devrites 1.19.0

package/pack/.claude/skills/rite-spec/reference/state-workspace.md

@@ -0,0 +1,159 @@
+# `.devrites/` state workspace — canonical format
+
+The shared state contract for **all** DevRites skills. Every phase reads the active
+workspace first; if none exists, it stops and tells the user to run `/rite-spec <feature>`
+(which creates it).
+
+## Layout
+```
+.devrites/
+  README.md                       # what this dir is (seeded at install)
+  ACTIVE                          # single line: active feature slug, or empty
+  work/
+    <feature-slug>/
+      brief.md                    # short user-facing objective
+      spec.md                     # what to build + why (from /rite-spec)
+      references/                 # saved design/reference assets (screenshots, exports, video)
+      references.md               # index of design references (saved files + links)
+      strategy.md                 # strategic review: scope mode + pre-mortem + dimension scores (from /rite-temper; optional — always invoked, significance-gated, in /rite-autocomplete)
+      plan.md                     # how to build it (from /rite-define)
+      tasks.md                    # ordered vertical slices (from /rite-define)
+      eng-review.md               # engineering plan review: scope challenge + axis findings + failure modes + parallelization (from /rite-vet — run on every plan; depth scales light/full, never skipped; always in /rite-autocomplete)
+      test-plan.md                # build-readable coverage target: coverage diagram + per-gap test requirements + acceptance→test map (from /rite-vet; read by /rite-build + /rite-prove)
+      state.md                    # phase, active slice, risk, next step
+      questions.md                # asked questions + answers
+      decisions.md                # decisions + rationale (+ a `## Dead ends` section: approaches tried that failed + why, so retries don't repeat them)
+      assumptions.md              # explicit assumptions still standing
+      drift.md                    # spec/plan drift observations + resolutions
+      touched-files.md            # files changed or intentionally inspected
+      evidence.md                 # commands run + results
+      browser-evidence.md         # screenshots, routes, console, viewport checks
+      design-brief.md             # UX/UI contract — if UI involved (from /rite-spec via devrites-ux-shape; refined per slice in /rite-build)
+      polish-report.md            # normalize+polish output
+      review.md                   # review findings + decisions
+      seal.md                     # final GO / NO-GO decision (from /rite-seal)
+      ship.md                     # ship record: commit/tag, acceptance, follow-ups (from /rite-ship)
+      handoff.md                  # human/next-agent-facing handoff summary (overwritten each handoff)
+  archive/
+    <feature-slug>/               # closed features (moved here by /rite-ship close-out; all .md preserved)
+```
+
+## Rules
+- **Slug**: kebab-case, derived from the objective (`add-csv-export`, not `feature1`).
+- All artifacts are **human-readable Markdown** — they must survive context compaction
+  and a fresh session. (`references/` also holds binary assets the human supplied.)
+- **`/rite-spec` creates the workspace** and writes `spec.md` (+ `references/`,
+  `references.md`, `brief.md`, `questions.md`, `decisions.md`, `assumptions.md`; **plus
+  `design-brief.md` when the feature touches UI**, via `devrites-ux-shape`) and sets
+  `ACTIVE`. **`/rite-define` reads `spec.md`** and adds `plan.md` + `tasks.md` and updates
+  `state.md`. Other skills read the active workspace; none create a new one.
+- Each phase **updates `state.md`** and the relevant evidence files.
+- Don't create `strategy.md` / `eng-review.md` / `test-plan.md` / `evidence.md` /
+  `browser-evidence.md` / `design-brief.md` / `polish-report.md` / `review.md` / `seal.md` /
+  `ship.md` / `handoff.md` until the producing phase runs — absence is meaningful (it means
+  "not done yet"). `strategy.md` is written by `/rite-temper` (which may also edit `spec.md` /
+  `decisions.md` / `assumptions.md` via the Spec Drift Guard); its absence means the spec was
+  planned without a strategic review. `eng-review.md` + `test-plan.md` are written by `/rite-vet`
+  (which also hardens `plan.md` / `tasks.md`, and routes acceptance-changing deltas via the Spec
+  Drift Guard); their absence means the plan was built without an engineering review. `handoff.md`
+  is written by `/rite-handoff` and overwritten each handoff (latest snapshot, not a log).
+- **`/rite-ship` closes the feature**: it writes `ship.md`, sets `state.md` phase `done`,
+  then archives `.devrites/work/<slug>/` → `.devrites/archive/<slug>/` (every `.md`
+  preserved) and clears `.devrites/ACTIVE`. Closing **relocates** the audit trail; it
+  never deletes it. Re-open by moving the dir back and re-pointing `ACTIVE`.
+
+## `state.md` template
+```markdown
+# State: <slug>
+
+- Phase: spec | temper | plan | vet | build | prove | polish | review | seal | ship | done   # `temper` (pre-plan) + `vet` (post-plan, pre-build) only when those optional reviews ran; spec→plan→build directly otherwise
+- Status: running | awaiting_human | blocked | done
+- Active slice: <N — name> | none
+- Slice mode: AFK | HITL | none
+- Spec gate: passed <iso> | none                    # optional — set when the spec readiness gate passes
+- Plan approved: <iso> | none                       # optional — /rite-define sets it when the human confirms the plan
+- AFK slices remaining: <n> | none                  # mutable counter; initialized from .devrites/AFK max_slices on first AFK build
+- Risk: <highest current risk> | none
+- Next step: <single recommended command + why>
+
+## Awaiting human   (only when Status == awaiting_human)
+- qid: <q-YYYY-MM-DD-NNN>
+- gate: advisory | validating | blocking | escalating
+- question: <crisp text>
+- proposed: <agent's tentative answer>
+- raised_at: <iso>
+- blocking_slices: [<slice ids that cannot advance until answered>]
+
+## Slice progress
+- [ ] Slice 1: <name> — <pending|built>
+- [ ] Slice 2: ...
+
+## Log
+- <date> <phase>: <one line of what happened>
+```
+
+A slice is only ever `pending` or `built`. Acceptance proof lives at the **feature**
+level in `evidence.md` (recorded by `/rite-prove`), not per slice — there is no per-slice
+`proven` / `done` state.
+
+## `.devrites/AFK` sentinel (AFK mode toggle)
+
+Presence of the file `.devrites/AFK` puts DevRites into **AFK mode**: skills that would
+normally pause for the user instead log to `questions.md` (when the gate severity allows
+it — see [`.claude/rules/afk-hitl.md`](../../../rules/afk-hitl.md)) and continue.
+`.devrites/AFK` presence is the **single source of truth** for run mode (the shared preamble
+derives it); skills re-read the sentinel at decision time rather than trusting a mirrored
+`state.md` field. The file content is optional YAML configuring loop discipline:
+
+```yaml
+# .devrites/AFK — presence = AFK mode active. All keys optional.
+max_slices: 10                       # read-only INITIAL budget; the mutable remaining count lives in state.md
+notify: "ntfy.sh/my-topic"           # shell command run on awaiting_human transition; see afk-discipline.md for the env table
+allow_gates: [advisory, validating]  # gate severities AFK may auto-handle; everything else pauses
+```
+
+`max_slices` is **read-only config** — never rewritten in place. The mutable remaining
+count lives in `state.md` as `AFK slices remaining: <n>`, initialized from `max_slices` on
+the first AFK build and decremented per built slice (the cap is enforced by
+`tick-afk.sh`, not by prose).
+
+Absent or empty file = AFK active with defaults (`max_slices: unlimited`, no `notify`,
+`allow_gates: [advisory]`). **Destructive migrations, auth/authz boundary changes, and
+public-API breaks always pause regardless of `allow_gates`** — AFK never silently accepts
+irreversible risk.
+
+## `questions.md` entry format
+
+`questions.md` is append-only. Each entry:
+
+```markdown
+## q-2026-05-28-001
+status: open | answered | dropped
+slice: 03-list-endpoint              # which slice raised it (or "spec" / "plan")
+gate: advisory | validating | blocking | escalating
+question: <one crisp sentence the human can answer>
+options: |                           # ranked option set, recommended FIRST
+  1. <recommended> (Recommended) — <dimension-tagged rationale + trade-off>
+  2. <alternative> — <rationale + trade-off>
+  3. Something else — describe it
+proposed: <the recommended option restated — the HITL default + AFK auto-pick>
+raised_at: 2026-05-28T17:30:00Z
+answered_at: <iso when status flips to answered>
+answer: <chosen option / human's reply, verbatim>
+supersedes: <q-... if this replaces an answered entry, else omit>
+```
+
+Canonical schema + rules (gate taxonomy, option-set contract): [`.claude/rules/afk-hitl.md`](../../../rules/afk-hitl.md).
+`/rite-resolve <qid> "<answer>"` is the canonical mutator — manual edits work but the
+skill keeps `state.md` and `questions.md` consistent.
+
+## `brief.md` template
+```markdown
+# <Feature>
+Objective: <one sentence — what and for whom>
+Why now: <one line>
+Definition of done: <one line>
+```
+
+`decisions.md`, `assumptions.md`, `questions.md`, `drift.md`, `touched-files.md` are
+append-only running logs — date-stamped bullet entries.

package/pack/.claude/skills/rite-status/SKILL.md

@@ -0,0 +1,101 @@
+---
+name: rite-status
+description: Read-only report on the active feature — phase, active slice, next action, evidence, open questions, drift, risks, handoff readiness. Use when the user says "where am I", "what's next", "status", "is this ready to ship", "show the active feature". Not for invoking phases or for the menu (use `/rite`).
+argument-hint: "[feature-slug]"
+user-invocable: true
+disable-model-invocation: true
+---
+
+# /rite-status — active feature status
+
+Read-only. Report where the active feature stands. **Do not run any phase.**
+
+## Load state
+
+Run this snippet (the shared DevRites preamble — one canonical command that
+resolves the install layouts: installed `.claude/` → plugin via `${CLAUDE_SKILL_DIR}`
+→ repo `pack/`, with a graceful fallback to reading `state.md`; default slug =
+`.devrites/ACTIVE`):
+
+```bash
+P=.claude/skills/devrites-lib/scripts/preamble.sh
+[ -f "$P" ] || P="${CLAUDE_SKILL_DIR:-}/../devrites-lib/scripts/preamble.sh"
+[ -f "$P" ] || P=pack/.claude/skills/devrites-lib/scripts/preamble.sh
+[ -f "$P" ] && bash "$P" [feature-slug] || echo "(orientation preamble unavailable on this install — read state.md directly to orient)"
+```
+
+The preamble prints the active workspace's `state.md` and the list of artifacts
+present. The `!`-prefix dynamic-context-injection idiom is **not** used here so
+the skill stays portable across harnesses; the script is the cross-harness
+mechanism.
+
+## What to output
+
+If no workspace: tell the user to run `/rite-spec <feature>` to start. Stop.
+
+Otherwise summarize from the loaded state, concisely:
+
+1. **Feature** + one-line objective (from `brief.md`).
+2. **Phase**, **active slice** + its slice mode (from `state.md`). **Run mode**
+   (`afk` / `hitl`) is derived from `.devrites/AFK` presence (the preamble
+   already does this), not from a `state.md` field — present = `afk`, absent = `hitl`.
+3. **Status** — `running` / `awaiting_human` / `blocked` / `done`. If
+   `awaiting_human`, render the `Awaiting human` block from `state.md` (qid, gate,
+   question, proposed, raised_at, blocking_slices) and instruct
+   `/rite-resolve <qid> "<answer>"`.
+4. **Next action** — the single recommended next command.
+5. **Evidence** — what's proven vs unproven (from `evidence.md` /
+   `browser-evidence.md`).
+6. **Open questions** — count by gate (from `questions.md`:
+   `n open: x blocking · y validating · z advisory`) + the blocking qids by id and one-line question.
+7. **Unresolved drift** (`drift.md`).
+8. **Risks** (from `state.md` / `spec.md`).
+9. **Ready for handoff?** — see section below.
+
+Flag anything blocking: unresolved drift, failing evidence, `Status: awaiting_human`,
+or open questions that change product behavior. End with the recommended next command
+and nothing else.
+
+## Ready for handoff?
+
+After the summary items (1–8), render the handoff readiness section (item 9 above) last —
+the canonical output order is: progress footer → summary items 1–8 → handoff readiness.
+A fresh agent
+or a future session should be able to pick the work up from the workspace
+**alone**, with zero chat context. Check:
+
+- [ ] `state.md` has a **single** next-action command (not a list of options).
+- [ ] `questions.md` lists every unresolved question raised in this or any
+      prior session.
+- [ ] `decisions.md` records the rationale for any non-obvious choice
+      ("why this, not the obvious alternative").
+- [ ] `assumptions.md` lists every load-bearing assumption that wasn't
+      confirmed by code or by the user.
+- [ ] `drift.md` shows current resolution status for every drift event
+      (open / asked-user / repaired).
+- [ ] `evidence.md` is current for the active phase (no claims without
+      recorded commands + output).
+
+If any item above fails, suggest `/rite-handoff` to compact chat-only
+context into the workspace before the session ends.
+
+## Gotchas
+- Read-only — never advance a phase or write to the workspace; that's the phase skills' job.
+- Report from the `.devrites/` files, not chat memory (it's gone after `/clear`).
+- Give the single next command, not a menu of options — an ambiguous next-action fails the handoff check.
+
+## Output format
+
+**Footer first** — `/rite-status` *is* the status meter: render it by running the progress footer (`progress.sh`, resolved like the step-0 preamble — canonical snippet in `devrites-lib/SKILL.md`). The slice meter + flow ribbon answer "where am I / how much is left". Then the handoff-readiness check:
+```
+Ready for handoff: yes / partial (n gaps) / no
+
+Gaps (if any):
+- state.md "next action" lists 2 options, not 1
+- 3 open questions raised in conversation not yet in questions.md
+- ...
+```
+
+If gaps exist, the recommended next command is to **persist them first** (see
+`.claude/rules/core.md` — "Persistence before stopping"). Only then
+move to the phase's next action.

package/pack/.claude/skills/rite-temper/SKILL.md

@@ -0,0 +1,119 @@
+---
+name: rite-temper
+description: Strategic review of a readied `spec.md` before planning — pick a scope mode (expand / selective / hold-rigor / reduce-to-MVP), run a pre-mortem, harden the spec, and fold decisions back via the Spec Drift Guard plus a persistent `strategy.md`. Use when the user says "temper this", "strategy review", "think bigger", "scope check", "pre-mortem the spec", "are we over/under-building", or before defining a big or risky feature. Not for a rough idea (`/rite-pressure-test`), a mid-build decision (`devrites-doubt`), a code diff (`/rite-review`), or the final gate (`/rite-seal`).
+argument-hint: "[feature-slug] [--mode expand|selective|hold|reduce]"
+user-invocable: true
+---
+
+# /rite-temper — temper the spec before you plan
+
+Take a readied spec and **temper** it: heat it (raise ambition on the *outcome*), then
+quench it (pre-mortem + prune the *solution surface*) — stronger and less brittle. The one
+DevRites step that decides scope/ambition on a written spec and folds the result into the
+canonical contract, so `/rite-define` plans the **hardened** spec. Optional for small work
+(significance-gated — auto-skips low-stakes specs), but always invoked inside
+`/rite-autocomplete`. **Read the active workspace first**; if there's no readied
+`spec.md`, tell the user to run `/rite-spec`.
+
+## Rules consulted (read on demand from `.claude/rules/`)
+**Step 0:** Read `.claude/rules/core.md` first. Pull on demand: `patterns.md` +
+`coding-style.md` (the over-engineering / YAGNI rubric — reuse the pack's standard, don't
+invent one), `documentation.md` (ADR-style `decisions.md` entries), `afk-hitl.md`
+(irreversible-risk list + gate ceiling).
+
+## Operating rules
+- **Ambition on outcomes, minimalism on the surface.** Raise the success bar and solve the
+  *real* problem; never add speculative capability/abstraction. The reconciliation hinge —
+  bigger ambition, smaller surface.
+- **Every scope change routes through the Spec Drift Guard** — it only becomes real by being
+  written into `spec.md` as a recorded, confirmable decision. Expansion is **opt-in** (HITL
+  confirm; AFK pauses — see autocomplete policy). Nothing auto-grows into the build.
+- **Bound ambition by reversibility.** Auth / migration / public-API / data-model touches get
+  the *opposite* of ambition — maximum conservatism; they always pause (irreversible-risk list).
+- **Honest verdict.** Never round "needs work" up to "ready"; record every scope call's *why*.
+- **You write; the reviewer judges.** You are the single canonical writer (`strategy.md` +
+  the spec edits); the reviewer agent is read-only.
+- **Demand the spec-quality checklists for big features.** `/rite-temper` only fires on
+  significant specs — exactly where vague requirement prose is most expensive. Before hardening,
+  confirm `checklists/<domain>.md` exist and pass (`rite-spec/reference/spec-checklists.md`); a
+  scope expansion you fold in **adds its own** rows (new Success/Acceptance criteria get
+  "unit-tested for English" too). A folded expansion with an unquantified criterion is a CRITICAL
+  fail that re-opens the readiness gate.
+
+## Workflow
+0. **Read `.claude/rules/core.md`**. Then **run the shared orientation preamble** — it prints `state.md`, the artifacts present,
+   the run mode (HITL/AFK), and the open-question tally by gate, so you orient deterministically
+   instead of re-deriving state from raw Markdown:
+   ```bash
+   P=.claude/skills/devrites-lib/scripts/preamble.sh
+   [ -f "$P" ] || P="${CLAUDE_SKILL_DIR:-}/../devrites-lib/scripts/preamble.sh"
+   [ -f "$P" ] || P=pack/.claude/skills/devrites-lib/scripts/preamble.sh
+   [ -f "$P" ] && bash "$P" || echo "(orientation preamble unavailable on this install — read state.md directly to orient)"
+   ```
+   Then read the workspace: `spec.md` (+ `decisions.md`,
+   `assumptions.md`, `design-brief.md` if UI), `state.md`. Require `Spec gate: passed` — else
+   STOP → `/rite-spec`. If a plan already exists, scope changes route through `/rite-plan
+   repair` (record in `drift.md`), not a blind spec edit.
+1. **Significance test** — [`reference/significance.md`](reference/significance.md). Low-stakes
+   / shape-not-meaning work → write the one-line `skipped — low stakes (<trigger>)` verdict to `strategy.md`,
+   set `state.md` `Next step: /rite-define`, and recommend it. Otherwise fire the full pass below.
+2. **FORWARD pass + mode selection** — [`reference/scope-modes.md`](reference/scope-modes.md).
+   Diverge on the *outcome* (the 10-star version of the real problem), then commit **exactly
+   one** scope mode (`expand` opt-in · `selective` · `hold-rigor` · `reduce-to-MVP`) with its
+   rationale and the **hinge** (what would change the call). `$ARGUMENTS` `--mode` is a hint, not
+   a command.
+3. **INVERSION pass** — pre-mortem in past tense ("it shipped and failed — what went wrong"),
+   each top risk carrying likelihood + mitigation + the slice it will bind to; then the **YAGNI
+   ledger** (each candidate scope item gets the "imagine the later refactor" test; defer unless
+   now-cost is trivial AND deferred-cost is large).
+4. **Score the 9 dimensions** — [`reference/review-dimensions.md`](reference/review-dimensions.md).
+   Cite evidence *before* the band; **gate on the floor** (the weakest dimension, not an average).
+5. **Walk the findings WITH the human — do not batch-dump.** The artifact is the *output* of an
+   interactive review, not a substitute for it: surface each material scope call / finding via
+   `AskUserQuestion`, one at a time, best-guess + **why**. Each material scope call ends as a
+   **recorded decision** — a resolved `questions.md` qid (HITL) or a `decisions.md` ADR (AFK) —
+   so the walk leaves an auditable trail, not just chat. (AFK gate policy is single-sourced in
+   [`reference/significance.md`](reference/significance.md): `hold-rigor` + `reduce-to-MVP`
+   auto-apply, **any `expand` is a blocking pause**, irreversible-risk always pauses.)
+6. **Write `strategy.md` + fold back** — [`reference/strategy-template.md`](reference/strategy-template.md).
+   **One drift rule (decide by whether a plan exists):** *no `plan.md` yet* (the normal pre-define
+   case) → update `spec.md` **through the Spec Drift Guard** — *Success criteria* **and**
+   *Acceptance criteria* for each opt-in expansion / cut, **Non-goals** for every deferred item,
+   *Constraints* **and** *Risks* the pre-mortem demands, and the gaps/decisions table; *`plan.md`
+   already exists* → do **not** edit `spec.md` here — write the deltas to `drift.md` and hand off
+   to `/rite-plan repair`. Either way, append `decisions.md` (one ADR per scope call: context ·
+   decision · why-not · what-would-change-it) and `assumptions.md` (every "we'll probably need X" →
+   assumption-to-verify). **Every scope delta must carry a recorded human decision** — a resolved
+   `questions.md` qid (HITL) or a `decisions.md` ADR (AFK within the ceiling); a folded change with
+   no recorded decision is the batch-dump failure. **Re-check the spec Readiness gate** (it fails if
+   any folded scope delta lacks its decision). Update `state.md`: `Phase: temper`,
+   `Next step: /rite-define`; on a blocking pause (expand / irreversible / a dimension still below
+   bar) write the `Awaiting human` block + `Status: awaiting_human` before stopping.
+7. **Adversarial verification loop** — dispatch [`devrites-strategy-reviewer`](../../agents/devrites-strategy-reviewer.md)
+   (fresh context, **only** the hardened spec + the rubric — no authoring reasoning). Resolve
+   actionable findings by editing `spec.md`/`strategy.md`, re-dispatch; **cap ≤3 iterations**. A
+   dimension still below bar after 3 → blocking question (HITL) or AFK gate-ceiling entry;
+   irreversible-risk findings always pause. If sub-agents are unavailable, do the independent
+   rubric pass yourself in a separate read, discarding the authoring reasoning (a flagged
+   fallback, not an independent review).
+8. **STOP.** Report the mode, the scope deltas, and the floor verdict; recommend `/rite-define`.
+
+> **Mid-flight discipline.** When tempted to dump findings into `strategy.md` and skip the
+> walk-through, expand the surface (not the outcome), grow scope without the Drift Guard, or
+> score before citing evidence — see [`reference/anti-patterns.md`](reference/anti-patterns.md).
+
+## Output
+
+**Footer first** — render the slice meter + flow ribbon by running the progress footer (`progress.sh`, resolved like the step-0 preamble — canonical snippet in `devrites-lib/SKILL.md`); keep the fact lines below it terse (`key value · key value`). Then:
+```
+Tempered: <slug>
+Significance: full | skipped — low stakes (<trigger>)
+Mode: <expand|selective|hold-rigor|reduce-to-MVP> — <one-line rationale> (hinge: <what would change it>)
+Scope: +<n expanded> / -<n reduced> / <n deferred to Non-goals>   (all via Spec Drift Guard)
+Pre-mortem: <n top risks> mitigated → bound to slices
+Dimensions: floor = <strong|adequate|thin|broken> on <weakest dimension>   Reviewer loop: <n> iter
+Spec readiness: re-checked → passes | <blocker>
+Next: /rite-define   (plans the hardened spec)
+↻ Hygiene: /clear before /rite-define (strategy.md + spec edits + decisions.md + assumptions.md captured). See rules/context-hygiene.md.
+```
+**DO NOT plan, slice, or write code here** — that's `/rite-define` and `/rite-build`.

package/pack/.claude/skills/rite-temper/reference/anti-patterns.md

@@ -0,0 +1,29 @@
+# /rite-temper — anti-patterns
+
+Universal rationalizations + red flags live in
+[`../../../rules/anti-patterns.md`](../../../rules/anti-patterns.md) — read it when the
+reluctance is broader than this phase. Below are the temper-specific ones.
+
+## Phase rationalizations
+
+| Excuse | Rebuttal |
+|---|---|
+| "I'll write all the findings into `strategy.md` and let the user read it." | The artifact is the *output* of an interactive review, not a substitute for it. A finding's path to "done" goes **through `AskUserQuestion`**, one at a time, with a recommendation + why. Dumping findings into one write and moving on is the exact failure mode this skill exists to prevent. |
+| "Bigger is better — let's add the extra capability while we're thinking big." | Ambition belongs on the **outcome**, not the **solution surface**. A speculative capability/abstraction is gold plating. Expand the problem + acceptance; never the machinery. |
+| "The user obviously wants the ambitious version — I'll add it to the spec." | Expansion is **opt-in**, recorded, and confirmed (HITL) or paused (AFK). Adding acceptance the human didn't approve is silent scope growth — route it through the Spec Drift Guard or don't add it. |
+| "It's over-scoped, I'll just trim those criteria." | Reducing scope is **still a spec change**. Cut acceptance only as a recorded Spec-Drift-Guard decision, and park the rest in Non-goals with a revisit note — never a silent trim. |
+| "This dimension is weak but the others are strong — net it's fine." | The gate is the **floor**, not the average. A spec `broken` on risk does not pass because it's `strong` on clarity. |
+| "I can see it's adequate — I'll note the band, evidence is obvious." | Cite the evidence (the spec line or its absence) **before** the band. Score-first-justify-later is how a reviewer rationalizes a spec it already likes. |
+| "It's a strategy doc, the implementation concerns don't apply yet." | Cross-cutting concerns (security/data/observability/modifiability) are where strategy breaks down. Address each or mark it explicitly N/A — silent omission is a gap. |
+| "This greenfield design is elegant." | Elegant for a codebase that doesn't exist. Ground ambition in the real seams + blast radius; flag a new dependency / second design system for an explicit decision. |
+
+## Red flags
+- `strategy.md` written but `spec.md` acceptance/Non-goals **not** updated — the build follows
+  the spec, so the review changed nothing.
+- An `expand` decision auto-applied in AFK (it must pause), or any irreversible-risk touch that
+  didn't pause.
+- A pre-mortem with risks listed but no mitigation + owning slice — a risk without an owner is a
+  wish.
+- The reviewer loop running past 3 iterations, or the reviewer being handed the author's
+  reasoning (defeats the fresh-context point).
+- The skill writing a `plan.md`, slicing, or touching code — that's `/rite-define` / `/rite-build`.

package/pack/.claude/skills/rite-temper/reference/review-dimensions.md

@@ -0,0 +1,65 @@
+# Review dimensions + the floor-gate rubric
+
+The spec is scored on nine dimensions. Each catches a *different* failure mode — strength in
+one never compensates for collapse in another, so the gate is the **floor**, not an average.
+
+## The nine dimensions
+1. **Problem altitude & ambition** — is this solving the *right* problem at the right altitude,
+   or timidly improving the obvious path / over-reaching past the real need? Here, *under-
+   reaching* on the outcome is a failure, not just over-building.
+2. **Scope honesty & boundary** — are Non-goals explicit? Is there a Minimum Usable Subset and a
+   clear IN/OUT line? Flags grab-bags and a missing "Won't-have-this-time".
+3. **Premise & alternatives** — are the load-bearing premises stated and challenged, and is at
+   least one genuinely different approach (different data model / flow / boundary) considered
+   with its trade-off? ("Alternatives considered" is one of the most valuable parts of a spec.)
+4. **Pre-mortem risk coverage** — run in prospective hindsight; each top risk carries likelihood
+   + mitigation + the slice that owns it. **Unmitigated top risks are gating.**
+5. **Over-engineering / YAGNI** — speculative capability, unused extension points, premature
+   abstraction, second-system bloat. Apply the pack's standard (`patterns.md`) + the "imagine
+   the later refactor" test. Defer unless now-cost is trivial AND deferred-cost is large.
+6. **Acceptance testability & done-ness** — every acceptance criterion measurable, technology-
+   agnostic, and comparable **down to a baseline** ("better than the current workaround"), not
+   up to an unbounded ideal. Vague adjectives ("fast/robust/intuitive") and "handles X
+   gracefully" are flagged.
+7. **Irreversibility & blast radius** — are auth / migration / public-API / data-model touches
+   treated with conservatism + rollback, and is the blast radius understood (from a
+   code-intelligence index if available)?
+8. **Cross-cutting coverage** — security/trust-boundary, data & migration, observability, and
+   modifiability each explicitly addressed **or explicitly N/A** — no silent omission.
+9. **Convention fit & placement realism** — does the ambition fit the codebase's existing seams
+   and patterns, or assume greenfield freedom a constrained space doesn't have? Prefer existing
+   conventions; flag a new dependency / second design system for explicit decision.
+
+UI specs additionally inherit `rite-polish/reference/anti-ai-slop.md` at the cross-cutting
+dimension (design-system fit, anti-AI-slop) — but `/rite-temper` reviews the *spec/design-brief*,
+not pixels; the built UI is judged later by `devrites-frontend-reviewer`.
+
+## The rubric — coarse bands, evidence first
+Score each dimension on a **labeled band**, never a 1-10 float or a composite number (labels do
+the work — matches the pack's severity-vocabulary stance):
+
+| Band | Meaning |
+|---|---|
+| **strong** | Addressed well; no action needed. |
+| **adequate** | Addressed; minor sharpening only (Suggestion/Nit). |
+| **thin** | Under-addressed; a real gap to close before planning (Important). |
+| **broken** | Missing or wrong in a way that will cost a redo (Critical). |
+
+**Cite evidence before the band** — name the spec line / absence that justifies it; never score
+first and rationalize after. Borderline dimensions may be sampled twice; take the **lower** band
+(don't average up).
+
+## The floor-gate
+- **Pass** only when every dimension is `adequate` or `strong` **and** no unmitigated top
+  pre-mortem risk remains. The verdict is the **weakest** dimension — a spec strong on clarity
+  but `broken` on risk does **not** pass.
+- Individual findings carry the pack's standard severity labels (**Critical / Important /
+  Suggestion / Nit / FYI**) so they compose with `/rite-review` and `/rite-seal`. `broken` →
+  Critical, `thin` → Important; **FYI is band-independent** — an observation on a `strong` /
+  `adequate` dimension, not a failing band.
+- **Don't double-count overlap.** Some dimensions key on the same evidence (e.g. #7
+  irreversibility & #9 convention-fit both touch codebase realism; #1 ambition & #2 scope both
+  touch over/under-reach). Don't fail two dimensions for the *same* root cause — cite the
+  evidence once, band it once, so one problem isn't laundered into two floor failures.
+- Below-bar dimension after the ≤3-iteration reviewer loop → blocking question (HITL) or AFK
+  gate-ceiling entry. Irreversible-risk findings always pause regardless of band.

package/pack/.claude/skills/rite-temper/reference/scope-modes.md

@@ -0,0 +1,53 @@
+# Scope modes + the two passes
+
+The heart of `/rite-temper`: two ordered passes (heat, then quench), converging on exactly
+one scope mode. Ambition is a **generative** move followed by a **required convergence** — the
+divergence is never the spec; the converged sweet spot is.
+
+## Pass 1 — FORWARD (heat: raise ambition on the outcome)
+Diverge on the *real problem*, not the obvious path. Ask:
+- What would an order-of-magnitude-better **outcome** look like (the 10-star version)? Design
+  the extreme, then come back to the feasible sweet spot — don't ship the extreme.
+- Is a **premise** load-bearing and wrong? Name the assumptions the spec rests on; challenge
+  the one that, if false, changes everything.
+- Where is **under-reaching** the real risk — a timid improvement to a path we should reframe?
+
+Ambition aims at the **outcome** (problem definition, success bar, user value) and at
+complexity-**neutral** future-proofing. It never aims at the **solution surface** (that's Pass 2's
+job to prune). Ground every ambitious idea in the codebase's real seams and blast radius (a code-intelligence
+index if available — see `../../../rules/tooling.md`) — don't invent greenfield scope a
+constrained codebase can't absorb.
+
+## Pass 2 — INVERSION (quench: pre-mortem + prune)
+Invert. Two subtractive moves:
+- **Pre-mortem (prospective hindsight).** State it in past tense: *"It's six months out. This
+  shipped and failed. What went wrong?"* List the top failure modes; for each: likelihood,
+  mitigation, and the slice that will own the mitigation. Unmitigated top risks are **gating**.
+- **YAGNI ledger.** Each candidate scope item gets the "imagine the later refactor" test: if
+  adding it *later* isn't materially more expensive, **defer it** (with a revisit note).
+  Bias hard toward defer — most presumed-needed features are never actually used. Reuse the
+  pack's existing standard — `patterns.md` ("no abstraction before two real callers",
+  "speculative generality") — don't invent a new YAGNI rule.
+
+## The four modes — commit exactly one
+Mode selection is the first convergence move. Record the chosen mode + rationale + the
+**hinge** (what would change the call) in `strategy.md` and `decisions.md`.
+
+| Mode | When | What it does | YAGNI / Drift Guard |
+|---|---|---|---|
+| **EXPAND** *(opt-in, default OFF)* | Under-reaching on the outcome is the real risk | Raise the success bar / reframe to the deeper problem; thinner-but-more-complete path to a bigger target | Expands the *problem + acceptance*, not machinery. Each added criterion is a Drift-Guard-recorded, human-confirmed (HITL) decision — never auto-grown |
+| **SELECTIVE** | One or two high-leverage dimensions deserve more; the rest is right | Expand only the high-upside dimension; hold the rest at spec scope | Each selected expansion routes through the Guard; everything not selected is parked in Non-goals so it's neither dropped nor re-injected mid-build |
+| **HOLD-RIGOR** | The spec is right-sized (default for irreversible-risk-heavy or already-tight specs) | No scope change — pure hardening: pre-mortem, risk mitigations, acceptance sharpening, cross-cutting coverage | Adds zero surface; trivially Drift-Guard-clean (no acceptance change) |
+| **REDUCE-TO-MVP** | Over-scoped: second-system bloat, ~all must-haves, gold-plating | Hammer scope to the Minimum Usable Subset; move the rest to Non-goals with one-line reasons + revisit notes | Strongest YAGNI alignment. Cutting acceptance is **still a spec change** — record it via the Guard, never a silent trim |
+
+## Bound ambition by reversibility
+The bigger the bet, the more it must be reversible. Irreversible-risk areas (auth, migrations,
+public API, data model) get the **opposite** of ambition — maximum conservatism, explicit
+rollback, and they **always pause** regardless of mode (the `afk-hitl.md` irreversible-risk
+list is honored verbatim). Size big bets so that if the whole thing vanished tomorrow, you'd be
+fine.
+
+## Effort foresight (frame it now, not "later")
+While choosing scope, surface the late-stage questions early: *"What will surprise us at
+integration? What will we wish we'd planned for at polish/test time?"* Turn each into a
+constraint, a risk, or a deferred Non-goal **now** — not a "figure it out later".

package/pack/.claude/skills/rite-temper/reference/significance.md

@@ -0,0 +1,46 @@
+# Significance test — fire the full review, or skip it
+
+`/rite-temper` is **significance-gated**: full strategic rigor only when the work is big
+enough to earn it, a one-line skip otherwise. This is the shared definition used by both the
+optional `/rite-temper` path and the always-run (significance-gated) `/rite-autocomplete` step,
+so they agree on when it fires.
+
+A strategic review of a five-line, reversible change is theatre; a strategic review of an
+auth rewrite is the cheapest insurance you'll buy. Gate on stakes and shape, not uniformly.
+
+## Fire the FULL review when ANY trips
+- **Irreversible-risk contact** — the slice/spec touches anything on the `afk-hitl.md`
+  irreversible-risk list: destructive data migration, auth/authz boundary, public-API break,
+  external-service contract, filesystem destruction outside the workspace.
+- **Data model** — new/changed entities, relationships, or persistence shape.
+- **Cross-module blast radius** — the impact (from a code-intelligence index if available — see
+  `../../../rules/tooling.md` — or an honest estimate) crosses
+  module/service boundaries or has many dependents.
+- **Greenfield / ambiguous scope** — a new surface with no existing seam to follow, or a spec
+  whose "right size" is genuinely open (multiple defensible scopes).
+- **Multi-slice / multi-day** — the work decomposes into several slices (large enough that a
+  wrong scope call is expensive to unwind).
+- **The user asked** — "think bigger", "is this ambitious enough", "scope check", "pre-mortem",
+  an explicit `/rite-temper` invocation, or a chosen `--mode`. An explicit ask always fires.
+
+## Skip (low stakes) when ALL hold
+- Single-module, reversible, behavior-shaped-not-structural change.
+- No irreversible-risk contact; blast radius contained to the touched files.
+- Scope is unambiguous — there's one obvious right size and the spec already has it.
+
+On skip, **don't run the passes**. Write only the one-line verdict to `strategy.md`:
+
+```markdown
+# Strategy: <slug>
+Significance: skipped — low stakes (<the trigger that was NOT met, e.g. "single-module, reversible, scope unambiguous">)
+Next: /rite-define
+```
+
+Then recommend `/rite-define`. A skip is a *recorded* decision, not a silent omission — the
+seal can see the call was made deliberately.
+
+## In `/rite-autocomplete`
+Autocomplete runs the significance test every feature. On skip → straight to `/rite-define`
+(no pause). On fire → run the full review under the AFK gate ceiling: `hold-rigor` and
+`reduce-to-MVP` auto-apply (they never grow acceptance); **any `expand` is a blocking pause**;
+irreversible-risk findings always pause. Expansion is never auto-grown unattended.