@schneiderjoseph/devia 0.4.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## 0.6.0 — 2026-09-09
+
+The standard is unchanged: `VERSION` stays at 0.1.0.
+
+### `devia read` — the memory as one page
+
+A memory nobody reads is documentation with extra steps. `devia read` renders `.devia/` into a
+single HTML file: a sidebar in reading order — the contract first, then the numbered files — and
+links between memory files that jump inside the page instead of asking the filesystem for them.
+
+The page is **self-contained**: content embedded, no fetch, no CDN, no stylesheet to resolve. It
+opens by double-click, offline. The reader that prompted this one needed a running local server,
+because a page that fetches its own content hits CORS on `file://`.
+
+- `devia read` writes `.devia/reader.html`; `--out` puts it elsewhere
+- It is a **snapshot**, never the source: regenerate it after changing the memory. Adopters
+  should gitignore it, as this repository now does
+- `src/lib/markdown.mjs` renders the subset the memory templates actually use — headings,
+  tables, fenced code, lists, quotes, rules, and a few inline marks. Same reasoning as the YAML
+  parser: devia writes the files it reads, and `ARC-004` rules out a library. Content is escaped
+  before anything else, so memory text cannot inject markup, and a line outside the subset is
+  shown as written rather than dropped
+
+Recorded as G9.
+
+### Fixed
+
+- `devia --help` still described `sync` as refreshing a vendored standard, which 0.5.0 made
+  opt-in
+
+## 0.5.0 — 2026-09-09
+
+The standard is unchanged: `VERSION` stays at 0.1.0.
+
+### Pinning the standard is now opt-in
+
+`devia init` used to copy the whole standard into `.devia/standard/`. Measured on a real
+repository: **391 pinned files against 17 of memory** — a folder whose purpose is to be read by
+a human and an agent, in which 96% of the files were a copy nobody wrote. On a 211-file project
+it tripled the repository, and every `devia sync` produced a 391-file diff in which a real
+memory change was invisible.
+
+- `devia init` writes the memory and the adapters, and pins nothing: **17 files, 57 kB**
+- `devia init --vendor` pins the copy for those who want it up front
+- `devia sync` pins it on demand and refreshes it afterwards — that is now its first job, not
+  only its maintenance one
+- `doctor` reports an unpinned standard as `INFO`, not a `WARN` to clear: the default is not a
+  defect
+- The memory templates, the agent adapters and the skill read the rules with
+  `npx devia rules --id <ID>` / `--domain <name>` instead of linking into a copy that may not
+  exist. A pinned copy is mentioned as what it is: optional
+
+Nothing to do when upgrading. An existing `.devia/standard/` is left alone, `devia sync` keeps
+refreshing it, and only new `devia init` runs behave differently. Recorded as G8.
+
+### A P0 blocker comes from the priority cell, never from prose
+
+`MEM-DEBT-P0` matched `P0` anywhere in a debt row. A P1 line reading "becomes P0 once the
+payment module ships" failed the gate, so a project with no P0 debt was told it was blocked by
+one. The check now reads the priority cell. Found by writing a real project's debt registry.
+
 ## 0.4.0 — 2026-09-09
 
 The standard is unchanged: `VERSION` stays at 0.1.0, no adopter needs `devia sync`.

package/MIGRATION.md

@@ -58,5 +58,6 @@ Then:
    (undecided) and `.devia/12_DEBT.md` (decided, not built) — the split matters.
 4. Replace `node scripts/production-check.mjs` in CI with `npx devia check`.
 
-Nothing in the old repos is lost: the full text of both is vendored here, and `devia init`
-vendors it again into the project under `.devia/standard/`.
+Nothing in the old repos is lost: the full text of both ships with this package, readable with
+`npx devia rules`, and `npx devia sync` pins a copy under `.devia/standard/` when a project
+wants one on disk.

package/README.md

@@ -56,7 +56,7 @@ npx devia doctor              # adoption + staleness diagnosis
 ├── 14_INDEX.md          # where to find what
 ├── impact-map.yaml      # change type → files that must be updated
 ├── devia.json           # profile, modules, maturity target, pinned version
-└── standard/            # vendored, version-pinned copy of the standard
+└── standard/            # optional: `devia sync` pins a copy of the standard here
 ```
 
 Plus adapters so every agent gets the same contract: `AGENTS.md` (universal), `CLAUDE.md`,
@@ -79,6 +79,26 @@ Update .devia/ in the SAME change
 An agent that codes without reading the memory, or that ships code without updating it, has
 failed the task — not styled it differently.
 
+## What the gates actually caught
+
+`PRINCIPLES.md` says evidence beats opinion, so here is the evidence. Every defect below was
+found by devia's own gates, in one week, on devia itself and on one real project — a Next.js
+application whose manifest lives in `apps/web/`. None of it is independent adoption; read it as
+a tool being run in anger, not as a case study.
+
+| Defect | Caught by |
+|---|---|
+| Nine relative links resolved in this repository and not in the copy shipped to adopters — every project got nine broken links | The test that walks a materialised `.devia/` instead of listing it |
+| `devia debt close` blanked a table row instead of removing it. A blank line ends a markdown table, so every debt line below the closed one was orphaned | Discharging a real debt line with the command itself |
+| Two tests parsed `--json` from stdout merged with stderr. On a machine with `FORCE_COLOR` set, a Node warning made the JSON unparseable | `prepublishOnly`, which refused to publish |
+| The skill told every agent to bootstrap with `npx devia init`. The package is scoped, so in a repository that has not installed devia that resolves to `404 devia@*` | Installing the skill system-wide, where a cold start is the normal case |
+| Five gates reported `SKIP  no package.json` to a repository that has one, with a lockfile, a lint script and thirteen dependencies. The letter of the rule held — nothing was rounded up to `PASS` — but the reason printed was false | Running `devia check` on a real project instead of a fixture |
+| `MEM-DEBT-P0` matched `P0` anywhere in a debt row. A P1 line reading "becomes P0 once payments ship" reported a P0 blocker on a project that had none | Writing a real project's debt registry |
+
+The last two are the ones worth dwelling on. A check that cannot answer must say so — but a
+`SKIP` with a false reason, or a `FAIL` invented out of prose, is worse than no check at all,
+because the reader believes the tool looked. Both are now regression tests.
+
 ## What is in the box
 
 | Layer | Where | Content |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@schneiderjoseph/devia",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "One standard, one memory: engineering and design rules plus living project memory for AI coding agents",
   "type": "module",
   "license": "MIT",

package/skills/devia/SKILL.md

@@ -40,8 +40,9 @@ the difference between a task and a guess (`AGT-002`).
 
 ## Step 2 — work under the rules
 
-The rules are pinned in `.devia/standard/rules/` with stable IDs. The ones that stop most bad
-changes:
+The rules have stable IDs and are read with `npx devia rules --id <ID>`, or `--domain <name>`
+for a whole area. A project that ran `devia sync` also has them on disk under
+`.devia/standard/rules/`. The ones that stop most bad changes:
 
 | If you are about to… | Rule |
 |---|---|

package/src/cli.mjs

@@ -10,6 +10,7 @@ const COMMANDS = {
   check: () => import("./commands/check.mjs"),
   doctor: () => import("./commands/doctor.mjs"),
   rules: () => import("./commands/rules.mjs"),
+  read: () => import("./commands/read.mjs"),
   sync: () => import("./commands/sync.mjs"),
   skills: () => import("./commands/skills.mjs"),
   gap: () => import("./commands/registry.mjs"),
@@ -24,7 +25,8 @@ ${color.bold("devia")} — one standard, one memory
   ${color.bold("devia check")}       readiness gates — P0 failures exit non-zero
   ${color.bold("devia doctor")}      adoption, drift and staleness diagnosis
   ${color.bold("devia rules")}       list or show rules from the registry
-  ${color.bold("devia sync")}        refresh the vendored standard after upgrading devia
+  ${color.bold("devia read")}        render the memory as one self-contained page
+  ${color.bold("devia sync")}        pin the standard under .devia/standard/, or refresh it
   ${color.bold("devia skills")}      install the agent adapters (install --agent all)
   ${color.bold("devia gap")}         add or close a line in 11_GAPS.md
   ${color.bold("devia debt")}        add or close a line in 12_DEBT.md

package/src/commands/check.mjs

@@ -154,9 +154,16 @@ function makeChecks(root, ctx) {
       run: () => {
         const text = read(path.join(root, ".devia", "12_DEBT.md"));
         if (text === null) return { kind: "SKIP", detail: "no debt registry" };
-        const rows = (text.match(/^\|\s*D\d+\s*\|.*$/gm) || []).filter(
-          (r) => /\bP0\b/.test(r) && !/TODO\(devia\)/.test(r)
-        );
+        // The priority is a cell, not a word somewhere in the row. Matching the whole line made
+        // a P1 line reading "becomes P0 once the payment module ships" fail the gate — a P0
+        // blocker invented out of prose, on a project that had none.
+        const rows = (text.match(/^\|\s*D\d+\s*\|.*$/gm) || []).filter((row) => {
+          if (/TODO\(devia\)/.test(row)) return false;
+          return row
+            .split("|")
+            .slice(1, -1)
+            .some((cell) => cell.trim().toUpperCase() === "P0");
+        });
         return rows.length
           ? { kind: "FAIL", detail: `${rows.length} P0 debt line(s) open` }
           : { kind: "PASS" };

package/src/commands/doctor.mjs

@@ -64,12 +64,11 @@ ${color.bold("devia doctor")} — adoption, drift and staleness
   const vendored = walk(path.join(deviaDir, "standard")).length;
   if (path.resolve(root) === path.resolve(packageRoot)) {
     status("SKIP", "vendored standard", "this repository is the standard");
+  } else if (vendored) {
+    status("PASS", `standard pinned: ${vendored} files`);
   } else {
-    status(
-      vendored ? "PASS" : "WARN",
-      `vendored standard: ${vendored} files`,
-      vendored ? "" : "run `devia sync`"
-    );
+    // Not pinning is the default, so absence is a fact to report, never a warning to clear.
+    status("INFO", "standard not pinned", "`devia rules` reads it; `devia sync` pins a copy");
   }
 
   // Adapters

package/src/commands/init.mjs

@@ -84,7 +84,7 @@ ${color.bold("devia init")} — create .devia/ in this repository
   --profile <name>    ${Object.keys(PROFILES).join(" | ")}
   --force             overwrite existing memory files (dangerous: they hold your decisions)
   --no-agents         do not write the agent adapters
-  --no-vendor         do not vendor the standard into .devia/standard/
+  --vendor            pin a copy of the standard into .devia/standard/ (~390 files)
   --yes               accept a detected root that is not the current directory
 `.trim());
     return 0;
@@ -163,17 +163,20 @@ ${color.bold("devia init")} — create .devia/ in this repository
     status("SKIP", "devia.json kept", "use --force to regenerate");
   }
 
-  // 3. Vendored standard
-  if (flags.vendor === false || flags["no-vendor"]) {
-    status("SKIP", "standard not vendored", "--no-vendor");
-  } else {
+  // 3. Pinned standard — opt-in. Vendoring writes ~390 files a project did not author, which
+  // buries the memory it is supposed to serve: on a real repository the ratio was 17 files of
+  // memory to 391 of copy, and every `sync` produced a 391-file diff. The rules stay reachable
+  // through `devia rules`, and `devia sync` pins the copy for whoever needs it offline.
+  if (flags.vendor && flags.vendor !== "false") {
     const files = vendorStandard(path.join(deviaDir, "standard"), {
       by: "devia init",
       cli,
       standard: version,
       date: vars.DATE,
     });
-    status("PASS", `standard vendored: ${files} files`, `v${version}`);
+    status("PASS", `standard pinned: ${files} files`, `v${version}`);
+  } else {
+    status("SKIP", "standard not pinned", "`devia sync` writes .devia/standard/ when you need it");
   }
 
   // 4. Agent adapters

package/src/commands/read.mjs

@@ -0,0 +1,161 @@
+import path from "node:path";
+import { exists, read, writeFile, walk } from "../lib/fs.mjs";
+import { renderMarkdown, escapeHtml } from "../lib/markdown.mjs";
+import { cliVersion } from "../lib/version.mjs";
+import { color, heading, status, line } from "../lib/ui.mjs";
+
+/**
+ * The memory, as one page a human can read.
+ *
+ * Self-contained on purpose: the content is embedded, so the file opens by double-click with no
+ * server, no network and no CDN. A reader that needs a running server is a reader nobody opens.
+ */
+
+/** Reading order: the contract first, then the numbered files, then whatever else is there. */
+function order(files) {
+  const rank = (f) => {
+    if (f === "AGENTS.md") return -2;
+    if (f === "README.md") return -1;
+    const n = f.match(/^(\d+)_/);
+    return n ? Number(n[1]) : 999;
+  };
+  return files.sort((a, b) => rank(a) - rank(b) || a.localeCompare(b));
+}
+
+function title(file) {
+  if (file === "AGENTS.md") return "AGENTS";
+  const body = file.replace(/\.md$/, "");
+  const m = body.match(/^(\d+)_(.*)$/);
+  return m ? `${m[1]} · ${m[2].replace(/_/g, " ")}` : body.replace(/_/g, " ");
+}
+
+const STYLE = `
+:root{--ink:#121826;--ink-line:#222F45;--paper:#fff;--canvas:#EFEEEA;--line:#E7E7EA;
+--muted:#6B7280;--muted-d:rgba(229,231,235,.62);--text-d:#E5E7EB;--accent:#FF5A5F;
+--mono:"JetBrains Mono",ui-monospace,SFMono-Regular,Menlo,monospace}
+*{box-sizing:border-box}
+body{margin:0;background:var(--canvas);color:var(--ink);
+font:15px/1.6 ui-sans-serif,system-ui,-apple-system,"Segoe UI",sans-serif;display:flex;min-height:100vh}
+nav{width:290px;flex:0 0 290px;background:var(--ink);color:var(--text-d);position:sticky;top:0;
+height:100vh;overflow:auto;padding:22px 16px}
+nav h1{font-size:13px;letter-spacing:.28em;text-transform:uppercase;font-family:var(--mono);
+color:var(--muted-d);margin:0 0 4px}
+nav .sub{font-size:12px;color:var(--muted-d);margin-bottom:18px;line-height:1.4}
+nav a{display:block;padding:7px 10px;border-radius:8px;color:var(--text-d);text-decoration:none;
+font-size:13px;margin-bottom:2px}
+nav a:hover{background:rgba(255,255,255,.06)}
+nav a.active{background:rgba(255,90,95,.16);outline:1px solid rgba(255,90,95,.25)}
+main{flex:1;min-width:0;padding:44px 56px;background:var(--paper)}
+article{max-width:820px;display:none}
+article.active{display:block}
+h1,h2,h3,h4{line-height:1.25;margin:1.8em 0 .6em}
+h1{font-size:30px;margin-top:0}h2{font-size:22px}h3{font-size:17px}h4{font-size:15px}
+h2{border-top:1px solid var(--line);padding-top:1.2em}
+p{margin:.7em 0}
+a{color:var(--accent)}
+code{font-family:var(--mono);font-size:.88em;background:var(--canvas);padding:2px 5px;border-radius:4px}
+pre{background:var(--ink);color:var(--text-d);padding:16px 18px;border-radius:10px;overflow:auto}
+pre code{background:none;color:inherit;padding:0;font-size:12.5px;line-height:1.55}
+table{border-collapse:collapse;width:100%;margin:1.1em 0;font-size:14px;display:block;overflow-x:auto}
+th,td{border:1px solid var(--line);padding:8px 11px;text-align:left;vertical-align:top}
+th{background:var(--canvas);font-weight:600}
+blockquote{margin:1.1em 0;padding:2px 0 2px 16px;border-left:3px solid var(--accent);color:var(--muted)}
+hr{border:0;border-top:1px solid var(--line);margin:2em 0}
+ul,ol{padding-left:1.3em}li{margin:.3em 0}
+footer{margin-top:48px;padding-top:16px;border-top:1px solid var(--line);
+font-family:var(--mono);font-size:11px;color:var(--muted)}
+@media(max-width:820px){body{display:block}nav{width:auto;height:auto;position:static}main{padding:28px 20px}}
+`;
+
+const SCRIPT = `
+var links = [].slice.call(document.querySelectorAll('nav a'));
+var docs = [].slice.call(document.querySelectorAll('article'));
+function show(id) {
+  docs.forEach(function (d) { d.classList.toggle('active', d.id === id); });
+  links.forEach(function (a) { a.classList.toggle('active', a.getAttribute('href') === '#' + id); });
+  if (location.hash !== '#' + id) history.replaceState(null, '', '#' + id);
+  window.scrollTo(0, 0);
+}
+links.forEach(function (a) {
+  a.addEventListener('click', function (e) { e.preventDefault(); show(a.getAttribute('href').slice(1)); });
+});
+// A link between memory files jumps inside the page instead of asking the filesystem for it.
+[].slice.call(document.querySelectorAll('article a')).forEach(function (a) {
+  var href = a.getAttribute('href') || '';
+  if (!/^[^/:#]+\\.md(#.*)?$/.test(href)) return;
+  var id = 'doc-' + href.split('#')[0].replace(/\\.md$/, '');
+  if (!document.getElementById(id)) return;
+  a.addEventListener('click', function (e) { e.preventDefault(); show(id); });
+});
+show((location.hash || '').slice(1) || docs[0].id);
+`;
+
+export default async function readCommand(ctx) {
+  const { root, deviaDir, flags } = ctx;
+
+  if (flags.help) {
+    line(`
+${color.bold("devia read")} — the memory as one self-contained page
+
+  --root <dir>   repository to read
+  --out <file>   where to write (default: .devia/reader.html)
+
+The page embeds the memory: it opens by double-click, with no server and no network.
+Regenerate it after changing the memory — it is a snapshot, never the source.
+`.trim());
+    return 0;
+  }
+
+  if (!exists(deviaDir)) {
+    status("FAIL", "no .devia/", "run `devia init` first");
+    return 1;
+  }
+
+  const files = order(walk(deviaDir, { filter: (f) => f.endsWith(".md") && !f.includes(path.sep) }));
+  if (!files.length) {
+    status("FAIL", "no memory files to read", ".devia/ holds no markdown");
+    return 1;
+  }
+
+  const project = path.basename(root);
+  const nav = [];
+  const articles = [];
+  for (const file of files) {
+    const id = `doc-${file.replace(/\.md$/, "")}`;
+    nav.push(`<a href="#${id}">${escapeHtml(title(file))}</a>`);
+    articles.push(
+      `<article id="${id}">\n${renderMarkdown(read(path.join(deviaDir, file)) || "")}\n` +
+        `<footer>${escapeHtml(file)} · .devia/</footer></article>`
+    );
+  }
+
+  const today = new Date().toISOString().slice(0, 10);
+  const html = `<!doctype html>
+<html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${escapeHtml(project)} — memory</title>
+<style>${STYLE}</style></head>
+<body>
+<nav><h1>${escapeHtml(project)}</h1>
+<div class="sub">Project memory · read before the code, updated with it</div>
+${nav.join("\n")}
+</nav>
+<main>
+${articles.join("\n")}
+</main>
+<script>${SCRIPT}</script>
+</body></html>
+`;
+
+  const out = flags.out ? path.resolve(String(flags.out)) : path.join(deviaDir, "reader.html");
+  writeFile(out, html);
+
+  heading(`devia read — ${project}`);
+  status("PASS", `${files.length} memory files rendered`, `${Math.round(html.length / 1024)} kB`);
+  status("PASS", "written", out);
+  line("");
+  line(color.dim("  Open it directly — no server needed. Regenerate after changing the memory."));
+  line(color.dim(`  Generated ${today} by devia ${cliVersion()}.`));
+  line("");
+  return 0;
+}

package/src/lib/markdown.mjs

@@ -0,0 +1,179 @@
+/**
+ * A Markdown subset, rendered to HTML.
+ *
+ * The same reasoning as `yaml.mjs`: devia writes the files it reads. The memory templates use
+ * headings, tables, fenced code, lists, blockquotes, rules and a few inline marks — so that is
+ * what this renders. Anything outside the subset survives as escaped text rather than being
+ * silently swallowed, because a reader that drops a line is worse than one that shows it plainly.
+ *
+ * A dependency would be the easy answer here, and `ARC-004` says it is not available.
+ */
+
+const ESCAPES = [
+  ["&", "&"],
+  ["<", "&lt;"],
+  [">", "&gt;"],
+  ['"', "&quot;"],
+];
+
+export function escapeHtml(text) {
+  let out = String(text);
+  for (const [from, to] of ESCAPES) out = out.split(from).join(to);
+  return out;
+}
+
+/**
+ * Inline marks, applied to already-escaped text. Code spans are lifted out first so their
+ * contents are never re-parsed. The placeholder is NUL-delimited on purpose: prose contains
+ * " 12 ", and a placeholder prose can produce turns a number into a code span.
+ */
+const MARK = "\u0000";
+
+function inline(text) {
+  const spans = [];
+  let out = text.replace(/`([^`]+)`/g, (_, code) => {
+    spans.push(code);
+    return `${MARK}${spans.length - 1}${MARK}`;
+  });
+
+  out = out.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_, label, href) => {
+    const safe = /^(https?:|mailto:|#|[\w./-])/.test(href) ? href : "#";
+    return `<a href="${safe}">${label}</a>`;
+  });
+  out = out.replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>");
+  out = out.replace(/(^|[\s(])\*([^*\n]+)\*(?=[\s).,;:!?]|$)/g, "$1<em>$2</em>");
+
+  // Regex littérale avec des échappements \u0000 : aucun octet de contrôle dans la source.
+  return out.replace(/\u0000(\d+)\u0000/g, (_, i) => `<code>${spans[Number(i)]}</code>`);
+}
+
+function isTableSeparator(line) {
+  return /^\|[\s:|-]+\|$/.test(line.trim()) && line.includes("-");
+}
+
+function cells(line) {
+  return line
+    .trim()
+    .replace(/^\|/, "")
+    .replace(/\|$/, "")
+    .split("|")
+    .map((c) => inline(c.trim()));
+}
+
+/** Render a Markdown subset to an HTML fragment. */
+export function renderMarkdown(source) {
+  const lines = escapeHtml(source).split(/\r?\n/);
+  const html = [];
+  let i = 0;
+
+  const flushList = (tag, items) => {
+    html.push(`<${tag}>`);
+    for (const item of items) html.push(`<li>${inline(item)}</li>`);
+    html.push(`</${tag}>`);
+  };
+
+  while (i < lines.length) {
+    const line = lines[i];
+
+    if (!line.trim()) {
+      i++;
+      continue;
+    }
+
+    // Fenced code: kept verbatim, never re-parsed.
+    const fence = line.match(/^```(\w*)\s*$/);
+    if (fence) {
+      const body = [];
+      i++;
+      while (i < lines.length && !/^```\s*$/.test(lines[i])) body.push(lines[i++]);
+      i++;
+      const lang = fence[1] ? ` data-lang="${fence[1]}"` : "";
+      html.push(`<pre${lang}><code>${body.join("\n")}</code></pre>`);
+      continue;
+    }
+
+    const heading = line.match(/^(#{1,4})\s+(.*)$/);
+    if (heading) {
+      const level = heading[1].length;
+      html.push(`<h${level}>${inline(heading[2].trim())}</h${level}>`);
+      i++;
+      continue;
+    }
+
+    if (/^(-{3,}|\*{3,})\s*$/.test(line.trim())) {
+      html.push("<hr>");
+      i++;
+      continue;
+    }
+
+    // Table: a header row followed by a separator row.
+    if (line.trim().startsWith("|") && i + 1 < lines.length && isTableSeparator(lines[i + 1])) {
+      const head = cells(line);
+      i += 2;
+      const body = [];
+      while (i < lines.length && lines[i].trim().startsWith("|")) body.push(cells(lines[i++]));
+      html.push("<table><thead><tr>");
+      for (const c of head) html.push(`<th>${c}</th>`);
+      html.push("</tr></thead><tbody>");
+      for (const row of body) {
+        html.push("<tr>");
+        for (const c of row) html.push(`<td>${c}</td>`);
+        html.push("</tr>");
+      }
+      html.push("</tbody></table>");
+      continue;
+    }
+
+    // Les lignes sont déjà échappées : le chevron d'une citation y est "&gt;", pas ">".
+    if (/^&gt;\s?/.test(line)) {
+      const quote = [];
+      while (i < lines.length && /^&gt;\s?/.test(lines[i])) {
+        quote.push(lines[i++].replace(/^&gt;\s?/, ""));
+      }
+      html.push(`<blockquote>${inline(quote.join(" "))}</blockquote>`);
+      continue;
+    }
+
+    if (/^\s*[-*]\s+/.test(line)) {
+      const items = [];
+      while (i < lines.length && /^\s*[-*]\s+/.test(lines[i])) {
+        let item = lines[i++].replace(/^\s*[-*]\s+/, "");
+        // A wrapped bullet continues on the next indented, non-marker line.
+        while (i < lines.length && /^\s{2,}\S/.test(lines[i]) && !/^\s*[-*]\s+/.test(lines[i])) {
+          item += " " + lines[i++].trim();
+        }
+        items.push(item);
+      }
+      flushList("ul", items);
+      continue;
+    }
+
+    if (/^\s*\d+\.\s+/.test(line)) {
+      const items = [];
+      while (i < lines.length && /^\s*\d+\.\s+/.test(lines[i])) {
+        let item = lines[i++].replace(/^\s*\d+\.\s+/, "");
+        while (i < lines.length && /^\s{2,}\S/.test(lines[i]) && !/^\s*\d+\.\s+/.test(lines[i])) {
+          item += " " + lines[i++].trim();
+        }
+        items.push(item);
+      }
+      flushList("ol", items);
+      continue;
+    }
+
+    // Paragraph: consecutive plain lines, joined.
+    const para = [];
+    while (
+      i < lines.length &&
+      lines[i].trim() &&
+      !/^(#{1,4}\s|```|&gt;|\s*[-*]\s|\s*\d+\.\s|\|)/.test(lines[i])
+    ) {
+      para.push(lines[i++].trim());
+    }
+    if (para.length) html.push(`<p>${inline(para.join(" "))}</p>`);
+    // A line the subset does not recognise is shown as written, never dropped.
+    else html.push(`<p>${inline(lines[i++].trim())}</p>`);
+  }
+
+  return html.join("\n");
+}

package/templates/agents/AGENTS.md

@@ -31,5 +31,5 @@ npx devia check       # readiness gates
 Update `.devia/` in the same change (see `.devia/impact-map.yaml`), then report what you changed
 **and what you did not verify**.
 
-Full standard: [`.devia/standard/AGENTS.md`](.devia/standard/AGENTS.md) ·
-rules by ID: [`.devia/standard/rules/README.md`](.devia/standard/rules/README.md)
+Rules by ID: `npx devia rules --id SEC-001`, or by domain: `npx devia rules --domain database`.
+A pinned copy lives under `.devia/standard/` only if this project ran `devia sync`.

package/templates/agents/CLAUDE.md

@@ -31,4 +31,5 @@ npx devia check
 
 Report the checks that ran, the rule IDs involved, and what you did **not** verify.
 
-Full contract: `.devia/standard/AGENTS.md`. Rules by ID: `.devia/standard/rules/README.md`.
+Rules by ID: `npx devia rules --id SEC-001`, or by domain: `npx devia rules --domain database`.
+A pinned copy lives under `.devia/standard/` only if this project ran `devia sync`.

package/templates/project/14_INDEX.md

@@ -38,13 +38,17 @@
 |---|---|---|
 | TODO(devia) | | |
 
-## Standard (vendored)
+## Standard
 
-| Need | Where |
+The standard is read through the CLI, not copied into this repository.
+
+| Need | Command |
 |---|---|
-| Work contract | [`standard/AGENTS.md`](standard/AGENTS.md) |
-| Rule by ID | [`standard/rules/README.md`](standard/rules/README.md) |
-| Engineering policy | [`standard/standard/engineering/README.md`](standard/standard/engineering/README.md) |
-| Design policy | [`standard/standard/design/README.md`](standard/standard/design/README.md) |
-| Checklists | [`standard/checklists/README.md`](standard/checklists/README.md) |
-| Memory doctrine | [`standard/MEMORY.md`](standard/MEMORY.md) |
+| A rule by ID | `npx devia rules --id SEC-001` |
+| Every rule in a domain | `npx devia rules --domain database --priority P0` |
+| Work contract | `AGENTS.md` at this repository's root |
+| Readiness gates | `npx devia check` |
+
+`npx devia sync` pins a version-locked copy under `standard/` when an agent must read it
+offline, or when an audit needs the exact wording you built against. Add the paths here if you
+do.

package/templates/project/AGENTS.md

@@ -8,8 +8,8 @@ This file is your contract. Violating it is a failed task.
 1. Read [`10_NEVER_ALWAYS.md`](10_NEVER_ALWAYS.md) — what this project has already banned
 2. Read [`00_OVERVIEW.md`](00_OVERVIEW.md) — what this project is
 3. Read the memory file for the surface you are about to change ([`14_INDEX.md`](14_INDEX.md))
-4. Read the standard section for the domain: [`standard/AGENTS.md`](standard/AGENTS.md),
-   [`standard/rules/README.md`](standard/rules/README.md)
+4. Read the rules for what you are touching: `npx devia rules --domain <name>`, or
+   `npx devia rules --id <ID>` for one
 
 Then work. Then update this memory in the same change.
 
@@ -48,4 +48,4 @@ TODO(devia): add this project's own commands — install, dev, test, lint, migra
 - Not verified: ...
 ```
 
-Full contract, routing table and hard stops: [`standard/AGENTS.md`](standard/AGENTS.md).
+Full contract, routing table and hard stops: the `AGENTS.md` at this repository's root.

package/templates/project/README.md

@@ -27,8 +27,11 @@ Created by `devia init` (devia {{DEVIA_VERSION}}, {{DATE}}).
 Machine files: [`devia.json`](devia.json) (profile, maturity, pinned version) and
 [`impact-map.yaml`](impact-map.yaml) (change type → files to update).
 
-The standard itself is vendored, version-pinned, under [`standard/`](standard/) — the same text
-for every agent, offline, no network and no package manager required.
+The standard itself is not copied in here. Read it with `npx devia rules --id SEC-001` or
+`npx devia rules --domain database`, which is the same text for every agent. If you need it on
+disk — an agent with no network, or an audit that must show the exact wording you built against
+— `npx devia sync` pins a version-locked copy under `standard/`, and `14_INDEX.md` then points
+at it.
 
 ## The two registries
 
@@ -43,7 +46,7 @@ for every agent, offline, no network and no package manager required.
 npx devia validate    # structure, registries, placeholders
 npx devia doctor      # is the memory older than the code?
 npx devia check       # readiness gates
-npx devia sync        # refresh the vendored standard after an upgrade
+npx devia sync        # pin the standard under standard/, or refresh a pinned copy
 ```
 
 `.devia/` is committed. It is part of the repository, not a local scratch pad.