devrites 7.3.3 → 7.3.5

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.3.5](https://github.com/ViktorsBaikers/DevRites/compare/v7.3.4...v7.3.5) (2026-11-05)
+
+### Fixed
+
+* **devrites:** enforce global autocomplete scheduling ([#208](https://github.com/ViktorsBaikers/DevRites/issues/208)) ([2e4fdb5](https://github.com/ViktorsBaikers/DevRites/commit/2e4fdb5178f2aa507ba565a70b3c2c86810cc5f7))
+
+## [7.3.4](https://github.com/ViktorsBaikers/DevRites/compare/v7.3.3...v7.3.4) (2026-11-03)
+
+### Fixed
+
+* **devrites:** restore global frontier and authenticated updates ([#207](https://github.com/ViktorsBaikers/DevRites/issues/207)) ([05cb719](https://github.com/ViktorsBaikers/DevRites/commit/05cb7198330b7ffa4d7176fc8398ff5a86b13f45))
+
 ## [7.3.3](https://github.com/ViktorsBaikers/DevRites/compare/v7.3.2...v7.3.3) (2026-11-02)
 
 ### Fixed
@@ -34,9 +46,38 @@ All notable changes to DevRites are documented here. The format follows [Keep a
   parallel controller, with rolling landings and refills across workspace sources.
 - Prune clean integrated worker checkouts without discarding transfer branches,
   proof identities, retained lease rows, or running siblings.
-
-### Fixed
-
+- Add read-only `frontier [slug]` reporting across recorded live and archived
+  sequence workspaces, with scoped preparation/repair/wait actions, explicit
+  mixed-workspace selection, and ambiguous-source refusal. Source-local selection
+  exposes the frontier without silently admitting other workspaces.
+
+### Fixed
+
+- Give an explicitly identified Autocomplete controller structural writer-admission
+  checks for actual successor preparation and source-qualified mixed reservations.
+  Surface fresh global scheduling after returns and prioritize unresolved global
+  work over local Build cursors, while preserving narrow disclosed deferrals,
+  standalone AFK, native review/proof, isolation and Ship approval.
+- Accept one explicit decision-bound canonical sequence roadmap without rewriting
+  historical tables; reject ambiguous owners, stale identities and unsafe paths.
+- Keep writer admission bound to immutable pending-lane paths, current controller
+  identity, disjoint active reservations and the effective global cap. Check the
+  complete writer allowlist against live foreign claims, including symlink
+  aliases, even when optional claim flags are absent or name unrelated paths.
+
+- Use `GH_TOKEN`, then `GITHUB_TOKEN`, then optional bounded noninteractive GitHub
+  CLI credential lookup for release API requests. Keep credentials off release
+  assets and off-origin redirects, fail explicit invalid credentials, and document
+  headless login and rate-limit recovery without exposing tokens.
+- Continue AFK from the narrow Vet-ready state and from actionable global native
+  preparation, preserving human gates, source cursors, and separate Ship approval.
+- Allow independent refill and capacity reconciliation after a parallel integration
+  failure without clearing its failure status or weakening pending-landing,
+  control-tip, overlap, capacity, or proof guards.
+- Enforce wright fanout and wider-batch guards even when a reslice review admits
+  another round window.
+- Recover a completed dispatch wave's retained claim through an exact recorded
+  return handle after claim-release failure, without replaying result admission.
 - Confine question resolution to checked workspaces and restore question/cursor
   files together when publication fails. Bundle rollback now includes the failing
   target and reports incomplete restoration.

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.3.3`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.3.3): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.3.5`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.3.5): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -273,6 +273,15 @@ no-recommendation questions still pause. When bounded recovery runs out,
 agents record a technical blocker instead of asking you. The full contract is
 in [`afk-hitl.md`](pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md).
 
+`devrites-engine frontier [slug]` reports the recorded sequence across live and
+archived workspaces without changing `ACTIVE`, creating workspaces, or launching
+agents. It distinguishes preparation, repair, waiting, and completed work, and
+prints an explicit mixed-workspace selection command when available. A source-local
+`parallel select --from-plan` exposes that frontier but still selects only its own
+workspace unless `--workspaces` is supplied. Native Autocomplete owns preparation
+and semantic admission; the report is neither Build readiness nor Ship approval.
+See the [frontier contract](docs/cli.md#sequence-frontier).
+
 ## Install, update, and remove
 
 ```bash
@@ -419,6 +428,17 @@ release assets. If an older engine reports `missing codex/hooks.json` or asks
 for `--source-dir`, use the npm or verified shell route once to reach a
 release with the self-contained updater.
 
+GitHub release API authentication uses `GH_TOKEN`, then `GITHUB_TOKEN`, then an
+optional, bounded, noninteractive `gh auth token --hostname github.com` lookup.
+GitHub CLI is not required. Credentials go only to the exact GitHub API origin,
+never release assets or off-origin redirects. Explicit invalid credentials fail
+instead of silently falling back to another identity. For a headless machine,
+run `gh auth login --hostname github.com --web` and complete its device-code flow
+in a browser on another device. Do not paste credentials into commands, logs, or
+support reports. `--force` controls managed-file replacement; it does not bypass
+GitHub authentication or rate limits. If authentication does not clear a rate
+limit, wait before retrying.
+
 `/rite-upgrade` is the separate, preservation-first route for reconciling an
 unfinished workspace; it never migrates cursor format or invents historical
 proof. `devrites-engine migrate` owns deterministic v5 schema normalization.

package/docs/adr/0039-autocomplete-structural-admission.md

@@ -0,0 +1,87 @@
+# ADR-0039: Structural admission for the native Autocomplete controller
+
+- **Status:** Accepted
+- **Date:** 2026-11-05
+
+## Context
+
+Consumer traces showed a native Autocomplete controller repeatedly completing one
+workspace while leaving recorded continuation preparation unstarted. A global
+frontier report alone did not prevent subsequent local writer admission. The
+controller also recognized a historical workspace rename without resolving the
+conflict between the old roadmap table and current sequence identities.
+
+ADR-0022 and ADR-0024 leave semantic scheduling and model dispatch with native
+hosts. Replacing them with an engine agent bridge, persistent queue, scheduling
+receipts, or heuristic interpretation of reviewer prose would create a second
+orchestration authority. Existing dispatch and lease primitives already retain
+observable preparation accounts, source-qualified reservations and write claims.
+
+## Decision
+
+Narrow ADR-0022's native-scheduling boundary and ADR-0024's policy boundary only
+for structural Autocomplete writer admission:
+
+- Explicit native Autocomplete invocation records `mode: autocomplete` in AFK.
+  This identifies the controller; it grants no readiness, independence or Ship
+  permission. Standalone AFK without this mode retains its existing contract.
+- Before admitting a new Build-wright wave at capacity greater than one, the
+  engine checks immediate successor preparation and the eligible mixed cohort.
+  Preparation is
+  represented by an actual pending native preparation account, current native
+  readiness, or a concrete retained hold. Creating a placeholder or printing a
+  frontier does not satisfy this boundary.
+- A source may disclose a target-specific preparation constraint through
+  `frontier-blocked: <workspace> — <reason>` in its existing evidence ledger.
+  `sequence` names only unresolved historical sequence normalization. These rows
+  defer scheduling obligations; they never waive malformed authority, source
+  readiness, trust boundaries, writer claims, path/capacity limits or proof.
+- An already-ready foreign slice requires an existing mixed lease reservation
+  or an exact source-qualified `serial:` rationale for ordered handoff. A local
+  serial reason or preparation deferral does not discharge foreign admission.
+- A fresh global observation follows a committed dispatch return after mutation
+  and locks settle, even if later claim release fails; its nonzero failure and
+  claim exclusion remain. Rejected/unpersisted returns do not refresh. Global
+  obligations take continuation priority without rewriting local phase cursors
+  or recursively routing local-only work.
+- One explicit canonical `roadmap.md`, bound to the actual sequence root and a
+  unique owner-local decision, may replace historical tables for scheduling.
+  History stays unchanged; duplicate authorities, malformed inputs, conflicting
+  current identities and invalid references fail closed. Native owners decide
+  whether the decision and scope are substantively approved.
+- Initial admission freezes each pending writer lane's normalized allowlist in
+  existing dispatch metadata. Mutable tasks, reused batch labels or replacement
+  lease rows cannot move a retained actor's authority. Exact claim identity and
+  session remain required; claim release or expiry does not prove actor exit.
+  Returned/integrated siblings may free slots for rolling refill.
+
+The engine does not invoke a model, create a native workspace, infer semantic
+independence, judge a rationale's truth, bind a handle to an execution checkout,
+or authorize publishing. Native hosts still execute preparation, dispatch exact
+profiles, reconcile results and obey human and protected-validation gates.
+
+## Alternatives considered
+
+| Option | Why rejected |
+| --- | --- |
+| More reminders and frontier reports only | The observed controller already had that guidance and still skipped preparation. |
+| Automatically accept the newest table or rename prose | Recency and prose do not establish canonical identity or supersession. |
+| Rewrite archived maps to match the current run | Destroys the historical decision rather than recording current authority. |
+| Require every future workspace READY before any writer | Serializes preparation and creates cycles when future plans depend on current repair. |
+| Engine-owned model scheduling, receipts or persistent queue | Duplicates host authority and exceeds the deterministic local boundary. |
+
+## Consequences
+
+Skipping required preparation now refuses an observable writer-admission step
+rather than remaining a narrative warning. Independent work can continue with a
+disclosed specific constraint, without disguising deferred work as completed.
+Canonical normalization has one machine-readable owner and does not require
+altering old evidence or guessing workspace names.
+
+This cannot prove that an arbitrary host obeys every instruction or that a native
+account represents real semantic progress. Runtime claims therefore distinguish
+structural admission, recorded native launches, and actual host behavior.
+
+Guard tests: `engine/internal/lib/frontier_controller_test.go`,
+`engine/internal/lib/frontier_roadmap_test.go`, and
+`engine/tests/autocomplete_global_test.go`.

package/docs/adr/README.md

@@ -84,3 +84,4 @@ architecture; per-feature `decisions.md` files stay scoped to that feature.
 | [0036](0036-archive-recall-is-a-read-time-query.md) | Archive recall is a read-time query | Accepted; consistent with 0014/0022 (no engine index or store) | `engine/internal/lib/recall_test.go` |
 | [0037](0037-autocomplete-lands-local-checkpoints.md) | Autocomplete lands local checkpoints and self-resolves own scratch | Accepted; supersedes the ADR-0022 local-commit approval clause | `tests/authority-drift-test.sh` |
 | [0038](0038-engine-flags-unattributed-root-edits.md) | The engine flags unattributed root edits | Accepted; narrows the ADR-0018 no-replacement-enforcement clause for root-edit attribution | `engine/internal/lib/treebaseline_test.go` |
+| [0039](0039-autocomplete-structural-admission.md) | Structural admission for native Autocomplete | Accepted; narrowly amends 0022/0024 for observable writer admission, retains native dispatch and semantic authority | `engine/internal/lib/frontier_controller_test.go`, `engine/internal/lib/frontier_roadmap_test.go`, `engine/tests/autocomplete_global_test.go` |

package/docs/cli.md

@@ -43,6 +43,7 @@ devrites-engine observe summary <slug>
 devrites-engine orient <slug>
 devrites-engine observe slice <slug> <SLICE-ID>
 devrites-engine next [slug]
+devrites-engine frontier [slug]
 devrites-engine handoff [slug] [--resume]
 devrites-engine recall --paths <p1,p2,...> [--limit n]
 devrites-engine context [slug] (--phase <p>|--skill <name>) [--role <r>] [--whole]
@@ -90,6 +91,21 @@ downloading assets. `--source-dir` and `--payload-dir` remain the advanced local
 update path for npm, shell, source-checkout, and test callers; a local `--check`
 needs only `--source-dir`.
 
+Release metadata requests to the exact HTTPS `api.github.com` origin use the
+first available credential: `GH_TOKEN`, then `GITHUB_TOKEN`, then optional
+`gh auth token --hostname github.com`. The helper is noninteractive, bounded to
+three seconds and 4 KiB of output; missing, failed, timed-out, or oversized helper
+output does not prevent an unauthenticated request. GitHub CLI is not required.
+An explicitly supplied invalid credential fails; the updater does not silently
+retry under another identity. Credentials are never sent to release assets or
+off-origin redirects. Same-origin GitHub API redirects may retain them.
+
+On a headless machine, run `gh auth login --hostname github.com --web`, then use
+the displayed device code in a browser on another device. Do not put credential
+values in commands, examples, logs, or support reports. `--force` permits
+managed-file replacement, not authentication or rate-limit bypass. Authenticated
+requests can still be rate-limited; wait before retrying when necessary.
+
 ## npm adapter
 
 The `npx devrites` adapter accepts `add` as an alias for `install`, `upgrade` for
@@ -153,12 +169,17 @@ self-contained updater.
   slice checkpoint or phase advance, and treat `BLOCKED` at Seal as NO-GO.
   Never use automatic updates to hide an unreconciled regression.
 - `check continuation [slug]` prints `continuation: required` and
-  `invoke: <next_action>` when `.devrites/AFK` is present, `status` is
-  `running`, no question cursor is set, no blocking or escalating question is
-  open, and `next_action` is an internal phase command (`/rite-vet`,
-  `/rite-build`, not `/rite-ship`). Otherwise it prints `continuation: clear`.
-  Exit `0` either way: `required` means invoke that command, not pause for a
-  human. `handoff` prints the same lines.
+  `invoke: <next_action>` when `.devrites/AFK` is a regular file, `status` is
+  `running` (or specifically `phase=vet,status=ready`), no question cursor is
+  set, no blocking or escalating question is open, and `next_action` is a valid
+  internal phase command, not `/rite-ship`. Other ready statuses do not inherit
+  this exception. It also reports the sequence frontier: when the local cursor
+  is clear but related work needs native preparation, it can print
+  `continuation: required` with `invoke: /rite-autocomplete` and the original
+  source identity. Waiting, human-blocked, or completed work alone does not
+  require continuation. Neither result authorizes Ship, overrides a human gate,
+  or declares an unvetted workspace Build-ready. Successful verdicts exit `0`;
+  malformed or ambiguous state fails visibly. `handoff` prints the same lines.
 - `check drift <slug>` attributes readiness-input drift to the exact artifact.
   `--record` snapshots per-input SHA-256 digests into `readiness-inputs.json`
   under the feature lock after Vet records the aggregate binding; a later
@@ -192,7 +213,9 @@ self-contained updater.
   and exits `3` naming the holder when a live claim by another session covers a
   path; `release --session <id> --id <claim>` frees it; `list [--all]` shows
   live (or all) claims; `check [--session <id>] <path>...` is the read-only
-  preflight. Each claim records its host and the claiming session's long-lived
+  preflight. Conflict checks cover logical paths and physical symlink aliases;
+  unresolved physical paths fail closed. Same-session allocation stays exempt.
+  Each claim records its host and the claiming session's long-lived
   processes; when all of them have exited on this host, `list` shows the claim
   `dead` and it no longer conflicts. Other hosts or an unavailable `ps` never
   prove exit. Claims coordinate concurrent same-tree sessions; they never
@@ -231,6 +254,158 @@ checked by the root's explicit native re-read checklist. Repository build,
 test, lint, typecheck, schema, and release commands belong to that repository
 or CI.
 
+## Sequence frontier
+
+`devrites-engine frontier [slug]` is a read-only structural report across the
+source's recorded sequence. An explicit slug may name a live or archived
+workspace. Without one, the command uses the selected source; if `ACTIVE` is
+absent, recovery requires a unique archived terminal sequence tip with an exact
+recorded native `/rite-spec <next>` edge. Multiple possible sources fail as ambiguous;
+folder names and numeric suffixes are not authority.
+
+The report emits:
+
+- `frontier: actionable|waiting|blocked|clear`, or `frontier: none` for a
+  non-sequence source.
+- `frontier-source: <slug>` and `frontier-workspace:` rows naming each related
+  workspace's `location=live|archive|missing`, `action=inspect|prepare|repair|wait|complete`,
+  and reason. Archived intermediaries do not hide live descendants, and archived
+  workspaces never become writer candidates.
+  Running or execution-unknown dispatch roles wait; completed writer returns
+  without durable acceptance require native inspection, not another writer launch.
+- `frontier-select-command:` with an explicit `parallel select --from-plan
+  --workspaces ...` command when a live controller is available. Selection still
+  enforces current readiness, recorded dependencies and independence, retained
+  leases, path conflicts, and the repository-wide capacity. `frontier-picks:`
+  names eligible source-qualified slices; `frontier-selection: blocked` names a
+  selection refusal. These are observations, not writer launches.
+  The explicit pool excludes retained dispatch and human/question/scope-held
+  sources; their workspace rows remain visible. `--workspaces` is the exact
+  candidate list; `--slug` identifies the controller, not an implicit candidate.
+  Legacy per-source slice counters never reduce the global writer cap or exclude
+  independent children; recorded workspace-opening limits still apply.
+- `frontier-prepare:` for a recorded next Spec cursor or an unambiguous next entry
+  in an exact position/workspace table, or `frontier-review-sequence:` artifact
+  paths when remaining work or conflicting sequence maps require native review.
+- `frontier-authority: <artifact-path>,...` identifies actual files supplying a
+  valid nonempty scheduling map. For explicit canonical authority it names the
+  owning `roadmap.md` and same-owner `decisions.md`; legacy maps list their actual
+  artifacts without claiming canonical status.
+
+Relations come from exact recorded `sequence_parent` edges, not name prefixes.
+Conflicting identities, cycles, malformed related state, or invalid declared
+sequence positions are refused. Missing or stale planning is a repair action,
+not permission to build. Continuation flags and remaining counts constrain new
+workspace preparation without silently discarding existing children.
+Conflicting or amended sequence maps suppress missing-workspace preparation even
+with a recorded Spec cursor until native authority normalization resolves them;
+valid existing live descendants remain visible and eligible for guarded selection.
+
+An optional `roadmap.md` becomes current scheduling authority when it contains
+either `Sequence root:` or `Decision:`. Both headers are then required:
+
+```markdown
+Sequence root: actual-anchor-slug
+Decision: DEC-017
+
+| Position | Workspace |
+| --- | --- |
+| 1 | actual-anchor-slug |
+| 2 | actual-renamed-child |
+```
+
+Exactly one related live or archived workspace may own this explicit map.
+`Decision: DEC-NNN` must identify exactly one `## DEC-NNN` heading in that
+owner's `decisions.md`; the root must match the actual chain anchor. Exactly
+one table must have contiguous positions from 1 and unique valid workspace
+slugs, matching every related recorded position and exact successor. Folder
+numbering, prose amendments, and unenrolled workspaces confer no authority.
+A valid explicit map supersedes historical tables in `decisions.md`, `spec.md`,
+and headerless `roadmap.md` for scheduling only; preserve those historical bytes.
+Without either header, `roadmap.md` retains conservative legacy parsing.
+Partial/malformed headers, multiple owners, invalid root/decision/table, or a
+symlink/unreadable explicit map fail closed without legacy fallback. Use native
+authority normalization to record the approved actual identities while retaining
+history. Structural validation establishes identity, not semantic approval,
+independence, Build readiness, or Ship permission.
+
+Under AFK, `next`, `handoff`, and `check continuation` expose the same frontier.
+A source-local `parallel select --from-plan` without `--workspaces` also prints
+the report to stderr, preserving its machine-readable selection on stdout and
+source-local picks: reporting another workspace never silently admits it.
+Native Autocomplete must inspect returned preparation/review actions and read
+the exact `frontier-authority:` paths plus recorded restrictions before invoking
+Spec/Plan/Vet or mixed selection. This read is required even when the owner is an
+archived ancestor or another related workspace outside the local read-next bundle.
+Path disjointness alone establishes neither semantic independence nor permission
+to lift a planning-only restriction.
+
+### Autocomplete controller admission
+
+The existing `/rite-autocomplete` invocation writes or upserts `mode: autocomplete`
+in `.devrites/AFK`; no extra flag is needed. It preserves other sentinel fields
+unless an explicit `--parallel N` changes capacity. Mode identifies the native
+controller, not authorization. Standalone AFK without mode retains its behavior;
+duplicate or invalid mode requires normalization rather than silently disabling
+the controller gate.
+
+With controller mode and global capacity above one, a new Build wright
+`dispatch open` checks structural global scheduling before writing claims, history,
+or a round. It checks one immediate recorded successor per admitted source, not
+the whole future sequence:
+
+- Missing permitted successor: start its native Spec/Plan/Vet preparation and
+  retain actual launched planning/review handles before admitting the writer.
+- Existing successor: require pending preparation handles, a current native
+  Build-ready binding, or its concrete human/dependency hold. A placeholder
+  state/spec or a prose claim that preparation happened is insufficient.
+- Opted-out or exhausted future opening and source human/question holds do not
+  invent new preparation obligations. Unresolved sequence authority requires
+  native normalization.
+
+For a concrete preparation constraint, retain
+`frontier-blocked: <successor-slug> — <specific constraint>` in the source's
+`evidence.md`. For unresolved historical normalization on otherwise-valid local
+work use `frontier-blocked: sequence — <specific constraint>`. These deferrals
+remain visible for native review; they grant no approval, readiness, or claim
+that normalization succeeded. Neither waives malformed canonical authority,
+invalid AFK/path/readiness/security checks, or already-ready foreign Build.
+A generic local `serial: SLICE-002 — <reason>` does not waive cross-workspace
+preparation. A discharged deferral does not repeatedly trigger controller work.
+
+Ready independent foreign sources must participate in explicit repository-wide
+mixed selection and lease capacity/path reservations. Reserve the cohort with
+`parallel create/add`; source waves may then open separately. A concrete
+`serial: other-workspace/SLICE-001 — <constraint>` can retain an ordered handoff
+for that exact foreign pick; an unqualified local serial reason cannot silently
+omit it. This does not waive successor preparation or readiness, dependencies,
+runtime/path isolation, actor claims, or reviewer/proof windows.
+Dispatch `controller_batch` is an opaque cohort-instance admission identity,
+recording initial whole-wave, source-qualified live-lease admission, never proof
+of actor checkout, cwd, or runtime profile. Immutable `admitted_paths` snapshots
+retain each pending writer lane's normalized allowlist. Missing snapshots or
+changed reservations require actor reconciliation; mutable tasks cannot backfill
+authority. Returned/integrated siblings may release slots for rolling refill.
+Exact claim identity/session remains required; release or expiry does not stop
+an actor. Retained unbound or other-cohort writers hold new actors; later lease
+IDs cannot retrofit them. Native exact cwd/profile checks remain required.
+Unsupported isolation permits truthful local-owner serial work and normal
+ordered handoff, never an early same-tree foreign writer.
+
+Controller continuation prioritizes actionable global normalization, preparation,
+and foreign work over a direct local Build invocation while preserving the local
+phase cursor. Local-only ready work does not recursively invoke Autocomplete.
+After a committed dispatch return, a fresh global scheduling result resurfaces
+the next obligation—even if later claim release fails; its nonzero failure and
+claim exclusion remain. Rejected or unpersisted returns do not refresh.
+Ordinary status reads remain read-only. Protected reviewer/proof windows defer
+unsafe landing, not independent planning. No such transition invokes Ship or
+launches a model through the engine.
+
+The engine does not invoke models, create workspaces, change `ACTIVE`, resolve
+semantic authority, or grant Ship approval. These outputs guide the native host;
+they cannot guarantee that an arbitrary host follows the workflow.
+
 ## Acceptance ledger
 
 `gates` operates the `gates.md` ledger inside a feature workspace: one gate per

package/docs/command-map.md

@@ -41,8 +41,8 @@ The Go surface is intentionally closed and deterministic:
 
 | Lane | Commands | Owner |
 |---|---|---|
-| Candidate and deterministic checks | `check candidate`, `check readiness [--emit-binding]`, `check preconditions <slug> [--slice <SLICE-ID>]`, `check seal`, `check slice <slug> <SLICE-ID>`, `check task-graph`, `check regression <slug> [--update]`, `check continuation [slug]`, `check drift <slug> [--record]`, `check windows <slug>`, `check dup`, `check path-disjoint`, `parallel select`, `check skill-trust`, `check indexes`, `detect commands [--root <dir>] [--json]` | Candidate validates/hashes the strict project manifest; readiness checks phase files, the required `tasks.md` slice graph, or emits the vetted Build-input binding; `check preconditions` runs the `test-plan.md` preflight rows whose `Run at` is `vet` (or `pre-dispatch <SLICE>`) with candidate-bound transcripts; seal checks final files/open gates, that graph and binding, then exact candidate bindings. `check slice` preflights one slice before wright dispatch — contract present, exact Writer allowlist paths, `Satisfies` AC ids resolvable, bounded scope — so a malformed slice fails before a writer context is spent. `check indexes` reports install manifest and optional code-index directory presence as JSON. `parallel select` returns the greedy path-disjoint subset ≤ cap from the supplied ready slices, or with `--from-plan` from tasks.md slices whose dependencies state.md checks built. `check regression` compares current workspace progress against the durable `regression-baseline.json` high-water mark and `--update` ratchets it at a checkpoint, so a lost slice, unchecked criterion, or reopened question fails closed instead of passing silently. `check continuation` prints `required` and the phase command to invoke when AFK, `status=running`, and `next_action` is an internal phase edge; `clear` otherwise. Exit 0 either way. `handoff` prints the same lines. `check windows` scans the feature diff for newly introduced deferral markers (TODO/FIXME/skipped test/stub idioms) and fails when any lacks a `windows.md` waiver row — silent deferrals block the seal. `check dup` reports advisory near-duplicate clusters that survive renaming (normalized token shingles, transitive clusters, distance-boosted rank, `*`-marked diff overlap, stable content hashes, `.devrites/dup-ignore` dismissal ledger) — leads for reviewer triage, never a gate. `check drift` attributes readiness-input drift to the exact artifact: `--record` snapshots per-input SHA-256 digests into `readiness-inputs.json` under the feature lock, and a later compare names each `changed`/`missing`/`added` input (falling back to the aggregate `eng-review.md` binding plus mtime candidates when no baseline exists) so a stale-binding repair starts at the right file — advisory, never a gate. `detect commands` resolves the repository's own test/lint/vet/build commands (Makefile targets, then `package.json` scripts, then language-manifest fallbacks, plus the lockfile-derived package manager) so `gates.md` `CHECK` lines and proof steps cite real wiring instead of invented commands — read-only, no installs, no execution. |
-| Workspace observation | `observe summary`, `orient`, `observe slice <slug> <SLICE-ID>`, `next`, `handoff` | JSON workspace snapshot for agents (cursor, task graph, `artifact_budgets`, `bulk_files`); `orient` is an alias for `observe summary`. `observe slice` prints one `SLICE-###` section of `tasks.md` so Build reads a slice, not the file. `next` prints the minimal remaining lifecycle path plus advisory skips (e.g. clarify at zero open questions). `handoff` emits the deterministic resume record (cursor, `awaiting_human`, blocking question gates, ledger reduction with unmet/stale ids, dead ends, read-next order, continuation verdict) — the `/rite-handoff` spine and compaction-fallback entry. |
+| Candidate and deterministic checks | `check candidate`, `check readiness [--emit-binding]`, `check preconditions <slug> [--slice <SLICE-ID>]`, `check seal`, `check slice <slug> <SLICE-ID>`, `check task-graph`, `check regression <slug> [--update]`, `check continuation [slug]`, `check drift <slug> [--record]`, `check windows <slug>`, `check dup`, `check path-disjoint`, `parallel select`, `check skill-trust`, `check indexes`, `detect commands [--root <dir>] [--json]` | Candidate validates/hashes the strict project manifest; readiness checks phase files, the required `tasks.md` slice graph, or emits the vetted Build-input binding; `check preconditions` runs the `test-plan.md` preflight rows whose `Run at` is `vet` (or `pre-dispatch <SLICE>`) with candidate-bound transcripts; seal checks final files/open gates, that graph and binding, then exact candidate bindings. `check slice` preflights one slice before wright dispatch — contract present, exact Writer allowlist paths, `Satisfies` AC ids resolvable, bounded scope — so a malformed slice fails before a writer context is spent. `check indexes` reports install manifest and optional code-index directory presence as JSON. `parallel select` returns the greedy path-disjoint subset ≤ cap from the supplied ready slices, or with `--from-plan` from tasks.md slices whose dependencies state.md checks built; source-local selection reports the sequence frontier without silently admitting other workspaces. `check regression` compares current workspace progress against the durable `regression-baseline.json` high-water mark and `--update` ratchets it at a checkpoint, so a lost slice, unchecked criterion, or reopened question fails closed instead of passing silently. `check continuation` prints `required` and the phase command when AFK, `status=running` (or specifically `phase=vet,status=ready`), and an internal phase edge passes human/question guards; actionable global preparation may instead require `/rite-autocomplete`, never Ship authorization. Successful `required`/`clear` verdicts exit 0; malformed or ambiguous state fails visibly. `handoff` prints the same lines. `check windows` scans the feature diff for newly introduced deferral markers (TODO/FIXME/skipped test/stub idioms) and fails when any lacks a `windows.md` waiver row — silent deferrals block the seal. `check dup` reports advisory near-duplicate clusters that survive renaming (normalized token shingles, transitive clusters, distance-boosted rank, `*`-marked diff overlap, stable content hashes, `.devrites/dup-ignore` dismissal ledger) — leads for reviewer triage, never a gate. `check drift` attributes readiness-input drift to the exact artifact: `--record` snapshots per-input SHA-256 digests into `readiness-inputs.json` under the feature lock, and a later compare names each `changed`/`missing`/`added` input (falling back to the aggregate `eng-review.md` binding plus mtime candidates when no baseline exists) so a stale-binding repair starts at the right file — advisory, never a gate. `detect commands` resolves the repository's own test/lint/vet/build commands (Makefile targets, then `package.json` scripts, then language-manifest fallbacks, plus the lockfile-derived package manager) so `gates.md` `CHECK` lines and proof steps cite real wiring instead of invented commands — read-only, no installs, no execution. |
+| Workspace observation | `observe summary`, `orient`, `observe slice <slug> <SLICE-ID>`, `next`, `frontier [slug]`, `handoff` | JSON workspace snapshot for agents (cursor, task graph, `artifact_budgets`, `bulk_files`); `orient` is an alias for `observe summary`. `observe slice` prints one `SLICE-###` section of `tasks.md` so Build reads a slice, not the file. `next` prints the minimal remaining lifecycle path plus advisory skips (e.g. clarify at zero open questions). `frontier` reports recorded live/archive sequence relations, scoped actions, explicit mixed selection, and native preparation/review needs without changing ACTIVE or admitting writers; ambiguous source recovery refuses. Under AFK, `next` and `handoff` expose the same frontier while retaining the source cursor. `handoff` emits the deterministic resume record (cursor, `awaiting_human`, blocking question gates, ledger reduction with unmet/stale ids, dead ends, read-next order, continuation verdict) — the `/rite-handoff` spine and compaction-fallback entry. |
 | Context packets, dispatch waves, metrics, claims, notes | `context [slug] (--phase <p> \| --skill <name>) [--role <r>] [--trigger a,b]`, `dispatch <slug> <open\|start\|seal\|return\|status\|abandon>`, `candidate freeze`, `packet`, `metrics record`, `metrics summary`, `claim <add\|release\|list\|check>`, `note <add\|list\|check\|rm>` | `context` emits one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest — a dispatch target reads it instead of selecting files; `--skill` works without a workspace when `--out` is given. `dispatch` owns the launch-wave barrier (seal needs a handle per role; return needs seal; the last start seals; open --claim-session/--claim takes the wave's file claim, released by the completing return or abandon --release) and auto-records dispatch/return metrics. `candidate freeze` writes a wave's frozen `packets/<w>.diff` + `.sha256`; `packet` renders and lints one role's by-reference packet. `metrics` owns the append-only `metrics.jsonl` ledger. `claim` owns the append-only `.devrites/claims.jsonl` ledger — advisory, session-scoped file claims with TTL so concurrent same-tree sessions see each other's write intent before edits collide (conflict exits 3; never a substitute for one-writer-per-worktree). `note` owns the anchored `notes.md` ledger — notes bound to verbatim code quotes, regraded `exact`/`moved`/`stale`/`ambiguous`/`lost` as the code drifts; `check seal` refuses non-`exact` anchors. `check diff-scope` is the mechanical changed-paths ⊆ allowlist gate run before reviewer dispatch. |
 | Atomic workspace state | `state resolve`, `state merge-manifest`, `state apply-bundle <slug> <bundle.json>... [--dry-run]`, `state set <slug> key=value... [--unset key]`, `state append <slug> <ledger.md> --heading <text> --body-file <path\|->`, `state close`, `migrate [--dry-run] [--answer id=choice]` | Go owns answer/drop/batch resolution, the recorded predecessor-chain manifest union for a release milestone, the all-or-nothing apply of plan-drafter hunk bundles (base-hash pins, unique non-overlapping anchors, no lost IDs, no new task-graph or budget defect, no appended dated delta section), cursor writes (known phase, engine-owned schema, no return-cursor overwrite; an AFK pause names auto-pickable questions), append-only ledger sections that refuse a duplicate heading, transactional close, and fail-closed v5 schema normalization. |
 | Acceptance ledger | `gates scaffold`, `gates status`, `gates run [--timeout N]`, `gates reverify [--timeout N]`, `gates lint [--strict]`, `gates precheck <slug> --worktree <path> [--slice <SLICE-ID>]`, `gates attest <id> <note>`, `gates abandon <id> <why>` | Go owns the `gates.md` ledger: per-outcome gates whose runnable `CHECK`/`CWD` must exactly match a `test-plan.md` Build-entry preflight row, evidence bound to the gate definition digest (stale = unmet), `ABANDON:` handoffs, oracle lint, and the wright's never-evidence `precheck` of `RUN: writer` gates. Readiness/seal require a parse-clean, all-met ledger whenever `gates.md` is a required artifact. |

package/docs/engine/commands.md

@@ -9,7 +9,7 @@ workflow strategy.
 | Command | Deterministic responsibility |
 | --- | --- |
 | `install [flags]` | Install manifest-owned host artifacts and the optional shared binary. |
-| `update [flags]` | Refresh an existing managed installation. |
+| `update [flags]` | Refresh an existing managed installation. Release API authentication uses `GH_TOKEN`, then `GITHUB_TOKEN`, then optional bounded noninteractive `gh auth token --hostname github.com`; explicit invalid credentials fail. Never sends credentials to assets or off-origin redirects. `--force` does not bypass rate limits. See [release authentication](../cli.md#updates). |
 | `uninstall [flags]` | Remove managed artifacts while preserving runtime workspace state. |
 | `check candidate <slug>` | Validate the strict manifest and compute the content-bound project-candidate identity. Exits `3` when the manifest omits a path the feature's `WIP(<slug>):` checkpoint commits changed (net from the feature base to HEAD). Also exits `3` with `unattributed root edit: <paths>` while the feature's `tree-baseline.json` tripwire flags a product path (ADR-0038; see `dispatch`). |
 | `check readiness <slug>` | Check target-Phase files, open human gates from Clarify onward, the `tasks.md` slice graph when that artifact is required, canonical `AC-###` presence in `tasks.md`/`test-plan.md` when those artifacts are required, and the current stable Build-input binding when applicable. Leaving Vet with a `Run at` column, a slice whose `Files likely touched`/`Writer allowlist` names a dependency manifest or lockfile needs a `dependency-dry-run SLICE-###` row at `vet` with a passing transcript. Leaving Vet, every slice `state.md` does not check built (a deferred `Satisfies: none` slice excepted) must also pass the Build-entry `check slice` contract; each failure prints one `invariant: slice-check:` line naming the slice and its exact `check slice` reason, to fix in `/rite-plan` before READY. |
@@ -17,11 +17,11 @@ workflow strategy.
 | `check preconditions <slug> [--slice SLICE-###] [--timeout N]` | Run the `test-plan.md` Build-entry preflight rows whose optional `Run at` cell is `vet` (with `--slice`, `pre-dispatch <SLICE>`); `action` rows and rows without the cell never run. Writes one candidate-bound transcript per row under `references/gates/preflight-*/`; a row passes on exit 0. A `pre-dispatch` row whose newest transcript passed is kept, not re-run: it is a pre-edit baseline, so a re-dispatch never runs it against the slice's own edits; changing its command or cwd retires the pass. Exit `3` on any failure or an invalid `Run at` value. |
 | `check seal <slug>` | Check files required by target Phase `seal`, open human gates, the `tasks.md` slice graph, canonical `AC-###` presence when `tasks.md`/`test-plan.md` are required, the stable Build-input binding, and exact candidate bindings. `check readiness` and `check seal` also block a `scripts/` test driver that a tasks.md Writer allowlist plans or touched-files.md lists when no gates.md `CHECK` runs it and no `Driver waiver: <path> — DEC-### <reason>` line cites a recorded decision; waived drivers print as `note: unexecuted driver (waived by DEC-###): <path>` lines, on pass or block. |
 | `check path-disjoint [--root <dir>] [<json-file> | -]` | Verify slice path sets are pairwise disjoint. |
-| `parallel select --cap <1-10> [--root <dir>] [--slug <controller>] [--from-plan [--workspaces <slug,...>] \| <json-file> \| -]` | Choose a plan-order path-disjoint ready subset, seeded by all retained repository-controller slots and paths. `--from-plan` uses canonical built checkpoints, local and declared workspace producer dependencies, exact write sets and required dependency manifests. The internal `--workspaces` data-source parameter pools recorded forward continuations with current readiness and explicit native-vetted per-slice declarations; blocked/stale/missing candidates print scoped notices without hiding other ready work. Foreign identities print `<workspace>/<slice>`. |
+| `parallel select --cap <1-10> [--root <dir>] [--slug <controller>] [--from-plan [--workspaces <slug,...>] \| <json-file> \| -]` | Choose a plan-order path-disjoint ready subset, seeded by all retained repository-controller slots and paths. `--from-plan` uses canonical built checkpoints, local and declared workspace producer dependencies, exact write sets and required dependency manifests. Without `--workspaces`, it also reports the full recorded sequence frontier but keeps source-local picks; other workspaces are never silently admitted. The explicit `--workspaces` data-source parameter pools recorded forward continuations with current readiness and explicit native-vetted per-slice declarations; blocked/stale/missing candidates print scoped notices without hiding other ready work. Foreign identities print `<workspace>/<slice>`. |
 | `parallel <create\|add\|integrate\|prune\|cleanup\|status\|abort\|lease-read\|lease-write\|lease-clear\|record-green>` | One repository controller owns isolated workers across source workspaces. `create` accepts a single initial worker; `create`/`add --cap N` persist the global admission capacity. Explicit `add --cap N --json -` with stdin `[]` updates capacity only; lowering below active count refuses without canceling workers. A completed retained lease can refill at unchanged control tip. `record-green` and per-slice `integrate --slice <workspace/id> --apply-to-control` target source-qualified lanes (bare IDs mean controller lanes); integration keeps exact ancestry/path/dirty-work checks and lands `WIP(<source>):`. `prune` removes only verified clean integrated checkouts, retaining branches, proof identities, lease rows and controller. Status exposes the retained controller and pending landing; cleanup preserves salvage/unknown work. |
 | `check task-graph <slug>` | Validate `tasks.md` slice dependency graph for cycles, unknown deps, malformed tokens, duplicate IDs, missing `Dependencies`, and `depends_on` mismatch. Prints a non-blocking `ADVISORY size:` line (and records a `size-advisory` metric) for each slice with 12+ Writer allowlist files and no `Size rationale:`. A `Dependencies` ID may carry a `(via <interface>)` suffix (empty or unclosed is a malformed token); prints a non-blocking `ADVISORY edge:` line (and records an `edge-advisory` metric) for each edge with no via, or whose via text is not a case-insensitive substring of the dependency's `Consumes / Produces:`. Prints `schedule: <n> slices in <r> build rounds at cap 10` (the `/rite-build` batch selection replayed over each slice's Writer allowlist, else Files likely touched, plus the manifest parallel select reserves; omitted when a slice has no path) and a non-blocking `ADVISORY hub:` line (top five; records a `hub-advisory` metric) for each path, compared case-folded, that three or more slices without `Serial rationale:` write. Advisories print only when the graph is valid. |
 | `check regression <slug> [--update [--allow-empty]]` | Compare the workspace's structural progress facts (phase ordinal, checked ACs, met/abandoned gates, done slices, resolved questions, present artifacts) against the recorded `regression-baseline.json` high-water mark. Ordinary checks block lost facts without changing the baseline. `--update` records the current facts under the feature lock and prints each blessed regression; a deliberate owner-authorized repair checkpoint can accept a backward phase as the new baseline. Removing every checked AC and met gate also requires `--allow-empty`. Never automatically bless an unreconciled regression. |
-| `check continuation [slug]` | Print whether an armed AFK run must invoke its cursor instead of replying. `continuation: required` plus `invoke: <next_action>` when `.devrites/AFK` is a regular file, `status` is `running`, `question_id` is empty, no blocking or escalating question is open, and `next_action` is an internal phase command (`/rite-spec` through `/rite-seal`, including `/rite-plan`, not `/rite-ship` or `/rite-autocomplete`). Otherwise `continuation: clear` with a one-line `reason`. Exit `0` either way. `handoff` prints the same lines. |
+| `check continuation [slug]` | Print whether an armed AFK run must invoke its cursor instead of replying. `continuation: required` plus `invoke: <next_action>` requires a regular `.devrites/AFK`, `status=running` or specifically `phase=vet,status=ready`, empty `question_id`, no blocking/escalating question, and a valid internal phase command (`/rite-spec` through `/rite-seal`, including `/rite-plan`, not `/rite-ship` or `/rite-autocomplete`). Also emits the sequence frontier; a clear local cursor with actionable global preparation can require `invoke: /rite-autocomplete` while preserving the source identity. Waiting, human-blocked, or completed work alone does not require continuation. Neither route authorizes Ship or bypasses human/readiness gates. Successful `required`/`clear` verdicts exit `0`; malformed or ambiguous state fails visibly. `handoff` prints the same lines. |
 | `check drift <slug> [--record]` | Attribute readiness-input changes to the exact artifact. `--record` writes the per-input `readiness-inputs.json` digest baseline under the feature lock; without it the workspace diffs current inputs against that baseline (or falls back to the aggregate binding recorded in `eng-review.md`). Advisory: exit `0` on drift; a corrupt baseline exits `3`. A `test-plan.md` change limited to exact `Workflow Artifact reviewed identity: <64hex>` lines is reported as `reviewed-identity-only` (ADR-0034). `--record` also stores each slice's proof bytes (its `tasks.md` block plus the `test-plan.md` lines naming it); both modes print `ADVISORY proportion:` for a slice whose proof grew over 2x since that baseline or carries over 3x the median proof per AC. |
 | `check windows <slug> [--worktree\|--staged\|--base <ref>\|--since-dispatch <wave>]` | Fail on deferral and bar-lowering markers the change introduces without a waiver row in the workspace's `windows.md`: added TODO/FIXME/XXX/HACK, skipped/focused-test and stub idioms, checker suppressions, one-line empty catch; removed `deleted-test` files and net `removed-assertion` lines in remaining test files. `--since-dispatch <wave>` reports only `deleted-test`/`removed-assertion` against the work-tree snapshot (`tree` in `dispatch.json`) recorded when that build wright wave opened, untracked files included; it takes no `--cwd` and records the `windows-since` metric. |
 | `check dup [slug] [--all\|--worktree\|--staged\|--base <ref>] [--min-lines n] [--threshold f] [--ignore-file <path>] [--limit n] [--exclude <csv>]` | Report near-duplicate code clusters that survive comment stripping, literal collapsing, and identifier renaming — token-shingle matches chained into segments, clustered transitively, ranked with bounded path/line-distance boosts. Diff modes mark units overlapping changed hunks with `*`; stable content-derived cluster hashes let `.devrites/dup-ignore` dismissals survive line moves but resurface on structural edits. Staged mode reads index blobs and excludes untracked files. Bounded heuristic: successful scans/leads exit `0`; usage, unavailable input, and partial scans exit `2`. |
@@ -35,6 +35,7 @@ workflow strategy.
 | `orient <slug>` | Alias for `observe summary`. |
 | `observe slice <slug> <SLICE-ID>` | Print one `SLICE-###` section of `tasks.md` so Build reads a slice, not the file. |
 | `next [slug]` | Print the minimal remaining lifecycle path plus advisory skips; in Build also `eligible_now:`, `batch:` and the `select-command:` (`parallel select --root <project> --slug <slug> --cap N --from-plan`, N = AFK max_parallel else 10) that reproduces the batch. Prints `blocked: unattributed root edit: ...` after `open-questions:` and exits `3` while the ADR-0038 tripwire flags a product path; the rest of the output still prints. |
+| `frontier [slug]` | Read-only report across exact recorded sequence relations, including archived intermediaries and live descendants. Emits `frontier: actionable\|waiting\|blocked\|clear` (`none` for a non-sequence source), `frontier-source:`, and `frontier-workspace:` rows with location, `inspect\|prepare\|repair\|wait\|complete` action, and reason. Emits `frontier-select-command:`, `frontier-picks:`, `frontier-selection: blocked`, `frontier-prepare:`, or `frontier-review-sequence:` where applicable. Explicit slug may be archived; absent ACTIVE recovery requires a unique archived terminal tip with a recorded native Spec edge, otherwise refuses ambiguity. One explicit `roadmap.md` owner anywhere in the related live/archive chain may supersede historical maps for scheduling: both `Sequence root:` and `Decision:` headers, a unique owner-local decision heading, and one contiguous position/workspace table must match recorded identities and successors. Either header claims this format; invalid authority fails closed without legacy fallback. Headerless maps retain legacy parsing. Native normalization preserves historical bytes; structural identity is not semantic approval. Never changes ACTIVE, restores archives, creates workspaces, or launches writers. Native preparation and semantic admission remain required; see [sequence frontier](../cli.md#sequence-frontier). |
 | `handoff [slug] [--resume]` | Emit the deterministic resume record: cursor fields, `awaiting_human`, open `questions.md` gate kinds, the `gates.md` reduction with unmet/stale/abandoned ids, `decisions.md` dead ends, in-flight dispatch waves (`inflight_wave:` lines: phase, state, pending roles, slices), missing required files, the canonical read-next order, and the same `continuation:` lines as `check continuation`. Read-only unless `--resume`, which appends one `resume` event (role root) to `metrics.jsonl`; `metrics summary` then reports minutes from each resume to the next dispatch. The `/rite-handoff` spine and the compaction-fallback entry point. |
 | `recall --paths <p1,p2,...> [--limit n]` | Read-time query over `.devrites/archive/`: list archived features whose `touched-files.md` candidate manifest covers a queried project-relative path (exact or directory prefix, case-folded), ranked by overlap count, then newest archive-directory mtime, then slug (default 10 features). Each feature prints up to 8 `archive/<slug>/<file>:<line>` pointers, then `+N more`: `decisions.md` `DEC-###` entries and `## Carry-forward constraints` bullets whose `Files:` overlap (or a constraint naming no files), plus `review.md`/`seal.md`/`drift.md` lines that mention a queried path; fenced examples are ignored. Never writes, caches, or indexes (no metric either); symlinked archive entries are refused. An unreadable archive file prints `unreadable:` and the scan continues. Exit `0` (including `recall: no archive`), `1` invalid archive directory, `2` usage. |
 | `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--slice <SLICE-ID>] [--recheck <inventory>] [--trigger a,b] [--inline-contract] [--whole]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. A root `--phase build\|autocomplete` bundle (no `--role`, no `--slice`) defaults to `--slice <active_slice>` while the state.md cursor phase is `build` and active_slice names a slice present in tasks.md (prints `scope: slice SLICE-### (auto from state.md) ...`), unless `.devrites/AFK` `max_parallel` is 2 or more or a parallel lease is `running` (the bundle stays whole); `--whole` opts out. Every bundle opens, after its header comments, with a table of contents: one `L<start>-<end> <section label>` line per `===== label =====` section, giving its exact line range in the bundle file. A bundle without `--role` (the root's own read) gives over-budget artifacts as by-reference indexes; a `--role` bundle leads with the role's agent contract and names the manifest's `rootOnly` paths instead of inlining them. When the contract resolves under `.claude/agents`, `.omp/agents`, or `.codex/agents` (the host loads it as the agent's system prompt), the bundle writes one header line naming its path, size, and SHA-256 instead of the body; other layouts (pi, devin, unknown) and `--inline-contract` (only with `--role`) inline the body, and a missing contract still exits `3`. Inside inlined files, a `--role` bundle replaces each `<!-- root-only -->`…`<!-- /root-only -->` block with a one-line stub naming the omitted heading, and does the same for each `<!-- model-surface -->` block unless the role is `security-auditor`, the feature has an `ai-spec.md`, or `spec.md`/`plan.md`/`tasks.md`/`design-brief.md` are absent or (outside the spec template's `AI-SPEC annex`) name a model, agent, RAG, or tool surface; an unbalanced or headingless marker exits `2`. `--slice` inlines that slice's `tasks.md` block and turns each over-budget artifact, and each artifact over 16 KiB except `spec.md`, into a by-reference index (path, SHA-256, headings, line hits for every ID the block cites); repeat `--slice` for several slices; an unknown slice exits `3`. In phase `build`, a `--role` bundle other than `slice-wright` without `--slice` exits `3` (`unscoped build reviewer bundle`). `--recheck <inventory>` (phase `build`, with `--role` and `--slice`; path relative to the workspace) writes `<phase>-<role>.<slice>.recheck.bundle.md`: the inventory file and `core.md` inline whole, every other non-`rootOnly` pack file becomes a by-reference index (path, SHA-256, headings with line numbers) followed by each section the inventory cites as `<file>.md § <heading>`; workspace handling matches `--slice`. A missing or empty inventory exits `2`. First reviews, full-inventory rechecks, Vet, `/rite-review`, and Seal do not use it. |
@@ -58,6 +59,55 @@ workflow strategy.
 | `overhaul <records\|admit\|snapshot\|score\|bench\|render> ...` | Deterministic tools behind the standalone `/overhaul` skill: run-record generations and cross-record validation, worker-receipt admission and quote anchoring, index-safe baseline snapshots and per-attempt deltas, exact-rational readiness scoring, benchmark ratio intervals, and escaped offline review/report views. Operates only on explicit run-area and repository paths. See [Overhaul tools](#overhaul-tools). |
 | `version` | Print the engine version. |
 
+Under AFK, `next`, `handoff`, and `check continuation` include the sequence
+frontier without replacing the source-local cursor. Reporting actionable work
+does not authorize Build or Ship, and cannot guarantee native-host compliance.
+For a valid nonempty map, `frontier-authority: <artifact-path>,...` exposes actual
+authority files. Canonical maps name owner `roadmap.md` and owner-local
+`decisions.md`; valid legacy maps name their artifacts without a canonical claim.
+Native preparation must read those exact paths and restrictions, including
+archived/related owners absent from the local context read-next bundle.
+
+Native `/rite-autocomplete` automatically upserts AFK `mode: autocomplete`
+(no new flag), preserving other fields except an explicit `--parallel N` capacity
+update. Missing mode retains standalone AFK behavior; invalid/duplicate mode
+fails closed. With mode and global cap >1, Build wright `dispatch open` checks
+global scheduling before claims/history/round writes: prepare one immediate
+recorded successor per source, with actual pending planning/review handles,
+current native readiness, or a concrete human/dependency hold; placeholders do
+not count. Opt-out, exhausted opening budgets, and source human/question holds
+remain binding. Unresolved authority requires native normalization.
+
+Source `evidence.md` may retain `frontier-blocked: <successor-slug> — <specific constraint>`
+or `frontier-blocked: sequence — <specific constraint>` as a visible scheduling
+deferral, never approval or completed normalization. Generic local `serial:`
+does not waive preparation. Ready foreign picks require mixed selection and
+global lease capacity/path reservations, or an exact qualified
+`serial: other-workspace/SLICE-001 — <constraint>` ordered handoff. Cohort waves
+need not open atomically. Opaque `controller_batch` identifies admission to an
+existing lease cohort instance; reusing a batch label creates no actor entitlement.
+It proves no actor checkout/cwd/runtime isolation and cannot retrofit a retained
+writer. Immutable per-slice `admitted_paths` retain only each pending actor lane;
+missing snapshots or changed reservations require actor reconciliation, not
+backfill from mutable tasks. Returned/integrated siblings may release slots for
+refill. Exact claim identity/session remains required even after release/expiry.
+Readiness, dependencies, actor claims and proof windows still apply.
+Target-specific blocking defers preparation, not ready foreign Build. Sequence
+blocking covers historical normalization only for otherwise-valid local work;
+malformed canonical authority and invalid AFK/path/readiness/security still fail.
+Discharged deferrals do not repeatedly trigger controller work. Native reviews
+constraint substance and verifies exact actor cwd/profile. Retained unbound or
+other-cohort writers hold new actors; unsupported isolation requires local-owner
+serial work and ordered handoff, never early same-tree foreign writing.
+
+Controller continuation prioritizes actionable global work over direct local
+Build without replacing the local cursor or looping on local-only ready work.
+Committed dispatch returns emit fresh scheduling after locks release even if
+later claim release fails; preserve that nonzero failure and claim exclusion.
+Rejected/unpersisted returns do not refresh; status reads stay read-only.
+Protected reviewer/proof windows constrain landing, not independent planning.
+See [controller admission](../cli.md#autocomplete-controller-admission).
+
 For `context --role`, optional `devrites-` prefixes and `.lane` suffixes resolve
 the base specialist's contract, workspace read-set, and role-specific rules.
 The full label remains in bundle filenames and attribution. Reviewer

package/engine/commands.go

@@ -48,7 +48,7 @@ func rootModeFor(command string, args []string) rootMode {
 			return rootLenient
 		}
 		return rootUnused
-	case "orient", "next", "context", "metrics", "dispatch", "handoff", "note", "packet":
+	case "orient", "next", "frontier", "context", "metrics", "dispatch", "handoff", "note", "packet":
 		return rootStrictUsage
 	case "candidate":
 		if subcommand == "freeze" {

package/engine/help.go

@@ -189,7 +189,7 @@ func shouldPrintHelp(args []string) bool {
 		return true
 	}
 	switch args[0] {
-	case "check", "state", "observe", "parallel", "gates", "claim", "detect", "note", "metrics", "handoff", "context", "orient", "migrate", "overhaul", "next", "dispatch", "secret-scan", "open-visual", "recall", "packet", "candidate":
+	case "check", "state", "observe", "parallel", "gates", "claim", "detect", "note", "metrics", "handoff", "context", "orient", "migrate", "overhaul", "next", "frontier", "dispatch", "secret-scan", "open-visual", "recall", "packet", "candidate":
 		return len(args) >= 2 && args[1] == "help"
 	default:
 		return false
@@ -231,6 +231,8 @@ func commandHelp(args []string) (string, bool) {
 		return orientUsage, true
 	case "next":
 		return nextUsage, true
+	case "frontier":
+		return "usage: devrites-engine frontier [slug]", true
 	case "handoff":
 		return handoffUsage, true
 	case "recall":