devrites 7.2.3 → 7.2.5

package/engine/internal/lib/handoff.go

@@ -89,6 +89,12 @@ func RunHandoff(root string, args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stdout, "missing_required: %s\n", strings.Join(report.MissingFiles, ", "))
 	}
 	fmt.Fprintf(stdout, "read_next: %s\n", strings.Join(readNext(featureDir), ", "))
+	verdict, err := classifyContinuation(root, slug)
+	if err != nil {
+		fmt.Fprintf(stderr, "handoff: continuation: %v\n", err)
+		return 2
+	}
+	writeContinuation(stdout, verdict)
 	if resume {
 		recordMetric(root, slug, string(report.Phase), "resume", "root", 0)
 	}

package/engine/internal/state/taskgraph.go

@@ -21,10 +21,11 @@ type TaskSlice struct {
 
 // TaskGraphResult is the deterministic outcome of parsing a tasks.md slice graph.
 type TaskGraphResult struct {
-	Slices   []TaskSlice
-	Cycle    []string // empty when acyclic
-	Unknown  []string // dependency ids with no defining slice
-	Problems []string // human-readable blockers
+	WorkflowOnly bool // explicit work scope, never inferred from an empty graph
+	Slices       []TaskSlice
+	Cycle        []string // empty when acyclic
+	Unknown      []string // dependency ids with no defining slice
+	Problems     []string // human-readable blockers
 }
 
 var (
@@ -72,6 +73,20 @@ func ParseTaskGraph(tasksMarkdown []byte) TaskGraphResult {
 	}
 
 	headers := sliceHeaderRE.FindAllStringSubmatchIndex(text, -1)
+	markers := 0
+	for _, line := range strings.Split(strings.ReplaceAll(text, "\r\n", "\n"), "\n") {
+		if line == "Work scope: workflow-only" {
+			markers++
+		}
+	}
+	if markers > 0 {
+		if markers != 1 || len(headers) != 0 {
+			result.Problems = append(result.Problems, "workflow-only scope requires exactly one marker and zero SLICE-### sections")
+			return result
+		}
+		result.WorkflowOnly = true
+		return result
+	}
 	if len(headers) == 0 {
 		result.Problems = append(result.Problems, "no SLICE-### sections found")
 		return result

package/engine/main.go

@@ -41,6 +41,8 @@ Usage:
   devrites-engine check skill-trust <path> Scan one skill/agent Markdown for trust violations
   devrites-engine check regression <slug> [--update]
                                          Compare workspace progress against the recorded baseline; --update ratchets it
+  devrites-engine check continuation [slug]
+                                         AFK + running internal phase edge must be invoked, not replied to
   devrites-engine check drift <slug> [--record]
                                          Attribute readiness-input changes to the exact artifact since the Vet baseline
   devrites-engine check windows <slug> [--worktree|--staged|--base <ref>|--since-dispatch <wave>]
@@ -241,6 +243,8 @@ func cmdCheck(root string, args []string, stdin io.Reader, stdout, stderr io.Wri
 		return lib.RunEnvironmentCheck(root, rest, stdout, stderr)
 	case "regression":
 		return lib.RunCheckRegression(root, rest, stdout, stderr)
+	case "continuation":
+		return lib.RunCheckContinuation(root, rest, stdout, stderr)
 	case "windows":
 		return lib.RunCheckWindows(root, rest, stdout, stderr)
 	case "dup":

package/pack/.claude/agents/devrites-plan-drafter.md

@@ -23,7 +23,11 @@ seams supplied by the orchestrator.
 Reuse existing seams and dependencies before proposing new ones. Per
 `.claude/skills/devrites-lib/reference/standards/code-navigation.md`, map seams with `get_architecture`, find reuse
 with `search_graph`, and size blast radius with `trace_path` (`direction: "inbound"`). Build vertical
-slices in dependency order; put a hub file's shared edit in one seam slice
+slices in dependency order for product work. For explicit workflow-only scope,
+follow [workflow-artifacts.md](../skills/devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning):
+map every REQ/AC to WA behavior and proof, retain zero product slices and empty
+product candidate, never fabricate slices. Product slice rules below apply only
+to product work; put a hub file's shared edit in one seam slice
 ([slicing.md](../skills/rite-plan/reference/slicing.md#slice-independence)). Map every REQ and AC to a slice and executable proof,
 name rollback and failure paths; keep acceptance-changing proposals separate. Each proof
 row quotes the spec line or standard rule it proves (`Proves`); proof that proves none

package/pack/.claude/agents/devrites-plan-reviewer.md

@@ -32,6 +32,13 @@ Per `.claude/skills/devrites-lib/reference/standards/code-navigation.md`, check
 placement with `get_architecture`, reuse with `search_graph`, and blast radius with
 `trace_path` (`direction: "inbound"`); fall back to Read/Grep/Glob.
 
+For explicit workflow-only tasks, also read `test-plan.md` and follow
+[workflow-artifacts.md](../skills/devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning).
+Review REQ/AC → admitted WA behavior/proof, admission completeness and root ownership
+instead of product slice writer/closure checks. Zero product slices and empty
+candidate are valid; do not demand fabricated slices or Build dispatch. Apply
+all seven dimensions to the workflow behaviors and proof.
+
 ## Score the seven dimensions
 For each dimension, **cite the evidence first**, including an absent plan or spec
 line, and then assign the band. Do not choose a score and justify it afterward:

package/pack/.claude/skills/devrites-lib/reference/reply-contract.md

@@ -26,6 +26,9 @@ individually or in one named group, so reviewers can `git diff` those paths.
 
 Active `/rite-autocomplete` consumes green checkpoints/`next_action` internally.
 Continue execution or tool progress; never end with a text-only final reply between green phases.
+Before that reply, `devrites-engine check continuation` must say `continuation: clear`.
+`required` means invoke `invoke:` now; exit 0 is not a pause. **Failing case:**
+`vet stopped` plus `Resume: /rite-vet` while the check says `required`.
 
 Standalone HITL mid-flight replies follow the same economy:
 

package/pack/.claude/skills/devrites-lib/reference/standards/workflow-artifacts.md

@@ -4,9 +4,37 @@
 
 > Applies when: a plan declares root-authored executable workflow files.
 
-Workflow Artifact plans/isolates/proves; never enters product candidate/readiness/
-built count or authorizes consumption. Module owns semantics; callers retain only
-link and entry/return.
+Workflow Artifact plans/isolates/proves; never enters the product candidate or
+built count and never authorizes consumption. Workspace planning readiness binds
+its admission and proof references, not executable bytes as product changes.
+Module owns semantics; callers retain only link and entry/return.
+
+## Workflow-only planning
+
+For exclusively root-owned executable workflow work, put the exact standalone
+line `Work scope: workflow-only` outside fences in `tasks.md`, with zero
+`## SLICE-###` sections. Empty tasks never imply this scope; mixed marker plus
+product slices is invalid. Keep ordinary spec AC IDs. In both `tasks.md` and
+`test-plan.md`, map every AC in two-cell rows `| AC-001 | WA-BEH-ID |` (backticks
+around the behavior ID are optional); `traceability.md` maps REQ/AC → that same
+behavior → proof → evidence. Define may name the planned behaviors before Vet
+admits them; Vet requires every mapped behavior in the admission below.
+
+Use the existing empty product representation in `touched-files.md`:
+`## Candidate manifest`, then `No project files.`, plus required `## Touched files`.
+Do not add workflow targets to the product manifest or invent slices. Define
+retains architecture/plan/tasks/traceability; Vet checks Workflow Artifact
+admission instead of product slice writer/closure checks. No Build/wright dispatch,
+built checkpoint, or ACTIVE switch. Product and mixed product work keep ordinary
+slice contracts; product writers still cannot write `.devrites`.
+
+Readiness at Vet and later checks admission structure, bounds, workspace-relative
+paths, ownership namespace, and referenced behavior/interface/fixtures. Ordinary
+`Readiness inputs SHA-256` binds current tasks and test-plan; editing admission or
+references makes READY stale. Do not embed that digest into its own bound inputs.
+This planning check does not open targets or authorize execution: native preflight
+still validates resolved paths, symlinks, trusted bytes, content limits and all
+transaction safety before mutation.
 
 ## Contents
 
@@ -72,12 +100,14 @@ configuration,performance`; positive `setup,action,expected`; failure
 mutation reject placeholders, missing/extra/reordered fields, duplicates, and
 referenced-empty blocks.
 
-Proof command=one unchanged trusted Vet-approved repository command; exclude `;`,
-`&&`, `||`, newline, unescaped/list-separator `|`. Cwd=`repository-root` or
+Proof command=one unchanged trusted Vet-approved repository command; exclude newline
+and unquoted/unescaped `;|&`. Planning permits quoted/escaped operators;
+substitutions reject all `;|&` data. Cwd=`repository-root` or
 `active-workspace`. Signal=fixed printable ASCII without CR/LF, 1..128 bytes.
 Rollback=`restore-preimage-or-absence`. Evidence=unique comma-separated lowercase
-identifiers. `return_phase`=lifecycle phase; `return_next_action`=exact slash action
-bound to `active_slug`. Malformed admission/reference routes Plan/Vet before mutation.
+identifiers. `return_phase`=lifecycle phase;
+`return_next_action`=`/rite-[a-z0-9-]+ <active_slug>` exactly.
+Malformed admission/reference routes Plan/Vet before mutation.
 
 Checked nonnegative arithmetic rejects overflow. Bounds: rows
 `1..target_count_limit`; per-target/aggregate content; `transaction_file_limit >=

package/pack/.claude/skills/rite-autocomplete/SKILL.md

@@ -153,13 +153,17 @@ pending slices. Each Autocomplete invocation owns internal backtracking. Context
 not create a stop; persist and resume the cursor.
 
 Reply only at final state: text-only turns end the run. Keep
-calling tools after compaction or phase changes. Use one line:
+calling tools after compaction or phase changes. Before any user-visible reply,
+`devrites-engine check continuation` must print `continuation: clear`
+(`handoff` prints the same lines). `required` means invoke `invoke:` now.
+`stopped` is not a phase token. Print this card only after `clear`:
 
 ```text
 Autocomplete: <slug>
-spec <done|stopped> · clarify <clear|stopped> · temper <done|stopped> · define <done|stopped> · vet <ready|stopped> · build <n/N|stopped> · prove <done|stopped> · polish <done|stopped> · review <done|stopped> · seal <GO|NO-GO|stopped>
+spec done · clarify clear · temper done · define done · vet ready · build n/N · prove — · polish — · review — · seal —
 ```
 
-Final state: `Shipped`, `Stopped`, `Awaiting human`, `NO-GO`, or `GO`; no narrative
-recap. Require clean or accepted baseline; land local unpushed checkpoints after
-each green check; never auto-pass red gates.
+Final state, only after `clear`: `Shipped`, `Stopped`, `Awaiting human`,
+`NO-GO`, or `GO`; no narrative recap. Require clean or accepted baseline; land
+local unpushed checkpoints after each green check; never auto-pass red gates.
+**Failing case:** `vet stopped` plus `Resume: /rite-vet` while the check says `required`.

package/pack/.claude/skills/rite-autocomplete/reference/loop.md

@@ -147,6 +147,7 @@ and park it after three escalations while independent work continues.
 
 Green slice/phase checkpoints consume their recorded `next_action` internally;
 only the caller replies finally at completion or a genuine stop.
+Before a reply, `devrites-engine check continuation` must print `continuation: clear`; `required` means invoke `invoke:` now.
 No user-facing reply is permitted while durable state contains agent-owned
 `NEEDS_REPLAN`, an intermediate Plan/Vet action, a distinct retained
 Critical/Important fingerprint below its cap or with an escalation left, runnable

package/pack/.claude/skills/rite-autocomplete/reference/stop-conditions.md

@@ -26,6 +26,8 @@ Fully escalated fingerprints park unless remaining owner is human.
 
 ## Not stops: internal technical routing
 
+AFK + `status=running` + an internal phase `next_action` is not a stop. `devrites-engine check continuation` prints `required` for that cursor and `clear` for `/rite-ship`, `awaiting_human`, a question cursor, or an open blocking or escalating question.
+
 `NEEDS_REPLAN` is not a stop condition under active Autocomplete. It blocks
 forward work, persists the return cursor, and invokes Plan repair plus Recovery
 Vet inline. The same applies to nested `STOP`/`Next step` when its decision is

package/pack/.claude/skills/rite-define/SKILL.md

@@ -34,6 +34,13 @@ Pull these via `Read` when shaping the plan:
 - Author one `architecture.md`/`plan.md` section at a time. Before slicing, use
   [`elicitation.md`](../devrites-lib/reference/standards/elicitation.md) Tournament for open
   designs and Delphi for uncertain estimates.
+- **Workflow-only exception.** Follow
+  [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning)
+  before applying product slice rules below: explicit scope, zero product slices,
+  existing empty candidate, AC/REQ → WA behavior/proof mapping in tasks, traceability
+  and test-plan. Keep every AC; never fabricate a slice or dispatch Build for
+  root-owned workflow artifacts. Slice-count, slice-format, writer and cross-slice
+  requirements below apply only when product slices exist.
 - **Derive the slice count from the work.**
   One per independently-shippable increment, sized by [`slicing.md`](../rite-plan/reference/slicing.md); map every acceptance
   criterion. User counts are hints: explain honest differences, never pad/compress.

package/pack/.claude/skills/rite-define/reference/plan-template.md

@@ -40,6 +40,12 @@ State strategy and rationale. For costly/hard-to-reverse boundaries, models, con
 or dependencies compare ≥2 `Option · Drivers · Trade-offs · Consequence`.
 
 ## Slice strategy
+For explicit workflow-only scope, use zero product slices and the existing empty
+candidate manifest (`No project files.` plus `## Touched files`). Map AC/REQ to
+Workflow Artifact behaviors and proof, not invented slices; follow
+[`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning).
+The following slice strategy applies to product work.
+
 List vertical `SLICE-###` increments, AC coverage, and risk-first order within dependency
 tiers. Wide refactors use expand → green migrate batches → contract, or an integration
 branch + final verify slice.

package/pack/.claude/skills/rite-vet/SKILL.md

@@ -138,7 +138,14 @@ plan declares a root-authored executable workflow file, read
    `devrites-engine check preconditions <slug>` (rows with `Run at` `vet`, including each
    `dependency-dry-run` and preserve-baseline row). A failure folds into Plan repair; only an
    owner-owned decision becomes a question, batched under the afk-hitl decision-chain rule.
-4. **Audit readiness.** Goal-backward map every requirement, criterion, NFR,
+4. **Audit readiness.** For explicit workflow-only tasks, follow
+   [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning):
+   check AC/REQ → admitted WA behavior and executable proof, all admission fields,
+   fixtures, bounds and root ownership, not product slice writer/closure checks.
+   Keep empty product candidate and zero built slices; no Build/wright dispatch.
+   Missing/malformed admission routes Plan; stale admission requires fresh Vet and
+   ordinary readiness SHA binding. Never switch ACTIVE for a named workspace.
+   Otherwise goal-backward map every requirement, criterion, NFR,
    interaction, edge/prohibition, and decision row to one slice and executable
    proof. Verify UX/spec/architecture alignment, contracts, dependency order,
    slice independence/wiring, prerequisites, failure/observability/rollback, and
@@ -208,7 +215,7 @@ plan declares a root-authored executable workflow file, read
    `marker sweep:` line is recorded in `eng-review.md`; a kept hit blocks READY. Write phase/next step and emit one
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
-   must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
+   must pass; workflow-only checks admission instead. For product work it replays Build-entry `check slice` on every unbuilt slice, so
    READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
    unbuilt slice's write set closed against the live tree (plan-reviewer
    dimension 6), so frontier gaps fold in one Plan repair, not one per slice; an

package/pack/.claude/skills/rite-vet/reference/artifacts.md

@@ -9,6 +9,13 @@ Authority: `.claude/skills/devrites-lib/reference/standards/acceptance-preservin
 <!-- include:../../devrites-lib/reference/_shared/reslice-vet.md -->
 <!-- END RESLICE ROUTE-TO-ACTION -->
 
+For explicit workflow-only tasks, use
+[`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning):
+AC → admitted WA behavior rows in tasks/test-plan; root-owned admission/proof
+instead of product writer/slice rows. Keep readiness SHA binding, empty product
+candidate and built counts unchanged. No Build dispatch. Product templates below
+remain unchanged for product work.
+
 ## `eng-review.md`: the record
 
 Write/update `.devrites/work/<slug>/eng-review.md`; never clobber.

package/pack/generated/claude/agents/devrites-plan-drafter.md

@@ -23,7 +23,11 @@ seams supplied by the orchestrator.
 Reuse existing seams and dependencies before proposing new ones. Per
 `.claude/skills/devrites-lib/reference/standards/code-navigation.md`, map seams with `get_architecture`, find reuse
 with `search_graph`, and size blast radius with `trace_path` (`direction: "inbound"`). Build vertical
-slices in dependency order; put a hub file's shared edit in one seam slice
+slices in dependency order for product work. For explicit workflow-only scope,
+follow [workflow-artifacts.md](../skills/devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning):
+map every REQ/AC to WA behavior and proof, retain zero product slices and empty
+product candidate, never fabricate slices. Product slice rules below apply only
+to product work; put a hub file's shared edit in one seam slice
 ([slicing.md](../skills/rite-plan/reference/slicing.md#slice-independence)). Map every REQ and AC to a slice and executable proof,
 name rollback and failure paths; keep acceptance-changing proposals separate. Each proof
 row quotes the spec line or standard rule it proves (`Proves`); proof that proves none

package/pack/generated/claude/agents/devrites-plan-reviewer.md

@@ -38,6 +38,13 @@ Per `.claude/skills/devrites-lib/reference/standards/code-navigation.md`, check
 placement with `get_architecture`, reuse with `search_graph`, and blast radius with
 `trace_path` (`direction: "inbound"`); fall back to Read/Grep/Glob.
 
+For explicit workflow-only tasks, also read `test-plan.md` and follow
+[workflow-artifacts.md](../skills/devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning).
+Review REQ/AC → admitted WA behavior/proof, admission completeness and root ownership
+instead of product slice writer/closure checks. Zero product slices and empty
+candidate are valid; do not demand fabricated slices or Build dispatch. Apply
+all seven dimensions to the workflow behaviors and proof.
+
 ## Score the seven dimensions
 For each dimension, **cite the evidence first**, including an absent plan or spec
 line, and then assign the band. Do not choose a score and justify it afterward:

package/pack/generated/claude/skills/devrites-lib/reference/reply-contract.md

@@ -26,6 +26,9 @@ individually or in one named group, so reviewers can `git diff` those paths.
 
 Active `/rite-autocomplete` consumes green checkpoints/`next_action` internally.
 Continue execution or tool progress; never end with a text-only final reply between green phases.
+Before that reply, `devrites-engine check continuation` must say `continuation: clear`.
+`required` means invoke `invoke:` now; exit 0 is not a pause. **Failing case:**
+`vet stopped` plus `Resume: /rite-vet` while the check says `required`.
 
 Standalone HITL mid-flight replies follow the same economy:
 

package/pack/generated/claude/skills/devrites-lib/reference/standards/workflow-artifacts.md

@@ -4,9 +4,37 @@
 
 > Applies when: a plan declares root-authored executable workflow files.
 
-Workflow Artifact plans/isolates/proves; never enters product candidate/readiness/
-built count or authorizes consumption. Module owns semantics; callers retain only
-link and entry/return.
+Workflow Artifact plans/isolates/proves; never enters the product candidate or
+built count and never authorizes consumption. Workspace planning readiness binds
+its admission and proof references, not executable bytes as product changes.
+Module owns semantics; callers retain only link and entry/return.
+
+## Workflow-only planning
+
+For exclusively root-owned executable workflow work, put the exact standalone
+line `Work scope: workflow-only` outside fences in `tasks.md`, with zero
+`## SLICE-###` sections. Empty tasks never imply this scope; mixed marker plus
+product slices is invalid. Keep ordinary spec AC IDs. In both `tasks.md` and
+`test-plan.md`, map every AC in two-cell rows `| AC-001 | WA-BEH-ID |` (backticks
+around the behavior ID are optional); `traceability.md` maps REQ/AC → that same
+behavior → proof → evidence. Define may name the planned behaviors before Vet
+admits them; Vet requires every mapped behavior in the admission below.
+
+Use the existing empty product representation in `touched-files.md`:
+`## Candidate manifest`, then `No project files.`, plus required `## Touched files`.
+Do not add workflow targets to the product manifest or invent slices. Define
+retains architecture/plan/tasks/traceability; Vet checks Workflow Artifact
+admission instead of product slice writer/closure checks. No Build/wright dispatch,
+built checkpoint, or ACTIVE switch. Product and mixed product work keep ordinary
+slice contracts; product writers still cannot write `.devrites`.
+
+Readiness at Vet and later checks admission structure, bounds, workspace-relative
+paths, ownership namespace, and referenced behavior/interface/fixtures. Ordinary
+`Readiness inputs SHA-256` binds current tasks and test-plan; editing admission or
+references makes READY stale. Do not embed that digest into its own bound inputs.
+This planning check does not open targets or authorize execution: native preflight
+still validates resolved paths, symlinks, trusted bytes, content limits and all
+transaction safety before mutation.
 
 ## Contents
 
@@ -72,12 +100,14 @@ configuration,performance`; positive `setup,action,expected`; failure
 mutation reject placeholders, missing/extra/reordered fields, duplicates, and
 referenced-empty blocks.
 
-Proof command=one unchanged trusted Vet-approved repository command; exclude `;`,
-`&&`, `||`, newline, unescaped/list-separator `|`. Cwd=`repository-root` or
+Proof command=one unchanged trusted Vet-approved repository command; exclude newline
+and unquoted/unescaped `;|&`. Planning permits quoted/escaped operators;
+substitutions reject all `;|&` data. Cwd=`repository-root` or
 `active-workspace`. Signal=fixed printable ASCII without CR/LF, 1..128 bytes.
 Rollback=`restore-preimage-or-absence`. Evidence=unique comma-separated lowercase
-identifiers. `return_phase`=lifecycle phase; `return_next_action`=exact slash action
-bound to `active_slug`. Malformed admission/reference routes Plan/Vet before mutation.
+identifiers. `return_phase`=lifecycle phase;
+`return_next_action`=`/rite-[a-z0-9-]+ <active_slug>` exactly.
+Malformed admission/reference routes Plan/Vet before mutation.
 
 Checked nonnegative arithmetic rejects overflow. Bounds: rows
 `1..target_count_limit`; per-target/aggregate content; `transaction_file_limit >=

package/pack/generated/claude/skills/rite-autocomplete/SKILL.md

@@ -155,13 +155,17 @@ pending slices. Each Autocomplete invocation owns internal backtracking. Context
 not create a stop; persist and resume the cursor.
 
 Reply only at final state: text-only turns end the run. Keep
-calling tools after compaction or phase changes. Use one line:
+calling tools after compaction or phase changes. Before any user-visible reply,
+`devrites-engine check continuation` must print `continuation: clear`
+(`handoff` prints the same lines). `required` means invoke `invoke:` now.
+`stopped` is not a phase token. Print this card only after `clear`:
 
 ```text
 Autocomplete: <slug>
-spec <done|stopped> · clarify <clear|stopped> · temper <done|stopped> · define <done|stopped> · vet <ready|stopped> · build <n/N|stopped> · prove <done|stopped> · polish <done|stopped> · review <done|stopped> · seal <GO|NO-GO|stopped>
+spec done · clarify clear · temper done · define done · vet ready · build n/N · prove — · polish — · review — · seal —
 ```
 
-Final state: `Shipped`, `Stopped`, `Awaiting human`, `NO-GO`, or `GO`; no narrative
-recap. Require clean or accepted baseline; land local unpushed checkpoints after
-each green check; never auto-pass red gates.
+Final state, only after `clear`: `Shipped`, `Stopped`, `Awaiting human`,
+`NO-GO`, or `GO`; no narrative recap. Require clean or accepted baseline; land
+local unpushed checkpoints after each green check; never auto-pass red gates.
+**Failing case:** `vet stopped` plus `Resume: /rite-vet` while the check says `required`.

package/pack/generated/claude/skills/rite-autocomplete/reference/loop.md

@@ -149,6 +149,7 @@ and park it after three escalations while independent work continues.
 
 Green slice/phase checkpoints consume their recorded `next_action` internally;
 only the caller replies finally at completion or a genuine stop.
+Before a reply, `devrites-engine check continuation` must print `continuation: clear`; `required` means invoke `invoke:` now.
 No user-facing reply is permitted while durable state contains agent-owned
 `NEEDS_REPLAN`, an intermediate Plan/Vet action, a distinct retained
 Critical/Important fingerprint below its cap or with an escalation left, runnable

package/pack/generated/claude/skills/rite-autocomplete/reference/stop-conditions.md

@@ -28,6 +28,8 @@ Fully escalated fingerprints park unless remaining owner is human.
 
 ## Not stops: internal technical routing
 
+AFK + `status=running` + an internal phase `next_action` is not a stop. `devrites-engine check continuation` prints `required` for that cursor and `clear` for `/rite-ship`, `awaiting_human`, a question cursor, or an open blocking or escalating question.
+
 `NEEDS_REPLAN` is not a stop condition under active Autocomplete. It blocks
 forward work, persists the return cursor, and invokes Plan repair plus Recovery
 Vet inline. The same applies to nested `STOP`/`Next step` when its decision is

package/pack/generated/claude/skills/rite-define/SKILL.md

@@ -34,6 +34,13 @@ Pull these via `Read` when shaping the plan:
 - Author one `architecture.md`/`plan.md` section at a time. Before slicing, use
   [`elicitation.md`](../devrites-lib/reference/standards/elicitation.md) Tournament for open
   designs and Delphi for uncertain estimates.
+- **Workflow-only exception.** Follow
+  [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning)
+  before applying product slice rules below: explicit scope, zero product slices,
+  existing empty candidate, AC/REQ → WA behavior/proof mapping in tasks, traceability
+  and test-plan. Keep every AC; never fabricate a slice or dispatch Build for
+  root-owned workflow artifacts. Slice-count, slice-format, writer and cross-slice
+  requirements below apply only when product slices exist.
 - **Derive the slice count from the work.**
   One per independently-shippable increment, sized by [`slicing.md`](../rite-plan/reference/slicing.md); map every acceptance
   criterion. User counts are hints: explain honest differences, never pad/compress.

package/pack/generated/claude/skills/rite-define/reference/plan-template.md

@@ -40,6 +40,12 @@ State strategy and rationale. For costly/hard-to-reverse boundaries, models, con
 or dependencies compare ≥2 `Option · Drivers · Trade-offs · Consequence`.
 
 ## Slice strategy
+For explicit workflow-only scope, use zero product slices and the existing empty
+candidate manifest (`No project files.` plus `## Touched files`). Map AC/REQ to
+Workflow Artifact behaviors and proof, not invented slices; follow
+[`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning).
+The following slice strategy applies to product work.
+
 List vertical `SLICE-###` increments, AC coverage, and risk-first order within dependency
 tiers. Wide refactors use expand → green migrate batches → contract, or an integration
 branch + final verify slice.

package/pack/generated/claude/skills/rite-vet/SKILL.md

@@ -140,7 +140,14 @@ plan declares a root-authored executable workflow file, read
    `devrites-engine check preconditions <slug>` (rows with `Run at` `vet`, including each
    `dependency-dry-run` and preserve-baseline row). A failure folds into Plan repair; only an
    owner-owned decision becomes a question, batched under the afk-hitl decision-chain rule.
-4. **Audit readiness.** Goal-backward map every requirement, criterion, NFR,
+4. **Audit readiness.** For explicit workflow-only tasks, follow
+   [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning):
+   check AC/REQ → admitted WA behavior and executable proof, all admission fields,
+   fixtures, bounds and root ownership, not product slice writer/closure checks.
+   Keep empty product candidate and zero built slices; no Build/wright dispatch.
+   Missing/malformed admission routes Plan; stale admission requires fresh Vet and
+   ordinary readiness SHA binding. Never switch ACTIVE for a named workspace.
+   Otherwise goal-backward map every requirement, criterion, NFR,
    interaction, edge/prohibition, and decision row to one slice and executable
    proof. Verify UX/spec/architecture alignment, contracts, dependency order,
    slice independence/wiring, prerequisites, failure/observability/rollback, and
@@ -210,7 +217,7 @@ plan declares a root-authored executable workflow file, read
    `marker sweep:` line is recorded in `eng-review.md`; a kept hit blocks READY. Write phase/next step and emit one
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
-   must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
+   must pass; workflow-only checks admission instead. For product work it replays Build-entry `check slice` on every unbuilt slice, so
    READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
    unbuilt slice's write set closed against the live tree (plan-reviewer
    dimension 6), so frontier gaps fold in one Plan repair, not one per slice; an

package/pack/generated/claude/skills/rite-vet/reference/artifacts.md

@@ -11,6 +11,13 @@ Authority: `.claude/skills/devrites-lib/reference/standards/acceptance-preservin
 - `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
 <!-- END RESLICE ROUTE-TO-ACTION -->
 
+For explicit workflow-only tasks, use
+[`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning):
+AC → admitted WA behavior rows in tasks/test-plan; root-owned admission/proof
+instead of product writer/slice rows. Keep readiness SHA binding, empty product
+candidate and built counts unchanged. No Build dispatch. Product templates below
+remain unchanged for product work.
+
 ## `eng-review.md`: the record
 
 Write/update `.devrites/work/<slug>/eng-review.md`; never clobber.

package/pack/generated/codex/agents/devrites-plan-drafter.toml

@@ -21,7 +21,11 @@ seams supplied by the orchestrator.
 Reuse existing seams and dependencies before proposing new ones. Per
 `.agents/skills/devrites-lib/reference/standards/code-navigation.md`, map seams with `get_architecture`, find reuse
 with `search_graph`, and size blast radius with `trace_path` (`direction: "inbound"`). Build vertical
-slices in dependency order; put a hub file's shared edit in one seam slice
+slices in dependency order for product work. For explicit workflow-only scope,
+follow [workflow-artifacts.md](.agents/skills/devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning):
+map every REQ/AC to WA behavior and proof, retain zero product slices and empty
+product candidate, never fabricate slices. Product slice rules below apply only
+to product work; put a hub file's shared edit in one seam slice
 ([slicing.md](.agents/skills/rite-plan/reference/slicing.md#slice-independence)). Map every REQ and AC to a slice and executable proof,
 name rollback and failure paths; keep acceptance-changing proposals separate. Each proof
 row quotes the spec line or standard rule it proves (`Proves`); proof that proves none

package/pack/generated/codex/agents/devrites-plan-reviewer.toml

@@ -36,6 +36,13 @@ Per `.agents/skills/devrites-lib/reference/standards/code-navigation.md`, check
 placement with `get_architecture`, reuse with `search_graph`, and blast radius with
 `trace_path` (`direction: "inbound"`); fall back to Read/Grep/Glob.
 
+For explicit workflow-only tasks, also read `test-plan.md` and follow
+[workflow-artifacts.md](.agents/skills/devrites-lib/reference/standards/workflow-artifacts.md#workflow-only-planning).
+Review REQ/AC → admitted WA behavior/proof, admission completeness and root ownership
+instead of product slice writer/closure checks. Zero product slices and empty
+candidate are valid; do not demand fabricated slices or Build dispatch. Apply
+all seven dimensions to the workflow behaviors and proof.
+
 ## Score the seven dimensions
 For each dimension, **cite the evidence first**, including an absent plan or spec
 line, and then assign the band. Do not choose a score and justify it afterward:

package/pack/generated/codex/skills/devrites-lib/reference/reply-contract.md

@@ -26,6 +26,9 @@ individually or in one named group, so reviewers can `git diff` those paths.
 
 Active `$rite-autocomplete` consumes green checkpoints/`next_action` internally.
 Continue execution or tool progress; never end with a text-only final reply between green phases.
+Before that reply, `devrites-engine check continuation` must say `continuation: clear`.
+`required` means invoke `invoke:` now; exit 0 is not a pause. **Failing case:**
+`vet stopped` plus `Resume: $rite-vet` while the check says `required`.
 
 Standalone HITL mid-flight replies follow the same economy:
 

package/pack/generated/codex/skills/devrites-lib/reference/standards/workflow-artifacts.md

@@ -4,9 +4,37 @@
 
 > Applies when: a plan declares root-authored executable workflow files.
 
-Workflow Artifact plans/isolates/proves; never enters product candidate/readiness/
-built count or authorizes consumption. Module owns semantics; callers retain only
-link and entry/return.
+Workflow Artifact plans/isolates/proves; never enters the product candidate or
+built count and never authorizes consumption. Workspace planning readiness binds
+its admission and proof references, not executable bytes as product changes.
+Module owns semantics; callers retain only link and entry/return.
+
+## Workflow-only planning
+
+For exclusively root-owned executable workflow work, put the exact standalone
+line `Work scope: workflow-only` outside fences in `tasks.md`, with zero
+`## SLICE-###` sections. Empty tasks never imply this scope; mixed marker plus
+product slices is invalid. Keep ordinary spec AC IDs. In both `tasks.md` and
+`test-plan.md`, map every AC in two-cell rows `| AC-001 | WA-BEH-ID |` (backticks
+around the behavior ID are optional); `traceability.md` maps REQ/AC → that same
+behavior → proof → evidence. Define may name the planned behaviors before Vet
+admits them; Vet requires every mapped behavior in the admission below.
+
+Use the existing empty product representation in `touched-files.md`:
+`## Candidate manifest`, then `No project files.`, plus required `## Touched files`.
+Do not add workflow targets to the product manifest or invent slices. Define
+retains architecture/plan/tasks/traceability; Vet checks Workflow Artifact
+admission instead of product slice writer/closure checks. No Build/wright dispatch,
+built checkpoint, or ACTIVE switch. Product and mixed product work keep ordinary
+slice contracts; product writers still cannot write `.devrites`.
+
+Readiness at Vet and later checks admission structure, bounds, workspace-relative
+paths, ownership namespace, and referenced behavior/interface/fixtures. Ordinary
+`Readiness inputs SHA-256` binds current tasks and test-plan; editing admission or
+references makes READY stale. Do not embed that digest into its own bound inputs.
+This planning check does not open targets or authorize execution: native preflight
+still validates resolved paths, symlinks, trusted bytes, content limits and all
+transaction safety before mutation.
 
 ## Contents
 
@@ -72,12 +100,14 @@ configuration,performance`; positive `setup,action,expected`; failure
 mutation reject placeholders, missing/extra/reordered fields, duplicates, and
 referenced-empty blocks.
 
-Proof command=one unchanged trusted Vet-approved repository command; exclude `;`,
-`&&`, `||`, newline, unescaped/list-separator `|`. Cwd=`repository-root` or
+Proof command=one unchanged trusted Vet-approved repository command; exclude newline
+and unquoted/unescaped `;|&`. Planning permits quoted/escaped operators;
+substitutions reject all `;|&` data. Cwd=`repository-root` or
 `active-workspace`. Signal=fixed printable ASCII without CR/LF, 1..128 bytes.
 Rollback=`restore-preimage-or-absence`. Evidence=unique comma-separated lowercase
-identifiers. `return_phase`=lifecycle phase; `return_next_action`=exact slash action
-bound to `active_slug`. Malformed admission/reference routes Plan/Vet before mutation.
+identifiers. `return_phase`=lifecycle phase;
+`return_next_action`=`/rite-[a-z0-9-]+ <active_slug>` exactly.
+Malformed admission/reference routes Plan/Vet before mutation.
 
 Checked nonnegative arithmetic rejects overflow. Bounds: rows
 `1..target_count_limit`; per-target/aggregate content; `transaction_file_limit >=