devrites 7.3.2 → 7.3.4

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.3.4](https://github.com/ViktorsBaikers/DevRites/compare/v7.3.3...v7.3.4) (2026-11-03)
+
+### Fixed
+
+* **devrites:** restore global frontier and authenticated updates ([#207](https://github.com/ViktorsBaikers/DevRites/issues/207)) ([05cb719](https://github.com/ViktorsBaikers/DevRites/commit/05cb7198330b7ffa4d7176fc8398ff5a86b13f45))
+
+## [7.3.3](https://github.com/ViktorsBaikers/DevRites/compare/v7.3.2...v7.3.3) (2026-11-02)
+
+### Fixed
+
+* **devrites:** harden workflow mutations and host diagnostics ([#206](https://github.com/ViktorsBaikers/DevRites/issues/206)) ([849a7d1](https://github.com/ViktorsBaikers/DevRites/commit/849a7d182c13453f4a542bd2b4c58f9adccebe22))
+
 ## [7.3.2](https://github.com/ViktorsBaikers/DevRites/compare/v7.3.1...v7.3.2) (2026-11-02)
 
 ### Fixed
@@ -28,8 +40,35 @@ All notable changes to DevRites are documented here. The format follows [Keep a
   parallel controller, with rolling landings and refills across workspace sources.
 - Prune clean integrated worker checkouts without discarding transfer branches,
   proof identities, retained lease rows, or running siblings.
-
-### Fixed
+- Add read-only `frontier [slug]` reporting across recorded live and archived
+  sequence workspaces, with scoped preparation/repair/wait actions, explicit
+  mixed-workspace selection, and ambiguous-source refusal. Source-local selection
+  exposes the frontier without silently admitting other workspaces.
+
+### Fixed
+
+- Use `GH_TOKEN`, then `GITHUB_TOKEN`, then optional bounded noninteractive GitHub
+  CLI credential lookup for release API requests. Keep credentials off release
+  assets and off-origin redirects, fail explicit invalid credentials, and document
+  headless login and rate-limit recovery without exposing tokens.
+- Continue AFK from the narrow Vet-ready state and from actionable global native
+  preparation, preserving human gates, source cursors, and separate Ship approval.
+- Allow independent refill and capacity reconciliation after a parallel integration
+  failure without clearing its failure status or weakening pending-landing,
+  control-tip, overlap, capacity, or proof guards.
+- Enforce wright fanout and wider-batch guards even when a reslice review admits
+  another round window.
+- Recover a completed dispatch wave's retained claim through an exact recorded
+  return handle after claim-release failure, without replaying result admission.
+- Confine question resolution to checked workspaces and restore question/cursor
+  files together when publication fails. Bundle rollback now includes the failing
+  target and reports incomplete restoration.
+- Verify Windows root-handle rename protection in resolution race tests while
+  preserving replacement coverage on platforms that permit renaming open roots.
+- Honor explicitly acknowledged backward-phase repair checkpoints in regression
+  baselines while retaining ordinary regression and empty-acceptance checks.
+- Check Pi/omp native role loading in doctor, clarify instruction-only shell
+  boundaries, and validate OMP invocations plus Codex reference documents.
 
 - Recover exact recorded parallel landings after interrupted lease persistence;
   preserve late worker edits, ignored data, extra commits, and missing-checkout

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.3.2`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.3.2): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.3.4`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.3.4): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -273,6 +273,15 @@ no-recommendation questions still pause. When bounded recovery runs out,
 agents record a technical blocker instead of asking you. The full contract is
 in [`afk-hitl.md`](pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md).
 
+`devrites-engine frontier [slug]` reports the recorded sequence across live and
+archived workspaces without changing `ACTIVE`, creating workspaces, or launching
+agents. It distinguishes preparation, repair, waiting, and completed work, and
+prints an explicit mixed-workspace selection command when available. A source-local
+`parallel select --from-plan` exposes that frontier but still selects only its own
+workspace unless `--workspaces` is supplied. Native Autocomplete owns preparation
+and semantic admission; the report is neither Build readiness nor Ship approval.
+See the [frontier contract](docs/cli.md#sequence-frontier).
+
 ## Install, update, and remove
 
 ```bash
@@ -419,6 +428,17 @@ release assets. If an older engine reports `missing codex/hooks.json` or asks
 for `--source-dir`, use the npm or verified shell route once to reach a
 release with the self-contained updater.
 
+GitHub release API authentication uses `GH_TOKEN`, then `GITHUB_TOKEN`, then an
+optional, bounded, noninteractive `gh auth token --hostname github.com` lookup.
+GitHub CLI is not required. Credentials go only to the exact GitHub API origin,
+never release assets or off-origin redirects. Explicit invalid credentials fail
+instead of silently falling back to another identity. For a headless machine,
+run `gh auth login --hostname github.com --web` and complete its device-code flow
+in a browser on another device. Do not paste credentials into commands, logs, or
+support reports. `--force` controls managed-file replacement; it does not bypass
+GitHub authentication or rate limits. If authentication does not clear a rate
+limit, wait before retrying.
+
 `/rite-upgrade` is the separate, preservation-first route for reconciling an
 unfinished workspace; it never migrates cursor format or invents historical
 proof. `devrites-engine migrate` owns deterministic v5 schema normalization.

package/docs/cli.md

@@ -43,6 +43,7 @@ devrites-engine observe summary <slug>
 devrites-engine orient <slug>
 devrites-engine observe slice <slug> <SLICE-ID>
 devrites-engine next [slug]
+devrites-engine frontier [slug]
 devrites-engine handoff [slug] [--resume]
 devrites-engine recall --paths <p1,p2,...> [--limit n]
 devrites-engine context [slug] (--phase <p>|--skill <name>) [--role <r>] [--whole]
@@ -90,6 +91,21 @@ downloading assets. `--source-dir` and `--payload-dir` remain the advanced local
 update path for npm, shell, source-checkout, and test callers; a local `--check`
 needs only `--source-dir`.
 
+Release metadata requests to the exact HTTPS `api.github.com` origin use the
+first available credential: `GH_TOKEN`, then `GITHUB_TOKEN`, then optional
+`gh auth token --hostname github.com`. The helper is noninteractive, bounded to
+three seconds and 4 KiB of output; missing, failed, timed-out, or oversized helper
+output does not prevent an unauthenticated request. GitHub CLI is not required.
+An explicitly supplied invalid credential fails; the updater does not silently
+retry under another identity. Credentials are never sent to release assets or
+off-origin redirects. Same-origin GitHub API redirects may retain them.
+
+On a headless machine, run `gh auth login --hostname github.com --web`, then use
+the displayed device code in a browser on another device. Do not put credential
+values in commands, examples, logs, or support reports. `--force` permits
+managed-file replacement, not authentication or rate-limit bypass. Authenticated
+requests can still be rate-limited; wait before retrying when necessary.
+
 ## npm adapter
 
 The `npx devrites` adapter accepts `add` as an alias for `install`, `upgrade` for
@@ -143,18 +159,27 @@ self-contained updater.
   against the durable `regression-baseline.json` high-water mark. A lost fact
   prints `REGRESSION: <detail>` and exits `3`. `--update` rewrites the baseline
   under the feature lock at a durable checkpoint and prints each regression it
-  blesses as `REGRESSION-BLESSED`; with no baseline recorded the check reports
-  `unproven` and exits `0`. Recommended placement: compare on a cold resume or
-  scheduled wake before acting on durable state, ratchet after a landed slice
-  checkpoint or phase advance, and treat `BLOCKED` at Seal as NO-GO; `--update`
-  never excuses an unreconciled regression.
+  blesses as `REGRESSION-BLESSED`. A deliberate owner-authorized repair checkpoint
+  may accept a backward phase along with other acknowledged facts: the current
+  phase becomes the new baseline. Ordinary checks never bless losses or change
+  the baseline. If the update would remove every checked acceptance criterion and
+  met gate, `--allow-empty` is also required. With no baseline recorded the check
+  reports `unproven` and exits `0`. Recommended placement: compare on a cold
+  resume or scheduled wake before acting on durable state, ratchet after a landed
+  slice checkpoint or phase advance, and treat `BLOCKED` at Seal as NO-GO.
+  Never use automatic updates to hide an unreconciled regression.
 - `check continuation [slug]` prints `continuation: required` and
-  `invoke: <next_action>` when `.devrites/AFK` is present, `status` is
-  `running`, no question cursor is set, no blocking or escalating question is
-  open, and `next_action` is an internal phase command (`/rite-vet`,
-  `/rite-build`, not `/rite-ship`). Otherwise it prints `continuation: clear`.
-  Exit `0` either way: `required` means invoke that command, not pause for a
-  human. `handoff` prints the same lines.
+  `invoke: <next_action>` when `.devrites/AFK` is a regular file, `status` is
+  `running` (or specifically `phase=vet,status=ready`), no question cursor is
+  set, no blocking or escalating question is open, and `next_action` is a valid
+  internal phase command, not `/rite-ship`. Other ready statuses do not inherit
+  this exception. It also reports the sequence frontier: when the local cursor
+  is clear but related work needs native preparation, it can print
+  `continuation: required` with `invoke: /rite-autocomplete` and the original
+  source identity. Waiting, human-blocked, or completed work alone does not
+  require continuation. Neither result authorizes Ship, overrides a human gate,
+  or declares an unvetted workspace Build-ready. Successful verdicts exit `0`;
+  malformed or ambiguous state fails visibly. `handoff` prints the same lines.
 - `check drift <slug>` attributes readiness-input drift to the exact artifact.
   `--record` snapshots per-input SHA-256 digests into `readiness-inputs.json`
   under the feature lock after Vet records the aggregate binding; a later
@@ -227,6 +252,62 @@ checked by the root's explicit native re-read checklist. Repository build,
 test, lint, typecheck, schema, and release commands belong to that repository
 or CI.
 
+## Sequence frontier
+
+`devrites-engine frontier [slug]` is a read-only structural report across the
+source's recorded sequence. An explicit slug may name a live or archived
+workspace. Without one, the command uses the selected source; if `ACTIVE` is
+absent, recovery requires a unique archived terminal sequence tip with an exact
+recorded native `/rite-spec <next>` edge. Multiple possible sources fail as ambiguous;
+folder names and numeric suffixes are not authority.
+
+The report emits:
+
+- `frontier: actionable|waiting|blocked|clear`, or `frontier: none` for a
+  non-sequence source.
+- `frontier-source: <slug>` and `frontier-workspace:` rows naming each related
+  workspace's `location=live|archive|missing`, `action=inspect|prepare|repair|wait|complete`,
+  and reason. Archived intermediaries do not hide live descendants, and archived
+  workspaces never become writer candidates.
+  Running or execution-unknown dispatch roles wait; completed writer returns
+  without durable acceptance require native inspection, not another writer launch.
+- `frontier-select-command:` with an explicit `parallel select --from-plan
+  --workspaces ...` command when a live controller is available. Selection still
+  enforces current readiness, recorded dependencies and independence, retained
+  leases, path conflicts, and the repository-wide capacity. `frontier-picks:`
+  names eligible source-qualified slices; `frontier-selection: blocked` names a
+  selection refusal. These are observations, not writer launches.
+  The explicit pool excludes retained dispatch and human/question/scope-held
+  sources; their workspace rows remain visible. `--workspaces` is the exact
+  candidate list; `--slug` identifies the controller, not an implicit candidate.
+  Legacy per-source slice counters never reduce the global writer cap or exclude
+  independent children; recorded workspace-opening limits still apply.
+- `frontier-prepare:` for a recorded next Spec cursor or an unambiguous next entry
+  in an exact position/workspace table, or `frontier-review-sequence:` artifact
+  paths when remaining work or conflicting sequence maps require native review.
+
+Relations come from exact recorded `sequence_parent` edges, not name prefixes.
+Conflicting identities, cycles, malformed related state, or invalid declared
+sequence positions are refused. Missing or stale planning is a repair action,
+not permission to build. Continuation flags and remaining counts constrain new
+workspace preparation without silently discarding existing children.
+Conflicting or amended sequence maps suppress missing-workspace preparation even
+with a recorded Spec cursor until native authority normalization resolves them;
+valid existing live descendants remain visible and eligible for guarded selection.
+
+Under AFK, `next`, `handoff`, and `check continuation` expose the same frontier.
+A source-local `parallel select --from-plan` without `--workspaces` also prints
+the report to stderr, preserving its machine-readable selection on stdout and
+source-local picks: reporting another workspace never silently admits it.
+Native Autocomplete must inspect the returned preparation and review
+actions, read the approved roadmap and recorded restrictions, then invoke the
+owning Spec/Plan/Vet steps or explicit mixed selection. Path disjointness alone
+does not establish semantic independence or lift a planning-only restriction.
+
+The engine does not invoke models, create workspaces, change `ACTIVE`, resolve
+semantic authority, or grant Ship approval. These outputs guide the native host;
+they cannot guarantee that an arbitrary host follows the workflow.
+
 ## Acceptance ledger
 
 `gates` operates the `gates.md` ledger inside a feature workspace: one gate per
@@ -254,8 +335,12 @@ without it any `answered_by:` line in the resolved block, whatever its indentati
 `state close` transactionally archives a shipped workspace and clears matching
 `ACTIVE`.
 
-The mutating forms share the engine's root-safety, locking, and atomic-write
-boundary.
+Mutations share root-safety checks, feature locks, and atomic per-file writes.
+`state resolve` and `state apply-bundle` restore attempted files after returned
+publication errors; `rollback incomplete` identifies files needing inspection
+and recovery. These multi-file operations are not crash-atomic: process
+termination can leave partial updates, and unlocked readers can see intermediate
+state. Inspect both artifacts before resuming after an interrupted publication.
 
 The root scans and rechecks `questions.md` to allocate the next unused qid,
 manages Clarify return fields without rewriting unrelated Markdown, charges an

package/docs/command-map.md

@@ -41,8 +41,8 @@ The Go surface is intentionally closed and deterministic:
 
 | Lane | Commands | Owner |
 |---|---|---|
-| Candidate and deterministic checks | `check candidate`, `check readiness [--emit-binding]`, `check preconditions <slug> [--slice <SLICE-ID>]`, `check seal`, `check slice <slug> <SLICE-ID>`, `check task-graph`, `check regression <slug> [--update]`, `check continuation [slug]`, `check drift <slug> [--record]`, `check windows <slug>`, `check dup`, `check path-disjoint`, `parallel select`, `check skill-trust`, `check indexes`, `detect commands [--root <dir>] [--json]` | Candidate validates/hashes the strict project manifest; readiness checks phase files, the required `tasks.md` slice graph, or emits the vetted Build-input binding; `check preconditions` runs the `test-plan.md` preflight rows whose `Run at` is `vet` (or `pre-dispatch <SLICE>`) with candidate-bound transcripts; seal checks final files/open gates, that graph and binding, then exact candidate bindings. `check slice` preflights one slice before wright dispatch — contract present, exact Writer allowlist paths, `Satisfies` AC ids resolvable, bounded scope — so a malformed slice fails before a writer context is spent. `check indexes` reports install manifest and optional code-index directory presence as JSON. `parallel select` returns the greedy path-disjoint subset ≤ cap from the supplied ready slices, or with `--from-plan` from tasks.md slices whose dependencies state.md checks built. `check regression` compares current workspace progress against the durable `regression-baseline.json` high-water mark and `--update` ratchets it at a checkpoint, so a lost slice, unchecked criterion, or reopened question fails closed instead of passing silently. `check continuation` prints `required` and the phase command to invoke when AFK, `status=running`, and `next_action` is an internal phase edge; `clear` otherwise. Exit 0 either way. `handoff` prints the same lines. `check windows` scans the feature diff for newly introduced deferral markers (TODO/FIXME/skipped test/stub idioms) and fails when any lacks a `windows.md` waiver row — silent deferrals block the seal. `check dup` reports advisory near-duplicate clusters that survive renaming (normalized token shingles, transitive clusters, distance-boosted rank, `*`-marked diff overlap, stable content hashes, `.devrites/dup-ignore` dismissal ledger) — leads for reviewer triage, never a gate. `check drift` attributes readiness-input drift to the exact artifact: `--record` snapshots per-input SHA-256 digests into `readiness-inputs.json` under the feature lock, and a later compare names each `changed`/`missing`/`added` input (falling back to the aggregate `eng-review.md` binding plus mtime candidates when no baseline exists) so a stale-binding repair starts at the right file — advisory, never a gate. `detect commands` resolves the repository's own test/lint/vet/build commands (Makefile targets, then `package.json` scripts, then language-manifest fallbacks, plus the lockfile-derived package manager) so `gates.md` `CHECK` lines and proof steps cite real wiring instead of invented commands — read-only, no installs, no execution. |
-| Workspace observation | `observe summary`, `orient`, `observe slice <slug> <SLICE-ID>`, `next`, `handoff` | JSON workspace snapshot for agents (cursor, task graph, `artifact_budgets`, `bulk_files`); `orient` is an alias for `observe summary`. `observe slice` prints one `SLICE-###` section of `tasks.md` so Build reads a slice, not the file. `next` prints the minimal remaining lifecycle path plus advisory skips (e.g. clarify at zero open questions). `handoff` emits the deterministic resume record (cursor, `awaiting_human`, blocking question gates, ledger reduction with unmet/stale ids, dead ends, read-next order, continuation verdict) — the `/rite-handoff` spine and compaction-fallback entry. |
+| Candidate and deterministic checks | `check candidate`, `check readiness [--emit-binding]`, `check preconditions <slug> [--slice <SLICE-ID>]`, `check seal`, `check slice <slug> <SLICE-ID>`, `check task-graph`, `check regression <slug> [--update]`, `check continuation [slug]`, `check drift <slug> [--record]`, `check windows <slug>`, `check dup`, `check path-disjoint`, `parallel select`, `check skill-trust`, `check indexes`, `detect commands [--root <dir>] [--json]` | Candidate validates/hashes the strict project manifest; readiness checks phase files, the required `tasks.md` slice graph, or emits the vetted Build-input binding; `check preconditions` runs the `test-plan.md` preflight rows whose `Run at` is `vet` (or `pre-dispatch <SLICE>`) with candidate-bound transcripts; seal checks final files/open gates, that graph and binding, then exact candidate bindings. `check slice` preflights one slice before wright dispatch — contract present, exact Writer allowlist paths, `Satisfies` AC ids resolvable, bounded scope — so a malformed slice fails before a writer context is spent. `check indexes` reports install manifest and optional code-index directory presence as JSON. `parallel select` returns the greedy path-disjoint subset ≤ cap from the supplied ready slices, or with `--from-plan` from tasks.md slices whose dependencies state.md checks built; source-local selection reports the sequence frontier without silently admitting other workspaces. `check regression` compares current workspace progress against the durable `regression-baseline.json` high-water mark and `--update` ratchets it at a checkpoint, so a lost slice, unchecked criterion, or reopened question fails closed instead of passing silently. `check continuation` prints `required` and the phase command when AFK, `status=running` (or specifically `phase=vet,status=ready`), and an internal phase edge passes human/question guards; actionable global preparation may instead require `/rite-autocomplete`, never Ship authorization. Successful `required`/`clear` verdicts exit 0; malformed or ambiguous state fails visibly. `handoff` prints the same lines. `check windows` scans the feature diff for newly introduced deferral markers (TODO/FIXME/skipped test/stub idioms) and fails when any lacks a `windows.md` waiver row — silent deferrals block the seal. `check dup` reports advisory near-duplicate clusters that survive renaming (normalized token shingles, transitive clusters, distance-boosted rank, `*`-marked diff overlap, stable content hashes, `.devrites/dup-ignore` dismissal ledger) — leads for reviewer triage, never a gate. `check drift` attributes readiness-input drift to the exact artifact: `--record` snapshots per-input SHA-256 digests into `readiness-inputs.json` under the feature lock, and a later compare names each `changed`/`missing`/`added` input (falling back to the aggregate `eng-review.md` binding plus mtime candidates when no baseline exists) so a stale-binding repair starts at the right file — advisory, never a gate. `detect commands` resolves the repository's own test/lint/vet/build commands (Makefile targets, then `package.json` scripts, then language-manifest fallbacks, plus the lockfile-derived package manager) so `gates.md` `CHECK` lines and proof steps cite real wiring instead of invented commands — read-only, no installs, no execution. |
+| Workspace observation | `observe summary`, `orient`, `observe slice <slug> <SLICE-ID>`, `next`, `frontier [slug]`, `handoff` | JSON workspace snapshot for agents (cursor, task graph, `artifact_budgets`, `bulk_files`); `orient` is an alias for `observe summary`. `observe slice` prints one `SLICE-###` section of `tasks.md` so Build reads a slice, not the file. `next` prints the minimal remaining lifecycle path plus advisory skips (e.g. clarify at zero open questions). `frontier` reports recorded live/archive sequence relations, scoped actions, explicit mixed selection, and native preparation/review needs without changing ACTIVE or admitting writers; ambiguous source recovery refuses. Under AFK, `next` and `handoff` expose the same frontier while retaining the source cursor. `handoff` emits the deterministic resume record (cursor, `awaiting_human`, blocking question gates, ledger reduction with unmet/stale ids, dead ends, read-next order, continuation verdict) — the `/rite-handoff` spine and compaction-fallback entry. |
 | Context packets, dispatch waves, metrics, claims, notes | `context [slug] (--phase <p> \| --skill <name>) [--role <r>] [--trigger a,b]`, `dispatch <slug> <open\|start\|seal\|return\|status\|abandon>`, `candidate freeze`, `packet`, `metrics record`, `metrics summary`, `claim <add\|release\|list\|check>`, `note <add\|list\|check\|rm>` | `context` emits one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest — a dispatch target reads it instead of selecting files; `--skill` works without a workspace when `--out` is given. `dispatch` owns the launch-wave barrier (seal needs a handle per role; return needs seal; the last start seals; open --claim-session/--claim takes the wave's file claim, released by the completing return or abandon --release) and auto-records dispatch/return metrics. `candidate freeze` writes a wave's frozen `packets/<w>.diff` + `.sha256`; `packet` renders and lints one role's by-reference packet. `metrics` owns the append-only `metrics.jsonl` ledger. `claim` owns the append-only `.devrites/claims.jsonl` ledger — advisory, session-scoped file claims with TTL so concurrent same-tree sessions see each other's write intent before edits collide (conflict exits 3; never a substitute for one-writer-per-worktree). `note` owns the anchored `notes.md` ledger — notes bound to verbatim code quotes, regraded `exact`/`moved`/`stale`/`ambiguous`/`lost` as the code drifts; `check seal` refuses non-`exact` anchors. `check diff-scope` is the mechanical changed-paths ⊆ allowlist gate run before reviewer dispatch. |
 | Atomic workspace state | `state resolve`, `state merge-manifest`, `state apply-bundle <slug> <bundle.json>... [--dry-run]`, `state set <slug> key=value... [--unset key]`, `state append <slug> <ledger.md> --heading <text> --body-file <path\|->`, `state close`, `migrate [--dry-run] [--answer id=choice]` | Go owns answer/drop/batch resolution, the recorded predecessor-chain manifest union for a release milestone, the all-or-nothing apply of plan-drafter hunk bundles (base-hash pins, unique non-overlapping anchors, no lost IDs, no new task-graph or budget defect, no appended dated delta section), cursor writes (known phase, engine-owned schema, no return-cursor overwrite; an AFK pause names auto-pickable questions), append-only ledger sections that refuse a duplicate heading, transactional close, and fail-closed v5 schema normalization. |
 | Acceptance ledger | `gates scaffold`, `gates status`, `gates run [--timeout N]`, `gates reverify [--timeout N]`, `gates lint [--strict]`, `gates precheck <slug> --worktree <path> [--slice <SLICE-ID>]`, `gates attest <id> <note>`, `gates abandon <id> <why>` | Go owns the `gates.md` ledger: per-outcome gates whose runnable `CHECK`/`CWD` must exactly match a `test-plan.md` Build-entry preflight row, evidence bound to the gate definition digest (stale = unmet), `ABANDON:` handoffs, oracle lint, and the wright's never-evidence `precheck` of `RUN: writer` gates. Readiness/seal require a parse-clean, all-met ledger whenever `gates.md` is a required artifact. |

package/docs/engine/commands.md

@@ -9,7 +9,7 @@ workflow strategy.
 | Command | Deterministic responsibility |
 | --- | --- |
 | `install [flags]` | Install manifest-owned host artifacts and the optional shared binary. |
-| `update [flags]` | Refresh an existing managed installation. |
+| `update [flags]` | Refresh an existing managed installation. Release API authentication uses `GH_TOKEN`, then `GITHUB_TOKEN`, then optional bounded noninteractive `gh auth token --hostname github.com`; explicit invalid credentials fail. Never sends credentials to assets or off-origin redirects. `--force` does not bypass rate limits. See [release authentication](../cli.md#updates). |
 | `uninstall [flags]` | Remove managed artifacts while preserving runtime workspace state. |
 | `check candidate <slug>` | Validate the strict manifest and compute the content-bound project-candidate identity. Exits `3` when the manifest omits a path the feature's `WIP(<slug>):` checkpoint commits changed (net from the feature base to HEAD). Also exits `3` with `unattributed root edit: <paths>` while the feature's `tree-baseline.json` tripwire flags a product path (ADR-0038; see `dispatch`). |
 | `check readiness <slug>` | Check target-Phase files, open human gates from Clarify onward, the `tasks.md` slice graph when that artifact is required, canonical `AC-###` presence in `tasks.md`/`test-plan.md` when those artifacts are required, and the current stable Build-input binding when applicable. Leaving Vet with a `Run at` column, a slice whose `Files likely touched`/`Writer allowlist` names a dependency manifest or lockfile needs a `dependency-dry-run SLICE-###` row at `vet` with a passing transcript. Leaving Vet, every slice `state.md` does not check built (a deferred `Satisfies: none` slice excepted) must also pass the Build-entry `check slice` contract; each failure prints one `invariant: slice-check:` line naming the slice and its exact `check slice` reason, to fix in `/rite-plan` before READY. |
@@ -17,11 +17,11 @@ workflow strategy.
 | `check preconditions <slug> [--slice SLICE-###] [--timeout N]` | Run the `test-plan.md` Build-entry preflight rows whose optional `Run at` cell is `vet` (with `--slice`, `pre-dispatch <SLICE>`); `action` rows and rows without the cell never run. Writes one candidate-bound transcript per row under `references/gates/preflight-*/`; a row passes on exit 0. A `pre-dispatch` row whose newest transcript passed is kept, not re-run: it is a pre-edit baseline, so a re-dispatch never runs it against the slice's own edits; changing its command or cwd retires the pass. Exit `3` on any failure or an invalid `Run at` value. |
 | `check seal <slug>` | Check files required by target Phase `seal`, open human gates, the `tasks.md` slice graph, canonical `AC-###` presence when `tasks.md`/`test-plan.md` are required, the stable Build-input binding, and exact candidate bindings. `check readiness` and `check seal` also block a `scripts/` test driver that a tasks.md Writer allowlist plans or touched-files.md lists when no gates.md `CHECK` runs it and no `Driver waiver: <path> — DEC-### <reason>` line cites a recorded decision; waived drivers print as `note: unexecuted driver (waived by DEC-###): <path>` lines, on pass or block. |
 | `check path-disjoint [--root <dir>] [<json-file> | -]` | Verify slice path sets are pairwise disjoint. |
-| `parallel select --cap <1-10> [--root <dir>] [--slug <controller>] [--from-plan [--workspaces <slug,...>] \| <json-file> \| -]` | Choose a plan-order path-disjoint ready subset, seeded by all retained repository-controller slots and paths. `--from-plan` uses canonical built checkpoints, local and declared workspace producer dependencies, exact write sets and required dependency manifests. The internal `--workspaces` data-source parameter pools recorded forward continuations with current readiness and explicit native-vetted per-slice declarations; blocked/stale/missing candidates print scoped notices without hiding other ready work. Foreign identities print `<workspace>/<slice>`. |
+| `parallel select --cap <1-10> [--root <dir>] [--slug <controller>] [--from-plan [--workspaces <slug,...>] \| <json-file> \| -]` | Choose a plan-order path-disjoint ready subset, seeded by all retained repository-controller slots and paths. `--from-plan` uses canonical built checkpoints, local and declared workspace producer dependencies, exact write sets and required dependency manifests. Without `--workspaces`, it also reports the full recorded sequence frontier but keeps source-local picks; other workspaces are never silently admitted. The explicit `--workspaces` data-source parameter pools recorded forward continuations with current readiness and explicit native-vetted per-slice declarations; blocked/stale/missing candidates print scoped notices without hiding other ready work. Foreign identities print `<workspace>/<slice>`. |
 | `parallel <create\|add\|integrate\|prune\|cleanup\|status\|abort\|lease-read\|lease-write\|lease-clear\|record-green>` | One repository controller owns isolated workers across source workspaces. `create` accepts a single initial worker; `create`/`add --cap N` persist the global admission capacity. Explicit `add --cap N --json -` with stdin `[]` updates capacity only; lowering below active count refuses without canceling workers. A completed retained lease can refill at unchanged control tip. `record-green` and per-slice `integrate --slice <workspace/id> --apply-to-control` target source-qualified lanes (bare IDs mean controller lanes); integration keeps exact ancestry/path/dirty-work checks and lands `WIP(<source>):`. `prune` removes only verified clean integrated checkouts, retaining branches, proof identities, lease rows and controller. Status exposes the retained controller and pending landing; cleanup preserves salvage/unknown work. |
 | `check task-graph <slug>` | Validate `tasks.md` slice dependency graph for cycles, unknown deps, malformed tokens, duplicate IDs, missing `Dependencies`, and `depends_on` mismatch. Prints a non-blocking `ADVISORY size:` line (and records a `size-advisory` metric) for each slice with 12+ Writer allowlist files and no `Size rationale:`. A `Dependencies` ID may carry a `(via <interface>)` suffix (empty or unclosed is a malformed token); prints a non-blocking `ADVISORY edge:` line (and records an `edge-advisory` metric) for each edge with no via, or whose via text is not a case-insensitive substring of the dependency's `Consumes / Produces:`. Prints `schedule: <n> slices in <r> build rounds at cap 10` (the `/rite-build` batch selection replayed over each slice's Writer allowlist, else Files likely touched, plus the manifest parallel select reserves; omitted when a slice has no path) and a non-blocking `ADVISORY hub:` line (top five; records a `hub-advisory` metric) for each path, compared case-folded, that three or more slices without `Serial rationale:` write. Advisories print only when the graph is valid. |
-| `check regression <slug> [--update]` | Compare the workspace's structural progress facts (phase ordinal, checked ACs, met/abandoned gates, done slices, resolved questions, present artifacts) against the recorded `regression-baseline.json` high-water mark; `--update` ratchets the baseline forward under the feature lock and prints each blessed regression. |
-| `check continuation [slug]` | Print whether an armed AFK run must invoke its cursor instead of replying. `continuation: required` plus `invoke: <next_action>` when `.devrites/AFK` is a regular file, `status` is `running`, `question_id` is empty, no blocking or escalating question is open, and `next_action` is an internal phase command (`/rite-spec` through `/rite-seal`, including `/rite-plan`, not `/rite-ship` or `/rite-autocomplete`). Otherwise `continuation: clear` with a one-line `reason`. Exit `0` either way. `handoff` prints the same lines. |
+| `check regression <slug> [--update [--allow-empty]]` | Compare the workspace's structural progress facts (phase ordinal, checked ACs, met/abandoned gates, done slices, resolved questions, present artifacts) against the recorded `regression-baseline.json` high-water mark. Ordinary checks block lost facts without changing the baseline. `--update` records the current facts under the feature lock and prints each blessed regression; a deliberate owner-authorized repair checkpoint can accept a backward phase as the new baseline. Removing every checked AC and met gate also requires `--allow-empty`. Never automatically bless an unreconciled regression. |
+| `check continuation [slug]` | Print whether an armed AFK run must invoke its cursor instead of replying. `continuation: required` plus `invoke: <next_action>` requires a regular `.devrites/AFK`, `status=running` or specifically `phase=vet,status=ready`, empty `question_id`, no blocking/escalating question, and a valid internal phase command (`/rite-spec` through `/rite-seal`, including `/rite-plan`, not `/rite-ship` or `/rite-autocomplete`). Also emits the sequence frontier; a clear local cursor with actionable global preparation can require `invoke: /rite-autocomplete` while preserving the source identity. Waiting, human-blocked, or completed work alone does not require continuation. Neither route authorizes Ship or bypasses human/readiness gates. Successful `required`/`clear` verdicts exit `0`; malformed or ambiguous state fails visibly. `handoff` prints the same lines. |
 | `check drift <slug> [--record]` | Attribute readiness-input changes to the exact artifact. `--record` writes the per-input `readiness-inputs.json` digest baseline under the feature lock; without it the workspace diffs current inputs against that baseline (or falls back to the aggregate binding recorded in `eng-review.md`). Advisory: exit `0` on drift; a corrupt baseline exits `3`. A `test-plan.md` change limited to exact `Workflow Artifact reviewed identity: <64hex>` lines is reported as `reviewed-identity-only` (ADR-0034). `--record` also stores each slice's proof bytes (its `tasks.md` block plus the `test-plan.md` lines naming it); both modes print `ADVISORY proportion:` for a slice whose proof grew over 2x since that baseline or carries over 3x the median proof per AC. |
 | `check windows <slug> [--worktree\|--staged\|--base <ref>\|--since-dispatch <wave>]` | Fail on deferral and bar-lowering markers the change introduces without a waiver row in the workspace's `windows.md`: added TODO/FIXME/XXX/HACK, skipped/focused-test and stub idioms, checker suppressions, one-line empty catch; removed `deleted-test` files and net `removed-assertion` lines in remaining test files. `--since-dispatch <wave>` reports only `deleted-test`/`removed-assertion` against the work-tree snapshot (`tree` in `dispatch.json`) recorded when that build wright wave opened, untracked files included; it takes no `--cwd` and records the `windows-since` metric. |
 | `check dup [slug] [--all\|--worktree\|--staged\|--base <ref>] [--min-lines n] [--threshold f] [--ignore-file <path>] [--limit n] [--exclude <csv>]` | Report near-duplicate code clusters that survive comment stripping, literal collapsing, and identifier renaming — token-shingle matches chained into segments, clustered transitively, ranked with bounded path/line-distance boosts. Diff modes mark units overlapping changed hunks with `*`; stable content-derived cluster hashes let `.devrites/dup-ignore` dismissals survive line moves but resurface on structural edits. Staged mode reads index blobs and excludes untracked files. Bounded heuristic: successful scans/leads exit `0`; usage, unavailable input, and partial scans exit `2`. |
@@ -35,6 +35,7 @@ workflow strategy.
 | `orient <slug>` | Alias for `observe summary`. |
 | `observe slice <slug> <SLICE-ID>` | Print one `SLICE-###` section of `tasks.md` so Build reads a slice, not the file. |
 | `next [slug]` | Print the minimal remaining lifecycle path plus advisory skips; in Build also `eligible_now:`, `batch:` and the `select-command:` (`parallel select --root <project> --slug <slug> --cap N --from-plan`, N = AFK max_parallel else 10) that reproduces the batch. Prints `blocked: unattributed root edit: ...` after `open-questions:` and exits `3` while the ADR-0038 tripwire flags a product path; the rest of the output still prints. |
+| `frontier [slug]` | Read-only report across exact recorded sequence relations, including archived intermediaries and live descendants. Emits `frontier: actionable\|waiting\|blocked\|clear` (`none` for a non-sequence source), `frontier-source:`, and `frontier-workspace:` rows with location, `inspect\|prepare\|repair\|wait\|complete` action, and reason. Emits `frontier-select-command:`, `frontier-picks:`, `frontier-selection: blocked`, `frontier-prepare:`, or `frontier-review-sequence:` where applicable. Explicit slug may be archived; absent ACTIVE recovery requires a unique archived terminal tip with a recorded native Spec edge, otherwise refuses ambiguity. Never changes ACTIVE, restores archives, creates workspaces, or launches writers. Native preparation and semantic admission remain required; see [sequence frontier](../cli.md#sequence-frontier). |
 | `handoff [slug] [--resume]` | Emit the deterministic resume record: cursor fields, `awaiting_human`, open `questions.md` gate kinds, the `gates.md` reduction with unmet/stale/abandoned ids, `decisions.md` dead ends, in-flight dispatch waves (`inflight_wave:` lines: phase, state, pending roles, slices), missing required files, the canonical read-next order, and the same `continuation:` lines as `check continuation`. Read-only unless `--resume`, which appends one `resume` event (role root) to `metrics.jsonl`; `metrics summary` then reports minutes from each resume to the next dispatch. The `/rite-handoff` spine and the compaction-fallback entry point. |
 | `recall --paths <p1,p2,...> [--limit n]` | Read-time query over `.devrites/archive/`: list archived features whose `touched-files.md` candidate manifest covers a queried project-relative path (exact or directory prefix, case-folded), ranked by overlap count, then newest archive-directory mtime, then slug (default 10 features). Each feature prints up to 8 `archive/<slug>/<file>:<line>` pointers, then `+N more`: `decisions.md` `DEC-###` entries and `## Carry-forward constraints` bullets whose `Files:` overlap (or a constraint naming no files), plus `review.md`/`seal.md`/`drift.md` lines that mention a queried path; fenced examples are ignored. Never writes, caches, or indexes (no metric either); symlinked archive entries are refused. An unreadable archive file prints `unreadable:` and the scan continues. Exit `0` (including `recall: no archive`), `1` invalid archive directory, `2` usage. |
 | `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--slice <SLICE-ID>] [--recheck <inventory>] [--trigger a,b] [--inline-contract] [--whole]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. A root `--phase build\|autocomplete` bundle (no `--role`, no `--slice`) defaults to `--slice <active_slice>` while the state.md cursor phase is `build` and active_slice names a slice present in tasks.md (prints `scope: slice SLICE-### (auto from state.md) ...`), unless `.devrites/AFK` `max_parallel` is 2 or more or a parallel lease is `running` (the bundle stays whole); `--whole` opts out. Every bundle opens, after its header comments, with a table of contents: one `L<start>-<end> <section label>` line per `===== label =====` section, giving its exact line range in the bundle file. A bundle without `--role` (the root's own read) gives over-budget artifacts as by-reference indexes; a `--role` bundle leads with the role's agent contract and names the manifest's `rootOnly` paths instead of inlining them. When the contract resolves under `.claude/agents`, `.omp/agents`, or `.codex/agents` (the host loads it as the agent's system prompt), the bundle writes one header line naming its path, size, and SHA-256 instead of the body; other layouts (pi, devin, unknown) and `--inline-contract` (only with `--role`) inline the body, and a missing contract still exits `3`. Inside inlined files, a `--role` bundle replaces each `<!-- root-only -->`…`<!-- /root-only -->` block with a one-line stub naming the omitted heading, and does the same for each `<!-- model-surface -->` block unless the role is `security-auditor`, the feature has an `ai-spec.md`, or `spec.md`/`plan.md`/`tasks.md`/`design-brief.md` are absent or (outside the spec template's `AI-SPEC annex`) name a model, agent, RAG, or tool surface; an unbalanced or headingless marker exits `2`. `--slice` inlines that slice's `tasks.md` block and turns each over-budget artifact, and each artifact over 16 KiB except `spec.md`, into a by-reference index (path, SHA-256, headings, line hits for every ID the block cites); repeat `--slice` for several slices; an unknown slice exits `3`. In phase `build`, a `--role` bundle other than `slice-wright` without `--slice` exits `3` (`unscoped build reviewer bundle`). `--recheck <inventory>` (phase `build`, with `--role` and `--slice`; path relative to the workspace) writes `<phase>-<role>.<slice>.recheck.bundle.md`: the inventory file and `core.md` inline whole, every other non-`rootOnly` pack file becomes a by-reference index (path, SHA-256, headings with line numbers) followed by each section the inventory cites as `<file>.md § <heading>`; workspace handling matches `--slice`. A missing or empty inventory exits `2`. First reviews, full-inventory rechecks, Vet, `/rite-review`, and Seal do not use it. |
@@ -46,7 +47,7 @@ workflow strategy.
 | `claim <add\|release\|list\|check>` | Advisory session-scoped file claims in `.devrites/claims.jsonl` (append-only). `add` records intent to write a path set with a TTL (1–240 min, default 30); a live claim by another session exits `3` and names the holder. `release` appends a release event owned by the claiming session. `list` shows every unreleased claim (live, expired, dead) plus one `N released (use --all)` count; `--all` includes released rows; a claim whose holding session has provably exited on this host shows `dead` and no longer conflicts. `check` is the read-only preflight for a path set. Coordination aid only — never a substitute for one-writer-per-worktree. |
 | `note <add\|list\|check\|rm> <slug> ...` | Anchored workspace notes in `notes.md`: `add <slug> <subject> <quote> <title> [body]` binds a note to a verbatim quote in one repository file and assigns `NOTE-###`; `list` and `check` regrade each anchor `exact`/`moved`/`stale`/`ambiguous`/`lost` by searching the repo for the quote (dependency and workspace trees excluded); `check --repair` rewrites a `moved` subject to its new file; `rm` deletes by ID. `check seal` refuses a malformed `notes.md` and any non-`exact` anchor. |
 | `gates <scaffold\|status\|run\|reverify\|lint\|precheck\|attest\|abandon> <slug>` | Operate the `gates.md` acceptance ledger: seed per-AC gates, execute runnable gates bound to `test-plan.md` preflight rows, attest manual gates, and reduce to `all-met`/`not-met`/`handoff`/`malformed`. A gate with `INPUTS:` records its files' content digest and is reused by `run` and `reverify` while they are unchanged. `run`/`reverify --transcripts` atomically publishes a private redacted v2 executed transcript, or returns its verified originating record unchanged, under `references/gates/<gate-id>/`; legacy v1/reuse-only logs cannot authorize reuse. `precheck <slug> --worktree <path> [--slice <SLICE-ID>]` runs every `RUN: writer` gate and `check windows` against the wright's worktree (with `--slice`, it prints `SKIP <gate-id>` for a gate whose id only other unbuilt slices name in `tasks.md`, since gate ids reuse `AC-###` ids; a gate no slice names still runs), prints PASS/FAIL per gate id, exits `3` on any FAIL or on a malformed ledger, and writes no ledger, EVIDENCE line or transcript (`check windows` still appends its metric event); its output is never evidence. |
-| `state resolve <qid> "<answer>"` | Resolve an open question and update `questions.md` plus `state.md` atomically. |
+| `state resolve <qid> "<answer>"` | Resolve an open question and update `questions.md` plus `state.md` under the feature lock, with rollback on returned publication errors. Per-file writes are atomic; the pair is not crash-atomic. Incomplete rollback requires inspection and recovery. |
 | `state merge-manifest <slug> [pred...]` | Fold the complete recorded predecessor chain's manifests into the release candidate manifest. Numbered sequences must reach position 1 through consecutive, unique positive positions; explicit predecessor lists cannot omit recorded members. Fully unnumbered legacy chains remain supported. Invalid or missing members leave the manifest unchanged. |
 | `state set <slug> <key>=<value>... [--unset <key>]...` | Write `state.md` cursor fields all-or-nothing under the feature lock. Refuses an unknown `phase`, the engine-owned `schema` row, a pipe or line break in a value, and an overwrite of a saved `return_phase`/`return_next_action`. Setting `status=awaiting_human` under `.devrites/AFK` prints each open question the sentinel's `allow_gates` auto-picks. |
 | `state append <slug> <ledger.md> --heading "<text>" --body-file <path\|->` | Append one `## <heading>` section to `assumptions.md`, `decisions.md`, `drift.md`, `evidence.md`, or `questions.md` atomically. Refuses a heading that already exists outside fenced code and a body line that opens another `#`/`##` section; for a new `questions.md` `q-` entry, also refuses a non-open status, a missing or unknown gate, a raised_at that is not a full RFC 3339 timestamp, options outside 2-4 concrete choices plus the closing "Something else" escape hatch, `(Recommended)` on any option but 1, and `proposed:` without a `(Recommended)` option 1 (or option 1 without `proposed:`); question or entry length is advisory only; reports an advisory when the ledger passes its line budget, and blocks (exit 3, nothing written) when a ledger other than evidence.md would land at or above 1.5x its line or byte budget without a covering `Budget override: <=N lines; <reason>` (N at most 2x the line budget). |
@@ -58,6 +59,10 @@ workflow strategy.
 | `overhaul <records\|admit\|snapshot\|score\|bench\|render> ...` | Deterministic tools behind the standalone `/overhaul` skill: run-record generations and cross-record validation, worker-receipt admission and quote anchoring, index-safe baseline snapshots and per-attempt deltas, exact-rational readiness scoring, benchmark ratio intervals, and escaped offline review/report views. Operates only on explicit run-area and repository paths. See [Overhaul tools](#overhaul-tools). |
 | `version` | Print the engine version. |
 
+Under AFK, `next`, `handoff`, and `check continuation` include the sequence
+frontier without replacing the source-local cursor. Reporting actionable work
+does not authorize Build or Ship, and cannot guarantee native-host compliance.
+
 For `context --role`, optional `devrites-` prefixes and `.lane` suffixes resolve
 the base specialist's contract, workspace read-set, and role-specific rules.
 The full label remains in bundle filenames and attribution. Reviewer

package/docs/engine/workspace-schema.md

@@ -157,8 +157,9 @@ not runtime authorities. See
 
 - New question IDs are `q-YYYY-MM-DD-NNN`. The root scans all same-day headers,
   chooses the next unused suffix, re-reads immediately before append, and
-  recomputes on collision. `state resolve` remains the atomic answer/drop/batch
-  writer; it does not allocate IDs.
+  recomputes on collision. `state resolve` remains the locked, rollback-protected
+  answer/drop/batch writer; it does not allocate IDs. Paired file updates are not
+  a crash-atomic transaction.
 - The root directly owns later-phase Clarify entry/restore cursor edits and AFK
   slice accounting, preserving unrelated Markdown. See
   [`state-schema.md`](state-schema.md).
@@ -187,7 +188,7 @@ The engine provides only:
 - `check seal`: final file completeness and open-human-gate checks, the
   `tasks.md` slice graph, then the readiness-binding recheck, then exact
   candidate bindings after that aggregate gate passes;
-- atomic `state resolve` answer/drop/batch and transactional `state close`;
+- locked, rollback-protected `state resolve` answer/drop/batch and transactional `state close`;
 - secret scanning, version reporting, and local install lifecycle primitives.
 
 A marker or file can satisfy structural presence without proving semantic

package/engine/commands.go

@@ -48,7 +48,7 @@ func rootModeFor(command string, args []string) rootMode {
 			return rootLenient
 		}
 		return rootUnused
-	case "orient", "next", "context", "metrics", "dispatch", "handoff", "note", "packet":
+	case "orient", "next", "frontier", "context", "metrics", "dispatch", "handoff", "note", "packet":
 		return rootStrictUsage
 	case "candidate":
 		if subcommand == "freeze" {

package/engine/help.go

@@ -189,7 +189,7 @@ func shouldPrintHelp(args []string) bool {
 		return true
 	}
 	switch args[0] {
-	case "check", "state", "observe", "parallel", "gates", "claim", "detect", "note", "metrics", "handoff", "context", "orient", "migrate", "overhaul", "next", "dispatch", "secret-scan", "open-visual", "recall", "packet", "candidate":
+	case "check", "state", "observe", "parallel", "gates", "claim", "detect", "note", "metrics", "handoff", "context", "orient", "migrate", "overhaul", "next", "frontier", "dispatch", "secret-scan", "open-visual", "recall", "packet", "candidate":
 		return len(args) >= 2 && args[1] == "help"
 	default:
 		return false
@@ -231,6 +231,8 @@ func commandHelp(args []string) (string, bool) {
 		return orientUsage, true
 	case "next":
 		return nextUsage, true
+	case "frontier":
+		return "usage: devrites-engine frontier [slug]", true
 	case "handoff":
 		return handoffUsage, true
 	case "recall":

package/engine/internal/hostpack/hostpack.go

@@ -128,7 +128,7 @@ var CodexConfigMerge = MarkerMerge{
 	Begin:      "# BEGIN DEVRITES CODEX PERMISSIONS",
 	End:        "# END DEVRITES CODEX PERMISSIONS",
 	MarkerRel:  ".claude/devrites.codex-config-merge",
-	MarkerText: ".codex/config.toml contains the DevRites read-only-root permission profile.",
+	MarkerText: ".codex/config.toml contains the DevRites workspace-capable root permission profile.",
 }
 
 // HostConfig is a host project config DevRites creates only when absent; an

package/engine/internal/lib/apply_bundle.go

@@ -437,20 +437,37 @@ func checkBundleResult(targets []*bundleTarget, retired map[string]bool) []strin
 	return problems
 }
 
-// writeBundleTargets writes every target atomically and, if one write fails,
-// restores the files already written so the workspace never holds half a
-// bundle.
+// writeBundleTargets writes every target atomically. A failed write may already
+// have published its bytes, so rollback covers every attempted target and reports
+// any restoration failures.
 func writeBundleTargets(ws *os.Root, targets []*bundleTarget) error {
+	return writeBundleTargetsWith(ws, targets, fsutil.WriteFileAtomicIn)
+}
+
+func writeBundleTargetsWith(ws *os.Root, targets []*bundleTarget, write func(*os.Root, string, []byte, fs.FileMode) error) error {
 	for i, target := range targets {
-		if err := fsutil.WriteFileAtomicIn(ws, filepath.FromSlash(target.rel), target.after, 0o644); err != nil {
-			for _, done := range targets[:i] {
+		if err := write(ws, filepath.FromSlash(target.rel), target.after, 0o644); err != nil {
+			writeErr := fmt.Errorf("write %s: %w", target.rel, err)
+			var rollbackErrors []error
+			for j := i; j >= 0; j-- {
+				done := targets[j]
+				var rollbackErr error
 				if done.existed {
-					_ = fsutil.WriteFileAtomicIn(ws, filepath.FromSlash(done.rel), done.before, 0o644)
+					rollbackErr = write(ws, filepath.FromSlash(done.rel), done.before, 0o644)
 				} else {
-					_ = ws.Remove(filepath.FromSlash(done.rel))
+					rollbackErr = ws.Remove(filepath.FromSlash(done.rel))
+					if errors.Is(rollbackErr, fs.ErrNotExist) {
+						rollbackErr = nil
+					}
 				}
+				if rollbackErr != nil {
+					rollbackErrors = append(rollbackErrors, fmt.Errorf("rollback %s: %w", done.rel, rollbackErr))
+				}
+			}
+			if len(rollbackErrors) > 0 {
+				return errors.Join(writeErr, fmt.Errorf("rollback incomplete: %w", errors.Join(rollbackErrors...)))
 			}
-			return fmt.Errorf("write %s: %w (earlier files restored)", target.rel, err)
+			return fmt.Errorf("%w (attempted files restored)", writeErr)
 		}
 	}
 	return nil

package/engine/internal/lib/continuation.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/devrites/devrites/internal/devritespaths"
 	"github.com/devrites/devrites/internal/gate"
+	"github.com/devrites/devrites/internal/markdowntext"
 	"github.com/devrites/devrites/internal/state"
 	"github.com/devrites/devrites/internal/workflow"
 )
@@ -44,7 +45,21 @@ func RunCheckContinuation(root string, args []string, stdout, stderr io.Writer)
 		fmt.Fprintf(stderr, "check continuation: %v\n", err)
 		return 2
 	}
+	var frontier []string
+	if afkPresent(root) {
+		frontier, err = FrontierLines(root, slug)
+		if err != nil {
+			fmt.Fprintf(stderr, "check continuation: frontier: %v\n", err)
+			return 2
+		}
+		if !verdict.Required && len(frontier) > 0 && frontier[0] == "frontier: actionable" {
+			verdict = continuationVerdict{Required: true, Invoke: "/rite-autocomplete", Source: slug, Reason: "global frontier requires native preparation, authority review, or selection; no Ship approval"}
+		}
+	}
 	writeContinuation(stdout, verdict)
+	for _, line := range frontier {
+		fmt.Fprintln(stdout, line)
+	}
 	return 0
 }
 
@@ -59,12 +74,16 @@ func classifyContinuation(root, slug string) (continuationVerdict, error) {
 	}
 	invoke, internal, err := internalPhaseEdge(report.NextAction, slug)
 	if err != nil {
-		return continuationVerdict{}, err
+		if !frontierBoundSpec(root, slug, report.NextAction) {
+			return continuationVerdict{}, err
+		}
+		// A successor Spec belongs to the global controller, never this source's phase invocation.
+		invoke, internal = "", false
 	}
 	if !afkPresent(root) {
 		return continuationVerdict{Reason: "no AFK sentinel"}, nil
 	}
-	if report.Status != "running" {
+	if report.Status != "running" && !(report.Phase == state.PhaseVet && report.Status == "ready") {
 		if report.Status == "" {
 			return continuationVerdict{Reason: "status unset"}, nil
 		}
@@ -75,7 +94,17 @@ func classifyContinuation(root, slug string) (continuationVerdict, error) {
 	if err != nil {
 		return continuationVerdict{}, err
 	}
-	if qid, ok := state.CursorField(strings.Split(string(data), "\n"), state.CursorQuestionID); ok && strings.TrimSpace(qid) != "" {
+	structural, err := markdowntext.Structural(data)
+	if err != nil {
+		return continuationVerdict{Reason: "malformed source cursor; native normalization required"}, nil
+	}
+	cursorLines := strings.Split(string(structural), "\n")
+	for _, key := range []string{state.CursorPhase, state.CursorStatus, state.CursorNextAction, state.CursorQuestionID} {
+		if _, _, err := frontierField(cursorLines, key); err != nil {
+			return continuationVerdict{Reason: err.Error() + "; native normalization required"}, nil
+		}
+	}
+	if qid, ok := state.CursorField(cursorLines, state.CursorQuestionID); ok && strings.TrimSpace(qid) != "" {
 		return continuationVerdict{Reason: "question cursor set"}, nil
 	}
 	// #nosec G304 -- questions.md inside the checked feature workspace
@@ -93,7 +122,7 @@ func classifyContinuation(root, slug string) (continuationVerdict, error) {
 	if !internal {
 		return continuationVerdict{Reason: "next_action is not an internal phase edge"}, nil
 	}
-	return continuationVerdict{Required: true, Invoke: invoke, Source: slug, Reason: "AFK status=running internal phase edge"}, nil
+	return continuationVerdict{Required: true, Invoke: invoke, Source: slug, Reason: "AFK status=" + report.Status + " internal phase edge"}, nil
 }
 
 func afkPresent(root string) bool {