devrites 1.19.0

package/pack/.claude/skills/rite-seal/reference/parallel-dispatch.md

@@ -0,0 +1,69 @@
+# Parallel review dispatch
+
+How `/rite-review` and `/rite-seal` fan out the fresh-context review subagents under `.claude/agents/`. Loaded on demand by the calling skill — not a skill itself.
+
+DevRites ships ten fresh-context review subagents under `.claude/agents/` (plus the write-capable `devrites-slice-wright`, which is not a reviewer). Eight are post-build reviewers used at the seal / multi-axis review; the other two are gate-specific and *not* part of the seal fan-out — `devrites-strategy-reviewer` is **pre-plan** (it judges the spec for `/rite-temper`) and `devrites-plan-reviewer` is **pre-build** (it judges the plan for `/rite-vet`). The seal and the multi-axis review need most of the post-build reviewers running **at the same time**, on the same workspace + diff, so the verdicts don't contaminate each other.
+
+Pattern: delegate to specialized agents with isolated context, brief each one precisely, run them concurrently, reconcile on return.
+
+## When to use which subagent
+
+| Subagent | Always | Conditional |
+|---|---|---|
+| `devrites-spec-reviewer` | `/rite-review` Spec axis; `/rite-seal` | — |
+| `devrites-code-reviewer` | `/rite-review` Standards axis; `/rite-seal` | — |
+| `devrites-test-analyst` | `/rite-seal` | — |
+| `devrites-frontend-reviewer` | — | UI files in the diff |
+| `devrites-security-auditor` | — | input / auth / data / external integrations / secrets in scope |
+| `devrites-performance-reviewer` | — | perf budget in `spec.md` or visible regression risk |
+| `devrites-doubt-reviewer` | — | a non-trivial decision is being stood up (called from `devrites-doubt`) |
+| `devrites-simplifier-reviewer` | — | `/rite-polish` Phase 1 audit (called from `devrites-audit simplify`) |
+
+## Dispatch shape
+
+For each chosen subagent, the caller uses the `Task` tool with this prompt shape:
+
+```
+Audit the active DevRites feature.
+
+Workspace: .devrites/work/<slug>/
+Read (yourself, fresh context):
+  - spec.md  (+ acceptance criteria)
+  - touched-files.md
+  - the git diff
+  - <any axis-specific files: decisions.md, evidence.md, references/...>
+
+Before judging the diff, derive the expected behaviour from the spec
+yourself, then compare it against what the code does. Anchor every finding
+to file:line plus the spec criterion or command output that proves it —
+an unanchored finding is a Suggestion at most. The order or length of the
+diff is not evidence.
+
+Apply your documented discipline. Return labeled findings (Critical /
+Important / Suggestion / Nit / FYI) using your documented output format,
+ONE FINDING PER LINE, cite file:line.
+
+Feature scope only. No edits. Do not summarize or re-rank — the caller
+reconciles.
+```
+
+Rules:
+
+- **One Task call per subagent.** Send them in a single message with multiple `Task` invocations so the runtime dispatches concurrently.
+- **No cross-pollination.** Each subagent gets only its narrow brief and the workspace path. Do not pass another subagent's findings into a sibling's prompt — that recreates the masking problem.
+- **No author context.** Do not include the caller's analysis or the user's framing of the change; the point is a fresh, adversarial read.
+- **Feature scope only.** Each subagent must stay inside `touched-files.md` + the diff.
+
+## Reconciliation
+
+When the subagents return:
+
+1. **Quote verbatim.** Place each subagent's findings under its own `## <axis>` heading in `review.md` / `seal.md`. Do not merge, re-rank, or summarize.
+2. **Surface contradictions explicitly.** "Spec axis says complete, Standards axis says untestable" is a finding, not noise. The caller decides at the gate.
+3. **Severity is the gate, not a score.** Sum the labels (`Critical / Important / Suggestion / Nit / FYI`) and apply the caller's gate (`/rite-seal` blocks on `Critical == 0`; `/rite-review` reports counts).
+4. **One scale.** All subagents use the same five-label scale (Critical / Important / Suggestion / Nit / FYI). Reject any subagent output that invents its own. **Exception:** `devrites-simplifier-reviewer` deliberately emits only Suggestion / Nit / FYI (it is non-blocking by design) — that is a valid subset of the scale, not an invented one; do not reject it during reconciliation.
+5. **Consensus roll-up (after the verbatim per-axis record).** Keep every axis's findings verbatim under its `## <axis>` heading (above), then add one deduped roll-up the gate reads: where **≥2 axes flag the same `file:line`**, raise it to the top and mark it *consensus* — independent corroboration raises confidence. A lone low-confidence finding with no `file:line` or evidence anchor drops out of the roll-up (it stays in its per-axis section). The roll-up reduces noise without hiding any axis — the verbatim sections are the audit trail; the roll-up is the actionable summary the gate acts on.
+
+## Fallback
+
+If the `Task` tool is unavailable in the current environment, the caller runs the relevant subagent discipline **inline** in its own context and flags the result as a fallback (not an independent review). The seal weighs the fallback differently — see [`./risk-and-rollback.md`](./risk-and-rollback.md).

package/pack/.claude/skills/rite-seal/reference/risk-and-rollback.md

@@ -0,0 +1,30 @@
+# Risk & rollback
+
+Before GO, know how to undo the change and what could go wrong in production.
+
+## Risk scan
+Rank risks; for each, note likelihood × impact and any mitigation:
+- **Data**: schema changes, data migration, destructive operations, backfills.
+- **Security**: new trust boundaries, auth/authz changes, secret handling, new deps.
+- **Compatibility**: API contract changes, breaking changes for existing clients,
+  feature interactions.
+- **Operational**: new external dependency, config/env requirements, rate limits.
+- **UX**: changed flows users rely on; unverified UI.
+
+## Rollback plan (required for risky changes)
+For each risky step, state how to back it out:
+- **Migrations**: is there a reversible `down` / a documented manual revert? Is data
+  loss possible on rollback?
+- **Feature flag**: can it be disabled without a deploy?
+- **Revert boundary**: can the change be `git revert`-ed cleanly, or does it entangle
+  with other work?
+- **Data**: is there a backup / a way to restore prior state?
+
+## Blocking rules
+- A **destructive or data-migration change with no rollback plan** is a **NO-GO**.
+- A new external dependency with no failure handling is at least **Important**.
+- Record the chosen rollback path in `seal.md` → "Rollback / Recovery".
+
+## Destructive operations
+Confirm any destructive step with the user before shipping. Verify backups exist where
+relevant. Never treat an irreversible action as routine.

package/pack/.claude/skills/rite-seal/reference/seal-template.md

@@ -0,0 +1,36 @@
+# `seal.md` template
+
+Loaded on demand by `/rite-seal`. The seal writes this template (filled in) to `.devrites/work/<slug>/seal.md` as the durable record of the GO / NO-GO verdict.
+
+```markdown
+# Seal: <Feature>
+
+Verdict: GO / NO-GO
+
+## Acceptance Criteria
+- [ ] <criterion> — evidence: <...>
+
+## Verification Evidence
+<tests / build / lint summary>
+
+## Browser Evidence
+<summary | n/a>
+
+## Risks
+<ranked>
+
+## Blockers
+<must-fix before ship>
+
+## Non-blocking Follow-ups
+<deferred items>
+
+## Rollback / Recovery
+<how to back this out>
+
+## Final Decision
+<one paragraph: verdict + why>
+
+## Footprint
+<deterministic fan-out from footprint.sh — subagents · slices · wall-clock; never tokens/cost>
+```

package/pack/.claude/skills/rite-ship/SKILL.md

@@ -0,0 +1,120 @@
+---
+name: rite-ship
+description: Ship the sealed feature and close the task — render type-GO, run the irreversible git commit/push/tag (or open the PR), write ship.md, then archive the workspace and clear .devrites/ACTIVE. Use when the user says "ship it", "ship this", "push it out", "close the task", "finish and archive", or right after /rite-seal returns GO. Not for the GO/NO-GO decision itself (use /rite-seal) or an unsealed feature.
+argument-hint: "[feature-slug]"
+user-invocable: true
+---
+
+# /rite-ship — ship + close the task
+
+The final phase. `/rite-seal` **decides** GO/NO-GO; `/rite-ship` **executes** the
+irreversible git actions and **closes** the feature. **Read the active workspace
+first**; if none, tell the user to run `/rite-spec <feature>`.
+
+Refuses to ship unless `seal.md` records a **GO** verdict.
+
+## Rules consulted (read on demand from `.claude/rules/`)
+**Step 0:** Read `.claude/rules/core.md` first. Then pull on demand:
+- `git-workflow.md` — Conventional Commits, atomic commits, the never-commit list.
+- `afk-hitl.md` — type-GO is the irreversible-action gate.
+
+## Operating rules
+- **Seal GO is a precondition.** No GO in `seal.md` → stop, point at `/rite-seal`.
+- **Evidence must be fresh.** If any file in `touched-files.md` changed after
+  `evidence.md` was written, the proof is stale → stop, point at `/rite-prove`. Enforced
+  deterministically by `evidence-fresh.sh` in step 1 (exit 3 = STALE), not by eyeballing
+  mtimes (see `.claude/rules/development-workflow.md`).
+- **type-GO before anything irreversible.** Render the prompt verbatim and wait for
+  the literal `GO`. Last safety net — render it every time, even under auto-trigger.
+- **Never delete the audit trail.** Closing *archives* the workspace; it never erases
+  the `.md` files.
+
+## Workflow
+1. **Run the shared orientation preamble** — it prints `state.md`, the artifacts present,
+   the run mode (HITL/AFK), and the open-question tally by gate, so you orient deterministically
+   instead of re-deriving state from raw Markdown:
+   ```bash
+   P=.claude/skills/devrites-lib/scripts/preamble.sh
+   [ -f "$P" ] || P="${CLAUDE_SKILL_DIR:-}/../devrites-lib/scripts/preamble.sh"
+   [ -f "$P" ] || P=pack/.claude/skills/devrites-lib/scripts/preamble.sh
+   [ -f "$P" ] && bash "$P" || echo "(orientation preamble unavailable on this install — read state.md directly to orient)"
+   ```
+   Then read `seal.md`, `state.md`, `spec.md`, `touched-files.md`, `evidence.md`, and
+   `design-brief.md` (if the feature is UI — the design-memory rollup in step 2a reads it).
+   Confirm the verdict is **GO**, then run the deterministic evidence-freshness gate rather than
+   eyeballing mtimes (mirrors `/rite-seal`):
+   ```bash
+   E=.claude/skills/devrites-lib/scripts/evidence-fresh.sh
+   [ -f "$E" ] || E="${CLAUDE_SKILL_DIR:-}/../devrites-lib/scripts/evidence-fresh.sh"
+   [ -f "$E" ] || E=pack/.claude/skills/devrites-lib/scripts/evidence-fresh.sh
+   [ -f "$E" ] && { bash "$E"; echo "evidence-fresh rc=$?"; } || echo "(evidence-fresh gate unavailable — compare mtimes by hand)"
+   ```
+   **Exit 3 → STALE proof: STOP**, point at `/rite-prove` (a polish/review edit made after
+   `/rite-prove` invalidates the proof). Not GO → stop with the single resume command.
+1a. **Health re-check (advisory).** Run the DevRites doctor before the irreversible ladder —
+   a stale `ACTIVE` or corrupt workspace here risks shipping or closing the wrong feature.
+   Advisory: surface issues, don't block.
+   ```bash
+   D=.claude/skills/devrites-lib/scripts/doctor.sh
+   [ -f "$D" ] || D="${CLAUDE_SKILL_DIR:-}/../devrites-lib/scripts/doctor.sh"
+   [ -f "$D" ] || D=pack/.claude/skills/devrites-lib/scripts/doctor.sh
+   [ -f "$D" ] && { bash "$D"; echo "doctor rc=$?"; } || true
+   ```
+   If it flags the active feature, confirm you're shipping the intended slug before proceeding.
+2. Build the git plan from `git-workflow.md` + the project's own convention: the
+   Conventional-Commit message(s), the target branch, and whether a tag / PR applies.
+   Scope the commit to `touched-files.md`; never stage secrets or out-of-scope files.
+2a. **Design memory (optional, UI features only).** If the feature shipped UI, offer to roll
+   its *proven* design language up into a project-level `DESIGN.md` so the next feature
+   inherits the system instead of re-discovering it
+   ([reference/design-memory.md](reference/design-memory.md)). **Opt-in and confirmed** —
+   present the option set (default **skip**; persisting beyond feature scope is the user's
+   call), and on yes append `DESIGN.md` to `touched-files.md` so it ships *in this commit*.
+   Skip silently when there's no UI. Record the outcome in `ship.md`.
+3. **Render the type-GO prompt** ([reference/git-ship.md](reference/git-ship.md)) and
+   wait. Only the literal `GO` proceeds; anything else cancels — record the cancel in
+   `ship.md` and stop (do not retry without the user asking).
+4. On `GO`: run the git ladder — commit → push → tag / PR as applicable
+   ([reference/git-ship.md](reference/git-ship.md)). Capture the commit SHA(s),
+   branch, and tag/PR URL.
+4a. **When opening a PR, render a structured body** — not just the commit message:
+   **Summary** (what shipped + acceptance n/total) · **Risk & rollback** (the migration /
+   destructive / auth touches + how to revert, from `seal.md`'s risk scan) · **What to scrutinize**
+   (point reviewers at the highest-blast-radius hunks) · **Evidence** (a condensed `evidence.md` +
+   the seal's reconciled reviewer-verdict digest, linking the full `.devrites/archive/<slug>/`
+   bundle). **Delete any N/A section** — an empty Risk block is noise.
+4b. **Promote architecturally-significant decisions to ADRs.** For each `decisions.md` ADR that
+   records a *durable* architecture / interface choice (not a slice-local call), append it to a
+   persistent `docs/adr/ADR-NNN.md` — Nygard shape (Context · Decision · Status `accepted` ·
+   Consequences), **append-only**, never rewritten; supersede with a new ADR that links the old.
+   The per-feature `decisions.md` is archived with the workspace; the ADR keeps the load-bearing
+   *why* discoverable in the repo. Skip if the project keeps no `docs/adr/` and the user doesn't want one.
+5. Write `ship.md` ([reference/ship-template.md](reference/ship-template.md)): what
+   shipped, SHA(s), branch, tag/PR, acceptance summary (n/total), link to `seal.md`,
+   follow-ups.
+6. **Close the task** ([reference/close-out.md](reference/close-out.md)): set
+   `state.md` phase `done`, then run
+   `bash .claude/skills/devrites-lib/scripts/close-out.sh <slug>` to archive
+   `.devrites/work/<slug>/` → `.devrites/archive/<slug>/` and clear `.devrites/ACTIVE`.
+   Every `.md` is preserved in the archive.
+
+> **Mid-flight discipline.** When tempted to ship without a GO seal, skip the type-GO,
+> stage files outside `touched-files.md`, or delete the workspace instead of archiving
+> it — stop. See [`anti-patterns`](reference/anti-patterns.md); the gate exists for the
+> failure mode the ask misses.
+
+## Output
+
+**Footer first** — render the flow ribbon by running the progress footer (`progress.sh`, resolved like the step-0 preamble — canonical snippet in `devrites-lib/SKILL.md`); at ship it reads `ship ✓` across the spine. Keep the fact lines below it terse (`key value · key value`). Then:
+```
+Shipped: <feature>
+Commit:  <sha> on <branch>    Tag/PR: <ref | none>
+Acceptance: <n/total> proven
+Archived: .devrites/archive/<slug>/    ·    ACTIVE cleared
+ship.md:  .devrites/archive/<slug>/ship.md
+```
+If the user declined type-GO: state that nothing shipped, the seal still reads GO, and
+the resume command (`/rite-ship`).
+
+End with `↻ Hygiene: /clear` — the feature is closed; start the next with
+`/rite-spec <feature>`. See `.claude/rules/context-hygiene.md`.

package/pack/.claude/skills/rite-ship/reference/anti-patterns.md

@@ -0,0 +1,25 @@
+# rite-ship — anti-patterns
+
+Load this before any irreversible action — `git commit`, `push`, `tag`, publish, deploy
+— or when tempted to skip the close-out.
+
+Pack-wide rationalizations + red flags: see
+[rules/anti-patterns.md](../../../rules/anti-patterns.md).
+
+## Phase-specific rationalizations
+
+| Excuse | Rebuttal |
+|---|---|
+| "Seal said GO, so I can just push." | A GO verdict is a decision, not authorization. **Render the type-GO prompt every time** and wait for the literal `GO`. |
+| "I'll push the tag now; type-GO is a formality." | Type-GO is the last safety net before an irreversible action. Always render it — even under auto-trigger. |
+| "`git add -A` is faster than listing touched files." | Stage only what's in `touched-files.md`. `-A` sweeps secrets, scratch files, and out-of-scope edits into the ship. |
+| "The evidence is probably still good." | If any touched file changed after `evidence.md`, the proof is stale — stop and re-prove. Ship on fresh evidence only. |
+| "Delete the workspace, the feature's done." | Closing **archives** the workspace (`.devrites/archive/<slug>/`); it never deletes the audit trail. |
+
+## Red Flags
+
+- About to run `git push` / `git tag` without rendering the type-GO prompt.
+- Shipping without a `GO` verdict recorded in `seal.md`.
+- Staging files not listed in `touched-files.md`, or any secret / `.env`.
+- `rm`-ing `.devrites/work/<slug>/` instead of archiving it.
+- Marking the feature `done` but leaving `.devrites/ACTIVE` pointing at it.

package/pack/.claude/skills/rite-ship/reference/close-out.md

@@ -0,0 +1,31 @@
+# Close-out — archive the workspace, free the active slot
+
+Closing a feature means it stops being the *active* work, not that its record is
+deleted. DevRites keeps the full audit trail; it just moves out of the live path.
+
+## What close-out does
+
+1. **Mark done.** Set `state.md` → `Phase: done`, `Status: done`, and a `Next step`
+   of `/rite-spec <next feature>`.
+2. **Archive.** Run the deterministic script:
+   ```bash
+   bash .claude/skills/devrites-lib/scripts/close-out.sh <slug>
+   ```
+   It moves `.devrites/work/<slug>/` → `.devrites/archive/<slug>/` (every `.md`
+   intact) and clears `.devrites/ACTIVE` **only if** ACTIVE still points at `<slug>`.
+   It refuses to clobber an existing `.devrites/archive/<slug>/` (exit 5).
+3. **Confirm.** ACTIVE is now empty, so the next `/rite-spec` starts a clean feature
+   and `/rite-status` reports "no active feature".
+
+## Why archive, not delete
+
+- The `.md` files (`spec`, `decisions`, `assumptions`, `evidence`, `seal`, `ship`, …)
+  are the project's record of *why* the feature is the way it is. A future
+  `/rite-zoom-out` or incident review reads them.
+- Deleting them would make the workflow's own "evidence over confidence" rule a lie.
+
+## Re-opening an archived feature
+
+To resume archived work, move it back:
+`mv .devrites/archive/<slug> .devrites/work/<slug>` and write `<slug>` into
+`.devrites/ACTIVE`. Nothing is lost — close-out is reversible by design.

package/pack/.claude/skills/rite-ship/reference/design-memory.md

@@ -0,0 +1,120 @@
+# Design memory — roll proven design language into project `DESIGN.md`
+
+Optional, UI-only step at `/rite-ship`. A feature's design decisions live in its
+feature-scoped `design-brief.md` and are thrown away when the workspace archives. **Design
+memory** is the deliberate exception: when a UI feature ships, roll the design language it
+*proved* up into a project-level `DESIGN.md`, so the next feature's `devrites-ux-shape`
+inherits the system instead of re-discovering it.
+
+The consumers already exist — `devrites-ux-shape` §1 and
+`devrites-frontend-craft/reference/design-references.md` both read `DESIGN.md` when present.
+This step is the missing **producer**. It closes the loop: feature N seals its design
+language → feature N+1 builds to it.
+
+## When it runs
+- **UI features only.** No UI in the diff → skip silently.
+- **At ship, GO sealed, after the git plan, before type-GO** (step 2a) — so the user sees
+  the full staged change set (code + `DESIGN.md`) under the single type-GO that ships it.
+- **Opt-in and confirmed.** Persisting to a project-wide artifact is outside feature scope
+  (`rules/core.md` rule 7) — so it is *never silent*. Present a ranked option set
+  (`rules/afk-hitl.md` — Option set); **default is skip**. The user opts to persist.
+- **AFK**: first-time `DESIGN.md` *creation* is treated as a `validating` gate (a new
+  persistent project artifact) — propose + queue, don't auto-create. An *append* to an
+  existing `DESIGN.md` is `advisory` and may auto-proceed when `allow_gates` permits, since
+  it only adds evidence-proven entries.
+
+## Inputs (proven only)
+- `design-brief.md` — direction, color strategy, **calibration** (density / motion), key
+  states, named anchors, and the per-slice **Build-time refinements**.
+- The **final diff** + `touched-files.md` — what tokens / components / states *actually
+  shipped* (the evidence). Roll up only what the diff proves, not what the brief intended.
+- Existing `DESIGN.md` if present — the merge target.
+
+## What to roll up — the project's *converged* system, evidence-gated
+Only entries the shipped, proven feature establishes. Each is durable, cross-feature design
+language — not this feature's one-off choices.
+- **Tokens introduced + used** — new color roles / spacing steps / type steps / elevation
+  / radius that shipped and are reusable. Names and values, mirrored from the code.
+- **Color strategy + calibration baseline** — the strategy (Restrained / Committed / …) and
+  density / motion the project keeps landing on; note a deviation as a deviation, not a new
+  default.
+- **Type & spacing scales** in actual use; **motion** classes + easing; **materiality**
+  (elevation set, hairline usage, glass / texture policy).
+- **Component behaviors** — for each shared component this feature established or extended:
+  the states it ships and its interaction model. Grows one feature at a time.
+- **Named-anchor lineage** — the anchors features steered toward, so later work stays
+  coherent with what's already built.
+- **Anti-slop exceptions** — any banned default the project *intentionally* uses (with the
+  why), so build / polish don't "correct" a deliberate choice.
+
+## Merge discipline
+- **Append, don't overwrite.** Add proven entries; never silently rewrite an existing one.
+- **Conflict is a question, not an edit.** A new token / font / strategy that contradicts an
+  existing `DESIGN.md` entry → surface it to the user (the option set), don't resolve it
+  yourself. One design system per project.
+- **Never invent.** If the feature didn't prove it, it doesn't go in. `DESIGN.md` is design
+  *memory*, not design *aspiration*.
+- **Attribute + keep lean.** Tag each new entry with the feature slug so the lineage is
+  legible; one good line beats a paragraph. The file is read every future spec — keep it
+  scannable.
+
+## How it commits
+`DESIGN.md` is a tracked project artifact, so it ships **in the feature commit**:
+1. Write / update `<project-root>/DESIGN.md` from the template below.
+2. **Append `DESIGN.md` to `touched-files.md`** so the existing ship commit-scoping (SKILL
+   steps 2 + 4) stages it — the design-memory write rides the same commit and the same
+   type-GO, no second commit.
+3. Note the rollup in `ship.md` (what was added, or "design-memory: skipped by user").
+
+## `DESIGN.md` template (project-level, stack-agnostic)
+```markdown
+# DESIGN.md — <project> design memory
+
+> Rolled up from shipped features by `/rite-ship` (design memory). Read by
+> `devrites-ux-shape` and `devrites-frontend-craft` as the inherited system. Evidence-only:
+> every entry shipped and was proven. Edit through a feature's ship, not by hand.
+
+## Register & direction
+Default register per surface (brand / product) and the scene-derived direction the product
+keeps converging on.
+
+## Color
+Strategy baseline (Restrained | Committed | Multi-role | Saturated). Token roles
+(surface / text / accent / border / danger / …) with values or token names. Dark-mode approach.
+
+## Calibration
+Density baseline (Airy | Balanced | Dense) · Motion baseline (Minimal | Standard | Expressive).
+Surfaces that deviate + why.
+
+## Typography
+Families; the scale in use (fixed rem / fluid clamp); heading↔body ratio; weights.
+
+## Spacing
+The scale (4 pt multiples) and section rhythm in use.
+
+## Motion
+Classes in use, easing, `prefers-reduced-motion` handling.
+
+## Materiality
+Elevation token set, hairline usage, glass policy, texture / asset approach.
+
+## Components (proven behaviors)
+| Component | States shipped | Interaction model | First proven by |
+|---|---|---|---|
+| <name> | default/hover/focus/loading/empty/error/… | inline / navigated / modal · feedback | <slug> |
+
+## Named-anchor lineage
+The anchors features steered toward (keeps new work coherent).
+
+## Anti-slop — project exceptions
+Banned defaults this project *intentionally* uses, with the why (so build/polish don't undo them).
+```
+
+## NEVER (design memory)
+- Never roll up unattended on first creation — a new persistent project artifact is a
+  confirmed step, never an AFK silent write.
+- Never write an entry the feature didn't *prove* shipped — no aspirational tokens.
+- Never overwrite or silently reconcile a conflicting existing entry — surface it.
+- Never persist a feature-only one-off as if it were the project default.
+- Never add `DESIGN.md` to the commit without appending it to `touched-files.md` first
+  (it would fall outside the ship's commit scope).

package/pack/.claude/skills/rite-ship/reference/git-ship.md

@@ -0,0 +1,42 @@
+# The irreversible ship — type-GO + git ladder
+
+`/rite-ship` is the only DevRites phase that runs actions that cannot be undone
+silently. The seal verdict authorizes the *decision*; this prompt authorizes the
+*action*.
+
+## The type-GO prompt (render verbatim, wait)
+
+```
+About to: <git commit + git push [+ git tag vX.Y.Z | open PR]>
+Feature:  <slug>
+Verdict:  GO  (seal.md)
+Acceptance criteria proven: <n / total>
+Branch:   <target branch>
+
+Type "GO" exactly to proceed. Anything else cancels.
+```
+
+Rules for the prompt:
+- Render it **every time**, even with auto-trigger enabled — this is the last net.
+- Only the literal string `GO` (no quotes) proceeds. `y`, `yes`, `go` (lowercase),
+  `ok`, `sure`, `do it`, or anything else → cancel, record the cancel in `ship.md`
+  as "user declined irreversible step at <ts>", and stop.
+- `/rite-autocomplete --ship` (or `--yolo`) is the *only* caller permitted to satisfy
+  this prompt automatically. Every other path requires the human's literal `GO`.
+
+## The git ladder
+
+Follow `.claude/rules/git-workflow.md` and the project's own convention. Do not invent
+a release flow the project doesn't use.
+
+1. **Stage** only the files in `touched-files.md`. Never `git add -A`; never stage
+   secrets, `.env`, or out-of-scope files (see the never-commit list in `git-workflow.md`).
+2. **Commit** with a Conventional Commit message derived from the feature (`feat(scope):
+   …` / `fix(scope): …`). Atomic — one logical change. Put the *why* in the body.
+3. **Push** to the target branch (the feature branch, or per the project's trunk
+   convention).
+4. **Tag / PR** only if the project does it: cut a tag when the project tags releases,
+   or open a PR when the project reviews via PRs. Otherwise skip — pushing the branch
+   is the ship.
+
+Capture the resulting commit SHA(s), branch, and tag/PR URL for `ship.md`.

package/pack/.claude/skills/rite-ship/reference/ship-template.md

@@ -0,0 +1,33 @@
+# `ship.md` template
+
+The durable record of what shipped and how. Written by `/rite-ship` into the
+workspace **before** close-out, so it travels into `.devrites/archive/<slug>/ship.md`.
+
+```markdown
+# Ship: <slug>
+
+- Shipped at: <iso>
+- Verdict: GO (see seal.md)
+- Branch: <branch>
+- Commit(s): <sha> [<sha> …]
+- Tag / PR: <vX.Y.Z | PR url | none>
+
+## What shipped
+<one-paragraph summary of the feature delivered, in the project's vocabulary>
+
+## Acceptance
+- Criteria proven: <n / total>   (full walk in evidence.md / seal.md)
+- Outstanding (shipped with known follow-ups): <list | none>
+
+## Evidence pointers
+- seal.md — final GO/NO-GO verdict + reviewer reconciliation
+- evidence.md — acceptance walk; browser-evidence.md (if UI)
+- review.md — multi-axis review findings
+
+## Follow-ups (FYI, not blocking)
+- <recorded follow-up + where it's tracked> | none
+```
+
+Keep it short — it points at the existing audit files rather than restating them.
+The acceptance count must match `seal.md`; if they disagree, the seal is the source of
+truth and the ship should not have proceeded.

package/pack/.claude/skills/rite-spec/SKILL.md

@@ -0,0 +1,126 @@
+---
+name: rite-spec
+description: Investigate a new feature and write `spec.md` (placement, gaps, design refs, measurable acceptance) under `.devrites/work/<slug>/`. Use when the user says "new feature", "spec this out", "start a project", "I have an idea". Not for planning approved specs (use `/rite-define`) or replanning (use `/rite-plan`).
+argument-hint: "<feature or idea>"
+user-invocable: true
+---
+
+# /rite-spec — investigate deeply, write the spec
+
+The spec phase. Turn a request (even a vague one) into a **fully-covered, correctly-placed
+`spec.md`** by investigating deeply and closing every material gap with the human — so
+`/rite-define` can plan it and nothing is missed. **No plan, tasks, or code here** — those
+are `/rite-define` and `/rite-build`.
+
+> **Too small to spec? Use `/rite-quick`.** A typo, copy tweak, config bump, or one-function
+> fix does **not** need a full workspace + lifecycle. Stop and run `/rite-quick <change>` — its
+> express lane (one contract → TDD build → scoped prove → ship) escalates back here the moment
+> the change turns out to touch auth / data / a migration / a public API / more than one slice.
+> Spec is for real features; don't pay its ceremony for a one-off.
+
+## Rules consulted (read on demand from `.claude/rules/`)
+**Step 0:** Read `.claude/rules/core.md` first. DevRites skills Read `.claude/rules/core.md`
+as their first step; the other rule files load on demand. Pull `documentation.md` via `Read`
+when capturing significant spec decisions (why-not-what, ADR-style notes in `decisions.md`).
+
+## Operating rules (DevRites core)
+- No silent assumptions · no guessing through confusion · prefer existing conventions ·
+  ask the human when an answer changes scope, placement, data model, UX, security,
+  migration risk, or acceptance.
+
+## Workflow
+0. **Read `.claude/rules/core.md`** — the always-on operating rules and anti-rationalizations.
+   Then **run the shared orientation preamble** — it prints `state.md`, the artifacts present,
+   the run mode (HITL/AFK), and the open-question tally by gate, so you orient deterministically
+   instead of re-deriving state from raw Markdown:
+   ```bash
+   P=.claude/skills/devrites-lib/scripts/preamble.sh
+   [ -f "$P" ] || P="${CLAUDE_SKILL_DIR:-}/../devrites-lib/scripts/preamble.sh"
+   [ -f "$P" ] || P=pack/.claude/skills/devrites-lib/scripts/preamble.sh
+   [ -f "$P" ] && bash "$P" || echo "(orientation preamble unavailable on this install — read state.md directly to orient)"
+   ```
+1. **Understand the request** (`$ARGUMENTS`). Restate the goal and the *real problem
+   behind it* in a sentence or two.
+2. **Investigate deeply** — [investigation](reference/investigation.md). Produce, and
+   later write into the spec: **current behavior**; **placement** (which module/layer/
+   file/component should own it, the seam, patterns to reuse, and integration points —
+   callers, dependents, data, APIs/events); **what it resolves**; **issues**
+   (conflicts/constraints); **gaps** (unknowns); **blast radius**. Use a code-intelligence
+   index **if available** — `codebase-memory-mcp` first, cross-checked with `codegraph`
+   (`.codegraph/` / `codegraph_*`) + `graphify` (`graphify-out/`), else standard methods
+   (LSP / `Read`/`Grep`/`Glob`); see `.claude/rules/tooling.md` —
+   for placement/callers/impact instead of broad file reads; fall back to reading files. For
+   uncertain external library/framework facts that bear on placement or feasibility, consult
+   context7 if available.
+   Also discover the project's **test / build/typecheck/lint** commands and the
+   frontend/backend systems; read `PRODUCT.md` / `DESIGN.md` / `CLAUDE.md` / `AGENTS.md` if
+   present (`AGENTS.md` is the cross-tool agent-conventions standard — treat it as project
+   conventions the build must follow, same standing as `CLAUDE.md`).
+3. **Gather design references (optional)** — [references-intake](reference/references-intake.md).
+   The human **may** attach screenshots, mockups, a Figma link, a video, or links — or
+   **none at all** (perfectly normal; skip this step then). If any are given: **view/fetch**
+   them, **save local files** into `.devrites/work/<slug>/references/`, and index them in
+   `references.md`. They become the target later phases verify against.
+3a. **Shape the UX/UI before code (if the feature touches UI)** — when this feature is
+   frontend ([frontend-trigger](../rite-build/reference/frontend-trigger.md)), apply
+   `devrites-ux-shape` **now**, woven into the spec — not as a separate phase. It turns the
+   references + the spec into a feature-level **`design-brief.md`** (design direction, key
+   states, interaction model, optional Figma/image visual-direction probe) that `/rite-build`
+   targets so the UI is built to plan, not guessed. In HITL it pauses for the human to
+   confirm the direction; in AFK it asserts the best guess and logs it. Pure
+   backend/data/CLI features skip this.
+4. **Close the gaps with the human.** Turn each material gap/issue into a question — one
+   at a time, **best guess attached**, structured options + escape hatch. (Vague ask →
+   `devrites-interview`; rough idea → `rite-pressure-test`; ladders in
+   [interview-patterns](reference/interview-patterns.md) / [question-protocol](reference/question-protocol.md).)
+   For a vague ask, **map the decision tree** and resolve each branch depth-first; **cover
+   every dimension** (objective · scope · data model · UX · integration · non-functional ·
+   acceptance) — resolved or explicitly deferred — and **stop when answers converge** or you
+   can predict them (don't interrogate). Aim for **zero blocking gaps**. *If a gap is genuinely undecidable on paper (state
+   machine that may deadlock, data shape ambiguity, "which UX wins") → suggest a
+   scoped detour to `/rite-prototype` to answer that ONE question before
+   continuing.*
+5. **Create the workspace** + set `.devrites/ACTIVE`
+   ([state-workspace](reference/state-workspace.md)). Write `spec.md`
+   ([spec-template](reference/spec-template.md)) — WHAT/WHY, technology-agnostic, with
+   **Placement & integration**, **Design references**, **Gaps/issues/decisions**, and
+   measurable acceptance ([acceptance-criteria](reference/acceptance-criteria.md)). Also
+   write `brief.md`, `references.md`, `questions.md`, `decisions.md`, `assumptions.md`,
+   and an initial `state.md` (phase: spec). When the feature touches UI, `design-brief.md`
+   is written here too (by `devrites-ux-shape`, step 3a).
+5a. **Score the spec prose — "unit tests for English"** ([spec-checklists](reference/spec-checklists.md)).
+   Emit `.devrites/work/<slug>/checklists/<domain>.md` (one per requirement domain the spec covers:
+   functional · data-model · interaction · non-functional · edge-cases). Each tests the *requirement
+   prose* for completeness / clarity / measurability — "is 'prominent' quantified?", "is every
+   enumeration closed?" — **not** the implementation. Fix each CRITICAL fail by editing the spec
+   (not by softening the question); minor fails are logged. The checklists feed the readiness gate.
+6. **Run the spec readiness gate** (bottom of spec-template): no blocking
+   `[NEEDS CLARIFICATION]`, placement decided, all material gaps resolved, any design
+   references provided are saved, **UX/UI shaped into `design-brief.md` if the feature is
+   UI**, requirements testable, success criteria measurable, **every `checklists/<domain>.md` at
+   `Verdict: pass`**. When it passes, write `Spec gate: passed <iso>` to `state.md`. **Stop** when
+   it passes.
+
+> **Mid-flight discipline.** When tempted to skip investigation depth, gap-closing, or placement decisions — see [`anti-patterns`](reference/anti-patterns.md) (Common Rationalizations + Red Flags). Load it the moment you reach for the excuse.
+
+## Output
+
+**Footer first** — render the slice meter + flow ribbon by running the progress footer (`progress.sh`, resolved like the step-0 preamble — canonical snippet in `devrites-lib/SKILL.md`); keep the fact lines below it terse (`key value · key value`). Then:
+```
+Spec ready: <slug>
+Objective: <one sentence>   Placement: <where it lives>
+Resolves: <value>
+References: <n saved | none provided>
+Design brief: <design-brief.md shaped (compact|full) | n/a — not UI>
+Gaps closed: <n>   Open (non-blocking): <n>
+Checklists: <n domains scored — all pass | BLOCKED: n CRITICAL open>
+Next: big / risky feature (auth · data model · public API · migration · multi-slice · ambiguous scope)?
+      → /rite-temper   (strategic review: scope mode + pre-mortem, hardens the spec) — then /rite-define.
+      Small / reversible / unambiguous? → /rite-define directly.
+↻ Hygiene: /clear before /rite-define (spec.md + references/ + decisions.md + assumptions.md + questions.md captured); /rite-handoff if away > a few hours. See rules/context-hygiene.md.
+```
+If a workspace with the slug already exists, update its spec rather than overwriting blindly —
+and **show the human a short diff of what changed** in `spec.md` (acceptance criteria added /
+removed / reworded) before proceeding. A spec edit reviewed as a diff catches silent scope
+drift that a full re-read buries; this is the spec-review view (`/rite-spec --review` renders
+just the diff + the open-question delta, no re-investigation).