devrites 7.0.7 → 7.0.9

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.0.9](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.8...v7.0.9) (2026-10-22)
+
+### Fixed
+
+* **devrites:** keep a passed pre-dispatch row on re-dispatch ([#165](https://github.com/ViktorsBaikers/DevRites/issues/165)) ([927f5a4](https://github.com/ViktorsBaikers/DevRites/commit/927f5a482cfb70c84255a9ead467251483de7fee))
+
+## [7.0.8](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.7...v7.0.8) (2026-10-22)
+
+### Fixed
+
+* **devrites:** wright contract lists the slice's tests/proof ([#162](https://github.com/ViktorsBaikers/DevRites/issues/162)) ([ce38f3c](https://github.com/ViktorsBaikers/DevRites/commit/ce38f3c850d32f9f614945dd9d6869dade85cf20))
+* **no-release:** except bundled npm ip-address advisory to 11-29 ([#163](https://github.com/ViktorsBaikers/DevRites/issues/163)) ([d558f28](https://github.com/ViktorsBaikers/DevRites/commit/d558f28cdacbdcd796e84e05589642c4485e0bb3))
+
 ## [7.0.7](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.6...v7.0.7) (2026-10-22)
 
 ### Fixed

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.0.7`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.0.7): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.0.9`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.0.9): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 

package/docs/cli.md

@@ -128,8 +128,9 @@ self-contained updater.
 - `check readiness --emit-binding <slug>` renders the exact stable Build-input
   binding for Vet to record after semantic review.
 - `check preconditions <slug>` runs the preflight rows whose `Run at` is `vet`
-  (`--slice <SLICE>` runs that slice's `pre-dispatch` rows) and records a
-  candidate-bound transcript per row; exit 3 on failure.
+  (`--slice <SLICE>` runs that slice's `pre-dispatch` rows, keeping one that
+  already passed) and records a candidate-bound transcript per row; exit 3 on
+  failure.
 - `check seal <slug>` checks final required files, open human gates, and the
   `tasks.md` slice graph. Once those files are complete, it verifies the stable
   readiness binding; only after that aggregate check passes does it verify that

package/docs/engine/commands.md

@@ -14,7 +14,7 @@ workflow strategy.
 | `check candidate <slug>` | Validate the strict manifest and compute the content-bound project-candidate identity. Exits `3` when the manifest omits a path the feature's `WIP(<slug>):` checkpoint commits changed (net from the feature base to HEAD). Also exits `3` with `unattributed root edit: <paths>` while the feature's `tree-baseline.json` tripwire flags a product path (ADR-0038; see `dispatch`). |
 | `check readiness <slug>` | Check target-Phase files, open human gates from Clarify onward, the `tasks.md` slice graph when that artifact is required, canonical `AC-###` presence in `tasks.md`/`test-plan.md` when those artifacts are required, and the current stable Build-input binding when applicable. Leaving Vet with a `Run at` column, a slice whose `Files likely touched`/`Writer allowlist` names a dependency manifest or lockfile needs a `dependency-dry-run SLICE-###` row at `vet` with a passing transcript. Leaving Vet, every slice `state.md` does not check built (a deferred `Satisfies: none` slice excepted) must also pass the Build-entry `check slice` contract; each failure prints one `invariant: slice-check:` line naming the slice and its exact `check slice` reason, to fix in `/rite-plan` before READY. |
 | `check readiness --emit-binding <slug>` | Render the exact stable Build-input binding for Vet to record after review. |
-| `check preconditions <slug> [--slice SLICE-###] [--timeout N]` | Run the `test-plan.md` Build-entry preflight rows whose optional `Run at` cell is `vet` (with `--slice`, `pre-dispatch <SLICE>`); `action` rows and rows without the cell never run. Writes one candidate-bound transcript per row under `references/gates/preflight-*/`; a row passes on exit 0. Exit `3` on any failure or an invalid `Run at` value. |
+| `check preconditions <slug> [--slice SLICE-###] [--timeout N]` | Run the `test-plan.md` Build-entry preflight rows whose optional `Run at` cell is `vet` (with `--slice`, `pre-dispatch <SLICE>`); `action` rows and rows without the cell never run. Writes one candidate-bound transcript per row under `references/gates/preflight-*/`; a row passes on exit 0. A `pre-dispatch` row whose newest transcript passed is kept, not re-run: it is a pre-edit baseline, so a re-dispatch never runs it against the slice's own edits; changing its command or cwd retires the pass. Exit `3` on any failure or an invalid `Run at` value. |
 | `check seal <slug>` | Check files required by target Phase `seal`, open human gates, the `tasks.md` slice graph, canonical `AC-###` presence when `tasks.md`/`test-plan.md` are required, the stable Build-input binding, and exact candidate bindings. `check readiness` and `check seal` also block a `scripts/` test driver that a tasks.md Writer allowlist plans or touched-files.md lists when no gates.md `CHECK` runs it and no `Driver waiver: <path> — DEC-### <reason>` line cites a recorded decision; waived drivers print as `note: unexecuted driver (waived by DEC-###): <path>` lines, on pass or block. |
 | `check path-disjoint [--root <dir>] [<json-file> | -]` | Verify slice path sets are pairwise disjoint. |
 | `parallel select --cap <1-10> [--root <dir>] [--slug <slug>] [--from-plan \| <json-file> \| -]` | Choose the greedy path-disjoint subset ≤ cap from supplied ready slices, or with `--from-plan` (needs `--slug`) from the plan: tasks.md slices whose dependencies state.md checks `built`, with Writer allowlist (else Files likely touched) paths plus the nearest manifest/lockfile when `External dependencies:` is not none. With `--slug` and a running lease, the lease's not-yet-landed slices hold cap slots and paths, slices it names are never picked, and only new picks print. |
@@ -39,7 +39,7 @@ workflow strategy.
 | `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--slice <SLICE-ID>] [--recheck <inventory>] [--trigger a,b] [--inline-contract] [--whole]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. A root `--phase build\|autocomplete` bundle (no `--role`, no `--slice`) defaults to `--slice <active_slice>` while the state.md cursor phase is `build` and active_slice names a slice present in tasks.md (prints `scope: slice SLICE-### (auto from state.md) ...`); `--whole` opts out. Every bundle opens, after its header comments, with a table of contents: one `L<start>-<end> <section label>` line per `===== label =====` section, giving its exact line range in the bundle file. A bundle without `--role` (the root's own read) gives over-budget artifacts as by-reference indexes; a `--role` bundle leads with the role's agent contract and names the manifest's `rootOnly` paths instead of inlining them. When the contract resolves under `.claude/agents`, `.omp/agents`, or `.codex/agents` (the host loads it as the agent's system prompt), the bundle writes one header line naming its path, size, and SHA-256 instead of the body; other layouts (pi, devin, unknown) and `--inline-contract` (only with `--role`) inline the body, and a missing contract still exits `3`. Inside inlined files, a `--role` bundle replaces each `<!-- root-only -->`…`<!-- /root-only -->` block with a one-line stub naming the omitted heading, and does the same for each `<!-- model-surface -->` block unless the role is `security-auditor`, the feature has an `ai-spec.md`, or `spec.md`/`plan.md`/`tasks.md`/`design-brief.md` are absent or (outside the spec template's `AI-SPEC annex`) name a model, agent, RAG, or tool surface; an unbalanced or headingless marker exits `2`. `--slice` inlines that slice's `tasks.md` block and turns each over-budget artifact, and each artifact over 16 KiB except `spec.md`, into a by-reference index (path, SHA-256, headings, line hits for every ID the block cites); repeat `--slice` for several slices; an unknown slice exits `3`. In phase `build`, a `--role` bundle other than `slice-wright` without `--slice` exits `3` (`unscoped build reviewer bundle`). `--recheck <inventory>` (phase `build`, with `--role` and `--slice`; path relative to the workspace) writes `<phase>-<role>.<slice>.recheck.bundle.md`: the inventory file and `core.md` inline whole, every other non-`rootOnly` pack file becomes a by-reference index (path, SHA-256, headings with line numbers) followed by each section the inventory cites as `<file>.md § <heading>`; workspace handling matches `--slice`. A missing or empty inventory exits `2`. First reviews, full-inventory rechecks, Vet, `/rite-review`, and Seal do not use it. |
 | `dispatch <slug> <open\|start\|seal\|return\|status\|abandon\|attribute>` | Launch-wave barrier for parallel dispatch: seal needs a handle per role, return needs seal; the start that gives the last role its handle seals the wave, and an explicit seal on a sealed wave is a no-op; `open --claim-session <id> --claim <path>... [--claim-ttl <minutes>]` records one file claim for the wave in claims.jsonl and exits `3`, creating no wave and no claim, while a live foreign session holds an overlapping path; the return that completes the wave releases that claim; `abandon --release` releases it on any other host-confirmed terminal path (a stop or a refused launch); re-opening an abandoned wave inherits its kept claim or, with new claim flags, replaces and releases it; claim flags apply to open only and `--release` to abandon only; start/return auto-record metrics, `return --outcome findings|no-findings|gap` records the role's Outcome line, and `abandon` records its reason, so `metrics summary` shows per-role yield and lost waves. Bare `status` prints every open, sealed, or abandoned wave and folds complete waves into one `N complete wave(s) (use --all)` line; `--all` lists every wave; it still exits nonzero while any wave is open or sealed. For a reviewer, auditor, or test-analyst role, `return --result <file>` stores the return verbatim as `packets/<wave>-<role>.return.md` (exit `3` if that file exists), derives the outcome from its `Outcome:`/`Counts:` head (a malformed or inconsistent head records `gap` with a warning, never `no-findings`), exits `3` when an explicit `--outcome` disagrees, and records each `Finding:` row's `role|slice|file|section|severity` key, so `metrics summary` adds per-role `resolution: resolved re-raised open late` counts. A `--result` file that already is that `packets/` path is kept as the stored return. A build wave with a wright role needs `--slice <SLICE-ID>` per slice, and a slice-bound vet wave takes it too; a reviewer-only wave (for example a Build slice review) may take it, uncapped, so its `Finding:` keys name that slice; a reviewer, auditor, or test-analyst wave needs `--packet <file>` and `open` exits `3` on a packet that seeds a conclusion (gate `*-PASS` token, `no-findings`, an `Outcome:`/`Counts:` line, an "already passed" claim, or zero Critical/Important counts) or tells the agent to read an installed `agents/devrites-*.md`/`.toml` role contract (on the line or under a "Read …" heading or label; canonical `pack/` paths excepted), and a wright wave's `--contract` gets the same role-contract check; a Review or Seal reviewer wave also exits `3` unless the packet names an existing non-empty `.diff`/`.patch` file and the manifest covers every checkpointed path; every 5 rounds of either kind on one slice, `open` exits `3` until `--reslice-review <DRIFT-ID>` names an unused `drift.md` `## <DRIFT-ID>` heading for that slice. `open` also warns when an earlier wave for the same slice never returned. Under `.devrites/AFK` max_parallel >= 2, a first-round build wright wave narrower than the `parallel select --from-plan` batch exits `3` (printing the batch, the command and the parallel-batch lifecycle) until evidence.md records `serial: <skipped ids> — <reason>`; repair rounds, lease siblings and HITL runs are never refused. A build wright `--contract` must name `gates precheck` under `Writer-safe checks:` when gates.md has a `RUN: writer` gate. `open` exits `3` when a `--role` names no pack agent in a project-level install (a `.<lane>` suffix is allowed), and lints a reviewer packet against the wave's roles, so a recheck may name its own role's fingerprint. Root-edit tripwire (ADR-0038): the first `open` records `<feature>/tree-baseline.json`, which maps dirty product paths outside `.devrites/` and `.scratch/` to their mode plus SHA-256, accepted as user work. The return that completes a wright wave (any phase) adds its slice write sets and claim paths. `open` exits `3` with `unattributed root edit: <paths>` while a dirty product path differs from that baseline and no live claim or in-flight wright wave covers it, unless the new wright wave covers the path through `--claim` or a slice write set. `attribute --reason <evidence> --path <path>...` records owner work, gate output, a standalone wright, or a sanctioned root write for flagged paths only. Each finding writes an `unattributed-edit` metrics row. The engine never reverts a file, and a workspace without the baseline is never blocked. |
 | `candidate freeze <slug> --wave <w> (--slice <SLICE-ID> \| --paths <path>...) [--base <ref>] [--worktree <path>]` | Writes packets/<w>.diff (tracked changes vs base, default HEAD, plus untracked files as /dev/null diffs) and packets/<w>.sha256 (base, diff digest, per-file sha256, aggregate check-candidate digest); never replaces a wave's frozen candidate with a different one. `--worktree <path>` (requires `--base`) reads the same path set from a parallel sibling's linked worktree before it lands: the path must be a symlink-free worktree top level that `git worktree list` names, shares the control repository, and is neither a submodule nor the control checkout. It exits `3` on uncommitted path-set changes there and adds a `head <sha>` row naming the worktree HEAD (the transfer commit); packets stay in the control workspace. |
-| `packet <slug> --wave <w> --phase <p> --role <r> [--slice <SLICE-ID>] [--recheck] [--checks <G-ID,...>] [--focus <file>]` | Renders one reviewer/auditor/test-analyst or same-worktree slice-wright by-reference packet (packets/<w>.<role>.md, or packets/<w>.contract.md for a wright) naming the context bundle (the .recheck bundle with `--recheck`) and frozen diff. It copies packets/<w>.sha256 (header rows only when large), resolves `--checks` through gates.md and approved preflight rows (adding `gates precheck` for `RUN: writer` gates), and accepts only anchored `--focus` rows (a doubt-reviewer's 1-3 row claim is required). It runs the dispatch open lints on a draft and never replaces a prior packet with a refused one (exit `3`). |
+| `packet <slug> --wave <w> --phase <p> --role <r> [--slice <SLICE-ID>] [--recheck] [--checks <G-ID,...>] [--focus <file>]` | Renders one reviewer/auditor/test-analyst or same-worktree slice-wright by-reference packet (packets/<w>.<role>.md, or packets/<w>.contract.md for a wright) naming the context bundle (the .recheck bundle with `--recheck`) and frozen diff. It copies packets/<w>.sha256 (header rows only when large), lists a wright slice's tasks.md `Tests/proof` as its first writer-safe check, resolves `--checks` through gates.md and approved preflight rows (adding `gates precheck` for `RUN: writer` gates), and accepts only anchored `--focus` rows (a doubt-reviewer's 1-3 row claim is required). It runs the dispatch open lints on a draft and never replaces a prior packet with a refused one (exit `3`). |
 | `metrics record <slug> --phase <p> --event <e> [--role r] [--bytes n] [--note s]` | Append an event to the workspace's `metrics.jsonl` ledger. |
 | `metrics summary [slug] [--by-slice]` | Reduce `metrics.jsonl` into a per-phase roll-up. `--by-slice` reads `dispatch.json` instead: per slice, build wright rounds, slice-bound Vet rechecks, and agent-minutes (role start to `returned_at`; abandoned waves excluded). When the ledger has `resume` events it adds `resumes count=N minutes_to_dispatch=...` (each resume timed to the next `dispatch` event; `none` when another resume came first, `open` when none followed). |
 | `claim <add\|release\|list\|check>` | Advisory session-scoped file claims in `.devrites/claims.jsonl` (append-only). `add` records intent to write a path set with a TTL (1–240 min, default 30); a live claim by another session exits `3` and names the holder. `release` appends a release event owned by the claiming session. `list` shows every unreleased claim (live, expired, dead) plus one `N released (use --all)` count; `--all` includes released rows; a claim whose holding session has provably exited on this host shows `dead` and no longer conflicts. `check` is the read-only preflight for a path set. Coordination aid only — never a substitute for one-writer-per-worktree. |

package/engine/internal/acceptance/preconditions.go

@@ -77,7 +77,9 @@ func PreflightPassed(work string, row PreflightRow) bool {
 // RunPreconditions is `check preconditions <slug> [--slice S]`: it executes
 // the Build-entry preflight rows whose `Run at` is `vet` (or, with --slice,
 // `pre-dispatch <S>`), writes one candidate-bound transcript per row, and exits
-// ExitBlocked on any failure. Rows are the approved surface itself, so nothing
+// ExitBlocked on any failure. A pre-dispatch row that already passed keeps that
+// transcript: it is a pre-edit baseline, and a repair round's re-dispatch would
+// otherwise re-run it against the slice's own unfinished edits. Rows are the approved surface itself, so nothing
 // outside test-plan.md runs; `action` rows and rows without a `Run at` cell
 // never run here.
 func RunPreconditions(root string, args []string, stdout, stderr io.Writer) int {
@@ -157,7 +159,7 @@ func RunPreconditions(root string, args []string, stdout, stderr io.Writer) int
 // and whether any row ran.
 func runPreflightRows(root, slug, work, project, runAt string, rows []PreflightRow, timeout time.Duration, stdout io.Writer) (bool, bool, error) {
 	before := candidateLabel(root, slug)
-	failed := false
+	failed, kept := false, false
 	doc := &Document{}
 	var results []GateResult
 	for _, row := range rows {
@@ -170,6 +172,11 @@ func runPreflightRows(root, slug, work, project, runAt string, rows []PreflightR
 		if !strings.EqualFold(row.RunAt, runAt) {
 			continue
 		}
+		if preDispatchRunAtRE.MatchString(runAt) && PreflightPassed(work, row) {
+			fmt.Fprintf(stdout, "row %s: pass (kept; a pre-dispatch row runs once, before the slice's first edit)\n", PreflightGateID(row))
+			kept = true
+			continue
+		}
 		gate := &Gate{ID: PreflightGateID(row), Title: row.Gate, Check: row.Command, Cwd: row.Cwd,
 			Expect: "exit 0 (Expected: " + valueOr(row.Expected, "unstated") + ")"}
 		cwd := project
@@ -197,5 +204,5 @@ func runPreflightRows(root, slug, work, project, runAt string, rows []PreflightR
 			return failed, true, fmt.Errorf("transcript: %w", err)
 		}
 	}
-	return failed, len(results) > 0, nil
+	return failed, kept || len(results) > 0, nil
 }

package/engine/internal/lib/packet.go

@@ -19,10 +19,11 @@ const PacketUsage = `usage: devrites-engine packet <slug> --wave <w> --phase <p>
 
 Renders one role's by-reference dispatch packet and runs the lints dispatch
 open runs on it; a refused packet is removed and the command exits 3. A
-wright role (needs --slice and --checks) writes a same-worktree
-packets/<w>.contract.md with the slice's Writer allowlist and each --checks
-gates.md gate's CHECK, which must be an approved test-plan.md Build-entry
-preflight row; a native-worktree pilot keeps its own contract. A reviewer
+wright role (needs --slice) writes a same-worktree packets/<w>.contract.md
+with the slice's Writer allowlist, its tasks.md Tests/proof as a writer-safe
+check, and each --checks gates.md gate's CHECK, which must be an approved
+test-plan.md Build-entry preflight row; a native-worktree pilot keeps its own
+contract. A reviewer
 role (*-reviewer, *-auditor, test-analyst) writes packets/<w>.<role>.md with
 its Outcome/Counts return head. Read first names the role's context bundle
 (run context first; --recheck names the build --recheck bundle) and
@@ -136,13 +137,11 @@ func RunPacket(root string, args []string, stdout, stderr io.Writer) int {
 		for _, p := range writes[slice] {
 			fmt.Fprintf(&b, "- %s\n", p)
 		}
-		if checks != "" {
-			lines, err := writerSafeChecks(root, slug, slice, checks)
-			if err != nil {
-				return fail(err)
-			}
-			b.WriteString("\n" + lines)
+		lines, err := writerSafeChecks(root, slug, slice, raw, checks)
+		if err != nil {
+			return fail(err)
 		}
+		b.WriteString("\n" + lines)
 	}
 	if candidate != "" {
 		source := "verbatim from"
@@ -247,24 +246,42 @@ func frozenCandidate(workspace, wave string) (sums string, partial bool, err err
 	return head.String(), true, nil
 }
 
-// writerSafeChecks resolves each named gates.md gate to its CHECK, refusing an
-// unknown gate or a CHECK no approved test-plan.md preflight row vets, and adds
-// `gates precheck --slice <slice>` when the ledger marks a gate `RUN: writer`.
-func writerSafeChecks(root, slug, slice, ids string) (string, error) {
+// writerSafeChecks lists the slice's own tasks.md Tests/proof first, so a
+// narrow package check never has to borrow a root-owned acceptance gate. It
+// then resolves each named gates.md gate to its CHECK, refusing an unknown gate
+// or a CHECK no approved test-plan.md preflight row vets, and adds `gates
+// precheck --slice <slice>` when the ledger marks a gate `RUN: writer`.
+func writerSafeChecks(root, slug, slice string, tasks []byte, ids string) (string, error) {
+	var names []string
+	var rows strings.Builder
+	block, _ := state.ExtractTaskSlice(tasks, slice)
+	if proof, _ := fieldValue(sliceFields(block), "tests/proof", "tests", "proof"); proof != "" {
+		names = append(names, slice+" Tests/proof")
+		fmt.Fprintf(&rows, "- %s Tests/proof (tasks.md): %s\n", slice, proof)
+	} else if ids == "" {
+		return "", fmt.Errorf("slice %s names no Tests/proof in tasks.md and --checks names no gate", slice)
+	}
 	ledger, err := readWorkspaceArtifact(root, slug, acceptance.GatesFile)
-	if err != nil {
-		return "", fmt.Errorf("--checks: %w", err)
+	if ids == "" && errors.Is(err, os.ErrNotExist) {
+		return "Writer-safe checks: " + strings.Join(names, ", ") + "\n" + rows.String(), nil
 	}
-	plan, err := readWorkspaceArtifact(root, slug, "test-plan.md")
 	if err != nil {
 		return "", fmt.Errorf("--checks: %w", err)
 	}
 	doc := acceptance.ParseLedger(string(ledger))
-	approved := acceptance.ApprovedCommands(plan)
-	var names []string
-	var rows strings.Builder
+	var approved []acceptance.ApprovedCommand
+	if ids != "" {
+		plan, err := readWorkspaceArtifact(root, slug, "test-plan.md")
+		if err != nil {
+			return "", fmt.Errorf("--checks: %w", err)
+		}
+		approved = acceptance.ApprovedCommands(plan)
+	}
 	for _, id := range strings.Split(ids, ",") {
 		id = strings.TrimSpace(id)
+		if id == "" {
+			continue
+		}
 		var gate *acceptance.Gate
 		for _, g := range doc.Gates {
 			if g.ID == id {

package/pack/.claude/skills/rite-build/reference/wright-dispatch.md

@@ -84,11 +84,11 @@ worktrees stay forbidden.
    Quote, as a `--focus` row, every active `decisions.md` carry-forward constraint whose `Files:`
    overlap the task paths (or that names no files).
    A new path requires a new bounded contract; the wright cannot widen the task.
-   Name (`--checks` gate IDs) the writer-safe commands the wright must run (syntax/type/lint, unit and
-   self-check suites, a narrow local smoke of the changed path) and never forbid
-   them: a wright that cannot execute writes blind and its failures surface a
-   whole review round later. Only artifact-producing, consumptive, or full
-   canonical feature gates stay root-owned; when `gates.md` has a `RUN: writer`
+   The contract lists the slice's `Tests/proof` as writer-safe checks (syntax/type/lint,
+   unit and self-check suites, a narrow smoke of the changed path); `--checks` adds
+   gate IDs. Never forbid them: a blind wright's failures surface a review
+   round later. Artifact-producing, consumptive, or full canonical feature
+   gates stay root-owned, never in `--checks`; when `gates.md` has a `RUN: writer`
    gate, the checks include `devrites-engine gates precheck <slug> --worktree <path> --slice <SLICE-ID>`
    (those gates, minus ones only other unbuilt slices own, plus `check windows`;
    never evidence, root still runs every gate).
@@ -107,7 +107,7 @@ open with no wave and no claim and stops the dispatch, per
 [`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
 is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
 Render the contract with `devrites-engine packet <slug> --wave <wave> --phase build
---role slice-wright --slice <SLICE-ID> --checks <G-ID,...> [--focus <file>]` (it
+--role slice-wright --slice <SLICE-ID> [--checks <G-ID,...>] [--focus <file>]` (it
 writes the linted same-worktree `packets/<wave>.contract.md`; a native-worktree pilot
 writes its own contract with `Isolation`, `worktree_base`, and subject) and hand the wright that text verbatim. Reviewers read
 that file, so `--focus` rows state each defect to fix with its anchor, never a reviewer's verdict,

package/pack/generated/claude/skills/rite-build/reference/wright-dispatch.md

@@ -84,11 +84,11 @@ worktrees stay forbidden.
    Quote, as a `--focus` row, every active `decisions.md` carry-forward constraint whose `Files:`
    overlap the task paths (or that names no files).
    A new path requires a new bounded contract; the wright cannot widen the task.
-   Name (`--checks` gate IDs) the writer-safe commands the wright must run (syntax/type/lint, unit and
-   self-check suites, a narrow local smoke of the changed path) and never forbid
-   them: a wright that cannot execute writes blind and its failures surface a
-   whole review round later. Only artifact-producing, consumptive, or full
-   canonical feature gates stay root-owned; when `gates.md` has a `RUN: writer`
+   The contract lists the slice's `Tests/proof` as writer-safe checks (syntax/type/lint,
+   unit and self-check suites, a narrow smoke of the changed path); `--checks` adds
+   gate IDs. Never forbid them: a blind wright's failures surface a review
+   round later. Artifact-producing, consumptive, or full canonical feature
+   gates stay root-owned, never in `--checks`; when `gates.md` has a `RUN: writer`
    gate, the checks include `devrites-engine gates precheck <slug> --worktree <path> --slice <SLICE-ID>`
    (those gates, minus ones only other unbuilt slices own, plus `check windows`;
    never evidence, root still runs every gate).
@@ -107,7 +107,7 @@ open with no wave and no claim and stops the dispatch, per
 [`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
 is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
 Render the contract with `devrites-engine packet <slug> --wave <wave> --phase build
---role slice-wright --slice <SLICE-ID> --checks <G-ID,...> [--focus <file>]` (it
+--role slice-wright --slice <SLICE-ID> [--checks <G-ID,...>] [--focus <file>]` (it
 writes the linted same-worktree `packets/<wave>.contract.md`; a native-worktree pilot
 writes its own contract with `Isolation`, `worktree_base`, and subject) and hand the wright that text verbatim. Reviewers read
 that file, so `--focus` rows state each defect to fix with its anchor, never a reviewer's verdict,

package/pack/generated/codex/skills/rite-build/reference/wright-dispatch.md

@@ -84,11 +84,11 @@ worktrees stay forbidden.
    Quote, as a `--focus` row, every active `decisions.md` carry-forward constraint whose `Files:`
    overlap the task paths (or that names no files).
    A new path requires a new bounded contract; the wright cannot widen the task.
-   Name (`--checks` gate IDs) the writer-safe commands the wright must run (syntax/type/lint, unit and
-   self-check suites, a narrow local smoke of the changed path) and never forbid
-   them: a wright that cannot execute writes blind and its failures surface a
-   whole review round later. Only artifact-producing, consumptive, or full
-   canonical feature gates stay root-owned; when `gates.md` has a `RUN: writer`
+   The contract lists the slice's `Tests/proof` as writer-safe checks (syntax/type/lint,
+   unit and self-check suites, a narrow smoke of the changed path); `--checks` adds
+   gate IDs. Never forbid them: a blind wright's failures surface a review
+   round later. Artifact-producing, consumptive, or full canonical feature
+   gates stay root-owned, never in `--checks`; when `gates.md` has a `RUN: writer`
    gate, the checks include `devrites-engine gates precheck <slug> --worktree <path> --slice <SLICE-ID>`
    (those gates, minus ones only other unbuilt slices own, plus `check windows`;
    never evidence, root still runs every gate).
@@ -107,7 +107,7 @@ open with no wave and no claim and stops the dispatch, per
 [`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
 is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
 Render the contract with `devrites-engine packet <slug> --wave <wave> --phase build
---role slice-wright --slice <SLICE-ID> --checks <G-ID,...> [--focus <file>]` (it
+--role slice-wright --slice <SLICE-ID> [--checks <G-ID,...>] [--focus <file>]` (it
 writes the linted same-worktree `packets/<wave>.contract.md`; a native-worktree pilot
 writes its own contract with `Isolation`, `worktree_base`, and subject) and hand the wright that text verbatim. Reviewers read
 that file, so `--focus` rows state each defect to fix with its anchor, never a reviewer's verdict,

package/pack/generated/devin/skills/rite-build/reference/wright-dispatch.md

@@ -84,11 +84,11 @@ worktrees stay forbidden.
    Quote, as a `--focus` row, every active `decisions.md` carry-forward constraint whose `Files:`
    overlap the task paths (or that names no files).
    A new path requires a new bounded contract; the wright cannot widen the task.
-   Name (`--checks` gate IDs) the writer-safe commands the wright must run (syntax/type/lint, unit and
-   self-check suites, a narrow local smoke of the changed path) and never forbid
-   them: a wright that cannot execute writes blind and its failures surface a
-   whole review round later. Only artifact-producing, consumptive, or full
-   canonical feature gates stay root-owned; when `gates.md` has a `RUN: writer`
+   The contract lists the slice's `Tests/proof` as writer-safe checks (syntax/type/lint,
+   unit and self-check suites, a narrow smoke of the changed path); `--checks` adds
+   gate IDs. Never forbid them: a blind wright's failures surface a review
+   round later. Artifact-producing, consumptive, or full canonical feature
+   gates stay root-owned, never in `--checks`; when `gates.md` has a `RUN: writer`
    gate, the checks include `devrites-engine gates precheck <slug> --worktree <path> --slice <SLICE-ID>`
    (those gates, minus ones only other unbuilt slices own, plus `check windows`;
    never evidence, root still runs every gate).
@@ -107,7 +107,7 @@ open with no wave and no claim and stops the dispatch, per
 [`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
 is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
 Render the contract with `devrites-engine packet <slug> --wave <wave> --phase build
---role slice-wright --slice <SLICE-ID> --checks <G-ID,...> [--focus <file>]` (it
+--role slice-wright --slice <SLICE-ID> [--checks <G-ID,...>] [--focus <file>]` (it
 writes the linted same-worktree `packets/<wave>.contract.md`; a native-worktree pilot
 writes its own contract with `Isolation`, `worktree_base`, and subject) and hand the wright that text verbatim. Reviewers read
 that file, so `--focus` rows state each defect to fix with its anchor, never a reviewer's verdict,

package/pack/generated/omp/skills/rite-build/reference/wright-dispatch.md

@@ -84,11 +84,11 @@ worktrees stay forbidden.
    Quote, as a `--focus` row, every active `decisions.md` carry-forward constraint whose `Files:`
    overlap the task paths (or that names no files).
    A new path requires a new bounded contract; the wright cannot widen the task.
-   Name (`--checks` gate IDs) the writer-safe commands the wright must run (syntax/type/lint, unit and
-   self-check suites, a narrow local smoke of the changed path) and never forbid
-   them: a wright that cannot execute writes blind and its failures surface a
-   whole review round later. Only artifact-producing, consumptive, or full
-   canonical feature gates stay root-owned; when `gates.md` has a `RUN: writer`
+   The contract lists the slice's `Tests/proof` as writer-safe checks (syntax/type/lint,
+   unit and self-check suites, a narrow smoke of the changed path); `--checks` adds
+   gate IDs. Never forbid them: a blind wright's failures surface a review
+   round later. Artifact-producing, consumptive, or full canonical feature
+   gates stay root-owned, never in `--checks`; when `gates.md` has a `RUN: writer`
    gate, the checks include `devrites-engine gates precheck <slug> --worktree <path> --slice <SLICE-ID>`
    (those gates, minus ones only other unbuilt slices own, plus `check windows`;
    never evidence, root still runs every gate).
@@ -107,7 +107,7 @@ open with no wave and no claim and stops the dispatch, per
 [`agents.md`](skill://devrites-lib/reference/standards/agents.md). `.devrites/**`
 is never a task path; see [Workflow Artifact admission](skill://devrites-lib/reference/standards/workflow-artifacts.md).
 Render the contract with `devrites-engine packet <slug> --wave <wave> --phase build
---role slice-wright --slice <SLICE-ID> --checks <G-ID,...> [--focus <file>]` (it
+--role slice-wright --slice <SLICE-ID> [--checks <G-ID,...>] [--focus <file>]` (it
 writes the linted same-worktree `packets/<wave>.contract.md`; a native-worktree pilot
 writes its own contract with `Isolation`, `worktree_base`, and subject) and hand the wright that text verbatim. Reviewers read
 that file, so `--focus` rows state each defect to fix with its anchor, never a reviewer's verdict,

package/pack/generated/pi/skills/rite-build/reference/wright-dispatch.md

@@ -84,11 +84,11 @@ worktrees stay forbidden.
    Quote, as a `--focus` row, every active `decisions.md` carry-forward constraint whose `Files:`
    overlap the task paths (or that names no files).
    A new path requires a new bounded contract; the wright cannot widen the task.
-   Name (`--checks` gate IDs) the writer-safe commands the wright must run (syntax/type/lint, unit and
-   self-check suites, a narrow local smoke of the changed path) and never forbid
-   them: a wright that cannot execute writes blind and its failures surface a
-   whole review round later. Only artifact-producing, consumptive, or full
-   canonical feature gates stay root-owned; when `gates.md` has a `RUN: writer`
+   The contract lists the slice's `Tests/proof` as writer-safe checks (syntax/type/lint,
+   unit and self-check suites, a narrow smoke of the changed path); `--checks` adds
+   gate IDs. Never forbid them: a blind wright's failures surface a review
+   round later. Artifact-producing, consumptive, or full canonical feature
+   gates stay root-owned, never in `--checks`; when `gates.md` has a `RUN: writer`
    gate, the checks include `devrites-engine gates precheck <slug> --worktree <path> --slice <SLICE-ID>`
    (those gates, minus ones only other unbuilt slices own, plus `check windows`;
    never evidence, root still runs every gate).
@@ -107,7 +107,7 @@ open with no wave and no claim and stops the dispatch, per
 [`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
 is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
 Render the contract with `devrites-engine packet <slug> --wave <wave> --phase build
---role slice-wright --slice <SLICE-ID> --checks <G-ID,...> [--focus <file>]` (it
+--role slice-wright --slice <SLICE-ID> [--checks <G-ID,...>] [--focus <file>]` (it
 writes the linted same-worktree `packets/<wave>.contract.md`; a native-worktree pilot
 writes its own contract with `Isolation`, `worktree_base`, and subject) and hand the wright that text verbatim. Reviewers read
 that file, so `--focus` rows state each defect to fix with its anchor, never a reviewer's verdict,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "7.0.7",
+  "version": "7.0.9",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, pi, and Devin CLI",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",