devrites 7.2.8 → 7.3.0

package/engine/internal/parallel/pathdisjoint.go

@@ -20,8 +20,47 @@ var winAbsRE = regexp.MustCompile(`(?i)^[A-Za-z]:[/\\]`)
 
 // SlicePaths is one path-disjoint eligibility unit.
 type SlicePaths struct {
-	ID    string   `json:"id"`
-	Paths []string `json:"paths"`
+	ID        string   `json:"id"`
+	Workspace string   `json:"workspace,omitempty"`
+	Paths     []string `json:"paths"`
+}
+
+// SliceKey identifies a slice in its source workspace; empty means controller.
+func SliceKey(workspace, id string) string {
+	if workspace == "" {
+		return id
+	}
+	return workspace + "/" + id
+}
+
+func normalizeSlices(controller string, slices []SlicePaths, root string) ([]SlicePaths, error) {
+	normalized := make([]SlicePaths, 0, len(slices))
+	seen := make(map[string]bool, len(slices))
+	for _, item := range slices {
+		if err := validateSliceID(item.ID); err != nil {
+			return nil, err
+		}
+		if item.Workspace != "" {
+			if err := validateSlug(item.Workspace); err != nil {
+				return nil, err
+			}
+			if item.Workspace == controller {
+				item.Workspace = ""
+			}
+		}
+		key := SliceKey(item.Workspace, item.ID)
+		if seen[key] {
+			return nil, fmt.Errorf("duplicate slice id %q", key)
+		}
+		seen[key] = true
+		paths, err := validateSlicePaths(item.Paths, fmt.Sprintf("slice %q", key), root)
+		if err != nil {
+			return nil, err
+		}
+		item.Paths = paths
+		normalized = append(normalized, item)
+	}
+	return normalized, nil
 }
 
 // NormalizePath mirrors scripts/check-path-disjoint.py: slash-normalize, reject
@@ -116,11 +155,16 @@ func CheckPathDisjoint(slices []SlicePaths, root string) ([]string, error) {
 	for index, item := range slices {
 		label := fmt.Sprintf("slice %d", index)
 		if item.ID != "" {
-			label = fmt.Sprintf("slice %q", item.ID)
-			ids = append(ids, item.ID)
+			label = fmt.Sprintf("slice %q", SliceKey(item.Workspace, item.ID))
+			ids = append(ids, SliceKey(item.Workspace, item.ID))
 		} else {
 			ids = append(ids, fmt.Sprintf("%d", index))
 		}
+		if item.Workspace != "" {
+			if err := validateSlug(item.Workspace); err != nil {
+				return nil, err
+			}
+		}
 		paths, err := validateSlicePaths(item.Paths, label, root)
 		if err != nil {
 			return nil, err

package/engine/internal/parallel/prune.go

@@ -0,0 +1,133 @@
+package parallel
+
+import (
+	"errors"
+	"fmt"
+	"os"
+)
+
+func fullyClean(worktree string) error {
+	out, err := git(worktree, "status", "--porcelain", "--untracked-files=all", "--ignored=matching")
+	if err != nil {
+		return err
+	}
+	if out != "" {
+		return fmt.Errorf("worktree has tracked, untracked, or ignored data: %s", worktree)
+	}
+	return nil
+}
+
+// acceptedWorker checks the ref even when its checkout has already disappeared.
+// Control rewrites WIP commits, so exact transfer identity replaces ancestry.
+func acceptedWorker(root, slug string, lease *Lease, sl LeaseSlice, registered map[string]bool) error {
+	if sl.Branch != workerBranch(slug, lease.BatchID, sl.Workspace, sl.ID) || !ownedWorktreePath(root, lease.BatchID, sl) {
+		return fmt.Errorf("worker identity is not owned: %s (%s)", sl.WorktreePath, sl.Branch)
+	}
+	accepted, err := revParse(root, sl.TransferCommit)
+	if err != nil || sl.TransferCommit == "" {
+		return fmt.Errorf("worker has no usable accepted transfer: %s", sl.Branch)
+	}
+	tip, err := revParse(root, "refs/heads/"+sl.Branch)
+	if err != nil || tip != accepted {
+		return fmt.Errorf("worker branch differs from accepted transfer %s: %s", accepted, sl.Branch)
+	}
+	if _, err := os.Lstat(sl.WorktreePath); os.IsNotExist(err) {
+		if registered[resolvedPath(sl.WorktreePath)] {
+			return fmt.Errorf("missing worker checkout remains registered; preserve its index and recovery metadata: %s", sl.WorktreePath)
+		}
+		return nil
+	} else if err != nil {
+		return err
+	}
+	if !registered[resolvedPath(sl.WorktreePath)] {
+		return fmt.Errorf("worker path is not registered; leaving replacement untouched: %s", sl.WorktreePath)
+	}
+	ref, err := git(sl.WorktreePath, "symbolic-ref", "--quiet", "HEAD")
+	if err != nil || ref != "refs/heads/"+sl.Branch {
+		return fmt.Errorf("worker checkout switched branch: %s", sl.WorktreePath)
+	}
+	head, err := headSHA(sl.WorktreePath)
+	if err != nil || head != accepted {
+		return fmt.Errorf("worker checkout differs from accepted transfer: %s", sl.WorktreePath)
+	}
+	return fullyClean(sl.WorktreePath)
+}
+
+// Prune removes only unchanged integrated checkouts, not refs or lease rows.
+// Worker-bound review/proof and source bookkeeping must finish before callers prune.
+func Prune(root, slug string) (removed []string, err error) {
+	err = withLeaseLock(root, slug, func() error {
+		path, err := LeasePath(root, slug)
+		if err != nil {
+			return err
+		}
+		lease, err := ReadLease(path)
+		if err != nil {
+			return err
+		}
+		if err := normalizeLease(lease, slug); err != nil {
+			return err
+		}
+		if _, err := controllerLease(root, slug); err != nil {
+			return err
+		}
+		if _, err := recoverLanding(root, slug, path, lease, false, false); err != nil {
+			return err
+		}
+		registered, err := registeredWorktrees(root)
+		if err != nil {
+			return err
+		}
+		var failures []error
+		for _, sl := range lease.Slices {
+			if sl.WrightStatus != WrightIntegrated {
+				continue
+			}
+			if err := acceptedWorker(root, slug, lease, sl, registered); err != nil {
+				failures = append(failures, fmt.Errorf("%s: %w", SliceKey(sl.Workspace, sl.ID), err))
+				continue
+			}
+			if _, err := os.Lstat(sl.WorktreePath); os.IsNotExist(err) {
+				continue
+			}
+			if err := removeWorktree(root, sl.WorktreePath); err != nil {
+				failures = append(failures, fmt.Errorf("kept recovery path %s and ref %s: %w", sl.WorktreePath, sl.Branch, err))
+				continue
+			}
+			removed = append(removed, sl.WorktreePath)
+		}
+		return errors.Join(failures...)
+	})
+	return removed, err
+}
+
+func prepareStaging(root, slug string, lease *Lease, path, branch string) error {
+	claim := LeaseSlice{ID: "integrate", WorktreePath: path}
+	if !ownedWorktreePath(root, lease.BatchID, claim) {
+		return fmt.Errorf("staging path is not owned: %s", path)
+	}
+	registered, err := registeredWorktrees(root)
+	if err != nil {
+		return err
+	}
+	if _, err := os.Lstat(path); err == nil {
+		if !registered[resolvedPath(path)] {
+			return fmt.Errorf("staging path is not registered; leaving replacement untouched: %s", path)
+		}
+		ref, err := git(path, "symbolic-ref", "--quiet", "HEAD")
+		if err != nil || ref != "refs/heads/"+branch {
+			return fmt.Errorf("staging checkout changed branch: %s", path)
+		}
+		if err := fullyClean(path); err != nil {
+			return err
+		}
+		if err := removeWorktree(root, path); err != nil {
+			return fmt.Errorf("staging checkout kept at %s: %w", path, err)
+		}
+	} else if !os.IsNotExist(err) {
+		return err
+	} else if registered[resolvedPath(path)] {
+		return fmt.Errorf("missing staging checkout remains registered; preserve its metadata and recover explicitly: %s", path)
+	}
+	return deleteBranch(root, branch)
+}

package/engine/internal/parallel/repository.go

@@ -0,0 +1,239 @@
+package parallel
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+
+	"github.com/devrites/devrites/internal/state"
+)
+
+// WithControlLock serializes controller admission and control-tip mutations.
+// devritesRoot is explicit; callers take this lock before any feature lock.
+func WithControlLock(devritesRoot string, fn func() error) error {
+	devritesRoot = filepath.Clean(devritesRoot)
+	if err := validateControlRoot(devritesRoot); err != nil {
+		return err
+	}
+	dir := devritesRoot
+	root := filepath.Dir(devritesRoot)
+	common, err := commonGitDir(root)
+	if err != nil {
+		return err
+	}
+	if common != "" {
+		dir = common
+	}
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return err
+	}
+	return state.WithLock(filepath.Join(dir, "parallel.lock"), fn)
+}
+
+func commonGitDir(root string) (string, error) {
+	common, err := git(root, "rev-parse", "--git-common-dir")
+	if err == nil {
+		if !filepath.IsAbs(common) {
+			common = filepath.Join(root, common)
+		}
+		return resolvedPath(common), nil
+	}
+	dir, absErr := filepath.Abs(root)
+	if absErr != nil {
+		return "", absErr
+	}
+	for {
+		if _, statErr := os.Lstat(filepath.Join(dir, ".git")); !os.IsNotExist(statErr) {
+			return "", fmt.Errorf("parallel repository discovery: %w", err)
+		}
+		parent := filepath.Dir(dir)
+		if parent == dir {
+			return "", nil
+		}
+		dir = parent
+	}
+}
+
+func validateControlRoot(root string) error {
+	info, err := os.Lstat(root)
+	if os.IsNotExist(err) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if !info.IsDir() {
+		return fmt.Errorf("parallel control root is not a safe directory: %s", root)
+	}
+	return nil
+}
+
+type repositoryLease struct {
+	root       string
+	controller string
+	lease      *Lease
+}
+
+// controlLeases reads explicit paths, never the ambient workspace override.
+func controlLeases(devritesRoot string) ([]repositoryLease, error) {
+	devritesRoot = filepath.Clean(devritesRoot)
+	if err := validateControlRoot(devritesRoot); err != nil {
+		return nil, err
+	}
+	root := filepath.Dir(devritesRoot)
+	roots := map[string]bool{resolvedPath(devritesRoot): true}
+	common, err := commonGitDir(root)
+	if err != nil {
+		return nil, err
+	}
+	if common != "" {
+		registered, err := registeredWorktrees(root)
+		if err != nil {
+			return nil, err
+		}
+		for path := range registered {
+			roots[filepath.Join(path, ".devrites")] = true
+		}
+	}
+	ordered := make([]string, 0, len(roots))
+	for path := range roots {
+		ordered = append(ordered, path)
+	}
+	sort.Strings(ordered)
+	var leases []repositoryLease
+	for _, control := range ordered {
+		work := filepath.Join(control, "work")
+		for _, path := range []string{control, work} {
+			if info, err := os.Lstat(path); err == nil && info.Mode()&os.ModeSymlink != 0 {
+				return nil, fmt.Errorf("parallel workspace path is a symlink: %s", path)
+			} else if err != nil && !os.IsNotExist(err) {
+				return nil, err
+			}
+		}
+		entries, err := os.ReadDir(work)
+		if os.IsNotExist(err) {
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+		for _, entry := range entries {
+			if !entry.IsDir() && entry.Type()&os.ModeSymlink == 0 {
+				continue
+			}
+			path := filepath.Join(work, entry.Name(), "parallel-lease.md")
+			info, err := os.Lstat(path)
+			if os.IsNotExist(err) {
+				continue
+			}
+			if err != nil {
+				return nil, err
+			}
+			if err := validateSlug(entry.Name()); err != nil {
+				return nil, err
+			}
+			if entry.Type()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
+				return nil, fmt.Errorf("parallel lease path is not an owned regular file: %s", path)
+			}
+			lease, err := ReadLease(path)
+			if err != nil {
+				return nil, fmt.Errorf("controller %s: %w", entry.Name(), err)
+			}
+			if err := normalizeLease(lease, entry.Name()); err != nil {
+				return nil, err
+			}
+			leases = append(leases, repositoryLease{filepath.Dir(control), entry.Name(), lease})
+		}
+	}
+	return leases, nil
+}
+
+func controllerLease(root, controller string) (*repositoryLease, error) {
+	leases, err := controlLeases(filepath.Join(root, ".devrites"))
+	if err != nil {
+		return nil, err
+	}
+	if len(leases) > 1 {
+		return nil, fmt.Errorf("multiple retained repository controller leases; cleanup explicitly before admission")
+	}
+	if len(leases) == 0 {
+		return nil, nil
+	}
+	found := &leases[0]
+	if controller != "" && (found.controller != controller || found.root != resolvedPath(root)) {
+		return nil, fmt.Errorf("repository controller lease retained by %s at %s; use its explicit root and --slug for mutations", found.controller, found.root)
+	}
+	return found, nil
+}
+
+// WorkspaceLeased protects both controller and source workspaces until cleanup.
+// devritesRoot is explicit; closeout holds WithControlLock through its rename.
+func WorkspaceLeased(devritesRoot, workspace string) (bool, error) {
+	if err := validateSlug(workspace); err != nil {
+		return false, err
+	}
+	leases, err := controlLeases(devritesRoot)
+	if err != nil {
+		return false, err
+	}
+	for _, found := range leases {
+		if found.controller == workspace {
+			return true, nil
+		}
+		for _, sl := range found.lease.Slices {
+			if sl.Workspace == workspace {
+				return true, nil
+			}
+		}
+	}
+	return false, nil
+}
+
+func validateSources(devritesRoot string, slices []SlicePaths) error {
+	seen := make(map[string]bool)
+	for _, sp := range slices {
+		if sp.Workspace == "" || seen[sp.Workspace] {
+			continue
+		}
+		seen[sp.Workspace] = true
+		if err := validateSource(devritesRoot, sp.Workspace); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateSource(devritesRoot, workspace string) error {
+	if workspace == "" {
+		return nil
+	}
+	path := devritesRoot
+	for index, component := range []string{"", "work", workspace, state.LedgerFile} {
+		if component != "" {
+			path = filepath.Join(path, component)
+		}
+		info, err := os.Lstat(path)
+		if err != nil {
+			return fmt.Errorf("source workspace %s is not live: %w", workspace, err)
+		}
+		if (index == 3 && !info.Mode().IsRegular()) || (index != 3 && !info.IsDir()) {
+			return fmt.Errorf("source workspace %s has an unsafe live path: %s", workspace, path)
+		}
+	}
+	return nil
+}
+
+func validateLeaseSources(devritesRoot string, lease *Lease) error {
+	seen := make(map[string]bool)
+	for _, sl := range lease.Slices {
+		if seen[sl.Workspace] {
+			continue
+		}
+		if err := validateSource(devritesRoot, sl.Workspace); err != nil {
+			return err
+		}
+		seen[sl.Workspace] = true
+	}
+	return nil
+}

package/engine/internal/parallel/select.go

@@ -23,39 +23,25 @@ func SelectGreedySeeded(cap int, seed, ready []SlicePaths, root string) ([]Slice
 	if cap < 1 || cap > MaxParallelSlices {
 		return nil, fmt.Errorf("cap must be 1-%d (got %d)", MaxParallelSlices, cap)
 	}
-	normalized := make([]SlicePaths, 0, len(ready))
-	seen := make(map[string]struct{}, len(ready))
-	for i, item := range ready {
-		label := fmt.Sprintf("slice %d", i)
-		if item.ID != "" {
-			if err := validateSliceID(item.ID); err != nil {
-				return nil, fmt.Errorf("%s: %w", label, err)
-			}
-			label = fmt.Sprintf("slice %q", item.ID)
-		} else {
-			return nil, fmt.Errorf("%s: missing id", label)
-		}
-		if _, ok := seen[item.ID]; ok {
-			return nil, fmt.Errorf("duplicate slice id %q", item.ID)
-		}
-		seen[item.ID] = struct{}{}
-		paths, err := validateSlicePaths(item.Paths, label, root)
-		if err != nil {
-			return nil, err
-		}
-		normalized = append(normalized, SlicePaths{ID: item.ID, Paths: paths})
+	normalized, err := normalizeSlices("", ready, root)
+	if err != nil {
+		return nil, err
+	}
+	seed, err = normalizeSlices("", seed, root)
+	if err != nil {
+		return nil, err
 	}
 
 	running := make(map[string]bool, len(seed))
 	for _, s := range seed {
-		running[s.ID] = true
+		running[SliceKey(s.Workspace, s.ID)] = true
 	}
 	selected := append([]SlicePaths{}, seed...)
 	for _, cand := range normalized {
 		if len(selected) >= cap {
 			break
 		}
-		if running[cand.ID] {
+		if running[SliceKey(cand.Workspace, cand.ID)] {
 			continue
 		}
 		if len(selected) == 0 {
@@ -79,32 +65,68 @@ func SelectGreedySeeded(cap int, seed, ready []SlicePaths, root string) ([]Slice
 // imports this package.
 var PlanReady func(root, slug string) ([]SlicePaths, error)
 
-// SelectForSlug is SelectGreedySeeded seeded from slug's running lease: its
-// active slices keep their slots and paths, and nothing it names (active or
-// landed) is picked again. eligible is ready minus those names; running is -1
-// when no lease seeded the selection. An empty slug skips the lease.
+// WorkspaceReady supplies native-authorized candidates and per-workspace notices.
+// main wires this hook from lib, which owns planning and dependency readiness.
+var WorkspaceReady func(root, controller, target string) ([]SlicePaths, []string, error)
+
+// SelectForSlug seeds every retained repository slot, regardless of source.
+// Bare candidates belong to slug; returned foreign identities stay qualified
+// relative to the retained controller. An omitted slug means controller-local.
 func SelectForSlug(root, slug string, capN int, ready []SlicePaths) (eligible, picks []SlicePaths, running int, err error) {
-	eligible, running = ready, -1
-	var seed []SlicePaths
+	if capN < 1 || capN > MaxParallelSlices {
+		return nil, nil, -1, fmt.Errorf("cap must be 1-%d (got %d)", MaxParallelSlices, capN)
+	}
 	if slug != "" {
-		lease, err := runningLease(root, slug)
+		if err := validateSlug(slug); err != nil {
+			return nil, nil, -1, err
+		}
+	}
+	running = -1
+	var seed []SlicePaths
+	controller := slug
+	var found *repositoryLease
+	if root != "" || slug != "" {
+		found, err = controllerLease(root, "")
 		if err != nil {
 			return nil, nil, -1, err
 		}
-		if lease != nil {
-			seed = activeSlices(lease)
-			running = len(seed)
-			named := make(map[string]bool, len(lease.Slices))
-			for _, sl := range lease.Slices {
-				named[sl.ID] = true
-			}
-			eligible = nil
-			for _, s := range ready {
-				if !named[s.ID] {
-					eligible = append(eligible, s)
+	}
+	candidates := make([]SlicePaths, len(ready))
+	copy(candidates, ready)
+	if found != nil {
+		if found.lease.PendingLanding != nil {
+			return nil, nil, -1, fmt.Errorf("pending landing blocks admission; recover controller %s at %s with integrate --apply-to-control or abort", found.controller, found.root)
+		}
+		controller = found.controller
+		if slug != "" && slug != controller {
+			for i := range candidates {
+				if candidates[i].Workspace == "" {
+					candidates[i].Workspace = slug
 				}
 			}
 		}
+		seed = activeSlices(found.lease)
+		running = len(seed)
+		if capacity := leaseCapacity(found.lease); capN > capacity {
+			capN = capacity
+		}
+	}
+	eligible, err = normalizeSlices(controller, candidates, root)
+	if err != nil {
+		return nil, nil, -1, err
+	}
+	if found != nil {
+		named := make(map[string]bool, len(found.lease.Slices))
+		for _, sl := range found.lease.Slices {
+			named[SliceKey(sl.Workspace, sl.ID)] = true
+		}
+		filtered := eligible[:0]
+		for _, sp := range eligible {
+			if !named[SliceKey(sp.Workspace, sp.ID)] {
+				filtered = append(filtered, sp)
+			}
+		}
+		eligible = filtered
 	}
 	picks, err = SelectGreedySeeded(capN, seed, eligible, root)
 	return eligible, picks, running, err
@@ -127,7 +149,7 @@ func selectMode(n int) string {
 func formatSelect(picks []SlicePaths, running int) string {
 	ids := make([]string, len(picks))
 	for i, item := range picks {
-		ids[i] = item.ID
+		ids[i] = SliceKey(item.Workspace, item.ID)
 	}
 	mode := selectMode(len(picks))
 	if running > 0 && len(picks) > 0 {

package/engine/main.go

@@ -74,7 +74,7 @@ Usage:
   devrites-engine check indexes [--root <dir>]  Report manifest and code-index presence as JSON
   devrites-engine detect commands [--root <dir>] [--json]
                                          Resolve test/lint/vet/build commands from the repository's own wiring
-  devrites-engine parallel <subcommand>   Deterministic parallel worktree lease/create/integrate/cleanup
+  devrites-engine parallel <subcommand>   Deterministic parallel worktree lease/create/integrate/prune/cleanup
   devrites-engine gates <subcommand> <slug>  Machine-checked gates.md ledger: scaffold/status/run/reverify/lint/precheck/attest/abandon
   devrites-engine state resolve <qid> "<ans>"  Resolve an open question and update state atomically
   devrites-engine state merge-manifest <slug> [pred...]  Fold the recorded predecessor chain's manifests into the release candidate manifest
@@ -125,6 +125,7 @@ func init() {
 	}
 	// parallel cannot import lib (lib imports it), so `parallel select --from-plan` gets the plan-derived ready set through this hook.
 	parallel.PlanReady = lib.PlanReady
+	parallel.WorkspaceReady = lib.WorkspaceReady
 	// `gates precheck` runs `check windows` through this hook for the same reason.
 	acceptance.WindowsCheck = lib.RunCheckWindows
 	// ...and `gates precheck --slice` learns which writer gates to skip.

package/pack/.claude/agents/devrites-proof-runner.md

@@ -26,8 +26,8 @@ and only the orchestrator-supplied changed paths.
    contradictory, whose output and exit come from different executions, whose
    command masks status, or whose exit and output disagree. A pass after a failed
    attempt on an unchanged digest is `flaky`: `fail` for its AC.
-2. Confirm every log, screenshot, trace, and result belongs to the supplied
-   candidate.
+2. Confirm proof belongs to the supplied candidate, except explicitly scoped
+   reuse backed by unchanged declared inputs and a valid executed origin.
 3. Map real REQ/AC/scenario/link IDs **and meaning** to observed proof. Invented/
    label-only maps or internal proof of an external outcome fail. Behavior MUST
    be positive, discriminating; reject skipped/focused/filtered/pending, zero-test,
@@ -49,13 +49,20 @@ and only the orchestrator-supplied changed paths.
    named blocker, never a pass. Otherwise use `cannot_verify`.
 8. A manual gate whose `gates.md` note lacks the human's own words or source, is a
    placeholder, or was runnable at Vet is `cannot_verify` ([`gates.md`](../skills/devrites-lib/reference/standards/gates.md)).
-9. An engine transcript (`DEVRITES-GATE-TRANSCRIPT v1` under `references/gates/`)
-   is immutable proof of its COMMAND, CWD, ATTEMPT, EXIT and output for the
-   candidate in CANDIDATE_BEFORE/AFTER. A `-reused.log` proves a gate for the
-   current candidate only when its INPUTS_SHA256 equals that of the gate's latest
-   executed, passing transcript.
-10. Recheck supplied before/after candidate identities. A mismatch or unexpected
-   repository mutation fails the side-effect boundary.
+9. An engine transcript (`DEVRITES-GATE-TRANSCRIPT v2` under `references/gates/`)
+   records one execution, not an assertion that proof is sufficient. Verify its
+   `TRANSCRIPT_SHA256` over all bytes before that footer; match the definition,
+   original output identity/byte count, declared inputs, EXIT and EXPECT verdict
+   against current ledger evidence and approved commands. Metadata and output may
+   be redacted; never hash the redacted body as the original output.
+   Reuse cites the unchanged executed origin path and its historical candidate
+   labels, with matching current `INPUTS_SHA256` and bounded dependency closure.
+   A legacy v1 or `-reused.log` alone cannot authorize reuse; request engine
+   `gates run`/`reverify --transcripts` to recover approved missing origins.
+10. Before/after identities must match within the recorded execution.
+    Historical/current candidate differences need the scoped reuse justification
+    above; never relabel an old observation. Unexpected repository mutation fails
+    the side-effect boundary.
 
 ## Rules
 

package/pack/.claude/skills/devrites-lib/SKILL.md

@@ -37,6 +37,8 @@ lifecycle state from chat or optional `README.md`.
   ([`workspace-artifact-schema.md`](reference/workspace-artifact-schema.md)).
 - [`reference/reply-contract.md`](reference/reply-contract.md): compact user-facing
   completion states. The host renders the response normally.
+- [`reference/parallel-workspaces.md`](reference/parallel-workspaces.md): explicit
+  phase targets, one isolated global controller, and source-owned proof.
 - [`reference/visual-playbooks/index.md`](reference/visual-playbooks/index.md): progressive
   visual HTML playbook router (load matching ids only; dual-read outline).
 

package/pack/.claude/skills/devrites-lib/reference/candidate-integrity.md

@@ -29,9 +29,13 @@ Same-candidate accounts may be cited when permitted. Corrections require
 new candidate checks, affected real proof and fresh affected exact reviewers for
 all open findings and dependency/regression closure, including newly triggered roles.
 After an all-met acceptance ledger has been executed, any candidate digest change
-requires `devrites-engine gates reverify <slug>` against the corrected frozen
-candidate before refreshed evidence or review bindings are written; ordinary
-`gates run` skips already-met rows and cannot refresh them.
+requires `devrites-engine gates reverify <slug> --transcripts` against the corrected
+frozen candidate before refreshed evidence or review bindings are written.
+Unchanged declared `INPUTS` may reuse complete passing originating transcripts;
+missing origins rerun only affected approved checks. Reuse is not execution.
+If non-file prerequisites changed or prior proof is doubtful, invalidate affected
+automatic evidence through the workspace's single-writer protocol before rerun.
+Ordinary `gates run` skips already-met rows and cannot refresh them.
 Changed contracts or uncertain closure require a full applicable pass.
 Unchanged sub-scope needs explicit unchanged-input/dependency justification and a
 link to original evidence. Never relabel an old candidate-bound account.

package/pack/.claude/skills/devrites-lib/reference/parallel-dispatch.md

@@ -45,6 +45,9 @@ If the candidate diff has no matching surfaces, record
    `proof-runner`, keep their own) with `devrites-engine packet <slug> --wave <w> --phase <p>
    --role <role> [--slice <SLICE-ID>] [--focus <file>]`: it names the bundle and frozen
    diff by reference, copies the digests, and runs the `open` lints. Build roles add `--slice <SLICE-ID>` (slice-scoped, slice-named bundle).
+   Packet rendering and dispatch verify each named diff's recorded SHA-256.
+   Manually authored `.diff`/`.patch` packets need explicit
+   `diff <64hex> <path>` binding rows too; an unbound diff is refused.
    Evaluate the skill's trigger conditions and pass each that fires — a role's
    Trigger column maps to the phase manifest's names: `security-auditor` →
    `security`; at Review, `frontend-reviewer` → `ui` and `performance-reviewer` →