devrites 7.2.7 → 7.2.8

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.2.8](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.7...v7.2.8) (2026-10-31)
+
+### Fixed
+
+* **no-release:** close installer evidence and recovery integrity gaps ([#200](https://github.com/ViktorsBaikers/DevRites/issues/200)) ([edb8754](https://github.com/ViktorsBaikers/DevRites/commit/edb8754ecf80d4a0dd83590c5b346787c3647244))
+* **no-release:** select exact OMP specialists and preserve reviewer roles ([#199](https://github.com/ViktorsBaikers/DevRites/issues/199)) ([b31814a](https://github.com/ViktorsBaikers/DevRites/commit/b31814a37d80c45a27d5470ab5464cd93c91f76a))
+* **release:** publish pending installer fixes ([dfd2192](https://github.com/ViktorsBaikers/DevRites/commit/dfd2192d1b7d9da1b0111603760c5eb8f246b9a4))
+
 ## [7.2.7](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.6...v7.2.7) (2026-10-31)
 
 ### Fixed

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.2.7`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.2.7): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.2.8`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.2.8): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -382,6 +382,11 @@ with `--force`; legacy manifests without hashes also require `--force`.
 `--force --dry-run` lists the exact destructive actions. Every settings and
 marker merge is checked before the first write, so a rejected merge (such as a
 Codex config that already sets top-level `default_permissions`) leaves the project untouched.
+Unmerges receive the same preflight: malformed settings or legacy hooks JSON
+blocks uninstall and dropped-host pruning, including dry runs, before writes.
+Existing files retain their permission bits. Claude permission ownership is
+recorded before settings replacement, so interrupted merges retain the records
+needed to remove installer-added grants on retry and uninstall.
 Marker-merged files keep user content outside the DevRites block, and
 `.devrites/` runtime state stays in place. `update` reuses the install flags
 recorded in the manifest; flags you pass explicitly win and are recorded. The installer refuses symlinks, junctions, and paths that

package/docs/command-map.md

@@ -50,6 +50,10 @@ The Go surface is intentionally closed and deterministic:
 | Install/operator | `install`, `update`, `uninstall`, `version` | Direct update acquires latest; npm/bootstrap may supply local candidates; the engine performs manifest-owned local changes. |
 | Native policy | no engine command | Skills/root own spec grammar re-read, qid allocation, Clarify cursor edits, AFK/recovery accounting, and read-only `/rite-doctor`. |
 
+`state apply-bundle` merges workspace-relative path aliases into one target:
+`plan.md`, `./plan.md`, and `refs/../plan.md` share base pins and patch hunks.
+Conflicting replacements or base hashes block the entire bundle without writes.
+
 `devrites-engine help` exhaustively lists the operational engine commands.
 Standard `help`, `-h`, `--help`, `version`, and `--version` forms remain
 available; each operational command and subcommand also accepts `-h` / `--help`.

package/docs/engine/commands.md

@@ -58,6 +58,13 @@ workflow strategy.
 | `overhaul <records\|admit\|snapshot\|score\|bench\|render> ...` | Deterministic tools behind the standalone `/overhaul` skill: run-record generations and cross-record validation, worker-receipt admission and quote anchoring, index-safe baseline snapshots and per-attempt deltas, exact-rational readiness scoring, benchmark ratio intervals, and escaped offline review/report views. Operates only on explicit run-area and repository paths. See [Overhaul tools](#overhaul-tools). |
 | `version` | Print the engine version. |
 
+For `context --role`, optional `devrites-` prefixes and `.lane` suffixes resolve
+the base specialist's contract, workspace read-set, and role-specific rules.
+The full label remains in bundle filenames and attribution. Reviewer
+`dispatch return` requires `--result <file>` or an explicit
+`--outcome findings|no-findings|gap`; omitting both refuses the return without
+changing the wave or releasing its claim. Non-reviewer returns are unchanged.
+
 `help`, `-h`, and `--help` print this operational inventory. Each operational
 command and subcommand also accepts `-h` / `--help` and prints that command's
 usage to stdout without requiring a workspace. `version` and `--version` print
@@ -66,6 +73,21 @@ engine has no compatibility aliases or tombstones. The `add`/`upgrade`/`remove`
 conveniences belong only to the `npx devrites` adapter, not to the engine
 command namespace.
 
+## State and evidence safety
+
+- `state set` resolves known cursor aliases before checking protected fields
+  and duplicate keys. Underscore variants cannot bypass phase, schema, or
+  saved-return-cursor protections; extension keys retain their spelling.
+- `state resolve` ignores fenced examples when matching and removing an
+  Awaiting-human section. Resolving another question leaves the live wait intact.
+- `state close` reads the physical `ACTIVE` pointer under the feature lock;
+  `DEVRITES_WORKSPACE` cannot make it clear another feature's pointer.
+- `gates run` and `reverify` snapshot every declared `INPUTS` dependency around
+  the actual shared CHECK execution, recheck during locked writeback, and
+  invalidate earlier passes if later checks move their inputs.
+  Missing or changed inputs cannot certify a pass. Execution, discarded-result,
+  or evidence-write failures exit `3`, even if an older ledger still reads met.
+
 ## Check boundary
 
 The candidate gate validates and hashes path/state/type/mode/content identity;

package/docs/orchestration.md

@@ -37,6 +37,15 @@ Skills name the exact role and bounded task in normal language. The host owns
 internal spawn fields, scheduling, waiting, follow-ups, and result delivery.
 DevRites does not parse rollout logs or maintain dispatch receipts.
 
+On OMP, each `task` item selects its specialist through `agent`, including every
+item in a `tasks[]` batch: `devrites-code-reviewer`, `devrites-test-analyst`, or
+`devrites-slice-wright` for those roles. Writing “you are…” in a task or naming it
+after a specialist does not select that profile. Lane suffixes stay on engine
+role labels, not native profile names. Check the actual host selector before
+admitting results: the engine records declared roles and host handles, not
+authenticated native profile identity. A missing profile remains a gap, not
+permission to select a generic/default child.
+
 Quick, Standard, and Full select evidence/review depth only; they are not agent
 API versions or execution tiers. The shared contract lives in
 [`orchestration-profiles.md`](../pack/.claude/skills/devrites-lib/reference/orchestration-profiles.md).

package/engine/internal/acceptance/cli.go

@@ -160,12 +160,12 @@ func cmdStatus(root string, args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stderr, "gates status: %v\n", err)
 		return ExitBlocked
 	}
-	return reportStatus(slug, ledgerPath, testPlanPath, stdout, stderr)
+	return reportStatus(slug, ledgerPath, testPlanPath, false, stdout, stderr)
 }
 
 // reportStatus prints the stable greppable reduction. It returns ExitOK only
-// for a parse-clean ledger with every gate met and none abandoned.
-func reportStatus(slug, ledgerPath, testPlanPath string, stdout, stderr io.Writer) int {
+// for a parse-clean ledger with every gate met, none abandoned and no failed attempt.
+func reportStatus(slug, ledgerPath, testPlanPath string, attemptFailed bool, stdout, stderr io.Writer) int {
 	text, err := ReadLedgerFile(ledgerPath)
 	if err != nil {
 		fmt.Fprintf(stderr, "gates status: %v\n", err)
@@ -191,7 +191,7 @@ func reportStatus(slug, ledgerPath, testPlanPath string, stdout, stderr io.Write
 	case reduction.HandoffRequired():
 		fmt.Fprintln(stdout, "result: handoff")
 		return ExitBlocked
-	case !reduction.AllMet():
+	case attemptFailed || !reduction.AllMet():
 		fmt.Fprintln(stdout, "result: not-met")
 		return ExitBlocked
 	default:
@@ -269,6 +269,7 @@ func cmdRun(root string, args []string, reverify bool, stdout, stderr io.Writer)
 	}
 	var ran []GateResult
 	var ranDoc *Document
+	attemptFailed := false
 
 	// The gates lock serializes check execution; the feature lock is held only
 	// to read inputs and per writeback, so dispatch and other workspace writers
@@ -294,6 +295,9 @@ func cmdRun(root string, args []string, reverify bool, stdout, stderr io.Writer)
 		}
 		ran, ranDoc = RunGates(context.Background(), project, ledgerPath, doc, approved, reverify, timeout, featureLock), doc
 		for _, result := range ran {
+			if result.Ran && !result.Passed || result.Discarded || result.WriteErr != nil {
+				attemptFailed = true
+			}
 			switch {
 			case !result.Ran:
 				fmt.Fprintf(stdout, "gate %s: skipped (%s)\n", result.ID, result.Detail)
@@ -320,7 +324,7 @@ func cmdRun(root string, args []string, reverify bool, stdout, stderr io.Writer)
 		}
 	}
 	fmt.Fprintln(stdout, "---")
-	return reportStatus(slug, ledgerPath, testPlanPath, stdout, stderr)
+	return reportStatus(slug, ledgerPath, testPlanPath, attemptFailed, stdout, stderr)
 }
 
 func cmdLint(root string, args []string, stdout, stderr io.Writer) int {

package/engine/internal/acceptance/run.go

@@ -28,7 +28,7 @@ type GateResult struct {
 	Ran       bool
 	Passed    bool
 	Detail    string // exit/match/timeout/approval diagnostic
-	Discarded bool   // result dropped: ledger changed under the run
+	Discarded bool   // result dropped: bound oracle or inputs changed during the run
 	WriteErr  error  // evidence writeback failed for a reason other than drift
 	Reused    bool   // met gate kept because its INPUTS are unchanged
 	Inputs    string // INPUTS content digest at run time, when declared
@@ -77,13 +77,24 @@ func ReadLedgerFile(ledgerPath string) (string, error) {
 // execute; writeResult re-verifies the gate's oracle before it writes.
 func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, approved []ApprovedCommand, reverify bool, timeout time.Duration, writeLock func(func() error) error) []GateResult {
 	var results []GateResult
-	outcomes := map[string]RunOutcome{}
-	spans := map[string][2]time.Time{}
-	write := func(gate *Gate, evidence string, checked bool) error {
-		if writeLock == nil {
-			return writeResult(ledgerPath, gate, evidence, checked)
+	executions := map[string]struct {
+		ran     bool
+		outcome RunOutcome
+		span    [2]time.Time
+		inputs  map[string]string
+	}{}
+	// Collect every dependent INPUTS spec before any shared command can run.
+	for _, gate := range doc.Gates {
+		if gate.Check == "" || gate.Inputs == "" {
+			continue
+		}
+		key := gate.Check + "\x00" + filepath.Join(root, filepath.FromSlash(gate.Cwd))
+		execution := executions[key]
+		if execution.inputs == nil {
+			execution.inputs = map[string]string{}
 		}
-		return writeLock(func() error { return writeResult(ledgerPath, gate, evidence, checked) })
+		execution.inputs[gate.Inputs] = ""
+		executions[key] = execution
 	}
 	for _, gate := range doc.Gates {
 		if _, abandoned := doc.Abandoned[gate.ID]; abandoned {
@@ -95,15 +106,15 @@ func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, appro
 			continue
 		}
 		inputs := ""
-		if gate.Inputs != "" {
-			// An unreadable or unmatched spec yields "", which never matches, so the gate re-executes.
-			inputs, _ = InputsDigest(root, gate.Inputs)
-		}
 		if GateState(gate, doc) == StateMet {
 			if gate.Inputs == "" && !reverify {
 				results = append(results, GateResult{ID: gate.ID, Passed: true, Detail: "already met"})
 				continue
 			}
+			if gate.Inputs != "" {
+				// An unreadable or unmatched spec never matches recorded evidence.
+				inputs, _ = InputsDigest(root, gate.Inputs)
+			}
 			// A gate that declares INPUTS is reused, under run and reverify alike,
 			// exactly while the files it depends on are byte-identical; any change re-executes it.
 			if inputs != "" && inputs == recordedInputs(gate) {
@@ -120,36 +131,84 @@ func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, appro
 			results = append(results, GateResult{ID: gate.ID, Detail: err.Error()})
 			continue
 		}
-		cwd := root
-		if gate.Cwd != "" {
-			cwd = filepath.Join(root, filepath.FromSlash(gate.Cwd))
-		}
+		cwd := filepath.Join(root, filepath.FromSlash(gate.Cwd))
 		key := gate.Check + "\x00" + cwd
-		outcome, ran := outcomes[key]
-		if !ran {
+		execution := executions[key]
+		if !execution.ran {
+			for spec := range execution.inputs {
+				execution.inputs[spec], _ = InputsDigest(root, spec)
+			}
 			started := time.Now().UTC()
-			outcome = Execute(ctx, gate.Check, cwd, timeout)
-			outcomes[key] = outcome
-			spans[key] = [2]time.Time{started, time.Now().UTC()}
-		}
-		span := spans[key]
-		if outcome.Err == nil && outcome.ExitCode == 0 && expectation.Matches(outcome.Output) {
-			evidence := withInputs(FormatEvidence(gate, OutputDigest(outcome.Output), outcome.OutputBytes, time.Now().UTC().Format(time.RFC3339)), inputs)
-			writeErr := write(gate, evidence, true)
-			results = append(results, GateResult{
-				ID: gate.ID, Ran: true, Passed: true,
-				Discarded: errors.Is(writeErr, ErrOracleMoved), WriteErr: writeErr,
-				Detail: resultDetail(writeErr, "pass"),
-				Inputs: inputs, Outcome: outcome, Started: span[0], Ended: span[1],
-			})
+			execution.outcome = Execute(ctx, gate.Check, cwd, timeout)
+			execution.span = [2]time.Time{started, time.Now().UTC()}
+			for spec, before := range execution.inputs {
+				after, _ := InputsDigest(root, spec)
+				if after != before {
+					execution.inputs[spec] = ""
+				}
+			}
+			execution.ran = true
+			executions[key] = execution
+		}
+		outcome := execution.outcome
+		inputs = execution.inputs[gate.Inputs]
+		passed := outcome.Err == nil && outcome.ExitCode == 0 && expectation.Matches(outcome.Output)
+		detail := "pass"
+		if !passed {
+			detail = failDetail(outcome, expectation)
+		}
+		write := func() error {
+			if passed && gate.Inputs != "" {
+				// Earlier writebacks may have moved files since execution.
+				current, _ := InputsDigest(root, gate.Inputs)
+				if inputs == "" || current != inputs {
+					passed = false
+					detail = "INPUTS changed or could not be read during the run"
+				}
+			}
+			evidence := "pending"
+			if passed {
+				evidence = withInputs(FormatEvidence(gate, OutputDigest(outcome.Output), outcome.OutputBytes, time.Now().UTC().Format(time.RFC3339)), inputs)
+			}
+			return writeResult(ledgerPath, gate, evidence, passed)
+		}
+		var writeErr error
+		if writeLock == nil {
+			writeErr = write()
+		} else {
+			writeErr = writeLock(write)
+		}
+		results = append(results, GateResult{
+			ID: gate.ID, Ran: true, Passed: passed,
+			Discarded: errors.Is(writeErr, ErrOracleMoved), WriteErr: writeErr,
+			Detail: resultDetail(writeErr, detail),
+			Inputs: inputs, Outcome: outcome, Started: execution.span[0], Ended: execution.span[1],
+		})
+	}
+	// Later checks may invalidate an earlier execution or reused pass.
+	for i, gate := range doc.Gates {
+		result := &results[i]
+		if !result.Passed || result.Discarded || result.WriteErr != nil || gate.Inputs == "" {
+			continue
+		}
+		validate := func() error {
+			current, _ := InputsDigest(root, gate.Inputs)
+			if current != "" && current == result.Inputs {
+				return nil
+			}
+			result.Passed, result.Reused, result.Discarded = false, false, true
+			result.Detail = "INPUTS changed or could not be read after a later check"
+			return writeResult(ledgerPath, gate, "pending", false)
+		}
+		var err error
+		if writeLock == nil {
+			err = validate()
 		} else {
-			writeErr := write(gate, "pending", false)
-			results = append(results, GateResult{
-				ID: gate.ID, Ran: true,
-				Discarded: errors.Is(writeErr, ErrOracleMoved), WriteErr: writeErr,
-				Detail: resultDetail(writeErr, failDetail(outcome, expectation)),
-				Inputs: inputs, Outcome: outcome, Started: span[0], Ended: span[1],
-			})
+			err = writeLock(validate)
+		}
+		if err != nil {
+			result.WriteErr = err
+			result.Detail = resultDetail(err, result.Detail)
 		}
 	}
 	return results

package/engine/internal/devritespaths/paths.go

@@ -194,14 +194,19 @@ func checkedCanonicalDir(root, candidate, parent, slug string) (string, error) {
 	return filepath.Clean(candidate), nil
 }
 
-// ActiveSlug reads and trims the active-feature pointer. A missing pointer file
-// is not an error; it yields the empty slug.
+// ActiveSlug resolves the workspace override, or reads the active-feature pointer.
+// A missing pointer file is not an error; it yields the empty slug.
 func ActiveSlug(root string) (string, error) {
 	if ws, err := WorkspaceOverrideChecked(root, ""); err != nil {
 		return "", err
 	} else if ws != "" {
 		return filepath.Base(ws), nil
 	}
+	return PhysicalActiveSlug(root)
+}
+
+// PhysicalActiveSlug reads the validated ACTIVE pointer without workspace overrides.
+func PhysicalActiveSlug(root string) (string, error) {
 	activePath := filepath.Join(root, "ACTIVE")
 	if info, err := os.Lstat(activePath); err == nil && info.Mode()&os.ModeSymlink != 0 {
 		return "", fmt.Errorf("DRV-ACTIVE-SYMLINK: ACTIVE is a symlink; run `rm -f %q`", activePath)

package/engine/internal/install/apply.go

@@ -231,6 +231,11 @@ func (r *runner) writeConfined(dest string, data []byte, perm fs.FileMode) error
 		return err
 	}
 	defer func() { _ = root.Close() }()
+	if info, err := root.Stat(rel); err == nil {
+		perm = info.Mode().Perm()
+	} else if !os.IsNotExist(err) {
+		return err
+	}
 	return fsutil.WriteFileAtomicIn(root, rel, data, perm)
 }
 

package/engine/internal/install/merge.go

@@ -17,11 +17,18 @@ import (
 )
 
 func (r *runner) installClaudeSettingsMarker(state claudeSettingsMerge) error {
+	return r.installMarker(hostpack.ClaudeSettingsMerge.MarkerRel, claudeSettingsMarkerText(state))
+}
+
+func claudeSettingsMarkerText(state claudeSettingsMerge) string {
 	var b strings.Builder
 	b.WriteString(hostpack.ClaudeSettingsMerge.MarkerText + "\n" + claudeRulesAddedLine)
 	if state.created {
 		b.WriteString("\n" + claudeSettingsCreatedLine)
 	}
+	if state.defaultModeOwned {
+		b.WriteString("\ndefault-mode=added")
+	}
 	rules := make([]string, 0, len(state.added))
 	for rule := range state.added {
 		rules = append(rules, rule)
@@ -30,7 +37,7 @@ func (r *runner) installClaudeSettingsMarker(state claudeSettingsMerge) error {
 	for _, rule := range rules {
 		b.WriteString("\nrule:" + rule)
 	}
-	return r.installMarker(hostpack.ClaudeSettingsMerge.MarkerRel, b.String())
+	return b.String()
 }
 
 const (
@@ -364,16 +371,45 @@ func (r *runner) mergeClaudeSettings(merge hostpack.JSONMerge) error {
 		return fmt.Errorf("encode merged Claude settings: %w", err)
 	}
 	data = append(data, '\n')
+	// Publish ownership before grants; keep retired ownership until settings land.
+	pending := r.pendingClaudeSettingsOwnership(state)
+	if err := r.installClaudeSettingsMarker(pending); err != nil {
+		return err
+	}
+	if r.records[merge.MarkerRel] == "" {
+		return fmt.Errorf("cannot merge %s without owning %s; use --force to replace the marker", merge.TargetRel, merge.MarkerRel)
+	}
+	if err := r.recheckPath(merge.TargetRel); err != nil {
+		return err
+	}
 	if err := r.writeConfined(dest, data, 0o644); err != nil {
 		return fmt.Errorf("cannot write %s: %w", merge.TargetRel, err)
 	}
-	return r.installClaudeSettingsMarker(state)
+	if pending.defaultModeOwned || len(pending.added) != len(state.added) {
+		if err := r.refreshPreflight(merge.MarkerRel); err != nil {
+			return err
+		}
+		return r.installClaudeSettingsMarker(state)
+	}
+	return nil
 }
 
 // claudeSettingsMerge is what the settings marker records about a merge.
 type claudeSettingsMerge struct {
-	created bool
-	added   map[string]bool
+	created          bool
+	added            map[string]bool
+	defaultModeOwned bool
+}
+
+func (r *runner) pendingClaudeSettingsOwnership(next claudeSettingsMerge) claudeSettingsMerge {
+	pending := claudeSettingsMerge{
+		created: next.created, added: r.managedClaudePermissionRules(),
+		defaultModeOwned: r.claudeDefaultModeOwned(),
+	}
+	for rule := range next.added {
+		pending.added[rule] = true
+	}
+	return pending
 }
 
 // claudeSettingsNext returns the merged .claude/settings.json without
@@ -433,6 +469,12 @@ func stripHooksWith(path string, write func([]byte) error, remove func() error)
 }
 
 func (r *runner) stripClaudeSettings(path string) error {
+	return r.stripClaudeSettingsWith(path, func(data []byte) error {
+		return r.writeConfined(path, data, 0o644)
+	}, func() error { return r.removeConfined(path) })
+}
+
+func (r *runner) stripClaudeSettingsWith(path string, write func([]byte) error, remove func() error) error {
 	current, err := readJSON(path)
 	if err != nil {
 		if errors.Is(err, fs.ErrNotExist) {
@@ -442,14 +484,14 @@ func (r *runner) stripClaudeSettings(path string) error {
 	}
 	next := stripDevritesSettings(current, r.claudeDefaultModeOwned(), r.managedClaudePermissionRules())
 	if len(next) == 0 && r.claudeSettingsCreated() {
-		return r.removeConfined(path)
+		return remove()
 	}
 	data, err := json.MarshalIndent(next, "", "  ")
 	if err != nil {
 		return fmt.Errorf("encode Claude settings: %w", err)
 	}
 	data = append(data, '\n')
-	return r.writeConfined(path, data, 0o644)
+	return write(data)
 }
 
 func (r *runner) stripMarkerConfined(path, begin, end string) error {

package/engine/internal/install/preflight.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"maps"
 	"os"
 	"path/filepath"
 	"slices"
@@ -22,6 +23,7 @@ func (r *runner) preflightInstall() error {
 		return fmt.Errorf("preflight install paths: %w", err)
 	}
 	var conflicts []string
+	dryTree := map[string][]byte{}
 	for rel := range desired {
 		snapshot, err := r.rememberPath(rel)
 		if err != nil {
@@ -34,7 +36,8 @@ func (r *runner) preflightInstall() error {
 			}
 		}
 	}
-	for rel, record := range r.prev {
+	for _, rel := range slices.Sorted(maps.Keys(r.prev)) {
+		record := r.prev[rel]
 		if desired[rel] || hostpack.PreserveOnPrune(rel) {
 			continue
 		}
@@ -58,7 +61,7 @@ func (r *runner) preflightInstall() error {
 			if _, err := r.rememberPath(merge.TargetRel); err != nil {
 				return err
 			}
-			if err := dryRunStripMarker(map[string][]byte{}, r.target, merge); err != nil {
+			if err := r.dryRunStripMarker(dryTree, merge); err != nil {
 				return err
 			}
 		}
@@ -104,19 +107,34 @@ func (r *runner) preflightMerges() error {
 			return fmt.Errorf("merge %s: %w", hostpack.CodexConfigMerge.TargetRel, err)
 		}
 	}
-	if _, _, err := r.claudeSettingsNext(); err != nil {
+	_, settings, err := r.claudeSettingsNext()
+	if err != nil {
 		return fmt.Errorf("seed claude settings: %w", err)
 	}
+	marker := hostpack.ClaudeSettingsMerge.MarkerRel
+	if snapshot := r.preflight[marker]; !snapshot.missing && !r.opts.Force {
+		if _, managed := r.prev[marker]; !managed {
+			text := claudeSettingsMarkerText(r.pendingClaudeSettingsOwnership(settings)) + "\n"
+			sum := sha256.Sum256([]byte(text))
+			if snapshot.hash != fmt.Sprintf("sha256:%x", sum[:]) {
+				return fmt.Errorf("cannot merge %s without owning %s; use --force to replace the marker", hostpack.ClaudeSettingsMerge.TargetRel, marker)
+			}
+		}
+	}
 	return nil
 }
 
 func (r *runner) preflightUninstall(entries []string) error {
 	var conflicts []string
+	dryTree := map[string][]byte{}
 	for _, rel := range entries {
 		if merge, ok := hostpack.ManagedMergeForMarker(rel); ok {
 			if _, err := r.rememberPath(merge.TargetRel); err != nil {
 				return err
 			}
+			if err := r.dryRunStripMarker(dryTree, merge); err != nil {
+				return err
+			}
 		}
 		if !hostpack.ShouldRemoveOnUninstall(rel, entries) {
 			continue

package/engine/internal/install/uninstall.go

@@ -35,18 +35,12 @@ func (r *runner) uninstall() error {
 		return err
 	}
 
-	// Per-path would-be content for a dry run; a nil value means the file
-	// would be removed.
-	dryTree := map[string][]byte{}
 	for _, rel := range entries {
 		merge, ok := hostpack.ManagedMergeForMarker(rel)
 		if !ok {
 			continue
 		}
 		if r.opts.DryRun {
-			if err := dryRunStripMarker(dryTree, r.target, merge); err != nil {
-				return err
-			}
 			fmt.Fprintf(r.opts.Stdout, "  [merge-remove] %s\n", merge.DryRun)
 			continue
 		}
@@ -142,11 +136,16 @@ func (r *runner) uninstall() error {
 // dryRunStripMarker runs the real marker strip against an in-memory view of
 // the target (tree), so a dry run follows the same sequence as the real
 // uninstall and reports the same errors without writing anything.
-func dryRunStripMarker(tree map[string][]byte, target string, merge hostpack.ManagedMerge) error {
-	if merge.MarkerRel == hostpack.LegacyCodexHooksMerge.MarkerRel || merge.TargetRel == hostpack.ClaudeSettingsMerge.TargetRel {
-		return nil
+func (r *runner) dryRunStripMarker(tree map[string][]byte, merge hostpack.ManagedMerge) error {
+	path := filepath.Join(r.target, filepath.FromSlash(merge.TargetRel))
+	write := func(data []byte) error { tree[path] = data; return nil }
+	remove := func() error { tree[path] = nil; return nil }
+	if merge.MarkerRel == hostpack.LegacyCodexHooksMerge.MarkerRel {
+		return stripHooksWith(path, write, remove)
+	}
+	if merge.TargetRel == hostpack.ClaudeSettingsMerge.TargetRel {
+		return r.stripClaudeSettingsWith(path, write, remove)
 	}
-	path := filepath.Join(target, filepath.FromSlash(merge.TargetRel))
 	data, seen := tree[path]
 	if !seen {
 		var err error

package/engine/internal/lib/apply_bundle.go

@@ -210,7 +210,12 @@ func collectBundleTargets(slug string, bundles []candidateBundle) ([]*bundleTarg
 		}
 		pins := map[string]string{}
 		for path, hash := range bundle.BaseHashes {
-			pins[strings.TrimPrefix(filepath.ToSlash(path), prefix)] = strings.ToLower(strings.TrimPrefix(strings.TrimSpace(hash), "sha256:"))
+			rel := filepath.ToSlash(filepath.Clean(strings.TrimPrefix(filepath.ToSlash(path), prefix)))
+			pin := strings.ToLower(strings.TrimPrefix(strings.TrimSpace(hash), "sha256:"))
+			if previous, ok := pins[rel]; ok && previous != pin {
+				problems = append(problems, fmt.Sprintf("bundle %d %s: conflicting base hashes for the same file", bi+1, path))
+			}
+			pins[rel] = pin
 		}
 		for _, file := range bundle.CandidateFiles {
 			rel := strings.TrimPrefix(filepath.ToSlash(file.Path), prefix)
@@ -219,6 +224,7 @@ func collectBundleTargets(slug string, bundles []candidateBundle) ([]*bundleTarg
 				problems = append(problems, where+": path must be a Markdown file inside the "+slug+" workspace")
 				continue
 			}
+			rel = filepath.ToSlash(filepath.Clean(rel))
 			op := strings.ToLower(strings.TrimSpace(file.Operation))
 			switch op {
 			case "create", "replace":

package/engine/internal/lib/closeout.go

@@ -62,11 +62,6 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 	archDisplay := filepath.ToSlash(filepath.Join("archive", slug))
 	active := filepath.Join(dv, "ACTIVE")
 
-	activeSlug, err := devritespaths.ActiveSlug(dv)
-	if err != nil {
-		fmt.Fprintf(stderr, "state close: invalid ACTIVE cursor: %v\n", err)
-		return 1
-	}
 	// A broken symlink at the destination still counts as "already there", so use
 	// Lstat rather than Stat to avoid silently overwriting it.
 	if _, err := os.Lstat(arch); err == nil {
@@ -84,7 +79,7 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 	// open file, so there the lock is released just before the rename.
 	code := 1
 	if err := state.WithFeatureLockRelease(dv, slug, func(release func()) error {
-		code = closeOutLocked(release, work, arch, archiveDir, archDisplay, active, activeSlug, slug, stdout, stderr)
+		code = closeOutLocked(release, work, arch, archiveDir, archDisplay, active, slug, stdout, stderr)
 		return nil
 	}); err != nil {
 		fmt.Fprintf(stderr, "state close: cannot lock feature %s: %v\n", slug, err)
@@ -96,7 +91,12 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 // closeOutLocked performs the rename and the conditional ACTIVE clear. It runs
 // under the feature lock held by CloseOut and reports an exit code rather than
 // an error, preserving CloseOut's documented exit codes.
-func closeOutLocked(release func(), work, arch, archiveDir, archDisplay, active, activeSlug, slug string, stdout, stderr io.Writer) int {
+func closeOutLocked(release func(), work, arch, archiveDir, archDisplay, active, slug string, stdout, stderr io.Writer) int {
+	activeSlug, err := devritespaths.PhysicalActiveSlug(filepath.Dir(active))
+	if err != nil {
+		fmt.Fprintf(stderr, "state close: invalid ACTIVE cursor: %v\n", err)
+		return 1
+	}
 	// Fail closed: if the move does not happen, leave the cursor alone and do not
 	// claim success: a lost audit trail must never look like a clean close-out.
 	if err := os.MkdirAll(archiveDir, 0o755); err != nil {

package/engine/internal/lib/context.go

@@ -80,7 +80,7 @@ func RunContext(root string, args []string, stdout, stderr io.Writer) int {
 	}
 	// A Build reviewer judges one slice; an unscoped bundle inlines whole
 	// plan/tasks/architecture into every dispatch.
-	if opts.phase == "build" && opts.role != "" && opts.role != "slice-wright" && opts.slice == "" {
+	if opts.phase == "build" && opts.role != "" && roleBase(opts.role) != "slice-wright" && opts.slice == "" {
 		fmt.Fprintf(stderr, "context: BLOCKED: unscoped build reviewer bundle: --role %s in phase build needs --slice <SLICE-ID>\n", opts.role)
 		return 3
 	}
@@ -455,7 +455,7 @@ func workspaceReadSet(manifest loadsManifest, role string) ([]string, bool) {
 	if role == "" {
 		return manifest.Workspace, false
 	}
-	if list, ok := manifest.WorkspaceByRole[role]; ok {
+	if list, ok := manifest.WorkspaceByRole[roleBase(role)]; ok {
 		return list, true
 	}
 	return manifest.Workspace, false
@@ -915,6 +915,7 @@ func parseLoadsManifest(text string) (loadsManifest, bool, error) {
 }
 
 func roleAgentPath(manifest loadsManifest, role string) string {
+	role = roleBase(role)
 	if manifest.Agents != nil {
 		if rel, ok := manifest.Agents[role]; ok {
 			return rel

package/engine/internal/lib/dispatch.go

@@ -50,6 +50,7 @@ For a reviewer role, return --result <file> stores the return verbatim as
 packets/<wave>-<role>.return.md (never overwritten), derives the outcome
 from its Outcome/Counts head (malformed records gap), refuses an --outcome
 that disagrees, and records its Finding: keys for metrics summary.
+Reviewer returns require --result or --outcome; omitting both leaves the role pending.
 
 A build wave with a wright role must name its slice(s) with --slice; a vet
 wave may (slice-bound recheck), and so may a reviewer-only wave (uncapped),
@@ -455,6 +456,9 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 		if r.Returned {
 			return fail("role %q already returned", role)
 		}
+		if isReviewerRole(role) && result == "" && outcome == "" {
+			return fail("reviewer %q needs --result <file> or --outcome <findings|no-findings|gap>", role)
+		}
 		if outcome != "" && !slices.Contains([]string{"findings", "no-findings", "gap"}, outcome) {
 			return fail("--outcome %q is not findings, no-findings, or gap", outcome)
 		}

package/engine/internal/lib/resolve.go

@@ -361,6 +361,10 @@ func clearAwaiting(sfile, qid string) error {
 		return fmt.Errorf("read state %s: %w", sfile, err)
 	}
 	lines := splitLinesNoTrailing(data)
+	visible, err := structuralLines(data)
+	if err != nil {
+		return fmt.Errorf("read state %s: %w", sfile, err)
+	}
 	resumePolicy, _ := state.PolicyFor(state.PhaseBuild)
 	if rawPhase, ok := state.CursorField(lines, state.CursorPhase); ok {
 		if fields := strings.Fields(strings.ToLower(rawPhase)); len(fields) > 0 {
@@ -373,7 +377,7 @@ func clearAwaiting(sfile, qid string) error {
 	// First check whether the awaiting block references this question at all.
 	inAw := false
 	var awaitingLines []string
-	for _, line := range lines {
+	for _, line := range visible {
 		switch {
 		case awaitingRe.MatchString(line):
 			inAw = true
@@ -400,7 +404,8 @@ func clearAwaiting(sfile, qid string) error {
 	ts := nowUTC()
 	var out []string
 	inAw, inLog, logAppended := false, false, false
-	for _, line := range lines {
+	for i, original := range lines {
+		line := visible[i]
 		if awaitingRe.MatchString(line) {
 			inAw = true
 			continue
@@ -413,7 +418,7 @@ func clearAwaiting(sfile, qid string) error {
 		}
 		switch {
 		case logHdrRe.MatchString(line):
-			out = append(out, line)
+			out = append(out, original)
 			inLog = true
 			continue
 		case inLog && hdrSpaceRe.MatchString(line):
@@ -422,10 +427,10 @@ func clearAwaiting(sfile, qid string) error {
 				logAppended = true
 			}
 			inLog = false
-			out = append(out, line)
+			out = append(out, original)
 			continue
 		}
-		out = append(out, line)
+		out = append(out, original)
 	}
 	if inLog && !logAppended {
 		out = append(out, fmt.Sprintf("- %s %s: resolved %s", ts, resumePolicy.Target, qid))

package/engine/internal/lib/state_edit.go

@@ -58,10 +58,17 @@ func RunStateSet(root string, args []string, stdout, stderr io.Writer) int {
 				return fail(stderr, stateSetUsage, 2)
 			}
 		}
-		if !cursorKeyPattern.MatchString(key) || seen[key] {
+		if !cursorKeyPattern.MatchString(key) {
 			return fail(stderr, fmt.Sprintf("state set: key %q is not a snake_case cursor key or repeats", key), 2)
 		}
-		seen[key] = true
+		if canonical, ok := state.CanonicalCursorKey(key); ok {
+			key = canonical
+		}
+		identity := strings.ReplaceAll(key, "_", "")
+		if seen[identity] {
+			return fail(stderr, fmt.Sprintf("state set: key %q is not a snake_case cursor key or repeats", key), 2)
+		}
+		seen[identity] = true
 		changes = append(changes, change{key, value})
 	}
 	sfile, code := stateEditWorkspace(root, slug, "state.md", stderr)

package/engine/internal/lib/triggers.go

@@ -52,7 +52,7 @@ var (
 // corpus (minus the template's AI-SPEC annex) names a model, agent, RAG, or
 // tool surface.
 func keepModelSurface(role string, facts triggerFacts) bool {
-	return role == "security-auditor" || facts.aiSpec || strings.TrimSpace(facts.corpus) == "" ||
+	return roleBase(role) == "security-auditor" || facts.aiSpec || strings.TrimSpace(facts.corpus) == "" ||
 		aiSignalRe.MatchString(aiAnnexRe.ReplaceAllString(facts.corpus, "$1"))
 }
 
@@ -102,7 +102,7 @@ func suggestTriggers(manifest loadsManifest, root, featureDir string, opts conte
 }
 
 func gatherTriggerFacts(root, featureDir, role string) triggerFacts {
-	facts := triggerFacts{role: role}
+	facts := triggerFacts{role: roleBase(role)}
 	if root != "" {
 		afkPath := filepath.Join(root, "AFK")
 		if info, err := os.Stat(afkPath); err == nil && info.Mode().IsRegular() {

package/engine/internal/state/cursor.go

@@ -265,7 +265,7 @@ func ConvertCursorToTable(lines []string) ([]string, bool) {
 		if strings.Contains(value, "|") {
 			continue
 		}
-		spelling, ok := canonicalCursorSpelling(key)
+		spelling, ok := CanonicalCursorKey(key)
 		if !ok {
 			continue
 		}
@@ -278,14 +278,14 @@ func ConvertCursorToTable(lines []string) ([]string, bool) {
 }
 
 func isMigratableCursorKey(key string) bool {
-	_, ok := canonicalCursorSpelling(key)
+	_, ok := CanonicalCursorKey(key)
 	return ok
 }
 
-// canonicalCursorSpelling maps a cursor key (including aliases) to the
+// CanonicalCursorKey maps a cursor key (including aliases) to the
 // canonical table-row spelling. Matching is normalization-based, so
-// "Next step" resolves to the "next_action" spelling.
-func canonicalCursorSpelling(key string) (string, bool) {
+// "Next step" resolves to the "next_action" spelling. Unknown extensions return false.
+func CanonicalCursorKey(key string) (string, bool) {
 	normalized := normalizeCursorKey(key)
 	canonicals := []string{CursorPhase, CursorStatus, CursorNextAction, CursorQuestionID,
 		CursorActiveSlice, CursorAFKSlicesRemaining, CursorSequenceParent,

package/pack/.claude/skills/devrites-lib/reference/standards/agents.md

@@ -45,8 +45,12 @@ Files own briefs; [`parallel-dispatch.md`](../parallel-dispatch.md) owns rosters
 <!-- root-only -->
 ## Native invocation
 
-Skills name exact fresh roles, omit native fields;
-hosts spawn/wait/deliver. Root MUST NOT advance/claim completion before admitting required results;
+Skills name exact fresh roles; hosts select matching native profiles and
+spawn/wait/deliver. Task prose and display names do not select profiles.
+Dispatch labels may add `devrites-` or `.lane`; the native profile stays
+`devrites-<base-role>`. Verify the host selector before recording a start or
+admitting a result; a ledger role and handle alone do not prove profile identity.
+Root MUST NOT advance/claim completion before admitting required results;
 running/orphaned/unavailable = `gap` — no root/generic substitute.
 Where a feature workspace exists, every fresh dispatch to a named `devrites-*`
 role — wave or solo — builds its read-set with `devrites-engine context <slug>

package/pack/.claude/skills/rite-build/reference/parallel-batch.md

@@ -128,9 +128,9 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    proof in the same window as that review. Gap or Critical/Important → `gap`;
    else proof → `green|red|gap`.
 
-   A recheck round is one dispatch per changed surface, not one per checklist: the
-   recheck agent carries every open checklist (code, test, doubt) for that diff and
-   answers each by name. Merging cuts dispatches; dropping a checklist does not.
+   Group recheck findings by owning role and changed surface. Each exact
+   specialist rechecks its own fingerprints and the correction diff; code, test,
+   and doubt remain separate dispatches, even on the same diff.
    Reviewer fan-out does not shrink the writer batch. Reviewers queue at the
    same cap as writers (10; see
    [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md#scale-limits)).

package/pack/generated/claude/skills/devrites-lib/reference/standards/agents.md

@@ -45,8 +45,12 @@ Files own briefs; [`parallel-dispatch.md`](../parallel-dispatch.md) owns rosters
 <!-- root-only -->
 ## Native invocation
 
-Skills name exact fresh roles, omit native fields;
-hosts spawn/wait/deliver. Root MUST NOT advance/claim completion before admitting required results;
+Skills name exact fresh roles; hosts select matching native profiles and
+spawn/wait/deliver. Task prose and display names do not select profiles.
+Dispatch labels may add `devrites-` or `.lane`; the native profile stays
+`devrites-<base-role>`. Verify the host selector before recording a start or
+admitting a result; a ledger role and handle alone do not prove profile identity.
+Root MUST NOT advance/claim completion before admitting required results;
 running/orphaned/unavailable = `gap` — no root/generic substitute.
 Where a feature workspace exists, every fresh dispatch to a named `devrites-*`
 role — wave or solo — builds its read-set with `devrites-engine context <slug>

package/pack/generated/claude/skills/rite-build/reference/parallel-batch.md

@@ -128,9 +128,9 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    proof in the same window as that review. Gap or Critical/Important → `gap`;
    else proof → `green|red|gap`.
 
-   A recheck round is one dispatch per changed surface, not one per checklist: the
-   recheck agent carries every open checklist (code, test, doubt) for that diff and
-   answers each by name. Merging cuts dispatches; dropping a checklist does not.
+   Group recheck findings by owning role and changed surface. Each exact
+   specialist rechecks its own fingerprints and the correction diff; code, test,
+   and doubt remain separate dispatches, even on the same diff.
    Reviewer fan-out does not shrink the writer batch. Reviewers queue at the
    same cap as writers (10; see
    [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md#scale-limits)).

package/pack/generated/codex/skills/devrites-lib/reference/standards/agents.md

@@ -45,8 +45,12 @@ Files own briefs; [`parallel-dispatch.md`](../parallel-dispatch.md) owns rosters
 <!-- root-only -->
 ## Native invocation
 
-Skills name exact fresh roles, omit native fields;
-hosts spawn/wait/deliver. Root MUST NOT advance/claim completion before admitting required results;
+Skills name exact fresh roles; hosts select matching native profiles and
+spawn/wait/deliver. spawn_agent prose and display names do not select profiles.
+Dispatch labels may add `devrites-` or `.lane`; the native profile stays
+`devrites-<base-role>`. Verify the host selector before recording a start or
+admitting a result; a ledger role and handle alone do not prove profile identity.
+Root MUST NOT advance/claim completion before admitting required results;
 running/orphaned/unavailable = `gap` — no root/generic substitute.
 Where a feature workspace exists, every fresh dispatch to a named `devrites-*`
 role — wave or solo — builds its read-set with `devrites-engine context --skills-root .agents/skills <slug>

package/pack/generated/codex/skills/rite-build/reference/parallel-batch.md

@@ -128,9 +128,9 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    proof in the same window as that review. Gap or Critical/Important → `gap`;
    else proof → `green|red|gap`.
 
-   A recheck round is one dispatch per changed surface, not one per checklist: the
-   recheck agent carries every open checklist (code, test, doubt) for that diff and
-   answers each by name. Merging cuts dispatches; dropping a checklist does not.
+   Group recheck findings by owning role and changed surface. Each exact
+   specialist rechecks its own fingerprints and the correction diff; code, test,
+   and doubt remain separate dispatches, even on the same diff.
    Reviewer fan-out does not shrink the writer batch. Reviewers queue at the
    same cap as writers (10; see
    [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md#scale-limits)).

package/pack/generated/devin/skills/devrites-lib/reference/standards/agents.md

@@ -45,8 +45,12 @@ Files own briefs; [`parallel-dispatch.md`](../parallel-dispatch.md) owns rosters
 <!-- root-only -->
 ## Native invocation
 
-Skills name exact fresh roles, omit native fields;
-hosts spawn/wait/deliver. Root MUST NOT advance/claim completion before admitting required results;
+Skills name exact fresh roles; hosts select matching native profiles and
+spawn/wait/deliver. Task prose and display names do not select profiles.
+Dispatch labels may add `devrites-` or `.lane`; the native profile stays
+`devrites-<base-role>`. Verify the host selector before recording a start or
+admitting a result; a ledger role and handle alone do not prove profile identity.
+Root MUST NOT advance/claim completion before admitting required results;
 running/orphaned/unavailable = `gap` — no root/generic substitute.
 Where a feature workspace exists, every fresh dispatch to a named `devrites-*`
 role — wave or solo — builds its read-set with `devrites-engine context --skills-root .devin/skills <slug>

package/pack/generated/devin/skills/rite-build/reference/parallel-batch.md

@@ -128,9 +128,9 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    proof in the same window as that review. Gap or Critical/Important → `gap`;
    else proof → `green|red|gap`.
 
-   A recheck round is one dispatch per changed surface, not one per checklist: the
-   recheck agent carries every open checklist (code, test, doubt) for that diff and
-   answers each by name. Merging cuts dispatches; dropping a checklist does not.
+   Group recheck findings by owning role and changed surface. Each exact
+   specialist rechecks its own fingerprints and the correction diff; code, test,
+   and doubt remain separate dispatches, even on the same diff.
    Reviewer fan-out does not shrink the writer batch. Reviewers queue at the
    same cap as writers (10; see
    [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md#scale-limits)).

package/pack/generated/dsh/skills/devrites-lib/reference/standards/agents.md

@@ -45,8 +45,12 @@ Files own briefs; [`parallel-dispatch.md`](../parallel-dispatch.md) owns rosters
 <!-- root-only -->
 ## Native invocation
 
-Skills name exact fresh roles, omit native fields;
-hosts spawn/wait/deliver. Root MUST NOT advance/claim completion before admitting required results;
+Skills name exact fresh roles; hosts select matching native profiles and
+spawn/wait/deliver. Task prose and display names do not select profiles.
+Dispatch labels may add `devrites-` or `.lane`; the native profile stays
+`devrites-<base-role>`. Verify the host selector before recording a start or
+admitting a result; a ledger role and handle alone do not prove profile identity.
+Root MUST NOT advance/claim completion before admitting required results;
 running/orphaned/unavailable = `gap` — no root/generic substitute.
 Where a feature workspace exists, every fresh dispatch to a named `devrites-*`
 role — wave or solo — builds its read-set with `devrites-engine context --skills-root .dsh/skills <slug>

package/pack/generated/dsh/skills/rite-build/reference/parallel-batch.md

@@ -128,9 +128,9 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    proof in the same window as that review. Gap or Critical/Important → `gap`;
    else proof → `green|red|gap`.
 
-   A recheck round is one dispatch per changed surface, not one per checklist: the
-   recheck agent carries every open checklist (code, test, doubt) for that diff and
-   answers each by name. Merging cuts dispatches; dropping a checklist does not.
+   Group recheck findings by owning role and changed surface. Each exact
+   specialist rechecks its own fingerprints and the correction diff; code, test,
+   and doubt remain separate dispatches, even on the same diff.
    Reviewer fan-out does not shrink the writer batch. Reviewers queue at the
    same cap as writers (10; see
    [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md#scale-limits)).

package/pack/generated/omp/skills/devrites-lib/reference/standards/agents.md

@@ -45,8 +45,16 @@ Files own briefs; [`parallel-dispatch.md`](skill://devrites-lib/reference/parall
 <!-- root-only -->
 ## Native invocation
 
-Skills name exact fresh roles, omit native fields;
-hosts spawn/wait/deliver. Root MUST NOT advance/claim completion before admitting required results;
+On omp, every `task` item (each `tasks[]` member) sets `agent` to the exact native profile;
+use `agent: "devrites-code-reviewer"`, `agent: "devrites-test-analyst"`, or
+`agent: "devrites-slice-wright"` for those roles, including rechecks and repairs.
+Keep `.frontend`, `.backend`, and `.SLICE-001` on dispatch labels, not `agent`.
+An omitted `agent` selects the default worker; `agent: "reviewer"` is generic. Hosts
+spawn/wait/deliver. Task prose and display names do not select profiles.
+Dispatch labels may add `devrites-` or `.lane`; the native profile stays
+`devrites-<base-role>`. Verify the host selector before recording a start or
+admitting a result; a ledger role and handle alone do not prove profile identity.
+Root MUST NOT advance/claim completion before admitting required results;
 running/orphaned/unavailable = `gap` — no root/generic substitute.
 Where a feature workspace exists, every fresh dispatch to a named `devrites-*`
 role — wave or solo — builds its read-set with `devrites-engine context --skills-root .omp/skills <slug>

package/pack/generated/omp/skills/rite-build/reference/parallel-batch.md

@@ -128,9 +128,9 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    proof in the same window as that review. Gap or Critical/Important → `gap`;
    else proof → `green|red|gap`.
 
-   A recheck round is one dispatch per changed surface, not one per checklist: the
-   recheck agent carries every open checklist (code, test, doubt) for that diff and
-   answers each by name. Merging cuts dispatches; dropping a checklist does not.
+   Group recheck findings by owning role and changed surface. Each exact
+   specialist rechecks its own fingerprints and the correction diff; code, test,
+   and doubt remain separate dispatches, even on the same diff.
    Reviewer fan-out does not shrink the writer batch. Reviewers queue at the
    same cap as writers (10; see
    [`parallel-dispatch.md`](skill://devrites-lib/reference/parallel-dispatch.md#scale-limits)).

package/pack/generated/pi/skills/devrites-lib/reference/standards/agents.md

@@ -45,8 +45,12 @@ Files own briefs; [`parallel-dispatch.md`](../parallel-dispatch.md) owns rosters
 <!-- root-only -->
 ## Native invocation
 
-Skills name exact fresh roles, omit native fields;
-hosts spawn/wait/deliver. Root MUST NOT advance/claim completion before admitting required results;
+Skills name exact fresh roles; hosts select matching native profiles and
+spawn/wait/deliver. Task prose and display names do not select profiles.
+Dispatch labels may add `devrites-` or `.lane`; the native profile stays
+`devrites-<base-role>`. Verify the host selector before recording a start or
+admitting a result; a ledger role and handle alone do not prove profile identity.
+Root MUST NOT advance/claim completion before admitting required results;
 running/orphaned/unavailable = `gap` — no root/generic substitute.
 Where a feature workspace exists, every fresh dispatch to a named `devrites-*`
 role — wave or solo — builds its read-set with `devrites-engine context --skills-root .pi/skills <slug>

package/pack/generated/pi/skills/rite-build/reference/parallel-batch.md

@@ -128,9 +128,9 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    proof in the same window as that review. Gap or Critical/Important → `gap`;
    else proof → `green|red|gap`.
 
-   A recheck round is one dispatch per changed surface, not one per checklist: the
-   recheck agent carries every open checklist (code, test, doubt) for that diff and
-   answers each by name. Merging cuts dispatches; dropping a checklist does not.
+   Group recheck findings by owning role and changed surface. Each exact
+   specialist rechecks its own fingerprints and the correction diff; code, test,
+   and doubt remain separate dispatches, even on the same diff.
    Reviewer fan-out does not shrink the writer batch. Reviewers queue at the
    same cap as writers (10; see
    [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md#scale-limits)).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "7.2.7",
+  "version": "7.2.8",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, pi, and Devin CLI",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",

package/scripts/build-host-artifacts.sh

@@ -100,7 +100,6 @@ render_codex_skill_tree() {
       ;;
     esac
   done < <(find "$_sd" -type f)
-  pin_context_skills_root "$_dest" .agents/skills
 }
 
 render_omp_skill_tree() {
@@ -114,18 +113,15 @@ render_omp_skill_tree() {
     case "$_r" in
     SKILL.md)
       gen_omp_skill_file "$f" "$_out"
-      omp_rewrite_skill_refs "$_out" "$(basename "$_dest")/$_r"
       ;;
     *.md)
       gen_omp_markdown_file "$f" "$_out"
-      omp_rewrite_skill_refs "$_out" "$(basename "$_dest")/$_r"
       ;;
     *)
       cp "$f" "$_out"
       ;;
     esac
   done < <(find "$_sd" -type f)
-  pin_context_skills_root "$_dest" .omp/skills
 }
 
 render_pi_skill_tree() {
@@ -148,7 +144,6 @@ render_pi_skill_tree() {
       ;;
     esac
   done < <(find "$_sd" -type f)
-  pin_context_skills_root "$_dest" .pi/skills
 }
 
 render_devin_skill_tree() {
@@ -171,7 +166,6 @@ render_devin_skill_tree() {
       ;;
     esac
   done < <(find "$_sd" -type f)
-  pin_context_skills_root "$_dest" .devin/skills
 }
 
 mkdir -p "$OUT_ROOT/claude" "$OUT_ROOT/codex" "$OUT_ROOT/omp" "$OUT_ROOT/pi" "$OUT_ROOT/devin"
@@ -204,6 +198,7 @@ while IFS= read -r d; do
   [ "$name" = ".impeccable" ] && continue
   render_codex_skill_tree "$d" "$OUT_ROOT/codex/skills/$name"
 done < <(find "$PACK_SRC/skills" -mindepth 1 -maxdepth 1 -type d)
+pin_context_skills_root "$OUT_ROOT/codex/skills" .agents/skills
 
 while IFS= read -r f; do
   name="$(basename "$f" .md)"
@@ -225,6 +220,8 @@ while IFS= read -r d; do
     ;;
   esac
 done < <(find "$PACK_SRC/skills" -mindepth 1 -maxdepth 1 -type d)
+omp_rewrite_skill_refs "$OUT_ROOT/omp/skills"
+pin_context_skills_root "$OUT_ROOT/omp/skills" .omp/skills
 
 while IFS= read -r f; do
   name="$(basename "$f" .md)"
@@ -248,6 +245,7 @@ while IFS= read -r d; do
     ;;
   esac
 done < <(find "$PACK_SRC/skills" -mindepth 1 -maxdepth 1 -type d)
+pin_context_skills_root "$OUT_ROOT/pi/skills" .pi/skills
 
 while IFS= read -r f; do
   name="$(basename "$f" .md)"
@@ -265,6 +263,7 @@ while IFS= read -r d; do
   [ "$name" = ".impeccable" ] && continue
   render_devin_skill_tree "$d" "$OUT_ROOT/devin/skills/$name"
 done < <(find "$PACK_SRC/skills" -mindepth 1 -maxdepth 1 -type d)
+pin_context_skills_root "$OUT_ROOT/devin/skills" .devin/skills
 
 while IFS= read -r f; do
   name="$(basename "$f" .md)"

package/scripts/omp-generate.sh

@@ -44,6 +44,7 @@ gen_omp_markdown_file() {
     -e '/Rules in scope/{N;s#;\n[[:space:]]*`[^`]+` mirror on Codex##;}' \
     -e '/On Codex, use the/{N;s# On Codex, use the mirrors under\n`[^`]+`\.##;s# On Codex, use the\nmirrors under `[^`]+`\.##;s# On Codex, use the\nmirror under `[^`]+`\.##;}' \
     -e 's#Host mapping: Claude Code uses `Agent` \(`Task` is its legacy alias\); Codex uses#Host mapping: omp fresh-context dispatch uses the `task` tool (`tasks[]` batch); hosts use#g' \
+    -e 's#Skills name exact fresh roles; hosts select matching native profiles and#On omp, every `task` item (each `tasks[]` member) sets `agent` to the exact native profile;\nuse `agent: "devrites-code-reviewer"`, `agent: "devrites-test-analyst"`, or\n`agent: "devrites-slice-wright"` for those roles, including rechecks and repairs.\nKeep `.frontend`, `.backend`, and `.SLICE-001` on dispatch labels, not `agent`.\nAn omitted `agent` selects the default worker; `agent: "reviewer"` is generic. Hosts#' \
     -e 's#`Agent` call#`task` call#g' \
     -e 's#Claude: N concurrent Task wrights \(`acceptEdits`, cwd=worktree\)\.#omp: one `tasks[]` batch of N wrights; `task` has no `cwd` or `acceptEdits`, so each task names its absolute worktree path and the wright works only there.#g' \
     -e 's#^Claude grants only the exact wright `acceptEdits`;#omp has no permission modes: only the wright'"'"'s `tools` allowlist has `edit`/`write`, and the root stays source-read-only by instruction. Claude grants only the exact wright `acceptEdits`;#' \
@@ -62,24 +63,33 @@ gen_omp_markdown_file() {
     "$_src" > "$_out"
 }
 
-# Rewrite one installed omp skill file in place. $2 is its path under the skills
-# root (<skill>/<path>).
+# Rewrite installed omp skill Markdown in place. $1 is the complete skills root.
 # - omp loads skill files as skill://<skill>/<path> and cannot climb above a
 #   skill root, so each `../` link target or backtick path becomes an absolute
 #   skill:// URL.
 omp_rewrite_skill_refs() {
-  python3 - "$1" "$2" <<'PY'
-import posixpath, re, sys
-path, rel = sys.argv[1], sys.argv[2]
-here = posixpath.dirname(rel)
-def fix(m):
-    target = posixpath.normpath(posixpath.join(here, m.group(2)))
-    return m.group(0) if target.startswith("..") else m.group(1) + "skill://" + target
-with open(path, encoding="utf-8") as fh:
-    text = fh.read()
-text = re.sub(r"(\]\(|`)((?:\.\./)+[A-Za-z0-9._/-]+)", fix, text)
-with open(path, "w", encoding="utf-8") as fh:
-    fh.write(text)
+  python3 - "$1" <<'PY'
+import os, posixpath, re, sys
+root = sys.argv[1]
+def fail(error):
+    raise error
+for directory, _, names in os.walk(root, onerror=fail):
+    for name in names:
+        if not name.endswith(".md"):
+            continue
+        path = os.path.join(directory, name)
+        if os.path.islink(path):
+            continue
+        rel = os.path.relpath(path, root).replace(os.sep, "/")
+        here = posixpath.dirname(rel)
+        def fix(m):
+            target = posixpath.normpath(posixpath.join(here, m.group(2)))
+            return m.group(0) if target.startswith("..") else m.group(1) + "skill://" + target
+        with open(path, encoding="utf-8") as fh:
+            text = fh.read()
+        text = re.sub(r"(\]\(|`)((?:\.\./)+[A-Za-z0-9._/-]+)", fix, text)
+        with open(path, "w", encoding="utf-8") as fh:
+            fh.write(text)
 PY
 }