devrites 7.3.3 → 7.3.4

package/engine/internal/lib/handoff.go

@@ -89,12 +89,9 @@ func RunHandoff(root string, args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stdout, "missing_required: %s\n", strings.Join(report.MissingFiles, ", "))
 	}
 	fmt.Fprintf(stdout, "read_next: %s\n", strings.Join(readNext(featureDir), ", "))
-	verdict, err := classifyContinuation(root, slug)
-	if err != nil {
-		fmt.Fprintf(stderr, "handoff: continuation: %v\n", err)
-		return 2
+	if code := RunCheckContinuation(root, []string{slug}, stdout, stderr); code != 0 {
+		return code
 	}
-	writeContinuation(stdout, verdict)
 	if resume {
 		recordMetric(root, slug, string(report.Phase), "resume", "root", 0)
 	}

package/engine/internal/lib/next.go

@@ -73,6 +73,16 @@ func RunNext(root string, args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stdout, "blocked: %s\n", unattributedMessage(slug, flagged))
 		exit = 3
 	}
+	if afkPresent(root) {
+		lines, err := FrontierLines(root, slug)
+		if err != nil {
+			fmt.Fprintf(stderr, "next: frontier: %v\n", err)
+			return 2
+		}
+		for _, line := range lines {
+			fmt.Fprintln(stdout, line)
+		}
+	}
 	if report.Phase == state.PhaseBuild {
 		printPlanBatch(stdout, root, slug)
 	}

package/engine/internal/parallel/cli.go

@@ -73,6 +73,10 @@ func runPathDisjoint(args []string, stdin io.Reader, stdout, stderr io.Writer) i
 	return ExitOK
 }
 
+// FrontierNotices exposes related work without broadening source-local selection.
+// main wires it from lib to avoid an import cycle.
+var FrontierNotices func(root, slug string) ([]string, error)
+
 func cmdSelect(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 	root := ""
 	slug := ""
@@ -148,21 +152,18 @@ func cmdSelect(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 			return ExitUsage
 		}
 		if sawWorkspaces {
-			order := []string{slug}
+			order := strings.Split(workspaces, ",")
 			seen := make(map[string]bool)
 			if err := validateSlug(slug); err != nil {
 				fmt.Fprintf(stderr, "parallel select: %v\n", err)
 				return ExitUsage
 			}
-			for _, target := range strings.Split(workspaces, ",") {
+			for _, target := range order {
 				if err := validateSlug(target); err != nil || seen[target] {
 					fmt.Fprintf(stderr, "parallel select: invalid or duplicate workspace %q\n", target)
 					return ExitUsage
 				}
 				seen[target] = true
-				if target != slug {
-					order = append(order, target)
-				}
 			}
 			if _, err := controllerLease(root, slug); err != nil {
 				fmt.Fprintf(stderr, "parallel select: %v\n", err)
@@ -199,6 +200,16 @@ func cmdSelect(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 				slices = append(slices, ready...)
 			}
 		} else {
+			if FrontierNotices != nil {
+				notices, err := FrontierNotices(root, slug)
+				for _, notice := range notices {
+					fmt.Fprintln(stderr, notice)
+				}
+				if err != nil {
+					fmt.Fprintf(stderr, "parallel select: frontier: %v\n", err)
+					return ExitBlocked
+				}
+			}
 			if PlanReady == nil {
 				fmt.Fprintln(stderr, "parallel select: --from-plan is unavailable in this build")
 				return ExitBlocked

package/engine/internal/parallel/ops.go

@@ -217,8 +217,8 @@ type AddOpts struct {
 	Capacity int
 }
 
-// Add refills freed slots of a running lease: each new slice gets a worktree
-// from the current control tip, under the same path-disjoint and cap rules as
+// Add refills freed slots of a running, integrate-failed, or complete lease:
+// each new slice gets a worktree from the current control tip, under the same path-disjoint and cap rules as
 // the slices still active. Landed (integrated) slices no longer claim paths.
 // An explicit Capacity with no Slices changes only the bound, not lease status.
 func Add(opts AddOpts) (lease *Lease, err error) {
@@ -262,8 +262,8 @@ func addLocked(opts AddOpts) (*Lease, error) {
 	if opts.Capacity == 0 {
 		opts.Capacity = leaseCapacity(lease)
 	}
-	if lease.Status != StatusRunning && lease.Status != StatusComplete {
-		return nil, fmt.Errorf("add requires status=running|complete (have %s)", lease.Status)
+	if lease.Status != StatusRunning && lease.Status != StatusIntegrateFailed && lease.Status != StatusComplete {
+		return nil, fmt.Errorf("add requires status=running|integrate-failed|complete (have %s)", lease.Status)
 	}
 	head, err := revParse(opts.Root, expectedControl(lease))
 	if err != nil {
@@ -329,7 +329,9 @@ func addLocked(opts AddOpts) (*Lease, error) {
 	lease.Slices = append(lease.Slices, made...)
 	lease.N = len(lease.Slices)
 	lease.Capacity = opts.Capacity
-	lease.Status = StatusRunning
+	if lease.Status == StatusComplete {
+		lease.Status = StatusRunning
+	}
 	if err := WriteLease(leasePath, lease); err != nil {
 		rollback()
 		return nil, err

package/engine/internal/parallel/repository.go

@@ -167,6 +167,19 @@ func controllerLease(root, controller string) (*repositoryLease, error) {
 	return found, nil
 }
 
+// ControllerLease returns the retained repository controller without changing its lease.
+// A lease in another checkout requires recovery at that explicit control root.
+func ControllerLease(repoRoot string) (string, *Lease, error) {
+	found, err := controllerLease(repoRoot, "")
+	if err != nil || found == nil {
+		return "", nil, err
+	}
+	if found.root != resolvedPath(repoRoot) {
+		return "", nil, fmt.Errorf("repository controller lease retained by %s at %s; recover at its explicit root", found.controller, found.root)
+	}
+	return found.controller, found.lease, nil
+}
+
 // WorkspaceLeased protects both controller and source workspaces until cleanup.
 // devritesRoot is explicit; closeout holds WithControlLock through its rename.
 func WorkspaceLeased(devritesRoot, workspace string) (bool, error) {

package/engine/internal/release/release.go

@@ -16,10 +16,12 @@ import (
 	"net/netip"
 	"net/url"
 	"os"
+	"os/exec"
 	"path"
 	"path/filepath"
 	"regexp"
 	"runtime"
+	"strconv"
 	"strings"
 	"time"
 )
@@ -162,13 +164,13 @@ func binaryNameFor(goos, goarch string) (string, error) {
 }
 
 func fetchJSON(ctx context.Context, rawURL string, out any) error {
-	resp, err := get(ctx, rawURL)
+	resp, err := get(ctx, rawURL, true)
 	if err != nil {
 		return err
 	}
 	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode < 200 || resp.StatusCode > 299 {
-		return fmt.Errorf("%s returned %s", resp.Request.URL.Redacted(), resp.Status)
+		return responseError(resp)
 	}
 	if resp.ContentLength > maxJSONBytes {
 		return fmt.Errorf("JSON response exceeds %d bytes", maxJSONBytes)
@@ -228,13 +230,13 @@ func downloadVerified(ctx context.Context, rawURL, destination, filename string,
 }
 
 func download(ctx context.Context, rawURL, destination string, maxBytes int64, mode fs.FileMode) error {
-	resp, err := get(ctx, rawURL)
+	resp, err := get(ctx, rawURL, false)
 	if err != nil {
 		return err
 	}
 	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode < 200 || resp.StatusCode > 299 {
-		return fmt.Errorf("%s returned %s", resp.Request.URL.Redacted(), resp.Status)
+		return responseError(resp)
 	}
 	if resp.ContentLength > maxBytes {
 		return fmt.Errorf("download exceeds %d bytes", maxBytes)
@@ -274,7 +276,7 @@ func download(ctx context.Context, rawURL, destination string, maxBytes int64, m
 	return nil
 }
 
-func get(ctx context.Context, rawURL string) (*http.Response, error) {
+func get(ctx context.Context, rawURL string, authenticate bool) (*http.Response, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, rawURL, nil)
 	if err != nil {
 		return nil, fmt.Errorf("build release request: %w", err)
@@ -284,9 +286,94 @@ func get(ctx context.Context, rawURL string) (*http.Response, error) {
 	}
 	req.Header.Set("Accept", "application/vnd.github+json")
 	req.Header.Set("User-Agent", "devrites-engine")
+	if authenticate && isGitHubAPI(req.URL) {
+		token, err := githubToken(ctx)
+		if err != nil {
+			return nil, err
+		}
+		if token != "" {
+			req.Header.Set("Authorization", "Bearer "+token)
+		}
+	}
 	return httpClient.Do(req)
 }
 
+func isGitHubAPI(u *url.URL) bool {
+	return u != nil && u.User == nil && strings.EqualFold(u.Scheme, "https") &&
+		(strings.EqualFold(u.Host, "api.github.com") || strings.EqualFold(u.Host, "api.github.com:443"))
+}
+
+// credentialOutput bounds untrusted helper output without accepting a truncated token.
+type credentialOutput struct {
+	data [4096]byte
+	n    int
+}
+
+func (out *credentialOutput) Write(p []byte) (int, error) {
+	if len(p) > len(out.data)-out.n {
+		return 0, errors.New("GitHub credential helper output exceeds limit")
+	}
+	out.n += copy(out.data[out.n:], p)
+	return len(p), nil
+}
+
+// githubToken follows gh's environment precedence without requiring gh to be installed.
+func githubToken(ctx context.Context) (string, error) {
+	token := os.Getenv("GH_TOKEN")
+	if token == "" {
+		token = os.Getenv("GITHUB_TOKEN")
+	}
+	if token == "" {
+		lookupCtx, cancel := context.WithTimeout(ctx, 3*time.Second)
+		defer cancel()
+		cmd := exec.CommandContext(lookupCtx, "gh", "auth", "token", "--hostname", "github.com")
+		cmd.Env = append(os.Environ(), "GH_PROMPT_DISABLED=1", "GIT_TERMINAL_PROMPT=0")
+		cmd.Stderr = io.Discard
+		cmd.WaitDelay = 100 * time.Millisecond
+		var output credentialOutput
+		cmd.Stdout = &output
+		err := cmd.Run()
+		if ctx.Err() != nil {
+			return "", ctx.Err()
+		}
+		if err != nil {
+			return "", nil
+		}
+		token = strings.TrimSpace(string(output.data[:output.n]))
+	}
+	for _, char := range token {
+		if char < '!' || char > '~' {
+			return "", errors.New("invalid GitHub credential; check GH_TOKEN, GITHUB_TOKEN, or gh auth login --hostname github.com")
+		}
+	}
+	return token, nil
+}
+
+func responseError(resp *http.Response) error {
+	message := fmt.Sprintf("release request returned HTTP %d %s", resp.StatusCode, http.StatusText(resp.StatusCode))
+	switch resp.StatusCode {
+	case http.StatusUnauthorized, http.StatusForbidden:
+		message += "; check GH_TOKEN/GITHUB_TOKEN (environment tokens take precedence) or run gh auth login --hostname github.com"
+	case http.StatusTooManyRequests:
+		message += "; GitHub API rate limit reached; use GH_TOKEN/GITHUB_TOKEN or gh auth login --hostname github.com, or wait before retrying"
+	}
+	if resp.StatusCode == http.StatusForbidden && resp.Header.Get("X-RateLimit-Remaining") == "0" {
+		message += "; GitHub API rate limit reached"
+	}
+	if resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden || resp.StatusCode == http.StatusTooManyRequests {
+		if reset, err := strconv.ParseInt(resp.Header.Get("X-RateLimit-Reset"), 10, 64); err == nil && reset >= 0 && reset <= 253402300799 {
+			message += "; rate limit resets at " + time.Unix(reset, 0).UTC().Format(time.RFC3339)
+		}
+		retry := resp.Header.Get("Retry-After")
+		if seconds, err := strconv.ParseUint(retry, 10, 32); err == nil {
+			message += fmt.Sprintf("; retry after %d seconds", seconds)
+		} else if date, err := http.ParseTime(retry); err == nil {
+			message += "; retry after " + date.UTC().Format(time.RFC3339)
+		}
+	}
+	return errors.New(message)
+}
+
 func validateURL(u *url.URL) error {
 	if u == nil || u.Hostname() == "" {
 		return errors.New("release URL has no host")
@@ -303,6 +390,10 @@ func validateURL(u *url.URL) error {
 }
 
 func checkRedirect(req *http.Request, via []*http.Request) error {
+	// net/http forwards sensitive headers to subdomains; GitHub tokens must not follow.
+	if !isGitHubAPI(req.URL) {
+		req.Header.Del("Authorization")
+	}
 	if len(via) >= 10 {
 		return errors.New("stopped after 10 redirects")
 	}

package/engine/main.go

@@ -26,6 +26,7 @@ Usage:
   devrites-engine install [flags]          Install DevRites skills, agents, and host configuration
   devrites-engine update [flags]           Update an existing DevRites install in place
   devrites-engine uninstall [flags]        Remove a DevRites install, preserving runtime state
+  devrites-engine frontier [slug]          Discover related ready work and native preparation without writes
   devrites-engine check candidate <slug>   Validate and hash the closed project candidate
   devrites-engine check readiness <slug>   Check required files, tasks.md graph, and Build-input binding
   devrites-engine check readiness --emit-binding <slug>  Emit the stable Build-input binding for Vet
@@ -126,6 +127,7 @@ func init() {
 	// parallel cannot import lib (lib imports it), so `parallel select --from-plan` gets the plan-derived ready set through this hook.
 	parallel.PlanReady = lib.PlanReady
 	parallel.WorkspaceReady = lib.WorkspaceReady
+	parallel.FrontierNotices = lib.FrontierNotices
 	// `gates precheck` runs `check windows` through this hook for the same reason.
 	acceptance.WindowsCheck = lib.RunCheckWindows
 	// ...and `gates precheck --slice` learns which writer gates to skip.
@@ -169,6 +171,8 @@ func run(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 		return cmdOrient(root, args[1:], stdout, stderr)
 	case "next":
 		return lib.RunNext(root, args[1:], stdout, stderr)
+	case "frontier":
+		return lib.RunFrontier(root, args[1:], stdout, stderr)
 	case "handoff":
 		return lib.RunHandoff(root, args[1:], stdout, stderr)
 	case "recall":

package/pack/.claude/skills/devrites-lib/reference/parallel-workspaces.md

@@ -37,17 +37,16 @@ handles before admitting more work; status queried via ACTIVE/source reports the
 actual retained controller even after ordered handoff. Another retained
 controller is not bypassable; no extra cursor pointer is needed.
 
-The existing `--parallel N` is one global active-writer cap across all sources:
+The existing `--parallel N` is one global active-writer cap, not a target guarantee:
 explicit invocation value, else AFK `max_parallel`, else retained lease capacity
 on resume, else 10. Explicit 1 means one writer, not one writer per workspace.
-Review queues obey host capacity and existing reviewer caps separately; they never
-erase required specialist accounts.
-
-Discover only recorded forward sequence continuations through `sequence_parent`
-and the parent's recorded objectives. Honor `continue_sequence: false`, opening
-budget and human bounded requests. Charge each opening once; reuse prepared
-children and their cursor rather than re-specifying or charging them again.
-An unrelated directory or user-mentioned slug is not automatic enrollment.
+Review queues obey host capacity and existing reviewer caps separately; neither
+capacity nor a Reslice cap waiver waives required named-role fanout or proof gates.
+
+Use the engine frontier below for recorded source-related sequence membership.
+Honor `continue_sequence: false`, opening budget and human bounded requests.
+Charge each opening once; reuse prepared children and their cursor.
+Unrelated directories or user-mentioned slugs are not automatic enrollment.
 Respect workspace claims: a live lookahead owner retains its artifacts until
 release/terminal reconciliation. Root alone writes workspace artifacts; leaves
 never write `.devrites/**`.
@@ -116,35 +115,37 @@ returns scheduling to Autocomplete; its source-local phase/recovery return curso
 and pending native reviewer handles remain intact. This is not a second phase
 controller or a persistent frontier artifact.
 
-1. Re-read controller lease, per-source state/questions/readiness and authorized
-   sequence. Examine every recorded authorized source once per pass, not only
-   the owner's next local slice or first blocked child. Prepare absent targets
-   through authorized native Spec → Clarify → Temper → Define/Plan → Vet; repair
-   and re-Vet current readiness of prepared targets now, not after owner Seal.
-   Assess actual source gates, claims and explicit planning/Build restrictions
-   before routing. Owner-local red/human/access gates withhold that owner or its
-   actual consumers, not independent authorized planning; true whole-run safety,
-   access and claim constraints still bind. Retain concrete actions or blockers
+1. Run `devrites-engine frontier <source>` before local recovery or selection.
+   This read-only report names the related pool, preparation/repair actions and
+   blockers; it neither authorizes work nor changes the source's local cursor.
+   For `frontier-prepare` and `frontier-workspace` prepare/repair actions, execute
+   authorized native Spec → Clarify → Temper → Define/Plan → affected Vet now,
+   not after owner Seal. Check source gates, claims and planning/Build restrictions.
+   For `frontier-review-sequence`, read the named approved roadmap/artifacts:
+   native authority normalization must record the exact continuation through its
+   owning decision/phase before rerunning frontier. Ambiguous legacy prose,
+   positive remaining budget and path disjointness never imply permission.
+   Retain unresolved authority blockers; continue independent authorized work.
+   Owner-local red/human/access gates withhold that owner and actual consumers;
+   whole-run safety/access/claim constraints still bind. Record actions/blockers
    in existing source artifacts under normal write authority.
-   Yield a child at its pending reviewer/phase boundary back to this controller;
-   never recursively wait for child completion while parent returns are pending.
-   Reconcile available parent returns before another pass. A native wait is
-   justified only after concrete authorized actions/blockers across the pool
-   have been examined; reading later phase skills is not pending Plan/Vet work.
-   If an explicit/AFK capacity change differs from retained capacity, reconcile it
-   before selection using `parallel add --root <repo> --slug <controller> --cap N --json -`
-   with stdin `[]`. This changes capacity only, not workers or a complete lease's
-   status. A decrease below active count refuses: pause admissions and drain to
-   the requested count, then retry; never cancel workers to meet a lower cap.
-   A pending landing is recovery, not free capacity: retry the exact recorded
-   integrate before admission; unrelated HEAD/ref movement remains blocked.
-2. Query the mixed pool in stable sequence order, controller first (the ordered
-   ACTIVE owner may now differ):
-   `devrites-engine parallel select --root <repo> --slug <controller> --from-plan --workspaces <controller,authorized-source,...> --cap N`.
-   `--workspaces` is an internal data-source parameter, not a user feature flag.
-   Read all notices and route repair/waits to their source. Existing running slots
-   and paths seed selection globally. Zero new picks with live writers means keep
-   planning/reviewing or wait, not Prove for those unfinished sources.
+   Yield children at pending reviewer/phase boundaries; reconcile available
+   parent returns before another pass. Reporting actions or reading phase skills
+   is not executing preparation/Vet. Wait only after authorized actions across
+   the pool have run or reached concrete pending handles/blockers.
+2. Reconcile explicit/AFK capacity changes with
+   `parallel add --root <repo> --slug <controller> --cap N --json -`, stdin `[]`.
+   This changes capacity only. Below active count, pause admissions, drain and
+   retry; never cancel workers to meet a lower cap. Recover a pending recorded
+   landing before admission; unrelated HEAD/ref movement remains blocked.
+   Rerun frontier after preparation/repair or capacity changes. Execute returned
+   `frontier-select-command` with only authorized live `--workspaces`: this exact
+   candidate list includes the `--slug` controller only when eligible. This is
+   internal, not a new user flag. `frontier: none` retains source-local routing.
+   Source-local `parallel select --from-plan` notices neither select globally nor
+   expand picks. Route notices to their source; running slots/paths seed mixed
+   selection globally. Zero picks with live writers means continue planning/review
+   or wait, not Prove for unfinished sources.
 3. Preflight selected slices against their SOURCE workspace with Build's normal
    slice/readiness/precondition, exact-path and runtime-isolation gates. Early
    foreign Build always uses isolated workers. For cap>1 on a capable host,
@@ -160,9 +161,9 @@ controller or a persistent frontier artifact.
    landing: defer control mutations while frozen validation is pending. Outside
    that window, land each individually green sibling through Build review/proof
    and `parallel integrate --slice <key>`; refill immediately from the whole pool.
-   A red sibling repairs in place and holds its slot/paths; it does not delay
-   independent safe landings. Never satisfy a producer edge on writer return or
-   green-but-unlanded work.
+   A red or `integrate-failed` sibling retains its slot/paths for repair; it does
+   not halt independent safe landings/refill. A pending landing intent still
+   requires exact recovery above. Only durable integration satisfies producer edges.
    After worker-bound review/proof and source bookkeeping finish, prune only
    verified clean integrated checkouts with `parallel prune --root <repo>
    --slug <controller>`. Retain transfer refs/lease identities; dirty or ignored

package/pack/.claude/skills/rite-autocomplete/SKILL.md

@@ -86,9 +86,9 @@ next sequence continuation through Vet in a second session, then stop.
 
 1. **Orient and parse.** Resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding); when a workspace exists,
    require its `state.md` and read its cursor; a fresh idea starts empty at step 2.
-   Before phase-local cold recovery, execute the bounded
-   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier);
-   retain this source's return cursor and pending reviewer handles.
+   After normalizing arguments below, run `devrites-engine frontier <source>`
+   before phase-local cold recovery; execute its actions under the shared
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier).
    Before honoring `blocked` with terminal `next_action`,
    reconcile retained consumptive evidence and fingerprint attempts from
    `drift.md`/`evidence.md`; a retained fingerprint below its cap resumes offline
@@ -102,7 +102,7 @@ next sequence continuation through Vet in a second session, then stop.
    Normalize current arguments to idea, `ship_preflight: yes|no`,
    `max_slices: unlimited`, `parallel: N|default`, `profile: standard|full`,
    and `cross_model: yes|no`.
-   **Completion:** normalized state is unambiguous and no sentinel or workspace file has been written.
+   **Completion:** arguments and source authority are unambiguous; local cursor and pending handles remain intact.
 2. **Specify and clarify.** Run `devrites-interview`, `/rite-spec`, and
    `/rite-clarify` as one window. `open` material coverage never arms
    AFK. **Completion:** `Decision coverage: CLEAR` is durable.
@@ -119,12 +119,12 @@ next sequence continuation through Vet in a second session, then stop.
    `/rite-build` batch loop → `/rite-prove` → `/rite-polish` →
    `/rite-review` → `/rite-seal`. Read and execute each skill; durable files, not
    chat, carry state. Apply the mutable post-vet budget before first Build.
-   Execute the shared [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
-   at phase entry, before recovery, on returns and before native waits, not only
-   during Build or after Seal. Preserve source-local phase cursors; Autocomplete
-   retains repository scheduling. Apply its protected validation window before
-   landings/checkpoints and account admission. Pass resolved `--parallel N` to
-   Build under its one global cap and existing admission/isolation gates.
+   Run `devrites-engine frontier <source>` at phase entry, before recovery,
+   on returns and before native waits; execute the shared
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier),
+   not merely its report. Autocomplete retains repository scheduling and local
+   cursors. Apply its protected validation window and pass resolved `--parallel N`
+   to Build under the same global cap and admission/isolation gates.
    **Completion:** loop reaches Seal GO or persists a valid stop before any later phase.
 5. **Apply stops.** At every gate use
    [stop-conditions.md](reference/stop-conditions.md). A `blocked` label alone is not a stop condition:

package/pack/.claude/skills/rite-autocomplete/reference/loop.md

@@ -72,12 +72,12 @@ Workspace files, not chat, carry state. Read/execute each phase skill:
 | 10 | `/rite-seal` | GO/NO-GO; no Git |
 | 11 | `/rite-ship` | only after GO; `--ship` never authorizes Git; stop at literal-GO/native approval |
 
-At every phase entry, before cold/local recovery, on reviewer/planning returns and
-before native waits, Autocomplete executes the bounded
-[global frontier pass](../../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier).
-Keep source-local return cursors and pending handles; apply its protected
-validation window before accepting accounts or landing work. This scheduling
-precedes owner Seal and does not change ordered handoff below.
+At phase entry, before cold/local recovery, on landing/reviewer/planning returns
+and before native waits, run `devrites-engine frontier <source>` and execute the
+shared [global frontier pass](../../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier).
+Its report requires authorized preparation/Vet and mixed selection, not a pause.
+Preserve local cursors, pending handles and protected validation windows;
+scheduling precedes owner Seal without changing ordered handoff below.
 
 Check [stop-conditions.md](stop-conditions.md) before advancing. Discard stale
 pass evidence after source edits. Re-read the selected source before each phase per [phase target binding](../../devrites-lib/reference/parallel-workspaces.md#phase-target-binding). On a cold resume or

package/pack/.claude/skills/rite-build/reference/parallel-batch.md

@@ -4,11 +4,11 @@
 
 Opt-in only. Default `/rite-build` stays [`one-slice-cycle.md`](one-slice-cycle.md).
 
-Autocomplete first executes shared
-[`parallel-workspaces.md`](../../devrites-lib/reference/parallel-workspaces.md):
-it owns global admission, authorized source discovery and controller routing.
-The local selection below applies to standalone Build; mixed selection uses
-that reference and then this same per-slice review/repair/integration lifecycle.
+Autocomplete runs `devrites-engine frontier <source>` and executes shared
+[`parallel-workspaces.md`](../../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier):
+it owns preparation, global admission and controller routing. Standalone Build
+stays source-local; frontier notices from `parallel select --from-plan` do not
+expand its picks. Autocomplete consumes `frontier-select-command`, then this lifecycle.
 
 ## Entry
 
@@ -161,8 +161,8 @@ means controller; CLI lease `--slice` uses source-qualified foreign keys.
    (imperative summary, never a slice id). Staging branch, durable exact landing
    intent, then FF; retry the same operation after interrupted persistence.
    The engine reconciles only that recorded landing and refuses unrelated
-   HEAD/ref movement. Conflict → `integrate-failed`; classify under repair rounds
-   (siblings stay in place).
+   HEAD/ref movement. Conflict → `integrate-failed`; repair in place, retaining
+   slot/paths while independent safe landings/refill continue.
    Never integrate because a wright returned.
 7. Each landing: FF control (the branch that held `HEAD` when the batch started —
    often `main`/`master`, otherwise whatever the user was on) by one local commit,