devrites 7.2.2 → 7.2.4

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.2.4](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.3...v7.2.4) (2026-10-30)
+
+### Fixed
+
+* **devrites:** support workflow-only Define and Vet ([#188](https://github.com/ViktorsBaikers/DevRites/issues/188)) ([51dcaf3](https://github.com/ViktorsBaikers/DevRites/commit/51dcaf3197e6abdb5987aec1a6da7de0cc71238f))
+
+## [7.2.3](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.2...v7.2.3) (2026-10-29)
+
+### Fixed
+
+* **agents:** honor DSH orchestrator permission selection ([#187](https://github.com/ViktorsBaikers/DevRites/issues/187)) ([1030093](https://github.com/ViktorsBaikers/DevRites/commit/10300933ac688c0e06217026c89c3ed657b58ec0))
+
 ## [7.2.2](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.1...v7.2.2) (2026-10-29)
 
 ### Fixed

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.2.2`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.2.2): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.2.4`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.2.4): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 

package/docs/dsh.md

@@ -32,10 +32,16 @@ settlement notice. A returned child id means dispatch was admitted; `inactive`
 activity alone does not prove successful completion. The orchestrator collects
 and reconciles every terminal result, including failures, before dependent work.
 
+The DevRites orchestrator honors DSH's selected permission mode, including
+**Full access**, without changing approval settings or enabling Full access
+automatically. After updating an older installation and restarting DSH, select
+your desired permission preset again if the session already shows **Custom**.
+
 Read-only roles retain only their mapped tools and run shell commands under the
 read-only sandbox. Shell-capable roles also receive native job tools to collect
-background command output and stop their jobs. Writers have a workspace-write ceiling. The guard narrows
-DSH's inherited parent override before each allowed call, preserves an existing
+background command output and stop their jobs. Specialist writers have a
+workspace-write ceiling. For specialists, the guard narrows DSH's inherited
+parent override before each allowed call, preserves an existing
 read-only parent boundary, and denies explicit sandbox escalation. Confining
 shell and filesystem providers are required; an unconfined composition fails
 closed. Tool access derives from canonical agent frontmatter; unsupported

package/engine/internal/gate/gate.go

@@ -154,6 +154,12 @@ func checkObservation(kind Kind, observation *state.WorkspaceObservation) (*Resu
 			}
 		}
 	}
+	if len(missingFiles) == 0 {
+		for _, problem := range workflowOnlyProblems(observation, policy) {
+			stateProblems = append(stateProblems, "workflow-only: "+problem)
+			blocked = true
+		}
+	}
 	if len(missingFiles) == 0 {
 		for _, problem := range acceptanceMapProblems(observation, policy) {
 			stateProblems = append(stateProblems, "acceptance-map: "+problem)

package/engine/internal/gate/workflow_only.go

@@ -0,0 +1,335 @@
+package gate
+
+import (
+	"fmt"
+	"math"
+	"path"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/devrites/devrites/internal/markdowntext"
+	"github.com/devrites/devrites/internal/state"
+)
+
+var workflowBehaviorRE = regexp.MustCompile(`\bWA-BEH-[A-Z0-9][A-Z0-9-]*\b`)
+var workflowModeRE = regexp.MustCompile(`^0[0-7]{3}$`)
+var workflowReviewedIdentityRE = regexp.MustCompile(`^Workflow Artifact reviewed identity: [0-9a-f]{64}$`)
+var workflowEvidenceRE = regexp.MustCompile(`^[a-z][a-z0-9_]*$`)
+var workflowActionRE = regexp.MustCompile(`^/rite-[a-z0-9-]+$`)
+var workflowPlaceholderRE = regexp.MustCompile(`(?i)^(?:todo|tbd|placeholder|<[^>]+>)$`)
+
+// workflowOnlyProblems checks planning authority, not executable bytes or runtime
+// safety. Native preflight still owns no-follow source/target and content checks.
+func workflowOnlyProblems(observation *state.WorkspaceObservation, policy state.PhasePolicy) []string {
+	tasks, ok := observation.Fact("tasks.md")
+	if !ok || !phaseRequiresTasks(policy) || !state.ParseTaskGraph(tasks.Bytes()).WorkflowOnly {
+		return nil
+	}
+	spec, _ := observation.Fact("spec.md")
+	ids := state.ParseAcceptanceMap(spec.Bytes(), nil, nil, false, false).SpecIDs
+	var problems []string
+	var refs map[string]bool
+	if phaseRequiresTestPlan(policy) {
+		plan, _ := observation.Fact("test-plan.md")
+		var err error
+		refs, err = workflowAdmission(plan.Bytes(), observation.Slug())
+		if err != nil {
+			problems = append(problems, err.Error())
+		}
+	}
+	for _, name := range []state.ArtifactPath{"tasks.md", "test-plan.md"} {
+		if name == "test-plan.md" && !phaseRequiresTestPlan(policy) {
+			continue
+		}
+		fact, _ := observation.Fact(name)
+		structural, _ := markdowntext.Structural(fact.Bytes())
+		mapped := map[string]bool{}
+		for _, line := range strings.Split(string(structural), "\n") {
+			_, cells, table := workflowTableCells(line)
+			if !table || len(cells) != 2 {
+				continue
+			}
+			id := strings.TrimSpace(cells[0])
+			if id == "" || specACTokenRE.FindString(id) != id {
+				continue
+			}
+			mapped[id] = true
+			target := strings.Trim(strings.TrimSpace(cells[1]), "`")
+			if target == "" || workflowBehaviorRE.FindString(target) != target || (phaseRequiresTestPlan(policy) && !refs[target]) {
+				problems = append(problems, fmt.Sprintf("%s maps %s to invalid or unadmitted Workflow Artifact behavior %q", name, id, target))
+			}
+		}
+		for _, id := range ids {
+			if !mapped[id] {
+				problems = append(problems, fmt.Sprintf("%s needs an AC-to-Workflow-Artifact row | %s | WA-BEH-ID | naming an admitted behavior", name, id))
+			}
+		}
+	}
+	return problems
+}
+
+var workflowAdmissionFields = strings.Fields("active_slug readiness_binding_command return_phase return_next_action target_order target_count_limit per_target_bytes_limit aggregate_bytes_limit transaction_file_limit diagnostic_bytes_limit journal_line_limit attempt_epoch_limit proof_command_timeout_seconds proof_aggregate_timeout_seconds proof_terminate_grace_seconds")
+var workflowTargetColumns = strings.Split("Index|Path|Mode|Behavior ref|Interface ref|Positive fixture|Failure fixtures|Proof command|Proof cwd|Proof signal|Rollback|Evidence fields", "|")
+
+func workflowAdmission(raw []byte, slug string) (map[string]bool, error) {
+	fail := func() (map[string]bool, error) {
+		return nil, fmt.Errorf("workflow artifact admission is missing or malformed; repair in /rite-plan and rerun /rite-vet")
+	}
+	structural, err := markdowntext.Structural(raw)
+	if err != nil {
+		return fail()
+	}
+	text := strings.ReplaceAll(string(structural), "\r\n", "\n")
+	sections := map[string][]string{}
+	current := ""
+	for _, line := range strings.Split(text, "\n") {
+		if strings.HasPrefix(line, "## ") {
+			current = strings.TrimPrefix(line, "## ")
+			if _, duplicate := sections[current]; duplicate {
+				return fail()
+			}
+			sections[current] = nil
+		} else if current != "" && strings.TrimSpace(line) != "" {
+			sections[current] = append(sections[current], line)
+		}
+	}
+	block := sections["Workflow Artifact admission"]
+	if len(block) == 0 || block[0] != "DevRites contract: devrites.workflow-artifact-admission.v1" {
+		return fail()
+	}
+	fields, rest, ok := workflowFields(block[1:], workflowAdmissionFields)
+	if !ok || fields["active_slug"] != slug || fields["readiness_binding_command"] != "devrites-engine check readiness --emit-binding "+slug || fields["target_order"] != "utf8-bytewise-path-ascending" {
+		return fail()
+	}
+	if _, ok := state.PolicyFor(state.Phase(fields["return_phase"])); !ok {
+		return fail()
+	}
+	action, actionSlug, ok := strings.Cut(fields["return_next_action"], " ")
+	if !ok || !workflowActionRE.MatchString(action) || actionSlug != slug {
+		return fail()
+	}
+	bounds := map[string]uint64{}
+	for _, key := range workflowAdmissionFields[5:] {
+		value := fields[key]
+		if value == "" || strings.Trim(value, "0123456789") != "" {
+			return fail()
+		}
+		n, err := strconv.ParseUint(value, 10, 64)
+		if err != nil || n == 0 {
+			return fail()
+		}
+		bounds[key] = n
+	}
+	count, epochs := bounds["target_count_limit"], bounds["attempt_epoch_limit"]
+	if count > (math.MaxUint64-6)/3 || epochs < 3 || epochs > math.MaxUint64-30 || count > math.MaxUint64-30-epochs || bounds["transaction_file_limit"] < 3*count+6 || bounds["diagnostic_bytes_limit"] != 256 || bounds["journal_line_limit"] < 30+count+epochs || bounds["journal_line_limit"] > 280 || bounds["proof_command_timeout_seconds"] <= bounds["proof_terminate_grace_seconds"] || bounds["proof_aggregate_timeout_seconds"] < bounds["proof_command_timeout_seconds"] {
+		return fail()
+	}
+	if len(rest) < 3 || !workflowHeader(rest[0], workflowTargetColumns) || !delimiterRow(rest[1]) {
+		return fail()
+	}
+	rows := rest[2:]
+	if workflowReviewedIdentityRE.MatchString(rows[len(rows)-1]) {
+		rows = rows[:len(rows)-1]
+	}
+	if len(rows) == 0 {
+		return fail()
+	}
+	if uint64(len(rows)) > count {
+		return fail()
+	}
+	refs := map[string]bool{}
+	previous := ""
+	for i, line := range rows {
+		row, ok := workflowCells(line, len(workflowTargetColumns))
+		if !ok || row[0] != fmt.Sprintf("%08x", i) || !workflowTargetPath(row[1]) || row[1] <= previous || !workflowModeRE.MatchString(row[2]) {
+			return fail()
+		}
+		previous = row[1]
+		if !workflowSingleCommand(row[7]) || (row[8] != "repository-root" && row[8] != "active-workspace") || len(row[9]) > 128 || row[10] != "restore-preimage-or-absence" {
+			return fail()
+		}
+		for _, c := range row[9] {
+			if c < 32 || c > 126 {
+				return fail()
+			}
+		}
+		seen := map[string]bool{}
+		for _, field := range strings.Split(row[11], ",") {
+			field = strings.TrimSpace(field)
+			if !workflowEvidenceRE.MatchString(field) || seen[field] {
+				return fail()
+			}
+			seen[field] = true
+		}
+		referenceIDs := []string{row[3], row[4], row[5]}
+		referenceIDs = append(referenceIDs, strings.Split(row[6], ",")...)
+		for j, id := range referenceIDs {
+			id = strings.TrimSpace(id)
+			kind, prefix, keys := "failure-fixture", "WA-FIX-F", strings.Fields("setup fault expected")
+			switch j {
+			case 0:
+				kind, prefix, keys = "behavior", "WA-BEH-", strings.Fields("success observable_effect")
+			case 1:
+				kind, prefix, keys = "interface", "WA-IF-", strings.Fields("inputs invariants ordering errors configuration performance")
+			case 2:
+				kind, prefix, keys = "positive-fixture", "WA-FIX-P", strings.Fields("setup action expected")
+			}
+			suffix := strings.TrimPrefix(id, prefix)
+			if suffix == id || suffix == "" || strings.Trim(suffix, "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-") != "" || suffix[0] == '-' || refs[id] {
+				return fail()
+			}
+			ref := sections[id]
+			if len(ref) == 0 || ref[0] != "DevRites workflow reference: "+kind {
+				return fail()
+			}
+			_, extra, ok := workflowFields(ref[1:], keys)
+			if !ok || len(extra) != 0 {
+				return fail()
+			}
+			refs[id] = true
+		}
+	}
+	return refs, nil
+}
+
+func workflowHeader(line string, columns []string) bool {
+	_, cells, ok := workflowTableCells(line)
+	if !ok || len(cells) != len(columns) {
+		return false
+	}
+	for i := range cells {
+		if strings.TrimSpace(cells[i]) != columns[i] {
+			return false
+		}
+	}
+	return true
+}
+
+func workflowFields(lines, keys []string) (map[string]string, []string, bool) {
+	if len(lines) < len(keys)+2 || !workflowHeader(lines[0], []string{"Field", "Value"}) || !delimiterRow(lines[1]) {
+		return nil, nil, false
+	}
+	fields := map[string]string{}
+	for i, key := range keys {
+		_, cells, ok := workflowTableCells(lines[i+2])
+		if !ok || len(cells) != 2 || strings.TrimSpace(cells[0]) != key {
+			return nil, nil, false
+		}
+		value, ok := workflowCell(cells[1])
+		if !ok {
+			return nil, nil, false
+		}
+		fields[key] = value
+	}
+	return fields, lines[len(keys)+2:], true
+}
+
+func workflowCells(line string, count int) ([]string, bool) {
+	_, cells, ok := workflowTableCells(line)
+	if !ok || len(cells) != count {
+		return nil, false
+	}
+	for i := range cells {
+		cells[i], ok = workflowCell(cells[i])
+		if !ok {
+			return nil, false
+		}
+	}
+	return cells, true
+}
+
+func workflowCell(raw string) (string, bool) {
+	raw = strings.TrimSpace(raw)
+	if len(raw) < 3 || raw[0] != '`' || raw[len(raw)-1] != '`' {
+		return "", false
+	}
+	value := raw[1 : len(raw)-1]
+	return value, strings.TrimSpace(value) != "" && !strings.ContainsAny(value, "`\r\n") && !workflowPlaceholderRE.MatchString(value)
+}
+
+// This checks command shape only; native preflight still owns execution safety.
+func workflowSingleCommand(command string) bool {
+	var quote byte
+	for i := 0; i < len(command); i++ {
+		c := command[i]
+		if c == '\r' || c == '\n' {
+			return false
+		}
+		if quote == '\'' {
+			if c == quote {
+				quote = 0
+			}
+			continue
+		}
+		if c == '\\' {
+			if i+1 == len(command) {
+				return false
+			}
+			if quote == 0 || strings.ContainsRune("$`\"\\", rune(command[i+1])) {
+				i++
+			}
+			continue
+		}
+		// shortcut: substitutions reject even literal operators; use a shell parser if needed.
+		if c == '$' && i+1 < len(command) && command[i+1] == '(' && strings.ContainsAny(command, ";|&") {
+			return false
+		}
+		if quote != 0 {
+			if c == quote {
+				quote = 0
+			}
+		} else if c == '\'' || c == '"' {
+			quote = c
+		} else if strings.ContainsRune(";|&", rune(c)) {
+			return false
+		}
+	}
+	return quote == 0
+}
+
+func workflowTargetPath(value string) bool {
+	if value == "." || path.IsAbs(value) || path.Clean(value) != value || strings.ContainsAny(value, "\\:*?[]{}|\t\r\n") {
+		return false
+	}
+	parts := strings.Split(value, "/")
+	for _, part := range parts {
+		if part == ".." || strings.HasPrefix(part, ".") || part == "node_modules" || part == "vendor" {
+			return false
+		}
+	}
+	// Canonical workspace ledgers and cross-workspace roots are not executable targets.
+	return parts[0] != "work" && parts[0] != "archive" && !strings.HasSuffix(value, "/") && !strings.HasSuffix(value, ".md")
+}
+
+// Admission escaping counts the whole backslash run; other Markdown tables do not.
+func workflowTableCells(line string) (string, []string, bool) {
+	line = strings.TrimSpace(line)
+	if len(line) < 2 || line[0] != '|' || line[len(line)-1] != '|' {
+		return "", nil, false
+	}
+	var cells []string
+	var cell strings.Builder
+	backslashes := 0
+	for _, c := range line[1:] {
+		if c == '|' {
+			if backslashes%2 == 1 {
+				value := cell.String()
+				cell.Reset()
+				cell.WriteString(value[:len(value)-1])
+				cell.WriteRune(c)
+			} else {
+				cells = append(cells, cell.String())
+				cell.Reset()
+			}
+		} else {
+			cell.WriteRune(c)
+		}
+		if c == '\\' {
+			backslashes++
+		} else {
+			backslashes = 0
+		}
+	}
+	return "", cells, cell.Len() == 0
+}

package/engine/internal/state/taskgraph.go

@@ -21,10 +21,11 @@ type TaskSlice struct {
 
 // TaskGraphResult is the deterministic outcome of parsing a tasks.md slice graph.
 type TaskGraphResult struct {
-	Slices   []TaskSlice
-	Cycle    []string // empty when acyclic
-	Unknown  []string // dependency ids with no defining slice
-	Problems []string // human-readable blockers
+	WorkflowOnly bool // explicit work scope, never inferred from an empty graph
+	Slices       []TaskSlice
+	Cycle        []string // empty when acyclic
+	Unknown      []string // dependency ids with no defining slice
+	Problems     []string // human-readable blockers
 }
 
 var (
@@ -72,6 +73,20 @@ func ParseTaskGraph(tasksMarkdown []byte) TaskGraphResult {
 	}
 
 	headers := sliceHeaderRE.FindAllStringSubmatchIndex(text, -1)
+	markers := 0
+	for _, line := range strings.Split(strings.ReplaceAll(text, "\r\n", "\n"), "\n") {
+		if line == "Work scope: workflow-only" {
+			markers++
+		}
+	}
+	if markers > 0 {
+		if markers != 1 || len(headers) != 0 {
+			result.Problems = append(result.Problems, "workflow-only scope requires exactly one marker and zero SLICE-### sections")
+			return result
+		}
+		result.WorkflowOnly = true
+		return result
+	}
 	if len(headers) == 0 {
 		result.Problems = append(result.Problems, "no SLICE-### sections found")
 		return result

package/pack/.claude/agents/devrites-plan-drafter.md

@@ -23,7 +23,11 @@ seams supplied by the orchestrator.
 Reuse existing seams and dependencies before proposing new ones. Per
 `.claude/skills/devrites-lib/reference/standards/code-navigation.md`, map seams with `get_architecture`, find reuse
 with `search_graph`, and size blast radius with `trace_path` (`direction: "inbound"`). Build vertical
-slices in dependency order; put a hub file's shared edit in one seam slice
+slices in dependency order for product work. For explicit workflow-only scope,
+follow [workflow-artifacts.md](../skills/devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning):
+map every REQ/AC to WA behavior and proof, retain zero product slices and empty
+product candidate, never fabricate slices. Product slice rules below apply only
+to product work; put a hub file's shared edit in one seam slice
 ([slicing.md](../skills/rite-plan/reference/slicing.md#slice-independence)). Map every REQ and AC to a slice and executable proof,
 name rollback and failure paths; keep acceptance-changing proposals separate. Each proof
 row quotes the spec line or standard rule it proves (`Proves`); proof that proves none

package/pack/.claude/agents/devrites-plan-reviewer.md

@@ -32,6 +32,13 @@ Per `.claude/skills/devrites-lib/reference/standards/code-navigation.md`, check
 placement with `get_architecture`, reuse with `search_graph`, and blast radius with
 `trace_path` (`direction: "inbound"`); fall back to Read/Grep/Glob.
 
+For explicit workflow-only tasks, also read `test-plan.md` and follow
+[workflow-artifacts.md](../skills/devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning).
+Review REQ/AC → admitted WA behavior/proof, admission completeness and root ownership
+instead of product slice writer/closure checks. Zero product slices and empty
+candidate are valid; do not demand fabricated slices or Build dispatch. Apply
+all seven dimensions to the workflow behaviors and proof.
+
 ## Score the seven dimensions
 For each dimension, **cite the evidence first**, including an absent plan or spec
 line, and then assign the band. Do not choose a score and justify it afterward:

package/pack/.claude/skills/devrites-lib/reference/standards/workflow-artifacts.md

@@ -4,9 +4,37 @@
 
 > Applies when: a plan declares root-authored executable workflow files.
 
-Workflow Artifact plans/isolates/proves; never enters product candidate/readiness/
-built count or authorizes consumption. Module owns semantics; callers retain only
-link and entry/return.
+Workflow Artifact plans/isolates/proves; never enters the product candidate or
+built count and never authorizes consumption. Workspace planning readiness binds
+its admission and proof references, not executable bytes as product changes.
+Module owns semantics; callers retain only link and entry/return.
+
+## Workflow-only planning
+
+For exclusively root-owned executable workflow work, put the exact standalone
+line `Work scope: workflow-only` outside fences in `tasks.md`, with zero
+`## SLICE-###` sections. Empty tasks never imply this scope; mixed marker plus
+product slices is invalid. Keep ordinary spec AC IDs. In both `tasks.md` and
+`test-plan.md`, map every AC in two-cell rows `| AC-001 | WA-BEH-ID |` (backticks
+around the behavior ID are optional); `traceability.md` maps REQ/AC → that same
+behavior → proof → evidence. Define may name the planned behaviors before Vet
+admits them; Vet requires every mapped behavior in the admission below.
+
+Use the existing empty product representation in `touched-files.md`:
+`## Candidate manifest`, then `No project files.`, plus required `## Touched files`.
+Do not add workflow targets to the product manifest or invent slices. Define
+retains architecture/plan/tasks/traceability; Vet checks Workflow Artifact
+admission instead of product slice writer/closure checks. No Build/wright dispatch,
+built checkpoint, or ACTIVE switch. Product and mixed product work keep ordinary
+slice contracts; product writers still cannot write `.devrites`.
+
+Readiness at Vet and later checks admission structure, bounds, workspace-relative
+paths, ownership namespace, and referenced behavior/interface/fixtures. Ordinary
+`Readiness inputs SHA-256` binds current tasks and test-plan; editing admission or
+references makes READY stale. Do not embed that digest into its own bound inputs.
+This planning check does not open targets or authorize execution: native preflight
+still validates resolved paths, symlinks, trusted bytes, content limits and all
+transaction safety before mutation.
 
 ## Contents
 
@@ -72,12 +100,14 @@ configuration,performance`; positive `setup,action,expected`; failure
 mutation reject placeholders, missing/extra/reordered fields, duplicates, and
 referenced-empty blocks.
 
-Proof command=one unchanged trusted Vet-approved repository command; exclude `;`,
-`&&`, `||`, newline, unescaped/list-separator `|`. Cwd=`repository-root` or
+Proof command=one unchanged trusted Vet-approved repository command; exclude newline
+and unquoted/unescaped `;|&`. Planning permits quoted/escaped operators;
+substitutions reject all `;|&` data. Cwd=`repository-root` or
 `active-workspace`. Signal=fixed printable ASCII without CR/LF, 1..128 bytes.
 Rollback=`restore-preimage-or-absence`. Evidence=unique comma-separated lowercase
-identifiers. `return_phase`=lifecycle phase; `return_next_action`=exact slash action
-bound to `active_slug`. Malformed admission/reference routes Plan/Vet before mutation.
+identifiers. `return_phase`=lifecycle phase;
+`return_next_action`=`/rite-[a-z0-9-]+ <active_slug>` exactly.
+Malformed admission/reference routes Plan/Vet before mutation.
 
 Checked nonnegative arithmetic rejects overflow. Bounds: rows
 `1..target_count_limit`; per-target/aggregate content; `transaction_file_limit >=

package/pack/.claude/skills/rite-define/SKILL.md

@@ -34,6 +34,13 @@ Pull these via `Read` when shaping the plan:
 - Author one `architecture.md`/`plan.md` section at a time. Before slicing, use
   [`elicitation.md`](../devrites-lib/reference/standards/elicitation.md) Tournament for open
   designs and Delphi for uncertain estimates.
+- **Workflow-only exception.** Follow
+  [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning)
+  before applying product slice rules below: explicit scope, zero product slices,
+  existing empty candidate, AC/REQ → WA behavior/proof mapping in tasks, traceability
+  and test-plan. Keep every AC; never fabricate a slice or dispatch Build for
+  root-owned workflow artifacts. Slice-count, slice-format, writer and cross-slice
+  requirements below apply only when product slices exist.
 - **Derive the slice count from the work.**
   One per independently-shippable increment, sized by [`slicing.md`](../rite-plan/reference/slicing.md); map every acceptance
   criterion. User counts are hints: explain honest differences, never pad/compress.

package/pack/.claude/skills/rite-define/reference/plan-template.md

@@ -40,6 +40,12 @@ State strategy and rationale. For costly/hard-to-reverse boundaries, models, con
 or dependencies compare ≥2 `Option · Drivers · Trade-offs · Consequence`.
 
 ## Slice strategy
+For explicit workflow-only scope, use zero product slices and the existing empty
+candidate manifest (`No project files.` plus `## Touched files`). Map AC/REQ to
+Workflow Artifact behaviors and proof, not invented slices; follow
+[`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning).
+The following slice strategy applies to product work.
+
 List vertical `SLICE-###` increments, AC coverage, and risk-first order within dependency
 tiers. Wide refactors use expand → green migrate batches → contract, or an integration
 branch + final verify slice.

package/pack/.claude/skills/rite-vet/SKILL.md

@@ -138,7 +138,14 @@ plan declares a root-authored executable workflow file, read
    `devrites-engine check preconditions <slug>` (rows with `Run at` `vet`, including each
    `dependency-dry-run` and preserve-baseline row). A failure folds into Plan repair; only an
    owner-owned decision becomes a question, batched under the afk-hitl decision-chain rule.
-4. **Audit readiness.** Goal-backward map every requirement, criterion, NFR,
+4. **Audit readiness.** For explicit workflow-only tasks, follow
+   [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning):
+   check AC/REQ → admitted WA behavior and executable proof, all admission fields,
+   fixtures, bounds and root ownership, not product slice writer/closure checks.
+   Keep empty product candidate and zero built slices; no Build/wright dispatch.
+   Missing/malformed admission routes Plan; stale admission requires fresh Vet and
+   ordinary readiness SHA binding. Never switch ACTIVE for a named workspace.
+   Otherwise goal-backward map every requirement, criterion, NFR,
    interaction, edge/prohibition, and decision row to one slice and executable
    proof. Verify UX/spec/architecture alignment, contracts, dependency order,
    slice independence/wiring, prerequisites, failure/observability/rollback, and
@@ -208,7 +215,7 @@ plan declares a root-authored executable workflow file, read
    `marker sweep:` line is recorded in `eng-review.md`; a kept hit blocks READY. Write phase/next step and emit one
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
-   must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
+   must pass; workflow-only checks admission instead. For product work it replays Build-entry `check slice` on every unbuilt slice, so
    READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
    unbuilt slice's write set closed against the live tree (plan-reviewer
    dimension 6), so frontier gaps fold in one Plan repair, not one per slice; an

package/pack/.claude/skills/rite-vet/reference/artifacts.md

@@ -9,6 +9,13 @@ Authority: `.claude/skills/devrites-lib/reference/standards/acceptance-preservin
 <!-- include:../../devrites-lib/reference/_shared/reslice-vet.md -->
 <!-- END RESLICE ROUTE-TO-ACTION -->
 
+For explicit workflow-only tasks, use
+[`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning):
+AC → admitted WA behavior rows in tasks/test-plan; root-owned admission/proof
+instead of product writer/slice rows. Keep readiness SHA binding, empty product
+candidate and built counts unchanged. No Build dispatch. Product templates below
+remain unchanged for product work.
+
 ## `eng-review.md`: the record
 
 Write/update `.devrites/work/<slug>/eng-review.md`; never clobber.

package/pack/generated/claude/agents/devrites-plan-drafter.md

@@ -23,7 +23,11 @@ seams supplied by the orchestrator.
 Reuse existing seams and dependencies before proposing new ones. Per
 `.claude/skills/devrites-lib/reference/standards/code-navigation.md`, map seams with `get_architecture`, find reuse
 with `search_graph`, and size blast radius with `trace_path` (`direction: "inbound"`). Build vertical
-slices in dependency order; put a hub file's shared edit in one seam slice
+slices in dependency order for product work. For explicit workflow-only scope,
+follow [workflow-artifacts.md](../skills/devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning):
+map every REQ/AC to WA behavior and proof, retain zero product slices and empty
+product candidate, never fabricate slices. Product slice rules below apply only
+to product work; put a hub file's shared edit in one seam slice
 ([slicing.md](../skills/rite-plan/reference/slicing.md#slice-independence)). Map every REQ and AC to a slice and executable proof,
 name rollback and failure paths; keep acceptance-changing proposals separate. Each proof
 row quotes the spec line or standard rule it proves (`Proves`); proof that proves none

package/pack/generated/claude/agents/devrites-plan-reviewer.md

@@ -38,6 +38,13 @@ Per `.claude/skills/devrites-lib/reference/standards/code-navigation.md`, check
 placement with `get_architecture`, reuse with `search_graph`, and blast radius with
 `trace_path` (`direction: "inbound"`); fall back to Read/Grep/Glob.
 
+For explicit workflow-only tasks, also read `test-plan.md` and follow
+[workflow-artifacts.md](../skills/devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning).
+Review REQ/AC → admitted WA behavior/proof, admission completeness and root ownership
+instead of product slice writer/closure checks. Zero product slices and empty
+candidate are valid; do not demand fabricated slices or Build dispatch. Apply
+all seven dimensions to the workflow behaviors and proof.
+
 ## Score the seven dimensions
 For each dimension, **cite the evidence first**, including an absent plan or spec
 line, and then assign the band. Do not choose a score and justify it afterward: