devrites 7.3.0 → 7.3.1

package/pack/generated/claude/skills/rite-review/SKILL.md

@@ -62,6 +62,9 @@ Pull these via `Read` when the diff demands them:
 0. Read `.claude/skills/devrites-lib/reference/standards/core.md` first (the always-on operating rules); pull the
    on-demand rules above as the diff demands them.
    Resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding) before loading workspace artifacts.
+   Under Autocomplete, return scheduling for its
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   before cold/local recovery, preserving Review's source-local return cursor.
 1. Read `spec.md`, `tasks.md`, `state.md`, `decisions.md`,
    `touched-files.md`, `.devrites/principles.md` (if present: the binding invariants to score
    the diff against), and the `git diff`. For "what would this change break"
@@ -127,6 +130,10 @@ Pull these via `Read` when the diff demands them:
      [[`agents.md`](../devrites-lib/reference/standards/agents.md) § Result admission](../devrites-lib/reference/standards/agents.md#result-admission).
      Either `Outcome: gap` stops Review; silence, failure, or malformed output never
      becomes an empty findings list.
+   Under Autocomplete, before native wait return scheduling to its global frontier
+   pass with cohort handles retained; standalone Review stays source-local. Apply
+   the shared protected validation window and identity recheck before account
+   admission.
 4. **Reconcile, don't re-review.** With the two parallel reports in hand, the inline
    lead reconciles. It does **not** re-run the code-review axes over correctness /
    readability / architecture / maintainability that `devrites-code-reviewer` already

package/pack/generated/claude/skills/rite-vet/SKILL.md

@@ -78,6 +78,9 @@ plan declares a root-authored executable workflow file, read
    assumptions, and state. Require approved Plan and `Decision coverage: CLEAR`;
    otherwise stop for Define or Clarify. Check placement (`get_architecture`),
    blast radius (`trace_path`), and reuse (`search_graph`) per [`code-navigation.md`](../devrites-lib/reference/standards/code-navigation.md).
+   Under Autocomplete, return scheduling for its
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   before cold/local recovery; preserve Vet's source-local return cursor.
 1. **Select depth.** Apply `reference/depth.md` exactly; never skip. Initial passes
    record engineering verdict and test-plan coverage. Valid Recovery rechecks
    retain prior depth; enter 1b.
@@ -87,12 +90,18 @@ plan declares a root-authored executable workflow file, read
    parallel under `../devrites-lib/reference/parallel-dispatch.md`: independent
    read-only passes on one frozen candidate. Missing required account blocks.
    Meanwhile run root steps 2–4, including step 3 preflight commands, on that
-   candidate; reconcile returned accounts.
+   candidate. Under Autocomplete, before native wait return scheduling to its
+   global frontier pass with reviewer handles retained; standalone Vet stays
+   source-local. Apply the shared protected validation window and identity
+   recheck before reconciling returned accounts.
 1b. **Recovery recheck.** Require valid return cursor, accepted prior finding,
    exact fingerprint/reproduction, repaired candidate identity, changed
    paths/criteria, affected drift/evidence, and the recorded delta self-check.
    Freeze that packet and dispatch each exact owning reviewer once,
    fresh/read-only, limited to it — all its open fingerprints in that dispatch.
+   Under Autocomplete, before native wait use the same controller pass and retained
+   handles as step 1a; standalone Vet stays source-local. Apply the same
+   protected-window account admission.
    Do not rerun broad inventory or unaffected reviewers. Close the prior
    fingerprint only with discriminating evidence plus an explicit
    correction-created regression verdict on the touched invariants (acyclic

package/pack/generated/codex/skills/devrites-lib/reference/parallel-workspaces.md

@@ -69,6 +69,9 @@ incomplete, stale or human-blocked future work is a planning/repair/blocked
 opportunity, not a fatal pool failure. Retain every readiness reason: fixing stale
 bindings does not waive a coexisting human/access/safety gate. Re-Vet affected
 predecessor assumptions, then record current bindings; never auto-refresh a digest.
+Read archived predecessors in place through the engine's referenced read-only
+readiness lookup. Never copy an archive into live `work/` merely to read/hash it:
+that can resurrect stale controller leases and claims.
 
 ## Recover avoidable serialization
 
@@ -106,13 +109,28 @@ reslicing unchanged work.
 
 ## Continuous global frontier
 
-At entry, each landing, planning/review return and before any wait or final reply:
+Autocomplete executes this bounded pass at every phase entry (including cold
+Prove/Vet/Review), before phase-local recovery, on each landing/planning/review
+return, and immediately before a native wait or final reply. A nested phase
+returns scheduling to Autocomplete; its source-local phase/recovery return cursor
+and pending native reviewer handles remain intact. This is not a second phase
+controller or a persistent frontier artifact.
 
 1. Re-read controller lease, per-source state/questions/readiness and authorized
-   sequence. Scan all stages, not only the owner's next local slice. While writers
-   run, root advances authorized Spec → Clarify → Temper → Define/Plan → Vet,
-   including narrow repair/re-Vet of prepared targets, under unchanged approval
-   and safety rules. Missing human authority blocks that target, not safe siblings.
+   sequence. Examine every recorded authorized source once per pass, not only
+   the owner's next local slice or first blocked child. Prepare absent targets
+   through authorized native Spec → Clarify → Temper → Define/Plan → Vet; repair
+   and re-Vet current readiness of prepared targets now, not after owner Seal.
+   Assess actual source gates, claims and explicit planning/Build restrictions
+   before routing. Owner-local red/human/access gates withhold that owner or its
+   actual consumers, not independent authorized planning; true whole-run safety,
+   access and claim constraints still bind. Retain concrete actions or blockers
+   in existing source artifacts under normal write authority.
+   Yield a child at its pending reviewer/phase boundary back to this controller;
+   never recursively wait for child completion while parent returns are pending.
+   Reconcile available parent returns before another pass. A native wait is
+   justified only after concrete authorized actions/blockers across the pool
+   have been examined; reading later phase skills is not pending Plan/Vet work.
    If an explicit/AFK capacity change differs from retained capacity, reconcile it
    before selection using `parallel add --root <repo> --slug <controller> --cap N --json -`
    with stdin `[]`. This changes capacity only, not workers or a complete lease's
@@ -137,11 +155,14 @@ At entry, each landing, planning/review return and before any wait or final repl
    Unsupported isolation uses truthful serial owner dispatch and ordinary ordered
    handoff, never early same-tree foreign Build or concurrent same-worktree writers.
 4. Launch every selected native writer before waiting on any; keep scheduling
-   planning and independent review while they run. Land each individually green
-   sibling through Build review/proof and `parallel integrate --slice <key>`;
-   refill immediately from the whole authorized pool. A red sibling repairs in
-   place and holds its slot/paths; it does not delay independent green landings.
-   Never satisfy a producer edge on writer return or green-but-unlanded work.
+   planning and independent review while they run, including while the owner
+   awaits Prove/Vet/Review accounts. Apply the protected window below before any
+   landing: defer control mutations while frozen validation is pending. Outside
+   that window, land each individually green sibling through Build review/proof
+   and `parallel integrate --slice <key>`; refill immediately from the whole pool.
+   A red sibling repairs in place and holds its slot/paths; it does not delay
+   independent safe landings. Never satisfy a producer edge on writer return or
+   green-but-unlanded work.
    After worker-bound review/proof and source bookkeeping finish, prune only
    verified clean integrated checkouts with `parallel prune --root <repo>
    --slug <controller>`. Retain transfer refs/lease identities; dirty or ignored
@@ -182,8 +203,17 @@ controller bookkeeping nor sibling proof closes a child's acceptance.
 
 Prove/Polish/Review/Seal remain per workspace with fresh candidate bindings. Shared
 durable Polish outputs serialize; source changes invalidate affected evidence.
-Before any non-lease product correction, shared durable Polish write or control
-checkpoint, freeze new writer admissions, drain/reconcile retained writers, land
+From candidate freeze/validator dispatch through account admission, preserve the
+exact candidate, control tip and all consumed metadata/validator inputs. Independent
+authorized planning and isolated writers may proceed only without changing those
+inputs or shared runtime resources. Defer integration, checkpoints, cross-source
+corrections and consumed-artifact edits until the window closes; retained green
+workers keep their identities/slots. Recheck candidate, control-tip identity and
+consumed inputs before accepting each account; drift invalidates affected accounts
+and requires native fresh validation, never acceptance against a moving tip.
+After any protected validation window closes, before a non-lease product correction,
+shared durable Polish write or control checkpoint, freeze new writer admissions,
+drain/reconcile retained writers, land
 safe green work and cleanup the lease. Preserve blocked work; never force-clean
 it merely to advance a phase. Perform phase-owned correction/proof/checkpoint,
 then resume the pool from new HEAD. Never accept unrelated commits as expected
@@ -192,6 +222,10 @@ ControlTip or invent phase slices. Read-only frozen proof/review and planning-on
 Normal ordered handoff reuses the same controller and prepared child cursor.
 Never archive controller/source while retained lease owns it; clean up owned
 workers first, preserving salvage and unknown outcomes.
+Global scheduling is not global gating or ordered handoff. Unmet or abandoned
+owner gates remain non-green: an owner request to defer obligations routes Spec
+Drift Guard → Plan → affected Vet under existing authority, or retains the blocked
+source. It never becomes Prove green or Seal GO merely to reach another source.
 
 Early child WIPs can interleave with parent WIPs. Parent-only Ship must not absorb
 those commits as if parent alone were sealed. Deferred release waits for every

package/pack/generated/codex/skills/rite-autocomplete/SKILL.md

@@ -88,6 +88,9 @@ next sequence continuation through Vet in a second session, then stop.
 
 1. **Orient and parse.** Resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding); when a workspace exists,
    require its `state.md` and read its cursor; a fresh idea starts empty at step 2.
+   Before phase-local cold recovery, execute the bounded
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier);
+   retain this source's return cursor and pending reviewer handles.
    Before honoring `blocked` with terminal `next_action`,
    reconcile retained consumptive evidence and fingerprint attempts from
    `drift.md`/`evidence.md`; a retained fingerprint below its cap resumes offline
@@ -118,16 +121,12 @@ next sequence continuation through Vet in a second session, then stop.
    `$rite-build` batch loop → `$rite-prove` → `$rite-polish` →
    `$rite-review` → `$rite-seal`. Read and execute each skill; durable files, not
    chat, carry state. Apply the mutable post-vet budget before first Build.
-   Execute [`parallel-workspaces.md`](../devrites-lib/reference/parallel-workspaces.md):
-   continuously scan the authorized recorded sequence across stages, preparing
-   and re-Vetting future targets while writers run. Build queries the global
-   pool with `parallel select --from-plan --slug <controller> --workspaces
-   <controller,authorized-source,...> --cap N`; N is explicit `--parallel N`, else
-   sentinel `max_parallel`, else 10 — one global writer cap, including explicit 1.
-   Always pass resolved `--parallel N` to Build. Cap>1 uses an isolated first
-   writer even when initially alone; refill globally per landing and planning/
-   review return. Unsupported host stays serial. No local ready slice is not
-   completion while authorized planning, repair/re-Vet or independent work remains.
+   Execute the shared [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   at phase entry, before recovery, on returns and before native waits, not only
+   during Build or after Seal. Preserve source-local phase cursors; Autocomplete
+   retains repository scheduling. Apply its protected validation window before
+   landings/checkpoints and account admission. Pass resolved `--parallel N` to
+   Build under its one global cap and existing admission/isolation gates.
    **Completion:** loop reaches Seal GO or persists a valid stop before any later phase.
 5. **Apply stops.** At every gate use
    [stop-conditions.md](reference/stop-conditions.md). A `blocked` label alone is not a stop condition:

package/pack/generated/codex/skills/rite-autocomplete/reference/loop.md

@@ -67,13 +67,20 @@ Workspace files, not chat, carry state. Read/execute each phase skill:
 | 3 | `$rite-temper` | harden or reduce; `expand` and extra acceptance stop for a human; irreversible risk still pauses |
 | 4 | `$rite-define` | approved plan/tasks/traceability |
 | 5 | `$rite-vet` | every plan; derive mutable budget after READY |
-| 6 | `$rite-build` global frontier | execute [shared controller workflow](../../devrites-lib/reference/parallel-workspaces.md); scan authorized stages and repair/re-Vet while writers run, refill per landing under one global cap; charge each source once per landed slice |
+| 6 | `$rite-build` | execute shared controller selection/admission; charge each source once per landed slice |
 | 7 | `$rite-prove` | all slices built except deferred (`Satisfies: none`); approved proof; recovery on red |
 | 8 | `$rite-polish` | re-prove after code edits |
 | 9 | `$rite-review` | in-scope correction then fresh proof |
 | 10 | `$rite-seal` | GO/NO-GO; no Git |
 | 11 | `$rite-ship` | only after GO; `--ship` never authorizes Git; stop at literal-GO/native approval |
 
+At every phase entry, before cold/local recovery, on reviewer/planning returns and
+before native waits, Autocomplete executes the bounded
+[global frontier pass](../../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier).
+Keep source-local return cursors and pending handles; apply its protected
+validation window before accepting accounts or landing work. This scheduling
+precedes owner Seal and does not change ordered handoff below.
+
 Check [stop-conditions.md](stop-conditions.md) before advancing. Discard stale
 pass evidence after source edits. Re-read the selected source before each phase per [phase target binding](../../devrites-lib/reference/parallel-workspaces.md#phase-target-binding). On a cold resume or
 new activation, run `devrites-engine check regression <slug>`: `BLOCKED` names a

package/pack/generated/codex/skills/rite-prove/SKILL.md

@@ -35,8 +35,9 @@ TTHW, and exact signal-bearing errors; never assert DX (trigger `devex`).
   grammar/hashing. Spec Drift Guard owns revealed contract drift.
 - Root runs vetted gates/browser and records immutable evidence; proof runner
   validates it. Only the bounded wright fixes product source/tests.
-- **Prove remains the controlling caller** during technical backtracking. Save
-  its cursor; run Plan repair, Recovery Vet, remediation, and re-proof inline;
+- **Prove remains the source-local controlling caller** during technical backtracking;
+  under Autocomplete, repository scheduling stays with Autocomplete. Save
+  Prove's cursor; run Plan repair, Recovery Vet, remediation, and re-proof inline;
   consume nested boundaries; resume the failed rung. A strategy is spent after
   three no-progress attempts on the exact same fingerprint; escalate it per the
   [retry contract](../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve)
@@ -60,12 +61,15 @@ test changes.
 ## Workflow
 
 1. **Orient.** Read core, resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding), require `state.md`, and read its
-   cursor. On blocked Prove cold resume, reconcile retained consumptive evidence
-   and no-progress corrections before accepting terminal none; a distinct
-   fingerprint below cap resumes offline triage without another real action.
+   cursor. Under Autocomplete, return scheduling for its
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   before cold/local recovery; preserve Prove's source-local return cursor.
+   On blocked Prove cold resume, reconcile retained consumptive evidence and
+   no-progress corrections before accepting terminal none; a distinct fingerprint
+   below cap resumes offline triage without another real action.
 2. **Freeze scope.** Read spec, tasks, state, test plan, and full diff. Require
-   every slice built except a [deferred slice](../rite-plan/reference/slicing.md#deferred-slice). Missing `test-plan.md` returns to Vet inline (Prove stays the controlling
-   caller) and resumes here; it never authorizes ad hoc proof.
+   every slice built except a [deferred slice](../rite-plan/reference/slicing.md#deferred-slice). Missing `test-plan.md` returns to Vet inline (Prove stays the source-local
+   controlling caller) and resumes here; it never authorizes ad hoc proof.
 3. **Approve commands.** If absent, use
    [test-command-discovery](reference/test-command-discovery.md) over repository
    manifests/CI. Discovery is evidence only: `test-plan.md` is the sole approved runtime
@@ -119,6 +123,10 @@ test changes.
 7. **Independent validation.** Fresh read-only `devrites-proof-runner` and
    `devrites-spec-reviewer`, in one parallel wave, judge the same candidate/commands/evidence/acceptance map.
    Neither runs commands; reject missing/stale, invented-ID, label-only or self-attested reports.
+   Under Autocomplete, before native wait return scheduling to its global frontier
+   pass, retaining both validator handles. Standalone Prove stays source-local.
+   Apply the shared protected validation window and recheck identities before
+   admitting accounts.
 8. **Map proof.** Reconcile verdicts under [acceptance-proof.md](reference/acceptance-proof.md).
    Every criterion/scenario/interaction/key link needs discriminating evidence or a
    blocker, including critical-path, observability, developer and wiring branches.

package/pack/generated/codex/skills/rite-review/SKILL.md

@@ -62,6 +62,9 @@ Pull these via `Read` when the diff demands them:
 0. Read `.agents/skills/devrites-lib/reference/standards/core.md` first (the always-on operating rules); pull the
    on-demand rules above as the diff demands them.
    Resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding) before loading workspace artifacts.
+   Under Autocomplete, return scheduling for its
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   before cold/local recovery, preserving Review's source-local return cursor.
 1. Read `spec.md`, `tasks.md`, `state.md`, `decisions.md`,
    `touched-files.md`, `.devrites/principles.md` (if present: the binding invariants to score
    the diff against), and the `git diff`. For "what would this change break"
@@ -127,6 +130,10 @@ Pull these via `Read` when the diff demands them:
      [[`agents.md`](../devrites-lib/reference/standards/agents.md) § Result admission](../devrites-lib/reference/standards/agents.md#result-admission).
      Either `Outcome: gap` stops Review; silence, failure, or malformed output never
      becomes an empty findings list.
+   Under Autocomplete, before native wait return scheduling to its global frontier
+   pass with cohort handles retained; standalone Review stays source-local. Apply
+   the shared protected validation window and identity recheck before account
+   admission.
 4. **Reconcile, don't re-review.** With the two parallel reports in hand, the inline
    lead reconciles. It does **not** re-run the code-review axes over correctness /
    readability / architecture / maintainability that `devrites-code-reviewer` already

package/pack/generated/codex/skills/rite-vet/SKILL.md

@@ -78,6 +78,9 @@ plan declares a root-authored executable workflow file, read
    assumptions, and state. Require approved Plan and `Decision coverage: CLEAR`;
    otherwise stop for Define or Clarify. Check placement (`get_architecture`),
    blast radius (`trace_path`), and reuse (`search_graph`) per [`code-navigation.md`](../devrites-lib/reference/standards/code-navigation.md).
+   Under Autocomplete, return scheduling for its
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   before cold/local recovery; preserve Vet's source-local return cursor.
 1. **Select depth.** Apply `reference/depth.md` exactly; never skip. Initial passes
    record engineering verdict and test-plan coverage. Valid Recovery rechecks
    retain prior depth; enter 1b.
@@ -87,12 +90,18 @@ plan declares a root-authored executable workflow file, read
    parallel under `../devrites-lib/reference/parallel-dispatch.md`: independent
    read-only passes on one frozen candidate. Missing required account blocks.
    Meanwhile run root steps 2–4, including step 3 preflight commands, on that
-   candidate; reconcile returned accounts.
+   candidate. Under Autocomplete, before native wait return scheduling to its
+   global frontier pass with reviewer handles retained; standalone Vet stays
+   source-local. Apply the shared protected validation window and identity
+   recheck before reconciling returned accounts.
 1b. **Recovery recheck.** Require valid return cursor, accepted prior finding,
    exact fingerprint/reproduction, repaired candidate identity, changed
    paths/criteria, affected drift/evidence, and the recorded delta self-check.
    Freeze that packet and dispatch each exact owning reviewer once,
    fresh/read-only, limited to it — all its open fingerprints in that dispatch.
+   Under Autocomplete, before native wait use the same controller pass and retained
+   handles as step 1a; standalone Vet stays source-local. Apply the same
+   protected-window account admission.
    Do not rerun broad inventory or unaffected reviewers. Close the prior
    fingerprint only with discriminating evidence plus an explicit
    correction-created regression verdict on the touched invariants (acyclic

package/pack/generated/devin/skills/devrites-lib/reference/parallel-workspaces.md

@@ -69,6 +69,9 @@ incomplete, stale or human-blocked future work is a planning/repair/blocked
 opportunity, not a fatal pool failure. Retain every readiness reason: fixing stale
 bindings does not waive a coexisting human/access/safety gate. Re-Vet affected
 predecessor assumptions, then record current bindings; never auto-refresh a digest.
+Read archived predecessors in place through the engine's referenced read-only
+readiness lookup. Never copy an archive into live `work/` merely to read/hash it:
+that can resurrect stale controller leases and claims.
 
 ## Recover avoidable serialization
 
@@ -106,13 +109,28 @@ reslicing unchanged work.
 
 ## Continuous global frontier
 
-At entry, each landing, planning/review return and before any wait or final reply:
+Autocomplete executes this bounded pass at every phase entry (including cold
+Prove/Vet/Review), before phase-local recovery, on each landing/planning/review
+return, and immediately before a native wait or final reply. A nested phase
+returns scheduling to Autocomplete; its source-local phase/recovery return cursor
+and pending native reviewer handles remain intact. This is not a second phase
+controller or a persistent frontier artifact.
 
 1. Re-read controller lease, per-source state/questions/readiness and authorized
-   sequence. Scan all stages, not only the owner's next local slice. While writers
-   run, root advances authorized Spec → Clarify → Temper → Define/Plan → Vet,
-   including narrow repair/re-Vet of prepared targets, under unchanged approval
-   and safety rules. Missing human authority blocks that target, not safe siblings.
+   sequence. Examine every recorded authorized source once per pass, not only
+   the owner's next local slice or first blocked child. Prepare absent targets
+   through authorized native Spec → Clarify → Temper → Define/Plan → Vet; repair
+   and re-Vet current readiness of prepared targets now, not after owner Seal.
+   Assess actual source gates, claims and explicit planning/Build restrictions
+   before routing. Owner-local red/human/access gates withhold that owner or its
+   actual consumers, not independent authorized planning; true whole-run safety,
+   access and claim constraints still bind. Retain concrete actions or blockers
+   in existing source artifacts under normal write authority.
+   Yield a child at its pending reviewer/phase boundary back to this controller;
+   never recursively wait for child completion while parent returns are pending.
+   Reconcile available parent returns before another pass. A native wait is
+   justified only after concrete authorized actions/blockers across the pool
+   have been examined; reading later phase skills is not pending Plan/Vet work.
    If an explicit/AFK capacity change differs from retained capacity, reconcile it
    before selection using `parallel add --root <repo> --slug <controller> --cap N --json -`
    with stdin `[]`. This changes capacity only, not workers or a complete lease's
@@ -137,11 +155,14 @@ At entry, each landing, planning/review return and before any wait or final repl
    Unsupported isolation uses truthful serial owner dispatch and ordinary ordered
    handoff, never early same-tree foreign Build or concurrent same-worktree writers.
 4. Launch every selected native writer before waiting on any; keep scheduling
-   planning and independent review while they run. Land each individually green
-   sibling through Build review/proof and `parallel integrate --slice <key>`;
-   refill immediately from the whole authorized pool. A red sibling repairs in
-   place and holds its slot/paths; it does not delay independent green landings.
-   Never satisfy a producer edge on writer return or green-but-unlanded work.
+   planning and independent review while they run, including while the owner
+   awaits Prove/Vet/Review accounts. Apply the protected window below before any
+   landing: defer control mutations while frozen validation is pending. Outside
+   that window, land each individually green sibling through Build review/proof
+   and `parallel integrate --slice <key>`; refill immediately from the whole pool.
+   A red sibling repairs in place and holds its slot/paths; it does not delay
+   independent safe landings. Never satisfy a producer edge on writer return or
+   green-but-unlanded work.
    After worker-bound review/proof and source bookkeeping finish, prune only
    verified clean integrated checkouts with `parallel prune --root <repo>
    --slug <controller>`. Retain transfer refs/lease identities; dirty or ignored
@@ -182,8 +203,17 @@ controller bookkeeping nor sibling proof closes a child's acceptance.
 
 Prove/Polish/Review/Seal remain per workspace with fresh candidate bindings. Shared
 durable Polish outputs serialize; source changes invalidate affected evidence.
-Before any non-lease product correction, shared durable Polish write or control
-checkpoint, freeze new writer admissions, drain/reconcile retained writers, land
+From candidate freeze/validator dispatch through account admission, preserve the
+exact candidate, control tip and all consumed metadata/validator inputs. Independent
+authorized planning and isolated writers may proceed only without changing those
+inputs or shared runtime resources. Defer integration, checkpoints, cross-source
+corrections and consumed-artifact edits until the window closes; retained green
+workers keep their identities/slots. Recheck candidate, control-tip identity and
+consumed inputs before accepting each account; drift invalidates affected accounts
+and requires native fresh validation, never acceptance against a moving tip.
+After any protected validation window closes, before a non-lease product correction,
+shared durable Polish write or control checkpoint, freeze new writer admissions,
+drain/reconcile retained writers, land
 safe green work and cleanup the lease. Preserve blocked work; never force-clean
 it merely to advance a phase. Perform phase-owned correction/proof/checkpoint,
 then resume the pool from new HEAD. Never accept unrelated commits as expected
@@ -192,6 +222,10 @@ ControlTip or invent phase slices. Read-only frozen proof/review and planning-on
 Normal ordered handoff reuses the same controller and prepared child cursor.
 Never archive controller/source while retained lease owns it; clean up owned
 workers first, preserving salvage and unknown outcomes.
+Global scheduling is not global gating or ordered handoff. Unmet or abandoned
+owner gates remain non-green: an owner request to defer obligations routes Spec
+Drift Guard → Plan → affected Vet under existing authority, or retains the blocked
+source. It never becomes Prove green or Seal GO merely to reach another source.
 
 Early child WIPs can interleave with parent WIPs. Parent-only Ship must not absorb
 those commits as if parent alone were sealed. Deferred release waits for every

package/pack/generated/devin/skills/rite-autocomplete/SKILL.md

@@ -87,6 +87,9 @@ next sequence continuation through Vet in a second session, then stop.
 
 1. **Orient and parse.** Resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding); when a workspace exists,
    require its `state.md` and read its cursor; a fresh idea starts empty at step 2.
+   Before phase-local cold recovery, execute the bounded
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier);
+   retain this source's return cursor and pending reviewer handles.
    Before honoring `blocked` with terminal `next_action`,
    reconcile retained consumptive evidence and fingerprint attempts from
    `drift.md`/`evidence.md`; a retained fingerprint below its cap resumes offline
@@ -117,16 +120,12 @@ next sequence continuation through Vet in a second session, then stop.
    `/rite-build` batch loop → `/rite-prove` → `/rite-polish` →
    `/rite-review` → `/rite-seal`. Read and execute each skill; durable files, not
    chat, carry state. Apply the mutable post-vet budget before first Build.
-   Execute [`parallel-workspaces.md`](../devrites-lib/reference/parallel-workspaces.md):
-   continuously scan the authorized recorded sequence across stages, preparing
-   and re-Vetting future targets while writers run. Build queries the global
-   pool with `parallel select --from-plan --slug <controller> --workspaces
-   <controller,authorized-source,...> --cap N`; N is explicit `--parallel N`, else
-   sentinel `max_parallel`, else 10 — one global writer cap, including explicit 1.
-   Always pass resolved `--parallel N` to Build. Cap>1 uses an isolated first
-   writer even when initially alone; refill globally per landing and planning/
-   review return. Unsupported host stays serial. No local ready slice is not
-   completion while authorized planning, repair/re-Vet or independent work remains.
+   Execute the shared [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   at phase entry, before recovery, on returns and before native waits, not only
+   during Build or after Seal. Preserve source-local phase cursors; Autocomplete
+   retains repository scheduling. Apply its protected validation window before
+   landings/checkpoints and account admission. Pass resolved `--parallel N` to
+   Build under its one global cap and existing admission/isolation gates.
    **Completion:** loop reaches Seal GO or persists a valid stop before any later phase.
 5. **Apply stops.** At every gate use
    [stop-conditions.md](reference/stop-conditions.md). A `blocked` label alone is not a stop condition:

package/pack/generated/devin/skills/rite-autocomplete/reference/loop.md

@@ -67,13 +67,20 @@ Workspace files, not chat, carry state. Read/execute each phase skill:
 | 3 | `/rite-temper` | harden or reduce; `expand` and extra acceptance stop for a human; irreversible risk still pauses |
 | 4 | `/rite-define` | approved plan/tasks/traceability |
 | 5 | `/rite-vet` | every plan; derive mutable budget after READY |
-| 6 | `/rite-build` global frontier | execute [shared controller workflow](../../devrites-lib/reference/parallel-workspaces.md); scan authorized stages and repair/re-Vet while writers run, refill per landing under one global cap; charge each source once per landed slice |
+| 6 | `/rite-build` | execute shared controller selection/admission; charge each source once per landed slice |
 | 7 | `/rite-prove` | all slices built except deferred (`Satisfies: none`); approved proof; recovery on red |
 | 8 | `/rite-polish` | re-prove after code edits |
 | 9 | `/rite-review` | in-scope correction then fresh proof |
 | 10 | `/rite-seal` | GO/NO-GO; no Git |
 | 11 | `/rite-ship` | only after GO; `--ship` never authorizes Git; stop at literal-GO/native approval |
 
+At every phase entry, before cold/local recovery, on reviewer/planning returns and
+before native waits, Autocomplete executes the bounded
+[global frontier pass](../../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier).
+Keep source-local return cursors and pending handles; apply its protected
+validation window before accepting accounts or landing work. This scheduling
+precedes owner Seal and does not change ordered handoff below.
+
 Check [stop-conditions.md](stop-conditions.md) before advancing. Discard stale
 pass evidence after source edits. Re-read the selected source before each phase per [phase target binding](../../devrites-lib/reference/parallel-workspaces.md#phase-target-binding). On a cold resume or
 new activation, run `devrites-engine check regression <slug>`: `BLOCKED` names a

package/pack/generated/devin/skills/rite-prove/SKILL.md

@@ -34,8 +34,9 @@ TTHW, and exact signal-bearing errors; never assert DX (trigger `devex`).
   grammar/hashing. Spec Drift Guard owns revealed contract drift.
 - Root runs vetted gates/browser and records immutable evidence; proof runner
   validates it. Only the bounded wright fixes product source/tests.
-- **Prove remains the controlling caller** during technical backtracking. Save
-  its cursor; run Plan repair, Recovery Vet, remediation, and re-proof inline;
+- **Prove remains the source-local controlling caller** during technical backtracking;
+  under Autocomplete, repository scheduling stays with Autocomplete. Save
+  Prove's cursor; run Plan repair, Recovery Vet, remediation, and re-proof inline;
   consume nested boundaries; resume the failed rung. A strategy is spent after
   three no-progress attempts on the exact same fingerprint; escalate it per the
   [retry contract](../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve)
@@ -59,12 +60,15 @@ test changes.
 ## Workflow
 
 1. **Orient.** Read core, resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding), require `state.md`, and read its
-   cursor. On blocked Prove cold resume, reconcile retained consumptive evidence
-   and no-progress corrections before accepting terminal none; a distinct
-   fingerprint below cap resumes offline triage without another real action.
+   cursor. Under Autocomplete, return scheduling for its
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   before cold/local recovery; preserve Prove's source-local return cursor.
+   On blocked Prove cold resume, reconcile retained consumptive evidence and
+   no-progress corrections before accepting terminal none; a distinct fingerprint
+   below cap resumes offline triage without another real action.
 2. **Freeze scope.** Read spec, tasks, state, test plan, and full diff. Require
-   every slice built except a [deferred slice](../rite-plan/reference/slicing.md#deferred-slice). Missing `test-plan.md` returns to Vet inline (Prove stays the controlling
-   caller) and resumes here; it never authorizes ad hoc proof.
+   every slice built except a [deferred slice](../rite-plan/reference/slicing.md#deferred-slice). Missing `test-plan.md` returns to Vet inline (Prove stays the source-local
+   controlling caller) and resumes here; it never authorizes ad hoc proof.
 3. **Approve commands.** If absent, use
    [test-command-discovery](reference/test-command-discovery.md) over repository
    manifests/CI. Discovery is evidence only: `test-plan.md` is the sole approved runtime
@@ -118,6 +122,10 @@ test changes.
 7. **Independent validation.** Fresh read-only `devrites-proof-runner` and
    `devrites-spec-reviewer`, in one parallel wave, judge the same candidate/commands/evidence/acceptance map.
    Neither runs commands; reject missing/stale, invented-ID, label-only or self-attested reports.
+   Under Autocomplete, before native wait return scheduling to its global frontier
+   pass, retaining both validator handles. Standalone Prove stays source-local.
+   Apply the shared protected validation window and recheck identities before
+   admitting accounts.
 8. **Map proof.** Reconcile verdicts under [acceptance-proof.md](reference/acceptance-proof.md).
    Every criterion/scenario/interaction/key link needs discriminating evidence or a
    blocker, including critical-path, observability, developer and wiring branches.

package/pack/generated/devin/skills/rite-review/SKILL.md

@@ -61,6 +61,9 @@ Pull these via `Read` when the diff demands them:
 0. Read `.devin/skills/devrites-lib/reference/standards/core.md` first (the always-on operating rules); pull the
    on-demand rules above as the diff demands them.
    Resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding) before loading workspace artifacts.
+   Under Autocomplete, return scheduling for its
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   before cold/local recovery, preserving Review's source-local return cursor.
 1. Read `spec.md`, `tasks.md`, `state.md`, `decisions.md`,
    `touched-files.md`, `.devrites/principles.md` (if present: the binding invariants to score
    the diff against), and the `git diff`. For "what would this change break"
@@ -126,6 +129,10 @@ Pull these via `Read` when the diff demands them:
      [[`agents.md`](../devrites-lib/reference/standards/agents.md) § Result admission](../devrites-lib/reference/standards/agents.md#result-admission).
      Either `Outcome: gap` stops Review; silence, failure, or malformed output never
      becomes an empty findings list.
+   Under Autocomplete, before native wait return scheduling to its global frontier
+   pass with cohort handles retained; standalone Review stays source-local. Apply
+   the shared protected validation window and identity recheck before account
+   admission.
 4. **Reconcile, don't re-review.** With the two parallel reports in hand, the inline
    lead reconciles. It does **not** re-run the code-review axes over correctness /
    readability / architecture / maintainability that `devrites-code-reviewer` already

package/pack/generated/devin/skills/rite-vet/SKILL.md

@@ -77,6 +77,9 @@ plan declares a root-authored executable workflow file, read
    assumptions, and state. Require approved Plan and `Decision coverage: CLEAR`;
    otherwise stop for Define or Clarify. Check placement (`get_architecture`),
    blast radius (`trace_path`), and reuse (`search_graph`) per [`code-navigation.md`](../devrites-lib/reference/standards/code-navigation.md).
+   Under Autocomplete, return scheduling for its
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   before cold/local recovery; preserve Vet's source-local return cursor.
 1. **Select depth.** Apply `reference/depth.md` exactly; never skip. Initial passes
    record engineering verdict and test-plan coverage. Valid Recovery rechecks
    retain prior depth; enter 1b.
@@ -86,12 +89,18 @@ plan declares a root-authored executable workflow file, read
    parallel under `../devrites-lib/reference/parallel-dispatch.md`: independent
    read-only passes on one frozen candidate. Missing required account blocks.
    Meanwhile run root steps 2–4, including step 3 preflight commands, on that
-   candidate; reconcile returned accounts.
+   candidate. Under Autocomplete, before native wait return scheduling to its
+   global frontier pass with reviewer handles retained; standalone Vet stays
+   source-local. Apply the shared protected validation window and identity
+   recheck before reconciling returned accounts.
 1b. **Recovery recheck.** Require valid return cursor, accepted prior finding,
    exact fingerprint/reproduction, repaired candidate identity, changed
    paths/criteria, affected drift/evidence, and the recorded delta self-check.
    Freeze that packet and dispatch each exact owning reviewer once,
    fresh/read-only, limited to it — all its open fingerprints in that dispatch.
+   Under Autocomplete, before native wait use the same controller pass and retained
+   handles as step 1a; standalone Vet stays source-local. Apply the same
+   protected-window account admission.
    Do not rerun broad inventory or unaffected reviewers. Close the prior
    fingerprint only with discriminating evidence plus an explicit
    correction-created regression verdict on the touched invariants (acyclic