devrites 7.2.3 → 7.2.4

package/pack/generated/dsh/skills/rite-vet/SKILL.md

@@ -140,7 +140,14 @@ plan declares a root-authored executable workflow file, read
    `devrites-engine check preconditions <slug>` (rows with `Run at` `vet`, including each
    `dependency-dry-run` and preserve-baseline row). A failure folds into Plan repair; only an
    owner-owned decision becomes a question, batched under the afk-hitl decision-chain rule.
-4. **Audit readiness.** Goal-backward map every requirement, criterion, NFR,
+4. **Audit readiness.** For explicit workflow-only tasks, follow
+   [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning):
+   check AC/REQ → admitted WA behavior and executable proof, all admission fields,
+   fixtures, bounds and root ownership, not product slice writer/closure checks.
+   Keep empty product candidate and zero built slices; no Build/wright dispatch.
+   Missing/malformed admission routes Plan; stale admission requires fresh Vet and
+   ordinary readiness SHA binding. Never switch ACTIVE for a named workspace.
+   Otherwise goal-backward map every requirement, criterion, NFR,
    interaction, edge/prohibition, and decision row to one slice and executable
    proof. Verify UX/spec/architecture alignment, contracts, dependency order,
    slice independence/wiring, prerequisites, failure/observability/rollback, and
@@ -210,7 +217,7 @@ plan declares a root-authored executable workflow file, read
    `marker sweep:` line is recorded in `eng-review.md`; a kept hit blocks READY. Write phase/next step and emit one
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
-   must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
+   must pass; workflow-only checks admission instead. For product work it replays Build-entry `check slice` on every unbuilt slice, so
    READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
    unbuilt slice's write set closed against the live tree (plan-reviewer
    dimension 6), so frontier gaps fold in one Plan repair, not one per slice; an

package/pack/generated/dsh/skills/rite-vet/reference/artifacts.md

@@ -11,6 +11,13 @@ Authority: `.dsh/skills/devrites-lib/reference/standards/acceptance-preserving-r
 - `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
 <!-- END RESLICE ROUTE-TO-ACTION -->
 
+For explicit workflow-only tasks, use
+[`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning):
+AC → admitted WA behavior rows in tasks/test-plan; root-owned admission/proof
+instead of product writer/slice rows. Keep readiness SHA binding, empty product
+candidate and built counts unchanged. No Build dispatch. Product templates below
+remain unchanged for product work.
+
 ## `eng-review.md`: the record
 
 Write/update `.devrites/work/<slug>/eng-review.md`; never clobber.

package/pack/generated/omp/agents/devrites-plan-drafter.md

@@ -22,7 +22,11 @@ seams supplied by the orchestrator.
 Reuse existing seams and dependencies before proposing new ones. Per
 `.omp/skills/devrites-lib/reference/standards/code-navigation.md`, map seams with `get_architecture`, find reuse
 with `search_graph`, and size blast radius with `trace_path` (`direction: "inbound"`). Build vertical
-slices in dependency order; put a hub file's shared edit in one seam slice
+slices in dependency order for product work. For explicit workflow-only scope,
+follow [workflow-artifacts.md](skill://devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning):
+map every REQ/AC to WA behavior and proof, retain zero product slices and empty
+product candidate, never fabricate slices. Product slice rules below apply only
+to product work; put a hub file's shared edit in one seam slice
 ([slicing.md](skill://rite-plan/reference/slicing.md#slice-independence)). Map every REQ and AC to a slice and executable proof,
 name rollback and failure paths; keep acceptance-changing proposals separate. Each proof
 row quotes the spec line or standard rule it proves (`Proves`); proof that proves none

package/pack/generated/omp/agents/devrites-plan-reviewer.md

@@ -37,6 +37,13 @@ Per `.omp/skills/devrites-lib/reference/standards/code-navigation.md`, check
 placement with `get_architecture`, reuse with `search_graph`, and blast radius with
 `trace_path` (`direction: "inbound"`); fall back to Read/Grep/Glob.
 
+For explicit workflow-only tasks, also read `test-plan.md` and follow
+[workflow-artifacts.md](skill://devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning).
+Review REQ/AC → admitted WA behavior/proof, admission completeness and root ownership
+instead of product slice writer/closure checks. Zero product slices and empty
+candidate are valid; do not demand fabricated slices or Build dispatch. Apply
+all seven dimensions to the workflow behaviors and proof.
+
 ## Score the seven dimensions
 For each dimension, **cite the evidence first**, including an absent plan or spec
 line, and then assign the band. Do not choose a score and justify it afterward:

package/pack/generated/omp/skills/devrites-lib/reference/standards/workflow-artifacts.md

@@ -4,9 +4,37 @@
 
 > Applies when: a plan declares root-authored executable workflow files.
 
-Workflow Artifact plans/isolates/proves; never enters product candidate/readiness/
-built count or authorizes consumption. Module owns semantics; callers retain only
-link and entry/return.
+Workflow Artifact plans/isolates/proves; never enters the product candidate or
+built count and never authorizes consumption. Workspace planning readiness binds
+its admission and proof references, not executable bytes as product changes.
+Module owns semantics; callers retain only link and entry/return.
+
+## Workflow-only planning
+
+For exclusively root-owned executable workflow work, put the exact standalone
+line `Work scope: workflow-only` outside fences in `tasks.md`, with zero
+`## SLICE-###` sections. Empty tasks never imply this scope; mixed marker plus
+product slices is invalid. Keep ordinary spec AC IDs. In both `tasks.md` and
+`test-plan.md`, map every AC in two-cell rows `| AC-001 | WA-BEH-ID |` (backticks
+around the behavior ID are optional); `traceability.md` maps REQ/AC → that same
+behavior → proof → evidence. Define may name the planned behaviors before Vet
+admits them; Vet requires every mapped behavior in the admission below.
+
+Use the existing empty product representation in `touched-files.md`:
+`## Candidate manifest`, then `No project files.`, plus required `## Touched files`.
+Do not add workflow targets to the product manifest or invent slices. Define
+retains architecture/plan/tasks/traceability; Vet checks Workflow Artifact
+admission instead of product slice writer/closure checks. No Build/wright dispatch,
+built checkpoint, or ACTIVE switch. Product and mixed product work keep ordinary
+slice contracts; product writers still cannot write `.devrites`.
+
+Readiness at Vet and later checks admission structure, bounds, workspace-relative
+paths, ownership namespace, and referenced behavior/interface/fixtures. Ordinary
+`Readiness inputs SHA-256` binds current tasks and test-plan; editing admission or
+references makes READY stale. Do not embed that digest into its own bound inputs.
+This planning check does not open targets or authorize execution: native preflight
+still validates resolved paths, symlinks, trusted bytes, content limits and all
+transaction safety before mutation.
 
 ## Contents
 
@@ -72,12 +100,14 @@ configuration,performance`; positive `setup,action,expected`; failure
 mutation reject placeholders, missing/extra/reordered fields, duplicates, and
 referenced-empty blocks.
 
-Proof command=one unchanged trusted Vet-approved repository command; exclude `;`,
-`&&`, `||`, newline, unescaped/list-separator `|`. Cwd=`repository-root` or
+Proof command=one unchanged trusted Vet-approved repository command; exclude newline
+and unquoted/unescaped `;|&`. Planning permits quoted/escaped operators;
+substitutions reject all `;|&` data. Cwd=`repository-root` or
 `active-workspace`. Signal=fixed printable ASCII without CR/LF, 1..128 bytes.
 Rollback=`restore-preimage-or-absence`. Evidence=unique comma-separated lowercase
-identifiers. `return_phase`=lifecycle phase; `return_next_action`=exact slash action
-bound to `active_slug`. Malformed admission/reference routes Plan/Vet before mutation.
+identifiers. `return_phase`=lifecycle phase;
+`return_next_action`=`/rite-[a-z0-9-]+ <active_slug>` exactly.
+Malformed admission/reference routes Plan/Vet before mutation.
 
 Checked nonnegative arithmetic rejects overflow. Bounds: rows
 `1..target_count_limit`; per-target/aggregate content; `transaction_file_limit >=

package/pack/generated/omp/skills/rite-define/SKILL.md

@@ -34,6 +34,13 @@ Pull these via `Read` when shaping the plan:
 - Author one `architecture.md`/`plan.md` section at a time. Before slicing, use
   [`elicitation.md`](skill://devrites-lib/reference/standards/elicitation.md) Tournament for open
   designs and Delphi for uncertain estimates.
+- **Workflow-only exception.** Follow
+  [`workflow-artifacts.md`](skill://devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning)
+  before applying product slice rules below: explicit scope, zero product slices,
+  existing empty candidate, AC/REQ → WA behavior/proof mapping in tasks, traceability
+  and test-plan. Keep every AC; never fabricate a slice or dispatch Build for
+  root-owned workflow artifacts. Slice-count, slice-format, writer and cross-slice
+  requirements below apply only when product slices exist.
 - **Derive the slice count from the work.**
   One per independently-shippable increment, sized by [`slicing.md`](skill://rite-plan/reference/slicing.md); map every acceptance
   criterion. User counts are hints: explain honest differences, never pad/compress.

package/pack/generated/omp/skills/rite-define/reference/plan-template.md

@@ -40,6 +40,12 @@ State strategy and rationale. For costly/hard-to-reverse boundaries, models, con
 or dependencies compare ≥2 `Option · Drivers · Trade-offs · Consequence`.
 
 ## Slice strategy
+For explicit workflow-only scope, use zero product slices and the existing empty
+candidate manifest (`No project files.` plus `## Touched files`). Map AC/REQ to
+Workflow Artifact behaviors and proof, not invented slices; follow
+[`workflow-artifacts.md`](skill://devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning).
+The following slice strategy applies to product work.
+
 List vertical `SLICE-###` increments, AC coverage, and risk-first order within dependency
 tiers. Wide refactors use expand → green migrate batches → contract, or an integration
 branch + final verify slice.

package/pack/generated/omp/skills/rite-vet/SKILL.md

@@ -140,7 +140,14 @@ plan declares a root-authored executable workflow file, read
    `devrites-engine check preconditions <slug>` (rows with `Run at` `vet`, including each
    `dependency-dry-run` and preserve-baseline row). A failure folds into Plan repair; only an
    owner-owned decision becomes a question, batched under the afk-hitl decision-chain rule.
-4. **Audit readiness.** Goal-backward map every requirement, criterion, NFR,
+4. **Audit readiness.** For explicit workflow-only tasks, follow
+   [`workflow-artifacts.md`](skill://devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning):
+   check AC/REQ → admitted WA behavior and executable proof, all admission fields,
+   fixtures, bounds and root ownership, not product slice writer/closure checks.
+   Keep empty product candidate and zero built slices; no Build/wright dispatch.
+   Missing/malformed admission routes Plan; stale admission requires fresh Vet and
+   ordinary readiness SHA binding. Never switch ACTIVE for a named workspace.
+   Otherwise goal-backward map every requirement, criterion, NFR,
    interaction, edge/prohibition, and decision row to one slice and executable
    proof. Verify UX/spec/architecture alignment, contracts, dependency order,
    slice independence/wiring, prerequisites, failure/observability/rollback, and
@@ -210,7 +217,7 @@ plan declares a root-authored executable workflow file, read
    `marker sweep:` line is recorded in `eng-review.md`; a kept hit blocks READY. Write phase/next step and emit one
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
-   must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
+   must pass; workflow-only checks admission instead. For product work it replays Build-entry `check slice` on every unbuilt slice, so
    READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
    unbuilt slice's write set closed against the live tree (plan-reviewer
    dimension 6), so frontier gaps fold in one Plan repair, not one per slice; an

package/pack/generated/omp/skills/rite-vet/reference/artifacts.md

@@ -11,6 +11,13 @@ Authority: `.omp/skills/devrites-lib/reference/standards/acceptance-preserving-r
 - `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
 <!-- END RESLICE ROUTE-TO-ACTION -->
 
+For explicit workflow-only tasks, use
+[`workflow-artifacts.md`](skill://devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning):
+AC → admitted WA behavior rows in tasks/test-plan; root-owned admission/proof
+instead of product writer/slice rows. Keep readiness SHA binding, empty product
+candidate and built counts unchanged. No Build dispatch. Product templates below
+remain unchanged for product work.
+
 ## `eng-review.md`: the record
 
 Write/update `.devrites/work/<slug>/eng-review.md`; never clobber.

package/pack/generated/pi/agents/devrites-plan-drafter.md

@@ -23,7 +23,11 @@ seams supplied by the orchestrator.
 Reuse existing seams and dependencies before proposing new ones. Per
 `.pi/skills/devrites-lib/reference/standards/code-navigation.md`, map seams with `get_architecture`, find reuse
 with `search_graph`, and size blast radius with `trace_path` (`direction: "inbound"`). Build vertical
-slices in dependency order; put a hub file's shared edit in one seam slice
+slices in dependency order for product work. For explicit workflow-only scope,
+follow [workflow-artifacts.md](../skills/devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning):
+map every REQ/AC to WA behavior and proof, retain zero product slices and empty
+product candidate, never fabricate slices. Product slice rules below apply only
+to product work; put a hub file's shared edit in one seam slice
 ([slicing.md](../skills/rite-plan/reference/slicing.md#slice-independence)). Map every REQ and AC to a slice and executable proof,
 name rollback and failure paths; keep acceptance-changing proposals separate. Each proof
 row quotes the spec line or standard rule it proves (`Proves`); proof that proves none

package/pack/generated/pi/agents/devrites-plan-reviewer.md

@@ -38,6 +38,13 @@ Per `.pi/skills/devrites-lib/reference/standards/code-navigation.md`, check
 placement with `get_architecture`, reuse with `search_graph`, and blast radius with
 `trace_path` (`direction: "inbound"`); fall back to Read/Grep/Glob.
 
+For explicit workflow-only tasks, also read `test-plan.md` and follow
+[workflow-artifacts.md](../skills/devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning).
+Review REQ/AC → admitted WA behavior/proof, admission completeness and root ownership
+instead of product slice writer/closure checks. Zero product slices and empty
+candidate are valid; do not demand fabricated slices or Build dispatch. Apply
+all seven dimensions to the workflow behaviors and proof.
+
 ## Score the seven dimensions
 For each dimension, **cite the evidence first**, including an absent plan or spec
 line, and then assign the band. Do not choose a score and justify it afterward:

package/pack/generated/pi/skills/devrites-lib/reference/standards/workflow-artifacts.md

@@ -4,9 +4,37 @@
 
 > Applies when: a plan declares root-authored executable workflow files.
 
-Workflow Artifact plans/isolates/proves; never enters product candidate/readiness/
-built count or authorizes consumption. Module owns semantics; callers retain only
-link and entry/return.
+Workflow Artifact plans/isolates/proves; never enters the product candidate or
+built count and never authorizes consumption. Workspace planning readiness binds
+its admission and proof references, not executable bytes as product changes.
+Module owns semantics; callers retain only link and entry/return.
+
+## Workflow-only planning
+
+For exclusively root-owned executable workflow work, put the exact standalone
+line `Work scope: workflow-only` outside fences in `tasks.md`, with zero
+`## SLICE-###` sections. Empty tasks never imply this scope; mixed marker plus
+product slices is invalid. Keep ordinary spec AC IDs. In both `tasks.md` and
+`test-plan.md`, map every AC in two-cell rows `| AC-001 | WA-BEH-ID |` (backticks
+around the behavior ID are optional); `traceability.md` maps REQ/AC → that same
+behavior → proof → evidence. Define may name the planned behaviors before Vet
+admits them; Vet requires every mapped behavior in the admission below.
+
+Use the existing empty product representation in `touched-files.md`:
+`## Candidate manifest`, then `No project files.`, plus required `## Touched files`.
+Do not add workflow targets to the product manifest or invent slices. Define
+retains architecture/plan/tasks/traceability; Vet checks Workflow Artifact
+admission instead of product slice writer/closure checks. No Build/wright dispatch,
+built checkpoint, or ACTIVE switch. Product and mixed product work keep ordinary
+slice contracts; product writers still cannot write `.devrites`.
+
+Readiness at Vet and later checks admission structure, bounds, workspace-relative
+paths, ownership namespace, and referenced behavior/interface/fixtures. Ordinary
+`Readiness inputs SHA-256` binds current tasks and test-plan; editing admission or
+references makes READY stale. Do not embed that digest into its own bound inputs.
+This planning check does not open targets or authorize execution: native preflight
+still validates resolved paths, symlinks, trusted bytes, content limits and all
+transaction safety before mutation.
 
 ## Contents
 
@@ -72,12 +100,14 @@ configuration,performance`; positive `setup,action,expected`; failure
 mutation reject placeholders, missing/extra/reordered fields, duplicates, and
 referenced-empty blocks.
 
-Proof command=one unchanged trusted Vet-approved repository command; exclude `;`,
-`&&`, `||`, newline, unescaped/list-separator `|`. Cwd=`repository-root` or
+Proof command=one unchanged trusted Vet-approved repository command; exclude newline
+and unquoted/unescaped `;|&`. Planning permits quoted/escaped operators;
+substitutions reject all `;|&` data. Cwd=`repository-root` or
 `active-workspace`. Signal=fixed printable ASCII without CR/LF, 1..128 bytes.
 Rollback=`restore-preimage-or-absence`. Evidence=unique comma-separated lowercase
-identifiers. `return_phase`=lifecycle phase; `return_next_action`=exact slash action
-bound to `active_slug`. Malformed admission/reference routes Plan/Vet before mutation.
+identifiers. `return_phase`=lifecycle phase;
+`return_next_action`=`/rite-[a-z0-9-]+ <active_slug>` exactly.
+Malformed admission/reference routes Plan/Vet before mutation.
 
 Checked nonnegative arithmetic rejects overflow. Bounds: rows
 `1..target_count_limit`; per-target/aggregate content; `transaction_file_limit >=

package/pack/generated/pi/skills/rite-define/SKILL.md

@@ -34,6 +34,13 @@ Pull these via `Read` when shaping the plan:
 - Author one `architecture.md`/`plan.md` section at a time. Before slicing, use
   [`elicitation.md`](../devrites-lib/reference/standards/elicitation.md) Tournament for open
   designs and Delphi for uncertain estimates.
+- **Workflow-only exception.** Follow
+  [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning)
+  before applying product slice rules below: explicit scope, zero product slices,
+  existing empty candidate, AC/REQ → WA behavior/proof mapping in tasks, traceability
+  and test-plan. Keep every AC; never fabricate a slice or dispatch Build for
+  root-owned workflow artifacts. Slice-count, slice-format, writer and cross-slice
+  requirements below apply only when product slices exist.
 - **Derive the slice count from the work.**
   One per independently-shippable increment, sized by [`slicing.md`](../rite-plan/reference/slicing.md); map every acceptance
   criterion. User counts are hints: explain honest differences, never pad/compress.

package/pack/generated/pi/skills/rite-define/reference/plan-template.md

@@ -40,6 +40,12 @@ State strategy and rationale. For costly/hard-to-reverse boundaries, models, con
 or dependencies compare ≥2 `Option · Drivers · Trade-offs · Consequence`.
 
 ## Slice strategy
+For explicit workflow-only scope, use zero product slices and the existing empty
+candidate manifest (`No project files.` plus `## Touched files`). Map AC/REQ to
+Workflow Artifact behaviors and proof, not invented slices; follow
+[`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning).
+The following slice strategy applies to product work.
+
 List vertical `SLICE-###` increments, AC coverage, and risk-first order within dependency
 tiers. Wide refactors use expand → green migrate batches → contract, or an integration
 branch + final verify slice.

package/pack/generated/pi/skills/rite-vet/SKILL.md

@@ -140,7 +140,14 @@ plan declares a root-authored executable workflow file, read
    `devrites-engine check preconditions <slug>` (rows with `Run at` `vet`, including each
    `dependency-dry-run` and preserve-baseline row). A failure folds into Plan repair; only an
    owner-owned decision becomes a question, batched under the afk-hitl decision-chain rule.
-4. **Audit readiness.** Goal-backward map every requirement, criterion, NFR,
+4. **Audit readiness.** For explicit workflow-only tasks, follow
+   [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning):
+   check AC/REQ → admitted WA behavior and executable proof, all admission fields,
+   fixtures, bounds and root ownership, not product slice writer/closure checks.
+   Keep empty product candidate and zero built slices; no Build/wright dispatch.
+   Missing/malformed admission routes Plan; stale admission requires fresh Vet and
+   ordinary readiness SHA binding. Never switch ACTIVE for a named workspace.
+   Otherwise goal-backward map every requirement, criterion, NFR,
    interaction, edge/prohibition, and decision row to one slice and executable
    proof. Verify UX/spec/architecture alignment, contracts, dependency order,
    slice independence/wiring, prerequisites, failure/observability/rollback, and
@@ -210,7 +217,7 @@ plan declares a root-authored executable workflow file, read
    `marker sweep:` line is recorded in `eng-review.md`; a kept hit blocks READY. Write phase/next step and emit one
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
-   must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
+   must pass; workflow-only checks admission instead. For product work it replays Build-entry `check slice` on every unbuilt slice, so
    READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
    unbuilt slice's write set closed against the live tree (plan-reviewer
    dimension 6), so frontier gaps fold in one Plan repair, not one per slice; an

package/pack/generated/pi/skills/rite-vet/reference/artifacts.md

@@ -11,6 +11,13 @@ Authority: `.pi/skills/devrites-lib/reference/standards/acceptance-preserving-re
 - `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
 <!-- END RESLICE ROUTE-TO-ACTION -->
 
+For explicit workflow-only tasks, use
+[`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning):
+AC → admitted WA behavior rows in tasks/test-plan; root-owned admission/proof
+instead of product writer/slice rows. Keep readiness SHA binding, empty product
+candidate and built counts unchanged. No Build dispatch. Product templates below
+remain unchanged for product work.
+
 ## `eng-review.md`: the record
 
 Write/update `.devrites/work/<slug>/eng-review.md`; never clobber.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "7.2.3",
+  "version": "7.2.4",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, pi, and Devin CLI",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",