devlyn-cli 2.2.2 → 2.3.0

package/AGENTS.md

@@ -28,7 +28,7 @@ ideate (optional)  ->  resolve  ->  ship
 
 - `/devlyn:ideate` (optional) — unstructured idea → `docs/specs/<id>/spec.md` + `spec.expected.json`. Modes: default Q&A, `--quick` (autonomous-pipeline-safe), `--from-spec <path>`, `--project` (multi-feature).
 - `/devlyn:resolve` — hands-free pipeline for any coding task. Free-form goal, `--spec <path>`, or `--verify-only <ref> --spec <path>`. Phases run inline: PLAN → IMPLEMENT → BUILD_GATE → CLEANUP → VERIFY (fresh-subagent, findings-only).
-- Three creative power-user skills (`/devlyn:reap`, `/devlyn:design-system`, `/devlyn:team-design-ui`) live in `optional-skills/` and install only when the user opts in.
+- Four creative power-user skills (`/devlyn:reap`, `/devlyn:design-system`, `/devlyn:design-ui`, `/devlyn:team-design-ui`) live in `optional-skills/` and install only when the user opts in.
 
 Each skill's `SKILL.md` is the source of truth for flags and workflow. Do not duplicate.
 
@@ -73,7 +73,7 @@ No silent fallbacks.
 - Fallbacks allowed only when widely accepted and harmless (CSS fallback fonts, CDN failover, image placeholders).
 - Silent `catch` blocks are bugs.
 - Logging is not user-visible error handling.
-- The Codex CLI availability downgrade is the one documented exception: emit `engine downgraded: codex-unavailable` and behave exactly like explicit Claude routing.
+- No engine-availability fallback is permitted for pair/risk-probe routes: if required Codex or Claude is unavailable, emit `BLOCKED:codex-unavailable` or `BLOCKED:claude-unavailable` with setup guidance. `--no-pair` and `--no-risk-probes` are explicit user opt-outs, not fallbacks.
 
 ## Evidence Over Claim
 

package/CLAUDE.md

@@ -24,7 +24,7 @@ The runtime sub-agent contract below (Subtractive-first / Goal-locked / No-worka
 
 ## Quick Start
 
-Two skills cover the full cycle post iter-0034 Phase 4 cutover (2026-05-04). `/devlyn:ideate` is OPTIONAL; `/devlyn:resolve` is REQUIRED. **Both default to `--engine claude`** for PLAN/IMPLEMENT. Codex BUILD/IMPLEMENT and PLAN-pair remain research-only, but `/devlyn:resolve` VERIFY has a gated pair-JUDGE product path when its `SKILL.md` trigger policy fires. Pass `--engine auto` or `--engine codex` explicitly to opt into the broader research path; the harness silently downgrades to `claude` and emits a banner if the Codex CLI is missing.
+Two skills cover the full cycle post iter-0034 Phase 4 cutover (2026-05-04). `/devlyn:ideate` is OPTIONAL; `/devlyn:resolve` is REQUIRED. **Both default to `--engine claude`** for PLAN/IMPLEMENT. Codex BUILD/IMPLEMENT and PLAN-pair remain research-only, but `/devlyn:resolve` VERIFY has conditional-default pair-JUDGE when its `SKILL.md` trigger policy fires. Pass `--engine auto` or `--engine codex` explicitly to opt into the broader research path. If a selected or conditionally required engine is unavailable, the run stops with `BLOCKED:<engine>-unavailable` and setup guidance.
 
 1. `/devlyn:ideate` (optional) — unstructured idea → `docs/specs/<id>/spec.md` + `spec.expected.json`. Modes: default Q&A, `--quick` (autonomous-pipeline-safe), `--from-spec <path>`, `--project`.
 2. `/devlyn:resolve` — hands-free pipeline for any coding task. Free-form goal, `--spec <path>`, or `--verify-only <diff> --spec <path>`. Phases: PLAN → IMPLEMENT → BUILD_GATE → CLEANUP → VERIFY (fresh subagent, findings-only).
@@ -123,7 +123,7 @@ No `any`, no `@ts-ignore`, no silent `catch`, no hardcoded values, no helper scr
 
 **Permitted exceptions** (explicitly carved out):
 - CSS fallback fonts, CDN failover, image placeholders — widely-accepted best practices.
-- Codex CLI availability downgrade — the one documented silent fallback in this repo. Fires when the resolved engine is `auto` or `codex` (either via skill default or explicit `--engine` flag) and the Codex CLI is absent. Banner `engine downgraded: codex-unavailable` always prints; verdict identical to `--engine claude`. Any other silent fallback in skills code is a bug — file it against the skill that introduced it.
+- No engine-availability fallback is permitted for `/devlyn:resolve` pair/risk-probe routes. If Codex or Claude is required and unavailable, the run stops with `BLOCKED:codex-unavailable` or `BLOCKED:claude-unavailable` plus setup guidance. `--no-pair` / `--no-risk-probes` are explicit user opt-outs, not fallbacks.
 <!-- runtime-principles:section=no-workaround:end -->
 
 ### Evidence over claim
@@ -141,7 +141,7 @@ A finding without one of these forms is excluded. Vague findings produce vague f
 
 ## Codex invocation
 
-When `/devlyn:resolve` or `/devlyn:ideate` route a phase to Codex (`--engine codex` or `--engine auto`), the wrapper-form contract lives in `config/skills/_shared/codex-config.md` (or `.claude/skills/_shared/codex-config.md` once installed). Omit `-m <model>` — the CLI's current flagship is used automatically. MCP is not in the loop. If the Codex CLI is absent the harness silently downgrades to Claude and prints `engine downgraded: codex-unavailable` in the final report.
+When `/devlyn:resolve` or `/devlyn:ideate` route a phase to Codex (`--engine codex`, `--engine auto`, or conditional VERIFY pair/risk-probe routing), the wrapper-form contract lives in `config/skills/_shared/codex-config.md` (or `.claude/skills/_shared/codex-config.md` once installed). Omit `-m <model>` — the CLI's current flagship is used automatically. MCP is not in the loop. If Codex is required and unavailable, stop with `BLOCKED:codex-unavailable` and setup guidance.
 
 ## Working Mode
 
@@ -152,7 +152,7 @@ When `/devlyn:resolve` or `/devlyn:ideate` route a phase to Codex (`--engine cod
 
 ## Skill Boundary Policy
 
-Post iter-0034 Phase 4 cutover (2026-05-04) the runtime product surface is two skills — `/devlyn:resolve` and `/devlyn:ideate`. `/devlyn:resolve` runs PLAN → IMPLEMENT → BUILD_GATE → CLEANUP → VERIFY inline; verification, cleanup, and security review (delegated to the native `security-review` Claude Code skill from BUILD_GATE) all live inside the pipeline. There are no standalone `/devlyn:review`, `/devlyn:evaluate`, `/devlyn:team-resolve`, etc. surfaces to delegate to — those skills were folded into resolve's phases or removed in iter-0034. Three creative power-user skills (`/devlyn:reap`, `/devlyn:design-system`, `/devlyn:team-design-ui`) live in `optional-skills/` and are user-invoked only; resolve never delegates to them.
+Post iter-0034 Phase 4 cutover (2026-05-04) the runtime product surface is two skills — `/devlyn:resolve` and `/devlyn:ideate`. `/devlyn:resolve` runs PLAN → IMPLEMENT → BUILD_GATE → CLEANUP → VERIFY inline; verification, cleanup, and security review (delegated to the native `security-review` Claude Code skill from BUILD_GATE) all live inside the pipeline. There are no standalone `/devlyn:review`, `/devlyn:evaluate`, `/devlyn:team-resolve`, etc. surfaces to delegate to — those skills were folded into resolve's phases or removed in iter-0034. Four creative power-user skills (`/devlyn:reap`, `/devlyn:design-system`, `/devlyn:design-ui`, `/devlyn:team-design-ui`) live in `optional-skills/` and are user-invoked only; resolve never delegates to them.
 
 Browser validation routes through `_shared/browser-runner.sh` (Chrome MCP → Playwright → curl tier) directly from BUILD_GATE — there is no separate `/devlyn:browser-validate` skill at HEAD.
 

package/README.md

@@ -79,11 +79,11 @@ PLAN  →  IMPLEMENT  →  BUILD_GATE  →  CLEANUP  →  VERIFY (fresh subagent
 - **VERIFY** runs in a fresh subagent context with no code-mutation tools — findings only, structurally independent.
 - Git checkpoints at every phase for safe rollback. Fix-loop budget shared across BUILD_GATE and VERIFY (`--max-rounds N`, default 4).
 
-Common flags: `--engine claude|codex|auto` (default `claude`), `--bypass build-gate,cleanup`, `--pair-verify` (force pair-mode JUDGE in VERIFY), `--perf` (per-phase timing).
+Common flags: `--engine claude|codex|auto` (default `claude`), `--bypass build-gate,cleanup`, `--pair-verify` (force pair-mode JUDGE in VERIFY), `--no-pair` (intentional solo VERIFY), `--risk-probes` / `--no-risk-probes`, `--perf` (per-phase timing).
 
-### Engine selection — Claude solo by default
+### Engine selection — Claude implementation, conditional pair VERIFY
 
-`--engine claude` (default) is the canonical surface. Every phase routes to Claude.
+`--engine claude` (default) is the canonical implementation surface for PLAN, IMPLEMENT, BUILD_GATE, and CLEANUP. VERIFY/JUDGE conditionally runs pair mode for verify-only runs, high-risk specs, risk probes, mechanical warnings, coverage gaps, or explicit `--pair-verify`.
 
 `--engine codex` routes IMPLEMENT to Codex; `--engine auto` opts into the experimental dual-engine routing where applicable. Both are research-only at HEAD: iter-0020 closed Codex BUILD/IMPLEMENT below the quality floor on the 9-fixture suite (L2 vs L1 = −3.6, 3/8 gated fixtures cleared the +5 margin floor — release-readiness FAIL); iter-0033g + iter-0034 closed PLAN-pair as research-only with explicit unblock conditions (container/sandbox infra OR production telemetry capturing positive evidence of subagent introspection). Install the Codex CLI (https://platform.openai.com/docs/codex) and pass the flag explicitly to opt in:
 
@@ -91,7 +91,7 @@ Common flags: `--engine claude|codex|auto` (default `claude`), `--bypass build-g
 /devlyn:resolve "fix the auth bug" --engine auto   # experimental, research-only
 ```
 
-If Codex is absent when `--engine auto` or `--engine codex` is requested, the harness silently downgrades to `--engine claude` and emits a banner in the final report.
+If Codex or Claude is absent when explicitly selected or conditionally required, the harness stops with `BLOCKED:codex-unavailable` or `BLOCKED:claude-unavailable` and prints setup guidance. Use `--no-pair` only when intentionally accepting solo VERIFY; use `--no-risk-probes` only when intentionally disabling automatic high-risk probes.
 
 <details>
 <summary><strong>What's new in 1.14.0</strong> — CPO lens + handoff enforcement</summary>
@@ -194,7 +194,7 @@ Selected during install. Run `npx devlyn-cli` again to add more.
 |---|---|
 | `playwright` | Playwright MCP — powers `/devlyn:resolve` BUILD_GATE browser tier (Chrome MCP → Playwright → curl fallback) |
 
-> `--engine auto/codex` uses the local `codex` CLI binary, not MCP. Install from https://platform.openai.com/docs/codex; the harness silently downgrades to `--engine claude` if the CLI is missing.
+> `--engine auto/codex` and conditional VERIFY pair mode use the local `codex` CLI binary, not MCP. Install from https://platform.openai.com/docs/codex, run the current Codex auth/login flow, verify `codex --version`, then rerun.
 
 </details>
 

package/bin/devlyn.js

@@ -103,7 +103,6 @@ const DEPRECATED_DIRS = [
   'skills/devlyn:auto-resolve',
   'skills/devlyn:browser-validate',
   'skills/devlyn:clean',
-  'skills/devlyn:design-ui',
   'skills/devlyn:discover-product',
   'skills/devlyn:evaluate',
   'skills/devlyn:feature-spec',
@@ -184,6 +183,7 @@ const OPTIONAL_ADDONS = [
   { name: 'devlyn:pencil-push', desc: 'Push codebase UI to Pencil canvas for design sync', type: 'local' },
   { name: 'devlyn:reap', desc: 'Safely reap orphaned MCP / codex / Superset child processes left behind by long Claude sessions', type: 'local' },
   { name: 'devlyn:design-system', desc: 'Extract design tokens from a chosen UI style for exact reproduction (creative power-user)', type: 'local' },
+  { name: 'devlyn:design-ui', desc: 'N (default 5) distinct UI style explorations from a single Lead Designer (creative power-user)', type: 'local' },
   { name: 'devlyn:team-design-ui', desc: '5 distinct UI style explorations from a full design team (creative power-user)', type: 'local' },
   // External skill packs (installed via npx skills add)
   { name: 'vercel-labs/agent-skills', desc: 'React, Next.js, React Native best practices', type: 'external' },
@@ -467,6 +467,17 @@ function installLocalSkill(skillName) {
 
   log(`\n🛠️  Installing ${skillName}...`, 'cyan');
   copyRecursive(src, dest, targetDir);
+
+  // Mirror to every CLI skill-loader directory that already exists so optional
+  // skills are picked up by Codex (and any future CLI with a skillsDir) the
+  // same way required skills are. Existing dir, not new dir — we don't create
+  // a Codex install just because someone opted into a Claude-side skill.
+  for (const cli of Object.values(CLI_TARGETS)) {
+    if (!cli.skillsDir || !fs.existsSync(cli.skillsDir)) continue;
+    const cliDest = path.join(cli.skillsDir, skillName);
+    if (fs.existsSync(cliDest)) fs.rmSync(cliDest, { recursive: true, force: true });
+    copyRecursive(src, cliDest, cli.skillsDir);
+  }
   return true;
 }
 

package/config/skills/_shared/codex-config.md

@@ -6,7 +6,7 @@ Single source of truth for how every skill calls Codex. **MCP is not used.** Ski
 
 All long-running Codex calls go through `codex-monitored.sh` — a thin wrapper that closes stdin (codex 0.124.0 hangs when both stdin is open and a prompt arg is given), streams Codex stdout fully (no `tail -n` truncation), and prints a `[codex-monitored] heartbeat` line every 30s so the outer `claude -p` byte-watchdog stays fed during long reasoning gaps. The wrapper passes its arguments through verbatim to the underlying CLI, so the canonical flag set is unchanged from a raw call — only the launcher differs.
 
-**Read-only critique / adversarial review / debate** (ideate CHALLENGE phase, `/devlyn:resolve` VERIFY pair-mode when triggered). Security review is delegated to the native `security-review` Claude Code skill, invoked from `/devlyn:resolve` BUILD_GATE rather than from Codex. Read-only critique returns findings on stdout; the orchestrator writes any files.
+**Read-only critique / adversarial review / debate** (ideate CHALLENGE phase, `/devlyn:resolve` VERIFY conditional pair-mode). Security review is delegated to the native `security-review` Claude Code skill, invoked from `/devlyn:resolve` BUILD_GATE rather than from Codex. Read-only critique returns findings on stdout; the orchestrator writes any files.
 
 ```bash
 bash .claude/skills/_shared/codex-monitored.sh \
@@ -41,11 +41,11 @@ Before the first Codex call in a run, verify the CLI is on PATH:
 command -v codex >/dev/null 2>&1
 ```
 
-If the check fails, the skill follows the `_shared/engine-preflight.md` downgrade rule — silently switch to Claude for this run and log `engine downgraded: codex-unavailable` in the final report. Never prompt, never abort.
+If the check fails while Codex is explicitly selected or conditionally required by pair/risk-probe VERIFY, follow `_shared/engine-preflight.md`: stop with `BLOCKED:codex-unavailable`, preserve run evidence, and print setup guidance. Do not convert the run to Claude. `--no-pair` and `--no-risk-probes` are explicit user opt-outs for reruns, not automatic fallbacks.
 
 ## Why CLI over other paths
 
-The local Codex CLI (fronted by `codex-monitored.sh`) is the primary (and only) integration. It beats alternatives on three dimensions: the model is inherited from the CLI's own default so no skill edits are needed when OpenAI ships a new flagship; flags compose on the command line and the skill docs stay grep-friendly; the invocation has one failure mode (the binary is on PATH or it isn't), which the shared availability check covers cleanly.
+The local Codex CLI (fronted by `codex-monitored.sh`) is the primary (and only) integration. It beats alternatives on three dimensions: the model is inherited from the CLI's own default so no skill edits are needed when OpenAI ships a new flagship; flags compose on the command line and the skill docs stay grep-friendly; the invocation has one failure mode (the binary is on PATH or it isn't), which the shared availability check reports explicitly.
 
 ## Invocation from inside a skill prompt
 

package/config/skills/_shared/engine-preflight.md

@@ -1,34 +1,38 @@
-# Shared — `--engine` Pre-flight
+# Shared — Engine Pre-flight
 
 Used by `/devlyn:resolve` and `/devlyn:ideate`. One shared availability rule so every skill routes identically.
 
 ## Rule
 
-Each skill resolves the effective engine from its own SKILL.md default plus any explicit `--engine` flag passed by the user. This pre-flight runs **only when the resolved engine is `auto` or `codex`** — when the resolved engine is `claude` (whether by skill default or explicit flag), the Codex check is skipped entirely.
+Each skill resolves the effective engine from its own SKILL.md default plus any explicit `--engine` flag passed by the user. `/devlyn:resolve` also computes conditional pair/risk-probe requirements before the phase that needs the OTHER engine.
 
-When the resolved engine is `auto` or `codex`, on entry (before spawning any phase that could route to Codex):
+When a run or phase requires Codex, before spawning that phase:
 
 1. Check if the Codex CLI is installed: `command -v codex >/dev/null 2>&1` (or equivalent bash test).
-2. On failure → silently set `engine = "claude"` for the remainder of this run AND log `engine downgraded: codex-unavailable` into the skill's final summary/report header.
-3. On success → proceed with the original engine value.
+2. On failure -> set the current phase/run verdict to `BLOCKED:codex-unavailable`, preserve the failed check evidence, and show setup guidance: install/configure the Codex CLI, run the current Codex auth/login flow, verify `codex --version`, then rerun. If the user intentionally wants solo VERIFY, they may rerun with `--no-pair`.
+3. On success -> proceed with the original engine value.
 
-Never prompt the user. Never abort the run on missing CLI.
+When a run or phase requires Claude, before spawning that phase:
 
-Per-skill defaults: `/devlyn:resolve` defaults to `claude` for PLAN/IMPLEMENT (post iter-0020 close-out — Codex BUILD/IMPLEMENT below quality floor; iter-0033g + iter-0034 close-out — PLAN-pair research-only until container/sandbox infra justifies a measurement). `/devlyn:resolve` VERIFY is the exception: gated pair-JUDGE may invoke the OTHER engine when its SKILL.md trigger policy fires. `/devlyn:ideate` defaults to `auto` for the CHALLENGE phase's cross-model GAN-critic dynamic. Each skill's SKILL.md flag block is the source of truth for that skill's default.
+1. Confirm the runtime can spawn Claude agents. Where the CLI is the launcher, `command -v claude >/dev/null 2>&1` is the equivalent check.
+2. On failure -> set the current phase/run verdict to `BLOCKED:claude-unavailable` and show setup guidance: install/configure Claude Code, verify `claude --version` where available, then rerun.
+3. On success -> proceed.
 
-## Why this is the one permitted silent fallback
+Never prompt the user mid-pipeline. Missing required engines are explicit BLOCKED states, not silent fallbacks.
 
-`CLAUDE.md` sets the no-silent-fallback rule for this repo. This downgrade is documented there as the single explicit exception because the hands-free contract — skills the user walks away from — would otherwise fail every run whenever the Codex CLI is absent. The user-visible behavior is identical to an explicit `--engine claude` invocation, and the banner in the final report removes the silence. Any other silent fallback in skills code is a bug.
+Per-skill defaults: `/devlyn:resolve` defaults to `claude` for PLAN/IMPLEMENT (post iter-0020 close-out — Codex BUILD/IMPLEMENT below quality floor; iter-0033g + iter-0034 close-out — PLAN-pair research-only until container/sandbox infra justifies a measurement). `/devlyn:resolve` VERIFY is the exception: conditional-default pair-JUDGE may invoke the OTHER engine when its SKILL.md trigger policy fires. `/devlyn:ideate` may use cross-model challenge phases when configured. Each skill's SKILL.md flag block is the source of truth for that skill's default.
 
-## What a skill must log after downgrade
+## What a skill must report after a BLOCKED engine check
 
-When the resolved engine was `auto` / `codex` and the Codex CLI was absent, the final user-facing report/summary shows both the requested and effective mode:
+When an engine required by the selected route or conditional pair trigger is absent, the final user-facing report/summary shows the requested route, the missing engine, and setup steps:
 
 ```
-Engine: claude (downgraded from auto — codex-unavailable)
+Engine: claude + codex pair required
+Verdict: BLOCKED:codex-unavailable
+Setup: install/configure Codex CLI; run the current Codex auth/login flow; verify `codex --version`; rerun. Use `--no-pair` only for an intentional solo VERIFY run.
 ```
 
-If no downgrade happened (either Codex was available, or the resolved engine was already `claude`), omit the parenthetical. That single line is the contract — the user can always see why Codex did or did not participate.
+Do not report a downgraded successful run when a required engine is missing.
 
 ## Canonical Codex invocation
 

package/config/skills/_shared/runtime-principles.md

@@ -79,7 +79,7 @@ No `any`, no `@ts-ignore`, no silent `catch`, no hardcoded values, no helper scr
 
 **Permitted exceptions** (explicitly carved out):
 - CSS fallback fonts, CDN failover, image placeholders — widely-accepted best practices.
-- Codex CLI availability downgrade — the one documented silent fallback in this repo. Fires when the resolved engine is `auto` or `codex` (either via skill default or explicit `--engine` flag) and the Codex CLI is absent. Banner `engine downgraded: codex-unavailable` always prints; verdict identical to `--engine claude`. Any other silent fallback in skills code is a bug — file it against the skill that introduced it.
+- No engine-availability fallback is permitted for `/devlyn:resolve` pair/risk-probe routes. If Codex or Claude is required and unavailable, the run stops with `BLOCKED:codex-unavailable` or `BLOCKED:claude-unavailable` plus setup guidance. `--no-pair` / `--no-risk-probes` are explicit user opt-outs, not fallbacks.
 <!-- runtime-principles:section=no-workaround:end -->
 
 ## Evidence over claim

package/config/skills/devlyn:resolve/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: devlyn:resolve
-description: Hands-free pipeline for any coding task — bug fix, feature, refactor, debug, modify, PR review. Free-form goal or formal spec input. Plan → Implement → Build-gate → Cleanup → Verify (fresh subagent, findings-only). Mechanical-first verification; pair-mode is gated in Verify. Use when the user says "resolve this", "fix this", "implement this", "refactor this", "debug this", "review this PR", or wants hands-off completion.
+description: Hands-free pipeline for any coding task — bug fix, feature, refactor, debug, modify, PR review. Free-form goal or formal spec input. Plan → Implement → Build-gate → Cleanup → Verify (fresh subagent, findings-only). Mechanical-first verification; pair-mode is conditional-default in Verify. Use when the user says "resolve this", "fix this", "implement this", "refactor this", "debug this", "review this PR", or wants hands-off completion.
 ---
 
 Orchestrator for the 2-skill harness pipeline. One subagent per phase; file-based handoff via `.devlyn/pipeline.state.json`. VERIFY spawns a fresh-context subagent so independence is structural — not advisory.
@@ -17,7 +17,7 @@ Long-horizon agentic work; context auto-compacts. State lives in `.devlyn/pipeli
 Hands-free. Measured by how far we get without human intervention.
 
 1. Do not prompt the user mid-pipeline. When tempted to ask, pick the safe default, proceed, and log it in the final report.
-2. Codex availability: on `--engine auto`/`codex`, follow `_shared/engine-preflight.md`. On failure, silently fall back to Claude and log `engine downgraded: codex-unavailable` in the final report.
+2. Engine availability: follow `_shared/engine-preflight.md`. When a selected or conditionally-required engine is unavailable, fail closed with `BLOCKED:<engine>-unavailable` and setup guidance; do not convert a pair-required or explicitly requested engine into a solo run.
 3. Phases run in declared order. No extra phases.
 4. Orchestrator does not write code. It parses input, spawns phases, reads state, branches on verdicts, emits the report.
 5. Continue by default. Halt only on (a) unrecoverable subagent failure, (b) IMPLEMENT producing zero code changes, (c) BUILD_GATE or VERIFY fix-loop exhausting `max_rounds`.
@@ -32,7 +32,7 @@ Each phase routes to an engine and prepends the per-engine adapter header from `
 
 - Claude phases: spawn `Agent` (`mode: "bypassPermissions"`); prompt = adapter-header + canonical-body + task-context.
 - Codex phases: shell out via `bash _shared/codex-monitored.sh` with the same compounded prompt. The wrapper closes stdin and emits a heartbeat. No MCP.
-- Default engine: Claude. `--engine codex` routes IMPLEMENT to Codex; orchestration stays Claude. Pair-mode (only in VERIFY/JUDGE) selects a different engine for the fresh subagent than IMPLEMENT used.
+- Default engine: Claude for PLAN / IMPLEMENT / BUILD_GATE / CLEANUP. `--engine codex` routes IMPLEMENT to Codex; orchestration stays Claude. Pair-mode is conditional-default in VERIFY/JUDGE and selects the OTHER engine for the fresh subagent when the trigger policy fires.
 - Multi-LLM evolution: when a new model adapter ships in `_shared/adapters/`, that engine becomes selectable via `--engine <model>` without further skill changes (NORTH-STAR.md "Multi-LLM evolution direction").
 </engine_routing>
 
@@ -59,20 +59,24 @@ Once `state.implement_passed_sha` is non-null (PHASE 2 returned and produced a d
    - `--spec <path>` — switches to spec mode.
    - `--verify-only <ref>` — switches to verify-only mode. Requires `--spec`.
    - `--pair-verify` — force pair-mode JUDGE in PHASE 5 even when not auto-triggered.
+   - `--no-pair` — disable conditional VERIFY pair-JUDGE for this run. Record `pair_trigger.skipped_reason: "user_no_pair"` whenever a trigger would otherwise fire.
    - `--risk-probes` — insert PHASE 1.5 cross-engine probe derivation. The OTHER engine converts visible `## Verification` bullets into bounded executable probes before IMPLEMENT; BUILD_GATE and VERIFY replay them mechanically.
+   - `--no-risk-probes` — disable automatic high-risk risk probes. Explicit `--risk-probes` wins over `--no-risk-probes`.
    - `--bypass <phase>[,...]` — skip specific phases. Valid: `build-gate`, `cleanup`. PLAN, IMPLEMENT, VERIFY are non-bypassable.
    - `--perf` — opt in to per-phase timing.
 
-2. Engine pre-flight: follow `_shared/engine-preflight.md`. The downgrade banner surfaces in the final report.
+2. Engine pre-flight: follow `_shared/engine-preflight.md`. If a required engine is unavailable, halt with a BLOCKED verdict and setup instructions instead of downgrading.
 
-3. Initialize `.devlyn/pipeline.state.json` per `references/state-schema.md`. Set `state.run_id`, `started_at`, `engine`, `base_ref.{branch, sha}`, `rounds.{max_rounds, global: 0}`, `bypasses`, empty `phases`, empty `criteria`.
+3. Initialize `.devlyn/pipeline.state.json` per `references/state-schema.md`. Set `state.run_id`, `started_at`, `engine`, `base_ref.{branch, sha}`, `rounds.{max_rounds, global: 0}`, `bypasses`, empty `phases`, empty `criteria`, and `risk_profile: { high_risk: false, reasons: [], risk_probes_enabled: false, pair_default_enabled: true }`.
 
 4. **Mode-specific init**:
    - **Free-form**: read `references/free-form-mode.md`. Run the complexity classifier deterministically (rules over keyword density / file count / spec-shape signals). Set `state.complexity ∈ {trivial, medium, large}`. Trivial: write internal mini-spec to `.devlyn/criteria.generated.md` and proceed. Medium: synthesize a minimal spec from the goal + add 1-2 context anchors from the codebase, write to `.devlyn/criteria.generated.md`, proceed. Large: log `recommend: /devlyn:ideate first` in the final report and either halt (default) or proceed with assumed defaults if `--continue-on-large` flag set.
    - **Spec**: validate spec exists + `## Verification` block parses (run `python3 .claude/skills/_shared/spec-verify-check.py --check <spec-path>` to validate carrier shape). Compute `state.source.spec_sha256`. Stage `.devlyn/spec-verify.json` from the spec's verification block.
    - **Verify-only**: skip to PHASE 5 with `state.source.spec_path` set, the supplied diff captured at `.devlyn/external-diff.patch`.
 
-5. Announce one line: `resolve starting — run <run_id> — engine <engine> — mode <mode> — complexity <complexity-or-na>`.
+5. Compute `state.risk_profile` from the user goal plus spec/criteria text. Mark `high_risk: true` when the work touches any of: auth/authz, permissions, security, token/session, payment/money/billing/invoice/pricing/tax/ledger, persistence/data mutation/deletion/migration, idempotency/replay/duplicate, API/webhook/raw-body/signature, allocation/scheduling/inventory/rollback/transaction, or explicit error-priority/output-shape contracts. If high-risk and `--no-risk-probes` is absent, set `risk_probes_enabled: true`; explicit `--risk-probes` also sets it true. If `--no-pair` is present, set `pair_default_enabled: false`.
+
+6. Announce one line: `resolve starting — run <run_id> — engine <engine> — mode <mode> — complexity <complexity-or-na> — pair <conditional|disabled> — risk_probes <on|off>`.
 
 ## PHASE 1: PLAN
 
@@ -90,8 +94,11 @@ After return:
 
 ## PHASE 1.5: RISK_PROBES
 
-Skip unless `--risk-probes` is set. This phase is findings-as-executable-checks,
-not a second plan and not debate.
+Skip unless `--risk-probes` is set OR `state.risk_profile.risk_probes_enabled`
+is true. This phase is findings-as-executable-checks, not a second plan and not
+debate. If this phase is required and the OTHER engine is unavailable, halt with
+`BLOCKED:codex-unavailable` or `BLOCKED:claude-unavailable` plus setup guidance;
+do not silently continue without probes.
 
 Engine: OTHER engine from PHASE 2's selected IMPLEMENT engine. Prompt body:
 `references/phases/probe-derive.md`.
@@ -196,6 +203,9 @@ Two sub-phases:
 
 2. **JUDGE** (fresh-context Agent): grade the diff against the spec on rubric axes (spec compliance, scope, quality, consistency). Split each Requirement into binding clauses and trace code-order counterexamples; a passing verifier proves only the case it exercises, not neighboring `once` / `regardless` / `duplicate` / auth-order / rollback invariants. Respect scope qualifiers such as `inside a warehouse`, `per resource`, `for this line`, and `after validation`; do not widen a scoped clause into a global invariant, and compose multiple ordering rules in the stated order. For stateful flows, explicitly trace failed-operation rollback and the next entity's state before hunting broader edge cases. For high-complexity specs, construct at least one interaction counterexample that combines ordering/priority with failure handling and state mutation, then execute at least one such scenario through the repo's existing CLI/API/test runner without leaving tracked files behind; one-axis examples and pure mental tracing are insufficient. Default engine = same as IMPLEMENT (solo). Pair-mode (cross-model JUDGE) is eligible only when MECHANICAL has no HIGH/CRITICAL findings; deterministic blockers already decide the verdict and route to the fix loop. Pair-mode fires when eligible and:
    - `--pair-verify` flag set, OR
+   - `state.mode == "verify-only"`, OR
+   - `state.risk_profile.high_risk == true`, OR
+   - `.devlyn/risk-probes.jsonl` exists or `state.risk_profile.risk_probes_enabled == true`, OR
    - spec frontmatter has `complexity: high`, OR `state.complexity` is `"high"` or `"large"`, OR
    - MECHANICAL emits findings flagged `severity: warning` (not disqualifier — those route to fix loop directly), OR
    - `state.verify.coverage_failed == true` (judge could not exercise a required spec axis from available evidence).
@@ -205,11 +215,22 @@ Before spawning JUDGE, compute `pair_trigger = { eligible, reasons[] }` and writ
 The `--engine` flag never suppresses this rule. Explicit `--engine claude`
 means "Claude is the primary judge"; it does not mean "do not run Codex as the
 second pair judge." The only valid skip reasons after a non-empty eligible
-trigger are deterministic MECHANICAL HIGH/CRITICAL blockers or Codex
-unavailability proven by the invocation layer.
+trigger are deterministic MECHANICAL HIGH/CRITICAL blockers or an explicit
+`--no-pair`. Engine unavailability is a `BLOCKED:<engine>-unavailable` verdict,
+not a skip reason.
 
 Pair-mode JUDGE: spawn a second Agent with the OTHER engine's adapter; the second judge is a bounded adversarial complement, not a duplicate broad audit. The primary judge owns broad coverage; pair-JUDGE targets the two highest-risk explicit `## Verification` bullets that cross state mutation, all-or-nothing rollback, ordering, idempotency, auth, or error-priority clauses. It must not read `.claude/skills`, `.codex/skills`, `CLAUDE.md`, `AGENTS.md`, or other harness docs unless the orchestrator pasted a specific excerpt into the prompt. It may use only the spec, diff, implementation files, tests, and the repo's existing CLI/API/test runner. It may execute at most two targeted probes before first output, and each probe must compare the full externally visible result (exit/stdout/stderr plus full parsed output object, including accepted/scheduled rows, rejected rows, and remaining state when present), not just a single property. For priority/stateful specs, at least one probe must include an earlier input entity that would succeed under input-order processing, a later higher-priority entity that consumes or blocks the critical resource, and a failure/blocked/rollback edge that determines a later entity's state. For cart/pricing specs where visible verification combines duplicate items, line promotions, tax, coupon, and shipping, the success-path probe must include interleaved duplicates plus taxable and non-taxable items and assert full output rows. Scope qualifiers are binding: pair-JUDGE must not reinterpret `inside a warehouse`, `per resource`, or line-scoped rules as global rules. When both priority ordering and rollback/blocked-interval behavior appear in the spec, this dominance-loss probe is mandatory and comes before any other probe: an earlier lower-priority entity that would succeed alone or under input-order processing must lose because a later higher-priority entity is processed first; a failed/blocked middle entity must not corrupt later state; and the assertion must cover complete accepted/scheduled and rejected output ordering. It must stop and emit JSONL immediately on the first verdict-binding finding, and must emit PASS immediately if both probes plus static scope/dependency checks pass. Both judgments merge with the rule "any HIGH/CRITICAL finding either model surfaces is verdict-binding; high-confidence MEDIUM findings are also verdict-binding when they identify a concrete behavioral regression against the spec, public contract, or existing test contract." Cross-model disagreement on advisory lower-severity findings is logged but does not change the verdict. If MECHANICAL has a HIGH/CRITICAL finding, skip the second judge and record `pair_judge: null`; the fix loop needs the deterministic finding, not duplicate review.
 
+If pair-mode is triggered and the OTHER engine is unavailable, do not downgrade
+or skip the required judge. Set VERIFY to `BLOCKED:<engine>-unavailable`, preserve the
+failed availability check evidence, and print setup guidance:
+
+- Codex: install/configure the Codex CLI, run `codex auth` or the current login
+  flow, verify `codex --version`, then rerun. Use `--no-pair` only when the user
+  intentionally accepts solo VERIFY for this run.
+- Claude: install/configure Claude Code, run `claude --version` when available,
+  confirm the host can spawn Claude agents, then rerun.
+
 Findings written to `.devlyn/verify.findings.jsonl`. **VERIFY agents have no code-mutation tools.** Codex pair-JUDGE is read-only: invoke `codex-monitored.sh` directly with `-c model_reasoning_effort=medium` for this bounded two-probe review, without piping to `tail`/`head`/`grep`, capture stdout/stderr by direct tool capture or file redirection, require JSONL findings on stdout, and have the orchestrator write `.devlyn/verify.pair.findings.jsonl`. If stdout is first captured as `.devlyn/codex-judge.stdout`, run `python3 .claude/skills/_shared/collect-codex-findings.py` before merge; that script is the deterministic boundary writer for `.devlyn/verify.pair.findings.jsonl`. Raw stdout remains diagnostic only: if stdout contains findings or a non-PASS summary while `.devlyn/verify.pair.findings.jsonl` is empty, `verify-merge-findings.py` blocks VERIFY for `verify.pair.emission-contract`. Do not ask Codex to `apply_patch` or edit `.devlyn`. After primary and pair findings are written, run `python3 .claude/skills/_shared/verify-merge-findings.py --write-state`. Branch only on the merged `state.phases.verify.verdict`; a HIGH/CRITICAL finding from either judge must mechanically become `NEEDS_WORK`. Never write `.devlyn/verify-merged.findings.jsonl` or `.devlyn/verify-merge.summary.json` by hand; `verify-merge-findings.py` is their only writer. State write: `phases.verify.{started_at, verdict, completed_at, duration_ms, sub_verdicts: {mechanical, judge, pair_judge?}, artifacts}`.
 
 Branch:
@@ -223,7 +244,7 @@ State write: `phases.final_report.started_at` at the top of this phase.
 
 1. **Terminal verdict** — derive from `state.phases.{plan, implement, build_gate, cleanup, verify}.verdict` per the precedence rules in `references/state-schema.md#terminal-verdict`. Verify-only mode short-circuits to `state.phases.verify.verdict`.
 
-2. **Render report** — sections: header (run_id, engine, mode, verdict, wall-time), per-phase summary, findings table (verify findings only — post-IMPLEMENT phases are findings-only), follow-up notes (any `--continue-on-large` assumptions, any silent fallbacks).
+2. **Render report** — sections: header (run_id, engine, mode, verdict, wall-time), per-phase summary, pair/risk-probe status, findings table (verify findings only — post-IMPLEMENT phases are findings-only), follow-up notes (any `--continue-on-large` assumptions, any `--no-pair` / `--no-risk-probes` opt-out, and any engine setup guidance after BLOCKED).
 
 3. State write: `phases.final_report.{verdict, completed_at, duration_ms}` BEFORE archive runs (archive prune logic skips runs whose `final_report.verdict` is null).
 

package/config/skills/devlyn:resolve/references/phases/implement.md

@@ -33,7 +33,7 @@ Read `_shared/runtime-principles.md`. Codex-routed phases receive the inlined ex
 
 - Subtractive-first: every accretion-shaped change is visible in the commit message or a flagged finding. Net-deletion is the default; pure-addition needs a citation.
 - Goal-locked: implement only the listed Requirements. Adjacent code that "looks fixable" is drift unless the spec or plan listed it.
-- No-workaround: no `any`, no `@ts-ignore`, no silent `catch`, no hardcoded values, no helper scripts that bypass root cause. The only documented exception is the Codex CLI availability downgrade.
+- No-workaround: no `any`, no `@ts-ignore`, no silent `catch`, no hardcoded values, no helper scripts that bypass root cause. Required unavailable engines stop with `BLOCKED:<engine>-unavailable`; they do not downgrade.
 - Evidence: every claim cites file:line you opened. Hallucinated APIs are excluded.
 </runtime_principles>
 

package/config/skills/devlyn:resolve/references/phases/verify.md

@@ -95,11 +95,19 @@ VERIFY agent.
 
 When eligible, trigger pair-mode if any of these are true:
 - `--pair-verify` was set.
+- `state.mode == "verify-only"`.
 - The spec frontmatter has `complexity: high`.
 - `state.complexity` is `"high"` or `"large"`.
+- `state.risk_profile.high_risk == true`.
+- `.devlyn/risk-probes.jsonl` exists or `state.risk_profile.risk_probes_enabled == true`.
 - MECHANICAL emitted warning-level findings but no HIGH/CRITICAL blockers.
 - `state.verify.coverage_failed == true`.
 
+If `--no-pair` was set, do not spawn the OTHER-engine judge. Record
+`pair_trigger: { eligible: false, reasons: [], skipped_reason: "user_no_pair" }`
+and continue with solo VERIFY. This is an explicit user opt-out, not an engine
+availability fallback.
+
 Before JUDGE spawn, compute and persist:
 
 ```json
@@ -118,8 +126,17 @@ The `--engine` flag never disables this rule. Explicit `--engine claude` means
 Claude is the primary judge; if pair-mode triggers, Codex is still the mandatory
 OTHER-engine judge. Do not record "explicit --engine claude" as a skip reason.
 The only valid skip reasons after a non-empty eligible trigger are deterministic
-MECHANICAL HIGH/CRITICAL blockers or Codex unavailability proven by the
-invocation layer.
+MECHANICAL HIGH/CRITICAL blockers or an explicit `--no-pair`. Engine
+unavailability is not a skip reason; it is `BLOCKED:<engine>-unavailable`.
+
+Before invoking the OTHER-engine judge, run the shared availability pre-flight
+for that engine. If Codex is required and unavailable, set VERIFY to
+`BLOCKED:codex-unavailable` and tell the user to install/configure the Codex CLI,
+run the current Codex auth/login flow, verify `codex --version`, and rerun. If
+Claude is required and the host cannot spawn a Claude agent, set VERIFY to
+`BLOCKED:claude-unavailable` and tell the user to install/configure Claude Code,
+verify `claude --version` where available, and rerun. Do not convert this to a
+solo pass, and do not synthesize pair findings.
 
 When eligible and the orchestrator spawns a second VERIFY agent with the OTHER engine's adapter, both judgments are merged:
 - Any HIGH/CRITICAL finding either model surfaces is verdict-binding.

package/config/skills/devlyn:resolve/references/state-schema.md

@@ -12,6 +12,7 @@ Single authoritative verdict source for `/devlyn:resolve`. The orchestrator bran
   "engine": "claude",
   "mode": "spec",
   "complexity": null,
+  "risk_profile": { "high_risk": false, "reasons": [], "risk_probes_enabled": false, "pair_default_enabled": true },
   "base_ref": { "branch": "main", "sha": "abc123..." },
   "rounds": { "max_rounds": 4, "global": 0 },
   "bypasses": [],
@@ -44,13 +45,14 @@ Single authoritative verdict source for `/devlyn:resolve`. The orchestrator bran
 - **version** — string. Bump major on a breaking schema change.
 - **mode** — `"free-form" | "spec" | "verify-only"`.
 - **complexity** — `null | "trivial" | "medium" | "large"`. Free-form mode populates this; spec/verify-only mode leaves it null.
-- **engine** — `"claude" | "codex" | "auto"` initially; rewritten by engine-preflight if a downgrade fired.
+- **engine** — `"claude" | "codex" | "auto"` initially; a required unavailable engine stops the run with `BLOCKED:<engine>-unavailable`.
+- **risk_profile** — PHASE 0 classification for conditional defaults. `high_risk` records durable-risk signals from the goal/spec; `risk_probes_enabled` is true for explicit `--risk-probes` or high-risk specs unless `--no-risk-probes`; `pair_default_enabled` is false only for explicit `--no-pair`.
 - **rounds.global** — incremented every fix-loop pass (BUILD_GATE → fix-loop OR VERIFY → fix-loop).
 - **phases.probe_derive** — optional PHASE 1.5 entry when `--risk-probes` is enabled. Artifacts include `.devlyn/risk-probes.jsonl`. Probe failures later surface through BUILD_GATE/VERIFY as `correctness.risk-probe-failed`.
 - **bypasses** — array of phase names from `--bypass`. Valid: `"build-gate" | "cleanup"`. PLAN, IMPLEMENT, VERIFY are non-bypassable (orchestrator rejects at parse time).
 - **implement_passed_sha** — captured at end of PHASE 2; null until then. Activates the post-implement invariant for CLEANUP and VERIFY.
 - **criteria** — generated from spec's `## Requirements` checklist (one per `- [ ]`). `status: pending → implemented` is the legal transition. `failed_by_finding_ids` populates when VERIFY surfaces a finding tied to a criterion.
-- **verify.coverage_failed** — set by VERIFY's JUDGE sub-phase when a spec axis could not be exercised against the diff. Triggers pair-mode escalation when set. Pair-mode also triggers for `complexity: high` specs or `state.complexity` of `"high"`/`"large"` when MECHANICAL has no HIGH/CRITICAL blockers.
+- **verify.coverage_failed** — set by VERIFY's JUDGE sub-phase when a spec axis could not be exercised against the diff. Triggers pair-mode escalation when set. Pair-mode also triggers for verify-only mode, high-risk specs, active risk probes, `complexity: high` specs, or `state.complexity` of `"high"`/`"large"` when MECHANICAL has no HIGH/CRITICAL blockers.
 - **verify.pair_trigger** — VERIFY's trigger decision: `{ "eligible": boolean, "reasons": string[], "skipped_reason": string|null }`. If eligible with any reason, `pair_judge` must be non-null.
 
 ## Per-phase shape
@@ -105,7 +107,7 @@ Per-phase summary table: `phase | verdict | duration_ms | round | triggered_by |
 
 Findings table (post-IMPLEMENT phases only — they are findings-only): each finding's `severity | rule_id | file:line | message | confidence`.
 
-Follow-up notes: any `--continue-on-large` assumptions, any silent fallbacks (engine downgrade), any `state.verify.coverage_failed` axes.
+Follow-up notes: any `--continue-on-large` assumptions, pair/risk-probe opt-out state, engine setup guidance for `BLOCKED:<engine>-unavailable`, any `state.verify.coverage_failed` axes.
 
 ## Archive contract
 

package/optional-skills/devlyn:design-ui/SKILL.md

@@ -0,0 +1,364 @@
+---
+name: devlyn:design-ui
+description: Generate N (default 5) radically distinct UI style options from a PRD as portfolio-worthy HTML/CSS samples. Pass a leading integer or `count:N` in the brief to change the count.
+source: project
+---
+
+You are the **Lead Designer** with full creative authority. Create N portfolio-worthy HTML/CSS style samples that help stakeholders visualize design directions. These aren't mockups—they're design statements.
+
+<escalation>
+If the design task requires multi-perspective exploration (brand strategy + interaction design + accessibility + visual craft all mattering equally), consider escalating to `/devlyn:team-design-ui` for a full 5-person design team.
+</escalation>
+
+<context>
+$ARGUMENTS
+</context>
+
+<count_resolution>
+**Resolve N before doing any design work.**
+
+1. If `$ARGUMENTS` begins with a positive integer (e.g. `3`, `7 dark dashboard`), that is N.
+2. Else if `$ARGUMENTS` contains a `count:N` or `n=N` token (any case), that is N.
+3. Otherwise N defaults to **5**.
+
+Clamp N to the range `1..10`. Values outside that range default to 5 and are noted in the final report. After resolving, use N consistently across every phase below — concept count, file count, output table rows.
+
+Strip the count token from the brief before using `$ARGUMENTS` as the product description.
+</count_resolution>
+
+<input_handling>
+The context above may contain:
+
+- **PRD document**: Extract product goals, target users, and brand requirements
+- **Product description**: Parse key features and emotional direction
+- **Image references**: Analyze and replicate the visual style as closely as possible
+
+If no input is provided, check for existing PRD at `docs/prd.md` or `README.md`.
+
+### When Image References Are Provided
+
+**Your primary goal shifts to replication, not invention.**
+
+1. **Analyze the reference image(s) precisely:**
+
+   - Extract exact color values (use color picker precision: #RRGGBB)
+   - Identify font characteristics (serif/sans, weight, spacing, size ratios)
+   - Map layout structure (grid, spacing rhythm, alignment patterns)
+   - Note visual effects (shadows, gradients, blur, textures, border styles)
+   - Capture motion cues (if animated reference or implied motion)
+
+2. **Generate designs that match the reference:**
+
+   - **First ~40% of N designs**: Replicate the reference style as closely as possible, adapting to the PRD's content (with N=5 this is designs 1-2; with N=3 just design 1; with N=10 designs 1-4).
+   - **Remaining designs**: Variations that preserve the reference's core aesthetic while exploring different directions within that style.
+
+3. **Fidelity checklist for reference-based designs:**
+   - [ ] Color palette within ±5% of reference values
+   - [ ] Typography style matches (same category, similar weight/spacing)
+   - [ ] Layout proportions preserved
+   - [ ] Visual effects replicated (shadows, gradients, textures)
+   - [ ] Overall "feel" is recognizably similar to reference
+
+### When No Image References Are Provided
+
+Follow the standard creative process: invent tension-based concept names, map across spectrums, and generate N radically different directions.
+</input_handling>
+
+<instructions>
+
+## Phase 1: Extract Design DNA
+
+Keep this brief—creative naming drives the design, not over-analysis.
+
+```
+**Product:** [one sentence]
+**User:** [who, in what context, with what goal]
+**Must convey:** [2-3 essential feelings]
+**Count (N):** [resolved N]
+```
+
+## Phase 2: Invent N Creative Directions
+
+### Check Existing Styles
+
+Read `docs/design/` directory. If `style_K_*.html` files exist, continue numbering from K+1. New styles must be visually distinct from existing ones.
+
+### Create N Concept Names
+
+**Before any design work, invent N evocative names.**
+
+Name format: `[word_A]_[word_B]` where:
+
+- Word A and Word B create **tension or contrast**
+- The combination should feel unexpected, not obvious
+- Each word pulls the design in a different direction
+
+Good patterns:
+
+- [temperature]\_[movement]: warm vs cold, static vs dynamic
+- [texture]\_[era]: rough vs smooth, retro vs futuristic
+- [emotion]\_[structure]: soft vs rigid, chaotic vs ordered
+- [material]\_[concept]: organic vs digital, heavy vs light
+
+Avoid:
+
+- Single adjectives
+- Obvious pairings without tension
+- Generic descriptors
+
+**The name drives the design.** Tension in the name forces creative problem-solving.
+
+### Map Each Concept Across 7 Spectrums
+
+For each concept, mark its position. **Extremes create distinctiveness—avoid the middle.**
+
+```
+Concept: [name]
+
+Layout:      Dense ●○○○○ Spacious
+Color:       Monochrome ○○○○● Vibrant
+Typography:  Serif ○○●○○ Display
+Depth:       Flat ○○○○● Layered
+Energy:      Calm ○●○○○ Dynamic
+Theme:       Dark ●○○○○ Light
+Shape:       Angular ○○○○● Curved
+```
+
+### Extreme Rule (Mandatory)
+
+**Each design MUST have at least 2 extreme positions** (●○○○○ or ○○○○●).
+
+Why: Middle positions (○○●○○) converge to "safe" averages. Extremes force distinctive choices.
+
+### Verify Contrast
+
+Before proceeding:
+
+- [ ] Each design has **2+ extreme positions**
+- [ ] No two concepts share the same position on 4+ spectrums
+- [ ] If N ≥ 2, mix of dark and light themes across the N designs
+- [ ] If N ≥ 2, mix of angular and curved across the N designs
+
+## Phase 3: Define Concrete Specifications
+
+For each concept, specify exact values—no adjectives.
+
+```
+### [Concept Name]
+
+**Palette:**
+- Background: #______
+- Surface: #______
+- Text: #______
+- Text muted: #______
+- Accent: #______
+
+**Typography:**
+- Font: [Google Font name]
+- Headline: [size]px / [weight] / [letter-spacing]em
+- Body: [size]px / [weight] / [line-height]
+
+**Spacing:**
+- Container max-width: [value]px
+- Section padding: [value]px
+- Element gap: [value]px
+- Border-radius: [value]px
+
+**Motion:**
+- Duration: [value]s
+- Easing: cubic-bezier([values])
+- Stagger delay: [value]s
+```
+
+## Phase 4: Generate HTML Files
+
+<use_parallel_tool_calls>
+Write all N HTML files simultaneously by making N independent Write tool calls in a single response. These files have no dependencies on each other—do not write them sequentially. Maximize parallel execution for speed.
+</use_parallel_tool_calls>
+
+<frontend_aesthetics>
+You tend to converge toward generic outputs. Avoid this:
+
+**Typography:** Never use Inter, Roboto, Arial, Helvetica, Open Sans, Space Grotesk, or system fonts. Choose distinctive typefaces. Use weight extremes (100 vs 900, not 400 vs 600). Dramatic size jumps (3x+). Tight headline letter-spacing (-0.02em to -0.05em).
+
+**Color:** One dominant + one sharp accent. Never pure #FFFFFF or #000000 backgrounds—add subtle tint. No purple gradients.
+
+**Motion:** Focus on high-impact moments, not scattered micro-interactions.
+
+- **Page load**: Orchestrated staggered reveals (vary `animation-delay` by 0.05-0.1s increments)
+- **Scroll**: Use `IntersectionObserver` for scroll-triggered fade-ins (vanilla JS, no frameworks)
+- **Hover**: Transform + opacity + subtle shadow shifts, not just color changes
+- **Transitions**: Custom `cubic-bezier` easings that feel physical (e.g., `cubic-bezier(0.34, 1.56, 0.64, 1)` for bounce)
+- **Advanced**: Gradient animations via `background-position`, `backdrop-filter` transitions, CSS `@property` for animatable custom properties
+- **Restraint**: One dramatic sequence beats many small animations. If everything moves, nothing stands out.
+
+**Backgrounds:** Never flat solid colors. Layer gradients, add subtle noise/grain, create atmosphere.
+
+**Layout:** Break at least one standard pattern per design. Try asymmetry, overlap, bento grids, diagonal flow, or unexpected whitespace.
+</frontend_aesthetics>
+
+### File Requirements
+
+| Requirement        | Details                                           |
+| ------------------ | ------------------------------------------------- |
+| **Path**           | `docs/design/style_{n}_{concept_name}.html`       |
+| **Content**        | Realistic view matching product purpose           |
+| **Self-contained** | Inline CSS, only Google Fonts external            |
+| **Interactivity**  | Hover, active, focus states + page load animation |
+| **Responsive**     | Basic mobile adaptation                           |
+| **Real content**   | Actual copy from PRD, no lorem ipsum              |
+
+### HTML Structure
+
+```html
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>[Product] - [Concept]</title>
+
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+    <link href="https://fonts.googleapis.com/css2?family=[Font]:[weights]&display=swap" rel="stylesheet" />
+
+    <style>
+      /* Concept: [name]
+       Spectrum: L[x] C[x] T[x] D[x] E[x] Th[x] Sh[x]
+       Extremes: [list which 2+ are extreme] */
+
+      :root {
+        --bg: #[hex];
+        --surface: #[hex];
+        --text: #[hex];
+        --text-muted: #[hex];
+        --accent: #[hex];
+      }
+
+      * {
+        margin: 0;
+        padding: 0;
+        box-sizing: border-box;
+      }
+
+      body {
+        font-family: "[Font]", sans-serif;
+        background: var(--bg);
+        color: var(--text);
+      }
+
+      /* Page load: staggered reveal */
+      .reveal {
+        opacity: 0;
+        transform: translateY(20px);
+        animation: fadeUp 0.6s cubic-bezier(0.16, 1, 0.3, 1) forwards;
+      }
+      .reveal:nth-child(1) {
+        animation-delay: 0.1s;
+      }
+      .reveal:nth-child(2) {
+        animation-delay: 0.15s;
+      }
+      .reveal:nth-child(3) {
+        animation-delay: 0.2s;
+      }
+
+      @keyframes fadeUp {
+        to {
+          opacity: 1;
+          transform: translateY(0);
+        }
+      }
+
+      /* Scroll-triggered: hidden until in view */
+      .scroll-reveal {
+        opacity: 0;
+        transform: translateY(30px);
+        transition: opacity 0.6s cubic-bezier(0.16, 1, 0.3, 1), transform 0.6s cubic-bezier(0.16, 1, 0.3, 1);
+      }
+      .scroll-reveal.visible {
+        opacity: 1;
+        transform: translateY(0);
+      }
+
+      /* Hover: physical-feeling bounce */
+      .interactive {
+        transition: transform 0.3s cubic-bezier(0.34, 1.56, 0.64, 1), box-shadow 0.3s ease;
+      }
+      .interactive:hover {
+        transform: translateY(-4px);
+        box-shadow: 0 12px 24px -8px rgba(0, 0, 0, 0.15);
+      }
+    </style>
+  </head>
+  <body>
+    <!-- Semantic HTML with real content -->
+
+    <script>
+      // Scroll-triggered animations
+      const observer = new IntersectionObserver(
+        (entries) => {
+          entries.forEach((entry) => {
+            if (entry.isIntersecting) {
+              entry.target.classList.add("visible");
+            }
+          });
+        },
+        { threshold: 0.1 }
+      );
+
+      document.querySelectorAll(".scroll-reveal").forEach((el) => observer.observe(el));
+    </script>
+  </body>
+</html>
+```
+
+## Phase 5: Verify Quality
+
+### Per-Design Checklist
+
+- [ ] Font is distinctive (not Inter/Roboto/Arial/system)
+- [ ] Background has depth (not flat white/black)
+- [ ] Page load animation with staggered delays
+- [ ] Scroll-triggered reveals on below-fold content
+- [ ] Hover states with transform + shadow (not just color)
+- [ ] Custom easing (cubic-bezier), not default `ease` or `linear`
+- [ ] CSS custom properties for colors
+- [ ] Layout breaks at least one standard pattern
+
+### Cross-Design Contrast
+
+Each pair of designs must have 5+ obvious visual differences. If not, revise. (Skipped automatically when N=1.)
+
+## Phase 6: Save & Report
+
+Create `docs/design/` directory if needed. Save all N HTML files.
+
+</instructions>
+
+<output_format>
+
+```
+## Generated Styles (N = {N})
+
+| # | Name | Spectrum (L/C/T/D/E/Th/Sh) | Extremes | Palette | Font |
+|---|------|---------------------------|----------|---------|------|
+| {k} | {name} | [x][x][x][x][x][x][x] | {which 2+} | #___, #___, #___ | {font} |
+
+### Files
+- docs/design/style_{k}_{name}.html
+- ...
+
+### Rationale
+1. **{name}**: [1 sentence connecting to product requirements]
+2. ...
+```
+
+</output_format>
+
+Make bold choices. Each design should be portfolio-worthy—something you'd proudly present.
+
+<next_step>
+After the user picks a style, suggest:
+→ Run `/devlyn:design-system [style-number]` to extract design tokens from the chosen style into a reusable design system reference.
+</next_step>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devlyn-cli",
-  "version": "2.2.2",
+  "version": "2.3.0",
   "description": "AI development toolkit for Claude Code — ideate, auto-resolve, and ship with context engineering and agent orchestration",
   "homepage": "https://github.com/fysoul17/devlyn-cli#readme",
   "bin": {

package/scripts/lint-skills.sh

@@ -283,10 +283,10 @@ else
 fi
 
 # ---------------------------------------------------------------------------
-# 9. Engine-downgrade string is canonical (codex-unavailable, not codex-ping failed).
+# 9. Engine availability fails closed; stale silent-downgrade wording is forbidden.
 # ---------------------------------------------------------------------------
-section "Check 9: Downgrade string uses 'codex-unavailable'"
-offenders=$(grep -RIln 'codex-ping failed\|codex-ping fail' \
+section "Check 9: Engine availability fails closed"
+offenders=$(grep -RInE 'codex-ping failed|codex-ping fail|engine downgraded: codex-unavailable|silently downgrades|silently downgrade|silently switch to Claude|Codex CLI availability downgrade' \
   config/skills CLAUDE.md README.md bin/ 2>/dev/null \
   | grep -v 'roadmap-archival-workspace/' \
   | grep -v 'devlyn:auto-resolve-workspace/' \
@@ -294,7 +294,7 @@ offenders=$(grep -RIln 'codex-ping failed\|codex-ping fail' \
   | grep -v 'preflight-workspace/' \
   || true)
 if [ -z "$offenders" ]; then
-  ok "all downgrade strings canonical"
+  ok "engine availability fail-closed wording canonical"
 else
   while IFS= read -r f; do bad "$f"; done <<< "$offenders"
 fi