devrites 7.0.9 → 7.0.11

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.0.11](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.10...v7.0.11) (2026-10-24)
+
+### Fixed
+
+* **deps:** restore dependency audits with bounded exceptions ([#168](https://github.com/ViktorsBaikers/DevRites/issues/168)) ([89b4aa7](https://github.com/ViktorsBaikers/DevRites/commit/89b4aa733d2395c09f979757cde094f57daca822))
+* **devrites:** permit proof runner read-only inspection ([#167](https://github.com/ViktorsBaikers/DevRites/issues/167)) ([aa11b9e](https://github.com/ViktorsBaikers/DevRites/commit/aa11b9e889a67f11de943fa9d90bff9ed0fd6bf3))
+
+## [7.0.10](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.9...v7.0.10) (2026-10-23)
+
+### Fixed
+
+* **devrites:** apply-bundle refuses an unrunnable preflight row ([#166](https://github.com/ViktorsBaikers/DevRites/issues/166)) ([6bc06a4](https://github.com/ViktorsBaikers/DevRites/commit/6bc06a40530e3456b80883303e345fb25d45357a))
+
 ## [7.0.9](https://github.com/ViktorsBaikers/DevRites/compare/v7.0.8...v7.0.9) (2026-10-22)
 
 ### Fixed

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.0.9`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.0.9): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.0.11`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.0.11): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 

package/engine/internal/acceptance/approve.go

@@ -1,6 +1,7 @@
 package acceptance
 
 import (
+	"fmt"
 	"path/filepath"
 	"strings"
 
@@ -25,6 +26,9 @@ type PreflightRow struct {
 	// RunAt is the optional `Run at` cell (`vet`, `pre-dispatch SLICE-###`,
 	// `action`), whitespace-collapsed; "" when the row or table has none.
 	RunAt string
+	// Width and HeaderWidth are the row's and its table header's cell counts;
+	// they differ when a bare `|` in a command splits the row.
+	Width, HeaderWidth int
 }
 
 // ApprovedCommands extracts the approved command surface of test-plan.md: the
@@ -56,7 +60,7 @@ func PreflightRows(testPlan []byte) (rows []PreflightRow, hasRunAt bool) {
 		return nil, false
 	}
 	inSection := false
-	commandCol, cwdCol, gateCol, expectedCol, runAtCol := -1, -1, -1, -1, -1
+	commandCol, cwdCol, gateCol, expectedCol, runAtCol, headerWidth := -1, -1, -1, -1, -1, 0
 	for _, line := range strings.Split(string(structural), "\n") {
 		trimmed := strings.TrimSpace(line)
 		if strings.HasPrefix(trimmed, "##") {
@@ -77,6 +81,7 @@ func PreflightRows(testPlan []byte) (rows []PreflightRow, hasRunAt bool) {
 			gateCol = columnIndex(cells, "gate")
 			expectedCol = columnIndex(cells, "expected")
 			runAtCol = columnIndex(cells, "run at")
+			headerWidth = len(cells)
 			hasRunAt = hasRunAt || (commandCol >= 0 && runAtCol >= 0)
 			continue
 		}
@@ -87,7 +92,7 @@ func PreflightRows(testPlan []byte) (rows []PreflightRow, hasRunAt bool) {
 		if command == "" {
 			continue
 		}
-		row := PreflightRow{ApprovedCommand: ApprovedCommand{Command: command}}
+		row := PreflightRow{ApprovedCommand: ApprovedCommand{Command: command}, Width: len(cells), HeaderWidth: headerWidth}
 		if cwdCol >= 0 && cwdCol < len(cells) {
 			row.Cwd = normalizeApprovedCwd(cells[cwdCol])
 		}
@@ -99,6 +104,30 @@ func PreflightRows(testPlan []byte) (rows []PreflightRow, hasRunAt bool) {
 	return rows, hasRunAt
 }
 
+// PreflightShapeProblems names each Build-entry preflight row that cannot run
+// as written: a cell count that differs from its header (an unescaped `|`
+// in the command, which must be written `\|`) or an invalid `Run at` value.
+// `check preconditions` would otherwise find it only when Vet runs the row.
+func PreflightShapeProblems(testPlan []byte) []string {
+	rows, _ := PreflightRows(testPlan)
+	var problems []string
+	for _, row := range rows {
+		name := valueOr(row.Gate, row.Command)
+		if row.Width != row.HeaderWidth {
+			problems = append(problems, fmt.Sprintf("preflight row %q has %d cells but its header has %d; escape each `|` in the command as `\\|`", name, row.Width, row.HeaderWidth))
+		} else if !ValidRunAt(row.RunAt) {
+			problems = append(problems, fmt.Sprintf("preflight row %q has invalid Run at %q (want vet, pre-dispatch SLICE-###, or action)", name, row.RunAt))
+		}
+	}
+	return problems
+}
+
+// ValidRunAt reports whether a `Run at` cell is empty or a known value.
+func ValidRunAt(runAt string) bool {
+	lower := strings.ToLower(runAt)
+	return lower == "" || lower == "vet" || lower == "action" || preDispatchRunAtRE.MatchString(runAt)
+}
+
 // cellText returns a cell's trimmed text without code backticks, "" when the
 // column is absent or the row is short.
 func cellText(cells []string, col int) string {

package/engine/internal/acceptance/preconditions.go

@@ -163,8 +163,7 @@ func runPreflightRows(root, slug, work, project, runAt string, rows []PreflightR
 	doc := &Document{}
 	var results []GateResult
 	for _, row := range rows {
-		lower := strings.ToLower(row.RunAt)
-		if lower != "" && lower != "vet" && lower != "action" && !preDispatchRunAtRE.MatchString(row.RunAt) {
+		if !ValidRunAt(row.RunAt) {
 			fmt.Fprintf(stdout, "row %s: invalid Run at %q (want vet, pre-dispatch SLICE-###, or action)\n", valueOr(row.Gate, row.Command), row.RunAt)
 			failed = true
 			continue

package/engine/internal/lib/apply_bundle.go

@@ -15,6 +15,7 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/devrites/devrites/internal/acceptance"
 	"github.com/devrites/devrites/internal/devritespaths"
 	"github.com/devrites/devrites/internal/fsutil"
 	"github.com/devrites/devrites/internal/state"
@@ -360,7 +361,8 @@ func applyHunks(base string, hunks []candidateHunk) (string, []string) {
 
 // checkBundleResult rejects an outcome the root would otherwise discover only
 // at Vet: a tracked ID that vanished from every touched file without being
-// listed in retired_ids, a new tasks.md graph problem, or a budgeted artifact
+// listed in retired_ids, a new tasks.md graph problem, a new test-plan.md
+// preflight row that cannot run as written, or a budgeted artifact
 // that grew into material overshoot without a covering
 // `Budget override: <=N lines; <reason>` line.
 func checkBundleResult(targets []*bundleTarget, retired map[string]bool) []string {
@@ -400,6 +402,17 @@ func checkBundleResult(targets []*bundleTarget, retired map[string]bool) []strin
 				}
 			}
 		}
+		if name == "test-plan.md" && filepath.Dir(target.rel) == "." {
+			old := map[string]bool{}
+			for _, p := range acceptance.PreflightShapeProblems(target.before) {
+				old[p] = true
+			}
+			for _, p := range acceptance.PreflightShapeProblems(target.after) {
+				if !old[p] {
+					problems = append(problems, "test-plan.md: "+p)
+				}
+			}
+		}
 		if filepath.Dir(target.rel) == "." && currentStatePlanning[name] &&
 			len(datedHeadingRE.FindAllIndex(target.after, -1)) > len(datedHeadingRE.FindAllIndex(target.before, -1)) {
 			problems = append(problems, target.rel+": adds a dated delta section; rewrite the owning clause in place (rationale to decisions.md, closed narrative to history/)")

package/pack/.claude/agents/devrites-proof-runner.md

@@ -60,7 +60,7 @@ and only the orchestrator-supplied changed paths.
 ## Rules
 
 - Read-only: do not edit source, tests, `.devrites/**`, Git state, or dependencies.
-- Execute no command or external write. Invoke no agent and fix nothing.
+- Read-only local filesystem inspection and digest calculations are permitted. Execute no test, build, benchmark, gate, application or other effectful command; perform no external write. Invoke no agent and fix nothing.
 - Return a reproduction. Unavailable proof is `cannot_verify`, never pass.
 
 ## Output format

package/pack/generated/claude/agents/devrites-proof-runner.md

@@ -66,7 +66,7 @@ and only the orchestrator-supplied changed paths.
 ## Rules
 
 - Read-only: do not edit source, tests, `.devrites/**`, Git state, or dependencies.
-- Execute no command or external write. Invoke no agent and fix nothing.
+- Read-only local filesystem inspection and digest calculations are permitted. Execute no test, build, benchmark, gate, application or other effectful command; perform no external write. Invoke no agent and fix nothing.
 - Return a reproduction. Unavailable proof is `cannot_verify`, never pass.
 
 ## Output format

package/pack/generated/codex/agents/devrites-proof-runner.toml

@@ -64,7 +64,7 @@ and only the orchestrator-supplied changed paths.
 ## Rules
 
 - Read-only: do not edit source, tests, `.devrites/**`, Git state, or dependencies.
-- Execute no command or external write. Invoke no agent and fix nothing.
+- Read-only local filesystem inspection and digest calculations are permitted. Execute no test, build, benchmark, gate, application or other effectful command; perform no external write. Invoke no agent and fix nothing.
 - Return a reproduction. Unavailable proof is `cannot_verify`, never pass.
 
 ## Output format

package/pack/generated/devin/agents/devrites-proof-runner.md

@@ -68,7 +68,7 @@ and only the orchestrator-supplied changed paths.
 ## Rules
 
 - Read-only: do not edit source, tests, `.devrites/**`, Git state, or dependencies.
-- Execute no command or external write. Invoke no agent and fix nothing.
+- Read-only local filesystem inspection and digest calculations are permitted. Execute no test, build, benchmark, gate, application or other effectful command; perform no external write. Invoke no agent and fix nothing.
 - Return a reproduction. Unavailable proof is `cannot_verify`, never pass.
 
 ## Output format

package/pack/generated/omp/agents/devrites-proof-runner.md

@@ -65,7 +65,7 @@ and only the orchestrator-supplied changed paths.
 ## Rules
 
 - Read-only: do not edit source, tests, `.devrites/**`, Git state, or dependencies.
-- Execute no command or external write. Invoke no agent and fix nothing.
+- Read-only local filesystem inspection and digest calculations are permitted. Execute no test, build, benchmark, gate, application or other effectful command; perform no external write. Invoke no agent and fix nothing.
 - Return a reproduction. Unavailable proof is `cannot_verify`, never pass.
 
 ## Output format

package/pack/generated/pi/agents/devrites-proof-runner.md

@@ -66,7 +66,7 @@ and only the orchestrator-supplied changed paths.
 ## Rules
 
 - Read-only: do not edit source, tests, `.devrites/**`, Git state, or dependencies.
-- Execute no command or external write. Invoke no agent and fix nothing.
+- Read-only local filesystem inspection and digest calculations are permitted. Execute no test, build, benchmark, gate, application or other effectful command; perform no external write. Invoke no agent and fix nothing.
 - Return a reproduction. Unavailable proof is `cannot_verify`, never pass.
 
 ## Output format

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "7.0.9",
+  "version": "7.0.11",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, pi, and Devin CLI",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",
@@ -92,7 +92,7 @@
     "@semantic-release/npm": {
       "npm": "11.21.1"
     },
-    "fast-uri": "3.1.8",
+    "fast-uri": "3.1.9",
     "js-yaml": "4.3.2"
   }
 }