those gates, minus ones only other unbuilt slices own, plus `check windows`;
    never evidence, root still runs every gate).
@@ -107,7 +107,7 @@ open with no wave and no claim and stops the dispatch, per
 [`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
 is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
 Render the contract with `devrites-engine packet <slug> --wave <wave> --phase build
---role slice-wright --slice <SLICE-ID> --checks <G-ID,...> [--focus <file>]` (it
+--role slice-wright --slice <SLICE-ID> [--checks <G-ID,...>] [--focus <file>]` (it
 writes the linted same-worktree `packets/<wave>.contract.md`; a native-worktree pilot
 writes its own contract with `Isolation`, `worktree_base`, and subject) and hand the wright that text verbatim. Reviewers read
 that file, so `--focus` rows state each defect to fix with its anchor, never a reviewer's verdict,

package/pack/generated/codex/skills/rite-vet/SKILL.md

@@ -214,7 +214,8 @@ plan declares a root-authored executable workflow file, read
    must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
    READY needs each to pass (fix failures in `$rite-plan`). READY also needs every
    unbuilt slice's write set closed against the live tree (plan-reviewer
-   dimension 6), so frontier gaps fold in one Plan repair, not one per slice. A `sequence_lookahead: yes` workspace also records one
+   dimension 6), so frontier gaps fold in one Plan repair, not one per slice; an
+   affected recheck also closes every unbuilt slice and never defers a closure row. A `sequence_lookahead: yes` workspace also records one
    `Predecessor readiness: <predecessor> <digest>` line from the predecessor's
    `--emit-binding` hex; readiness re-checks it. Record the per-input drift baseline alongside it:
    `devrites-engine check drift <slug> --record` — a later stale binding then

package/pack/generated/devin/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -387,6 +387,9 @@ access, safety and irreversible-action boundaries independently stop work.
   next full-inventory gate (Vet `mechanism` → one `test-plan.md` proof row; Build →
   the `/rite-review` roster) — never by another repair round in this phase. Review
   closes every deferred row with a labeled verdict; Seal blocks on any without one.
+  A Vet write-set closure row (plan-reviewer dimension 6) is never late: it names
+  an unbuilt slice's missing path and folds in this phase's one Plan repair, since
+  deferring it only reopens Plan at that slice's Build entry.
   **Failing case:** round 4 finds three Important items on clauses untouched since
   round 1 and dispatches another repair.
 - **Recovery findings need a discriminator; recovery scope stays frozen.** While a

package/pack/generated/devin/skills/rite-build/reference/wright-dispatch.md

@@ -84,11 +84,11 @@ worktrees stay forbidden.
    Quote, as a `--focus` row, every active `decisions.md` carry-forward constraint whose `Files:`
    overlap the task paths (or that names no files).
    A new path requires a new bounded contract; the wright cannot widen the task.
-   Name (`--checks` gate IDs) the writer-safe commands the wright must run (syntax/type/lint, unit and
-   self-check suites, a narrow local smoke of the changed path) and never forbid
-   them: a wright that cannot execute writes blind and its failures surface a
-   whole review round later. Only artifact-producing, consumptive, or full
-   canonical feature gates stay root-owned; when `gates.md` has a `RUN: writer`
+   The contract lists the slice's `Tests/proof` as writer-safe checks (syntax/type/lint,
+   unit and self-check suites, a narrow smoke of the changed path); `--checks` adds
+   gate IDs. Never forbid them: a blind wright's failures surface a review
+   round later. Artifact-producing, consumptive, or full canonical feature
+   gates stay root-owned, never in `--checks`; when `gates.md` has a `RUN: writer`
    gate, the checks include `devrites-engine gates precheck <slug> --worktree <path> --slice <SLICE-ID>`
    (those gates, minus ones only other unbuilt slices own, plus `check windows`;
    never evidence, root still runs every gate).
@@ -107,7 +107,7 @@ open with no wave and no claim and stops the dispatch, per
 [`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
 is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
 Render the contract with `devrites-engine packet <slug> --wave <wave> --phase build
---role slice-wright --slice <SLICE-ID> --checks <G-ID,...> [--focus <file>]` (it
+--role slice-wright --slice <SLICE-ID> [--checks <G-ID,...>] [--focus <file>]` (it
 writes the linted same-worktree `packets/<wave>.contract.md`; a native-worktree pilot
 writes its own contract with `Isolation`, `worktree_base`, and subject) and hand the wright that text verbatim. Reviewers read
 that file, so `--focus` rows state each defect to fix with its anchor, never a reviewer's verdict,

package/pack/generated/devin/skills/rite-vet/SKILL.md

@@ -213,7 +213,8 @@ plan declares a root-authored executable workflow file, read
    must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
    READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
    unbuilt slice's write set closed against the live tree (plan-reviewer
-   dimension 6), so frontier gaps fold in one Plan repair, not one per slice. A `sequence_lookahead: yes` workspace also records one
+   dimension 6), so frontier gaps fold in one Plan repair, not one per slice; an
+   affected recheck also closes every unbuilt slice and never defers a closure row. A `sequence_lookahead: yes` workspace also records one
    `Predecessor readiness: <predecessor> <digest>` line from the predecessor's
    `--emit-binding` hex; readiness re-checks it. Record the per-input drift baseline alongside it:
    `devrites-engine check drift <slug> --record` — a later stale binding then

package/pack/generated/omp/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -387,6 +387,9 @@ access, safety and irreversible-action boundaries independently stop work.
   next full-inventory gate (Vet `mechanism` → one `test-plan.md` proof row; Build →
   the `/rite-review` roster) — never by another repair round in this phase. Review
   closes every deferred row with a labeled verdict; Seal blocks on any without one.
+  A Vet write-set closure row (plan-reviewer dimension 6) is never late: it names
+  an unbuilt slice's missing path and folds in this phase's one Plan repair, since
+  deferring it only reopens Plan at that slice's Build entry.
   **Failing case:** round 4 finds three Important items on clauses untouched since
   round 1 and dispatches another repair.
 - **Recovery findings need a discriminator; recovery scope stays frozen.** While a

package/pack/generated/omp/skills/rite-build/reference/wright-dispatch.md

@@ -84,11 +84,11 @@ worktrees stay forbidden.
    Quote, as a `--focus` row, every active `decisions.md` carry-forward constraint whose `Files:`
    overlap the task paths (or that names no files).
    A new path requires a new bounded contract; the wright cannot widen the task.
-   Name (`--checks` gate IDs) the writer-safe commands the wright must run (syntax/type/lint, unit and
-   self-check suites, a narrow local smoke of the changed path) and never forbid
-   them: a wright that cannot execute writes blind and its failures surface a
-   whole review round later. Only artifact-producing, consumptive, or full
-   canonical feature gates stay root-owned; when `gates.md` has a `RUN: writer`
+   The contract lists the slice's `Tests/proof` as writer-safe checks (syntax/type/lint,
+   unit and self-check suites, a narrow smoke of the changed path); `--checks` adds
+   gate IDs. Never forbid them: a blind wright's failures surface a review
+   round later. Artifact-producing, consumptive, or full canonical feature
+   gates stay root-owned, never in `--checks`; when `gates.md` has a `RUN: writer`
    gate, the checks include `devrites-engine gates precheck <slug> --worktree <path> --slice <SLICE-ID>`
    (those gates, minus ones only other unbuilt slices own, plus `check windows`;
    never evidence, root still runs every gate).
@@ -107,7 +107,7 @@ open with no wave and no claim and stops the dispatch, per
 [`agents.md`](skill://devrites-lib/reference/standards/agents.md). `.devrites/**`
 is never a task path; see [Workflow Artifact admission](skill://devrites-lib/reference/standards/workflow-artifacts.md).
 Render the contract with `devrites-engine packet <slug> --wave <wave> --phase build
---role slice-wright --slice <SLICE-ID> --checks <G-ID,...> [--focus <file>]` (it
+--role slice-wright --slice <SLICE-ID> [--checks <G-ID,...>] [--focus <file>]` (it
 writes the linted same-worktree `packets/<wave>.contract.md`; a native-worktree pilot
 writes its own contract with `Isolation`, `worktree_base`, and subject) and hand the wright that text verbatim. Reviewers read
 that file, so `--focus` rows state each defect to fix with its anchor, never a reviewer's verdict,

package/pack/generated/omp/skills/rite-vet/SKILL.md

@@ -214,7 +214,8 @@ plan declares a root-authored executable workflow file, read
    must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
    READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
    unbuilt slice's write set closed against the live tree (plan-reviewer
-   dimension 6), so frontier gaps fold in one Plan repair, not one per slice. A `sequence_lookahead: yes` workspace also records one
+   dimension 6), so frontier gaps fold in one Plan repair, not one per slice; an
+   affected recheck also closes every unbuilt slice and never defers a closure row. A `sequence_lookahead: yes` workspace also records one
    `Predecessor readiness: <predecessor> <digest>` line from the predecessor's
    `--emit-binding` hex; readiness re-checks it. Record the per-input drift baseline alongside it:
    `devrites-engine check drift <slug> --record` — a later stale binding then

package/pack/generated/pi/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -387,6 +387,9 @@ access, safety and irreversible-action boundaries independently stop work.
   next full-inventory gate (Vet `mechanism` → one `test-plan.md` proof row; Build →
   the `/rite-review` roster) — never by another repair round in this phase. Review
   closes every deferred row with a labeled verdict; Seal blocks on any without one.
+  A Vet write-set closure row (plan-reviewer dimension 6) is never late: it names
+  an unbuilt slice's missing path and folds in this phase's one Plan repair, since
+  deferring it only reopens Plan at that slice's Build entry.
   **Failing case:** round 4 finds three Important items on clauses untouched since
   round 1 and dispatches another repair.
 - **Recovery findings need a discriminator; recovery scope stays frozen.** While a

package/pack/generated/pi/skills/rite-build/reference/wright-dispatch.md

@@ -84,11 +84,11 @@ worktrees stay forbidden.
    Quote, as a `--focus` row, every active `decisions.md` carry-forward constraint whose `Files:`
    overlap the task paths (or that names no files).
    A new path requires a new bounded contract; the wright cannot widen the task.
-   Name (`--checks` gate IDs) the writer-safe commands the wright must run (syntax/type/lint, unit and
-   self-check suites, a narrow local smoke of the changed path) and never forbid
-   them: a wright that cannot execute writes blind and its failures surface a
-   whole review round later. Only artifact-producing, consumptive, or full
-   canonical feature gates stay root-owned; when `gates.md` has a `RUN: writer`
+   The contract lists the slice's `Tests/proof` as writer-safe checks (syntax/type/lint,
+   unit and self-check suites, a narrow smoke of the changed path); `--checks` adds
+   gate IDs. Never forbid them: a blind wright's failures surface a review
+   round later. Artifact-producing, consumptive, or full canonical feature
+   gates stay root-owned, never in `--checks`; when `gates.md` has a `RUN: writer`
    gate, the checks include `devrites-engine gates precheck <slug> --worktree <path> --slice <SLICE-ID>`
    (those gates, minus ones only other unbuilt slices own, plus `check windows`;
    never evidence, root still runs every gate).
@@ -107,7 +107,7 @@ open with no wave and no claim and stops the dispatch, per
 [`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
 is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
 Render the contract with `devrites-engine packet <slug> --wave <wave> --phase build
---role slice-wright --slice <SLICE-ID> --checks <G-ID,...> [--focus <file>]` (it
+--role slice-wright --slice <SLICE-ID> [--checks <G-ID,...>] [--focus <file>]` (it
 writes the linted same-worktree `packets/<wave>.contract.md`; a native-worktree pilot
 writes its own contract with `Isolation`, `worktree_base`, and subject) and hand the wright that text verbatim. Reviewers read
 that file, so `--focus` rows state each defect to fix with its anchor, never a reviewer's verdict,

package/pack/generated/pi/skills/rite-vet/SKILL.md

@@ -214,7 +214,8 @@ plan declares a root-authored executable workflow file, read
    must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
    READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
    unbuilt slice's write set closed against the live tree (plan-reviewer
-   dimension 6), so frontier gaps fold in one Plan repair, not one per slice. A `sequence_lookahead: yes` workspace also records one
+   dimension 6), so frontier gaps fold in one Plan repair, not one per slice; an
+   affected recheck also closes every unbuilt slice and never defers a closure row. A `sequence_lookahead: yes` workspace also records one
    `Predecessor readiness: <predecessor> <digest>` line from the predecessor's
    `--emit-binding` hex; readiness re-checks it. Record the per-input drift baseline alongside it:
    `devrites-engine check drift <slug> --record` — a later stale binding then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "7.0.6",
+  "version": "7.0.8",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, pi, and Devin CLI",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",