devrites 2.6.0 → 3.0.0

package/pack/generated/codex/skills/rite-review/reference/nielsen-heuristics.md

@@ -0,0 +1,130 @@
+# Nielsen's 10 usability heuristics — DevRites scoring rubric
+
+A structured UX rubric for `$rite-review` when the feature touches UI. Score each
+heuristic on a **0–4** scale; the per-heuristic scores feed the UX axis of the
+multi-axis review and shape the severity labels on UX findings.
+
+**Score honestly.** 4 means *genuinely excellent* — not "good enough", not "no
+findings". 3 is "good with minor gaps". 2 is "partial — significant gaps". 0–1 is a
+Critical / Important.
+
+Heuristics are Jakob Nielsen's 10 (1994, refreshed 2020) — public usability canon,
+referenced by every serious design discipline.
+
+## 1. Visibility of system status
+Users know what's happening, when, and where.
+- Loading indicators on async operations.
+- Confirmation when actions complete (save, submit, delete).
+- Progress on multi-step flows.
+- Current location in nav (active state, breadcrumbs).
+- Inline form validation, not just on submit.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| No feedback. | Critical actions lack feedback. | Most actions have feedback; gaps. | Consistent feedback; minor lag/lateness. | Anticipates uncertainty; reassures throughout. |
+
+## 2. Match between system and the real world
+The UI speaks the user's language and follows real-world conventions.
+- Domain vocabulary the *user* shares — not the team's internal names.
+- Familiar metaphors where they help (cart, inbox, draft).
+- Information ordered the way the user thinks about it, not the way the DB stores it.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Jargon throughout. | Mostly internal vocabulary. | Mixed — some user terms, some internal. | Clear user terms; a couple of leaks. | Reads like the user's own words. |
+
+## 3. User control and freedom
+Easy escape, undo, and back-out from any state.
+- Cancel / close / back on every modal, route, and form.
+- Undo on destructive operations (delete, archive, reset).
+- No dead-end states ("Error — refresh the page" with no recovery).
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Users trapped in states. | Limited escape on key flows. | Most flows reversible; gaps on destructive ops. | Good escape + undo on most flows. | Confident exploration possible everywhere. |
+
+## 4. Consistency and standards
+Internal consistency (this feature matches the project) + external consistency (the
+project matches platform / web norms).
+- Same concept named the same way across screens.
+- Same affordance (button vs link vs row) means the same thing across screens.
+- Platform conventions respected (browser back, focus rings, native controls where appropriate).
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Inconsistent vocabulary + affordances. | Major drift from neighbours. | Mostly aligned; visible drift. | Well-aligned; minor inconsistencies. | Indistinguishable from the rest of the product. |
+
+## 5. Error prevention
+Designed so the user *can't* make the error in the first place.
+- Confirmations on destructive operations.
+- Disabled / hidden actions when they're not valid.
+- Smart defaults; constrained inputs (date pickers vs free text).
+- Field formats validated as you type, not just on submit.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Many error-prone flows. | Some preventable errors still possible. | Common errors prevented; edge cases slip. | Most errors prevented before they occur. | Errors are genuinely rare; the easy path is the safe path. |
+
+## 6. Recognition rather than recall
+Show options; don't force the user to remember them.
+- Visible choices rather than free-text "type the command".
+- Recently-used values surfaced.
+- Labels persist (don't disappear after focus).
+- Context (where the user is, what they were doing) survives navigation.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Heavy recall required. | Critical flows demand recall. | Mixed — some visible, some hidden. | Mostly recognition; minor recall asks. | Pure recognition; nothing the user needs is hidden. |
+
+## 7. Flexibility and efficiency of use
+Novices and experts both productive.
+- Keyboard shortcuts on power flows; visible affordances for everyone else.
+- Sensible defaults for the common case; depth available when needed.
+- Saved views / templates / bulk actions on tasks done repeatedly.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| One-size-fits-all; no acceleration. | Limited shortcuts; novice-only. | Some efficiency for experts; uneven. | Strong shortcut + default story; small gaps. | Both populations measurably fast. |
+
+## 8. Aesthetic and minimalist design
+Every element earns its place. No decorative noise.
+- One primary action per screen / surface.
+- Visual hierarchy carries the eye to the next step.
+- Decoration in service of meaning, not for its own sake.
+- Whitespace used as a tool, not because the page felt empty.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Cluttered; no hierarchy. | Visible noise / competing actions. | Generally clean; some clutter. | Strong hierarchy; minor noise. | Every pixel deliberate; nothing extraneous. |
+
+## 9. Help users recognize, diagnose, and recover from errors
+Error states are designed, not afterthoughts.
+- Errors named in user language ("Your card was declined") not codes ("Stripe 4002").
+- A concrete next step ("Try a different card" + "Use PayPal instead").
+- Inline location — the error appears next to the field / action that caused it.
+- No blame — the message describes the situation, not the user.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Cryptic codes / silent failures. | Errors visible but unhelpful. | Some errors recoverable; others stranded. | Most errors actionable; minor gaps. | Every error has a clear cause + clear next step. |
+
+## 10. Help and documentation
+Users can find what they need without leaving the surface.
+- Inline hints on novel patterns.
+- Search-friendly help for deeper questions.
+- No help is needed for the common path — and that's documented as a goal.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| No in-product help. | Help exists but hidden / stale. | Help exists; quality uneven. | Good inline help; reachable docs. | Help feels native; users barely need it. |
+
+## Reporting
+
+In `$rite-review` output, surface only the heuristics scoring **≤2** as findings,
+plus any 3 with a specific noted gap. Heuristics at 4 are not reported individually
+— they roll up into the UX axis. Heuristics at 3 with no specific gap are not
+reported. Each surfaced finding gets a severity label per `rite-review/SKILL.md`.
+
+The rubric is descriptive, not gating. A score of 2 on aesthetic-minimalist isn't
+an automatic NO-GO; the `rite-seal` gate is `Critical == 0`, not "every heuristic
+≥ 3".

package/pack/generated/codex/skills/rite-review/reference/performance-checklist.md

@@ -0,0 +1,80 @@
+# Performance checklist (baseline for the perf reviewer)
+
+The minimum baseline `devrites-performance-reviewer` checks against, in feature scope. It
+is a checklist, not a mandate: flag what the diff actually touches or what a measurement
+flags, never a project-wide sweep. The philosophy lives in
+[`standards/performance.md`](../../devrites-lib/reference/standards/performance.md) (measure first) — this file is the
+concrete what-to-look-for.
+
+## Core Web Vitals targets
+
+| Metric | Good | Needs work | Poor |
+|---|---|---|---|
+| LCP — Largest Contentful Paint | ≤ 2.5s | ≤ 4.0s | > 4.0s |
+| INP — Interaction to Next Paint | ≤ 200ms | ≤ 500ms | > 500ms |
+| CLS — Cumulative Layout Shift | ≤ 0.1 | ≤ 0.25 | > 0.25 |
+
+A CWV value only counts when it carries a source — `Field (CrUX)`, `Lab (Lighthouse)`, or
+`Trace (DevTools)`. No source → it's a Source-mode hypothesis, not a measurement.
+
+## Frontend (only when the feature is UI-facing)
+
+Identify the framework first; apply only its idioms.
+
+- **Images** — modern format (WebP/AVIF); responsive `srcset`/`sizes`; explicit
+  `width`/`height` to reserve space (CLS); below-the-fold `loading="lazy"`; the LCP image
+  gets `fetchpriority="high"` and is **not** lazy-loaded.
+- **JavaScript** — initial bundle stays small (≈200KB gzipped is the usual line); code-split
+  routes and heavy features; no blocking script in `<head>` without `defer`/`async`; break
+  long tasks (>50ms) so the main thread stays free (the main INP lever); `memo`/`useMemo`/
+  `useCallback` only where profiling shows a win, not wrapped over everything.
+- **CSS** — critical CSS not render-blocking; no per-render CSS-in-JS runtime cost in prod.
+- **Fonts** — 2–3 families max; WOFF2; self-hosted where possible; preload the LCP font;
+  `font-display: swap`; subset with `unicode-range`.
+- **Rendering** — no layout thrashing (batch reads, then writes); animate `transform`/
+  `opacity` only; virtualize long lists; `content-visibility: auto` for off-screen sections;
+  don't break bfcache (no `unload` handler, no `Cache-Control: no-store` on HTML).
+
+## Backend (every feature, UI or not)
+
+- No N+1 queries; eager-load / join / batch instead.
+- New queries have the indexes they need for their filter/sort columns.
+- List endpoints paginate — never an unbounded `SELECT *`.
+- Per-request work that doesn't change per call is cached or hoisted.
+- Responses compressed (gzip/brotli); bulk operations instead of a loop of single calls.
+
+## Network
+
+- Static assets cached with a long `max-age` + content hashing.
+- Known origins `preconnect`-ed; no unnecessary redirects; HTTP/2 or HTTP/3 where available.
+
+## AI-codegen perf smells (fold into the area above, not a separate finding category)
+
+- State duplicated instead of lifted; effects with over-broad deps that re-run needlessly.
+- Sequential `await`s where `Promise.all` / parallel fetch fits.
+- Over-fetching "just in case"; redundant calls a dedup would collapse.
+- Defensive memoization wrapping cheap components — cost with no benefit.
+
+## Modern APIs to consider (one-liners — reach for these, don't gate on them)
+
+`scheduler.yield()` to keep input responsive in long loops · Speculation Rules for
+prefetch/prerender · View Transitions on SPA navigation · Long Animation Frames (LoAF) for
+production INP attribution · `fetchpriority` on critical non-image resources.
+
+## Measurement commands (name these in Source mode; don't run installs in review)
+
+```bash
+# Lighthouse (lab)
+npx lighthouse <url> --output json --output-path ./report.json
+# or via the Chrome DevTools MCP CLI, no install:
+npx -p chrome-devtools-mcp chrome-devtools lighthouse_audit --output-format=json > report.json
+
+# Bundle size
+npx vite-bundle-visualizer        # Vite
+npx webpack-bundle-analyzer stats.json   # webpack
+
+# Field data: CrUX / PageSpeed Insights (real users, p75) — needs an API key
+```
+
+Field is what real users experienced; lab is one synthetic run. Don't present one as the
+other.

package/pack/generated/codex/skills/rite-review/reference/performance-review.md

@@ -0,0 +1,14 @@
+# Performance review (feature-scoped)
+
+Apply only when a stated budget or visible regression risk makes performance relevant.
+The canonical measurement, pitfall, optimization, and scope rules live in
+[`performance.md`](../../devrites-lib/reference/standards/performance.md); apply every
+one before filing a performance finding.
+
+The agent runs **Source mode** (static scan, findings tagged `potential` + the verify
+command) or **Measured mode** (real CWV numbers → a source-labeled scorecard). Baseline
+checks + measurement commands: [`performance-checklist.md`](performance-checklist.md).
+
+## Labels
+A perf issue that breaches a stated budget is **Important** or **Critical**; a
+speculative micro-optimization is a **Suggestion** at most.

package/pack/generated/codex/skills/rite-review/reference/security-review.md

@@ -0,0 +1,37 @@
+# Security review (feature-scoped)
+
+Apply when the feature involves user input, auth/authz, data storage, external
+integrations, secrets, or permissions. Delegates to `devrites-audit security`.
+
+## OWASP-Top-10-oriented checks
+
+This is the **single-sourced OWASP-web checklist** both `$rite-review` and the
+`devrites-security-auditor` agent apply (trust-boundary + the OWASP **LLM** Top 10 live in
+[`standards/security.md`](../../devrites-lib/reference/standards/security.md)). Keep the enumeration here; don't restate it.
+
+- **Injection** — parameterized queries; no string-built SQL/shell/HTML; validate &
+  encode at boundaries.
+- **Broken access control** — every sensitive action checks authz server-side; no
+  trusting client-supplied IDs/roles; no IDOR.
+- **Auth / session** — secure session handling; no credentials in code/logs; correct
+  password/token handling.
+- **Sensitive data** — PII/secrets not logged or returned; encryption where required;
+  least data exposed.
+- **SSRF / external calls** — validate/allowlist outbound URLs; timeouts; don't reflect
+  untrusted input into requests.
+- **Misconfiguration** — safe defaults; debug off; CORS scoped; security headers as the
+  project uses them.
+- **Vulnerable dependencies** — new/updated deps audited; no known-vuln versions added.
+- **Integrity / deserialization** — don't deserialize untrusted data unsafely.
+
+## Trust boundary
+Apply the three-tier discipline (untrusted → boundary → trusted) per the canonical rule
+in [`standards/security.md`](../../devrites-lib/reference/standards/security.md#trust-boundary-three-tiers). A value
+that skips the boundary tier is a finding.
+
+## Rules
+- Findings labeled Critical/Important/Suggestion. A real auth/data-exposure issue is
+  **Critical** → NO-GO until fixed.
+- Secrets management: never commit secrets; use the project's secret mechanism.
+- Don't expand into a project-wide security audit — feature scope. Record out-of-scope
+  risks as follow-ups.

package/pack/generated/codex/skills/rite-seal/SKILL.md

@@ -0,0 +1,113 @@
+---
+name: rite-seal
+description: Decide GO / NO-GO readiness on the active feature. Use when the user asks "seal this", "GO / NO-GO", "decide if we can ship", "can we ship", or "safe to merge". Not for commit/push/tag/close; use $rite-ship.
+argument-hint: "[feature-slug] [--full]"
+user-invocable: true
+---
+
+## Codex compatibility
+
+This is the Codex mirror of a DevRites skill. In Codex:
+
+- Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
+- Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
+- When this skill asks for a DevRites specialist or writer agent, **explicitly** spawn the matching Codex custom agent from `.codex/agents/devrites-*.toml` through Codex subagents (`spawn_agent`), then wait for its result and reconcile it as the skill instructs. Do not do the review inline just because the instruction to spawn is embedded here — Codex under-fires embedded spawn/skill instructions (openai/codex #23496), so treat the spawn as required, not optional.
+- The independence of a fresh-context subagent is the point. If Codex genuinely cannot spawn subagents in the current surface, run the documented inline fallback and **label the result an inline fallback, not an independent review** — an inline pass shares the calling context and is weaker evidence.
+- Codex project hooks are installed in `.codex/hooks.json`. Review and trust them with `/hooks` before relying on hook enforcement.
+- When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers — NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
+
+
+# $rite-seal — GO / NO-GO
+
+The decision gate before shipping. **Read the active workspace first**; if none, tell
+the user to run `$rite-spec <feature>`. Produces `seal.md` with a clear verdict.
+`$rite-seal` **decides**; the irreversible git commit/push/tag and the task close-out
+live in `$rite-ship`, which refuses to run without a GO recorded here.
+
+## Rules consulted (read on demand from `.agents/skills/devrites-lib/reference/standards/`)
+**Step 0:** Read `.agents/skills/devrites-lib/reference/standards/core.md` first. The other rule files load on demand —
+pull these via `Read` before sealing:
+- `agents.md` — review-subagent fan-out at seal.
+- `code-review.md` — severity labels (Critical / Important / Suggestion / Nit / FYI).
+- `review-checklist.md` — compact final review pass/fail sweep.
+- `test-proof-checklist.md` — compact proof-quality gate for tests and evidence.
+- `browser-proof-checklist.md` — for UI scope, the browser-state and Visual Verdict gate.
+- `security-checklist.md` — when input / auth / data / integrations / secrets are in scope.
+- `principles.md` — declared project invariants (`.devrites/principles.md`) are a pass/fail gate; a diff that violates one with no recorded, human-approved exception is a NO-GO.
+- `documentation.md` — record decisions in `decisions.md` before sealing.
+- `observability.md` — a runtime surface that ships blind is an Important finding.
+- `deprecation.md` — when the diff removes / migrates code, API, or data (read with the
+  risk-and-rollback step below).
+- `definition-of-done.md` — standing Done bar: acceptance mapped, fresh proof, no open hard gates, scoped edits, rollback/docs where needed.
+
+
+## Operating rules
+- Evidence over confidence — a criterion is met only if evidence proves it.
+- Spec Drift Guard applies: unresolved drift is a NO-GO.
+- **Honest verdict.** DO NOT round a NO-GO up to GO to be agreeable.
+
+## Severity gate (the ship/no-ship rule)
+
+Read `review.md` and the latest reviewer outputs.
+
+| State | Gate result |
+|---|---|
+| `Critical == 0` and `Important == 0` and acceptance proven and drift resolved | **GO** (proceed) |
+| `Critical == 0` and `Important > 0` and acceptance proven and drift resolved | Render interactive prompt: *"`Important > 0` open. Proceed to seal? [y/N]"*. Default **N**. If the user types `y`, GO; otherwise NO-GO with the open Important findings listed as blockers-by-policy. |
+| `Critical > 0` | **NO-GO**, no exceptions. List every Critical with `file:line` and fix direction. |
+| Any acceptance criterion unproven, any bespoke `Prohibitions (must-NOT)` `resolved/test` row lacking linked proof, or any `plan.md` Key links row with no covering `EVID-###` wiring check (built-but-not-wired; `none declared` → n/a) | **NO-GO**, list the unproven criteria/prohibitions/links. |
+| Any criterion tagged `proof: judgment` in `evidence.md` (untagged reads `judgment`) | Judgment proof needs a human eye. HITL: enumerate them in the verdict digest — the human's GO covers them. AFK: **no auto-GO** — append a `gate: validating` question listing them and stop. |
+| Fan-out roster incomplete — `devrites-engine footprint roster` rc=3 (a reviewer neither dispatched nor skip-recorded) | **NO-GO** on the review's *completeness*, not a verdict on the diff: dispatch the missing reviewer or record a justified skip, then re-seal. Same standing as an unproven criterion. |
+| Silent review axis — `devrites-engine review-integrity` rc=1 (an adversarial axis in `review.md` reported nothing and justified nothing) | **Important** — a suspected rubber-stamp, on the review's *completeness* not the diff. Re-run that axis or record its `No-findings:` justification (`code-review.md` § Zero findings is suspicious), then re-seal. |
+| A declared extension check unaddressed — a valid `.devrites/extensions/*/component.yaml` declares `checks: at: seal` and `seal.md` records neither the check's outcome nor a skip justification | **Important** — same standing as a silent axis, on the review's *completeness*. Address the check's instruction or record why it doesn't apply, then re-seal. Checks are additive-only (an extension raises the bar, never lowers it); an extension that fails `extensions validate` has inactive checks — not a blocker. |
+| Visual Verdict `FAIL` on an acceptance-mapped UI criterion (`browser-evidence.md`) | **NO-GO** — an unmet acceptance criterion. A declared-state `FAIL` is Important (the `Important > 0` row). UI build with a `design-brief.md` but no Visual Verdict → Important evidence gap. No brief → not applicable. |
+| Diff violates a declared project principle (`.devrites/principles.md`) with no recorded, human-approved exception | **NO-GO**, list each violated principle with `file:line`. Same standing as an unproven criterion (absent / empty file → none declared → not a blocker). |
+| Unresolved drift in `drift.md` | **NO-GO**, route through `$rite-plan` first. |
+| Any `questions.md` entry with `gate: validating` and `status: open` | **NO-GO** regardless of behavior impact — an open validating gate is merge-blocking by definition. A slice marked `built (pending review)` is not done. |
+| A stood decision (boundary / data-model / auth / public-API / migration / branching) in the `decisions.md` `## Decisions stood` ledger with no recorded `devrites-doubt` verdict — `doubt: MISSING` / `doubt-coverage` rc=3 | **Important** — **NO-GO** when the undoubted decision is irreversible-risk (auth / public-API / migration), the same standing as an unproven acceptance criterion. Severity rides the unverified **decision**, not the exit code: `doubt-coverage` rc=1 (zero doubt dispatched) is a **prompt to verify**, not itself a finding — confirm against the ledger, where every-slice-trivial (`- none`) passes and a skipped triggering decision is the finding. |
+| `devrites-engine docs-stale` warns that user-facing CLI/API/install/docs-referenced code changed without README/docs updates | **FYI** unless the spec promised docs or users need docs to satisfy acceptance; then escalate to Important. |
+| Outside voice (`devrites-engine outside-voice`) is unavailable in `auto` mode | Advisory only; record `outside-voice: skipped-unavailable`. Disabled mode records `outside-voice: disabled`. |
+
+## Workflow
+
+Before the verdict, run the deterministic advisory checks and record their outcomes in `seal.md`:
+```bash
+devrites-engine docs-stale; echo "docs-stale rc=$?"
+devrites-engine outside-voice; echo "outside-voice rc=$?"
+```
+If outside voice is `available`, ask the same artifacts/diff second opinion;
+findings stay advisory until verified with line quotes or accepted into the normal review pipeline.
+If `.devrites/extensions/` exists, read each valid extension's `component.yaml` for `checks:
+at: seal` entries and record every declared check's outcome (or skip justification) in `seal.md`
+— the severity gate treats an unaddressed one as Important.
+For developer-facing surfaces, compare `devex.md` predicted TTHW against the measured proof path and
+record the boomerang result.
+
+Run the full execution contract in
+[`reference/phase-contract.md`](reference/phase-contract.md). It is not optional:
+it contains the orientation, evidence, risk, reviewer fan-out, roster,
+review-integrity, verdict, convention, and learning steps for this gate.
+
+## On GO → hand off to $rite-ship
+
+`$rite-seal` makes the **decision** and stops. It does **not** run `git commit`,
+`git push`, `git tag`, publish, or deploy — those moved to `$rite-ship`, which renders
+the type-GO prompt and refuses to run without a GO recorded here. Keeping the decision
+and the irreversible action as two separately-auditable steps is the point: a GO seal
+is a verdict, not an authorization to push.
+
+On **GO**: write `seal.md`, set `state.md` `Next step: $rite-ship`, and tell the user
+the feature is cleared to ship. Do **not** set phase `done` — `$rite-ship` marks done
+after the task is shipped and archived. The `Important > 0` interactive y/N earlier in
+the gate is the one off-ramp seal still owns; the type-GO off-ramp now lives in ship.
+For a **UI feature**, note in the hand-off that `$rite-ship` offers an optional
+**design-memory** rollup — persist this feature's proven design language into a project
+`DESIGN.md` so later features inherit it (`../rite-ship/reference/design-memory.md`).
+
+## Output
+
+Use the full output contract in [`reference/output.md`](reference/output.md).
+It preserves the progress-first GO / NO-GO shape, uses the shared completion
+reply contract
+([`devrites-lib/reference/reply-contract.md`](../devrites-lib/reference/reply-contract.md)),
+and keeps the boundary that `$rite-seal` decides only; `$rite-ship` executes.

package/pack/generated/codex/skills/rite-seal/reference/anti-patterns.md

@@ -0,0 +1,29 @@
+# rite-seal — anti-patterns
+
+Load this when standing the final GO/NO-GO decision, or when tempted to round
+NO-GO up to GO. (The irreversible push/tag/deploy and its type-GO gate now live in
+`$rite-ship` — see that skill's anti-patterns for the type-GO discipline.)
+
+Pack-wide rationalizations + red flags (incl. user-wants-it-bypass-gate):
+see [standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-patterns.md).
+
+## Phase-specific rationalizations
+
+| Excuse | Rebuttal |
+|---|---|
+| "All Important findings are minor; just GO." | `Important > 0` triggers an interactive y/N — do not bypass the prompt, present it. |
+| "User clearly wants this to ship." | Ship is evidence-driven, not consent-driven. A Critical finding outranks "the user said go". |
+| "Drift is small; resolve it inline and seal." | Unresolved drift = NO-GO, no exceptions. Route through `$rite-plan` to repair, then seal. |
+| "Reviewer findings overlap; average them away." | Surface disagreements explicitly. Averaging hides where the reviewers actually disagree. |
+| "Carry the old reviewer verdicts though the diff changed." | If the diff changed since `$rite-review`, re-run the Spec + Code axes — don't carry stale verdicts forward. |
+| "Build never doubted a decision, but the wright seemed confident — GO without checking." | Doubt is a gate, not a vibe. `doubt-coverage` rc=1 — or a stood boundary / data-model / auth / public-API / migration decision in `decisions.md` with no recorded `devrites-doubt` verdict — is an Important finding, escalating to NO-GO when the undoubted decision is irreversible-risk (auth / public-API / migration). An empty `Decisions stood` on every slice passes only when confirmed against `decisions.md`, never assumed. |
+
+## Red Flags
+
+- About to write `Verdict: GO` while any `Critical` finding is open.
+- Writing `Next step` as anything other than `$rite-ship` after a GO verdict.
+- Reviewer subagents spawned with the author's reasoning attached (defeats the fresh-context point).
+- `seal.md` written before walking *every* acceptance criterion one by one.
+- A NO-GO rounded up to GO "to be agreeable".
+- Unresolved drift, unresolved questions, or pending tasks — and you're sealing anyway.
+- `doubt-coverage` rc=1 left unexamined, or a stood irreversible-risk decision (auth / public-API / migration) carrying no recorded `devrites-doubt` verdict — and you're sealing GO anyway.

package/pack/generated/codex/skills/rite-seal/reference/conventions-ledger.md

@@ -0,0 +1,60 @@
+# Recording proven conventions (the ledger, on GO)
+
+Loaded on demand by `$rite-seal` step 9. On a **GO** seal — and only then — promote the
+durable project conventions this feature *proved* into the local conventions ledger
+(`.devrites/conventions.md`). Orient reads it on later slices so the wright stops
+re-deriving the same idioms every time.
+
+The discipline mirrors DevRites' whole thesis: a convention is not "learned" until a
+**sealed slice proved it**. The ledger is evidence-gated, just like the seal.
+
+## What to promote
+
+Durable, reusable facts about *this codebase* that a future slice would otherwise
+re-discover — each as one entry:
+
+- **Commands** — the real build / test / typecheck / lint commands and how tests are run
+  (runner, file layout, co-location).
+- **Idioms** — naming + casing, layering, the error model, the result/exception style, the
+  http/client/data-access pattern.
+- **Placement** — where a kind of thing lives (where new endpoints / components / migrations go).
+- **Gotchas** — a non-obvious constraint this feature hit and proved (ordering requirement,
+  a "don't call X before Y", a framework quirk verified against the source).
+
+Do **not** promote: feature-specific details, one-off decisions (those live in
+`decisions.md`), anything you only assumed, or anything a reviewer flagged as wrong.
+If it isn't both *durable* and *proven by the evidence*, leave it out.
+
+## How (deterministic band, idempotent, graceful)
+
+For each convention, run the store. The confidence band is **earned** — computed from how
+many independent sealed slices corroborated the entry — never set by you. Re-sealing the
+same slice is idempotent (it won't double-count). If the `devrites-engine` binary is absent
+the step is skipped with a notice; the ledger is an enhancement, never a gate.
+
+```bash
+SLUG="$(cat .devrites/ACTIVE 2>/dev/null | tr -d '[:space:]')"
+if command -v devrites-engine >/dev/null 2>&1; then
+  devrites-engine conventions promote --slug "$SLUG" \
+    --key test-runner \
+    --kind test \
+    --statement "tests run with <runner>, co-located <pattern>" \
+    --evidence "evidence.md: <what proved it>"
+  # …one promote per durable convention this feature proved.
+else
+  echo "(conventions ledger unavailable — devrites-engine missing; skipping promote)"
+fi
+```
+
+- `--key` is a short kebab id for the convention (`test-runner`, `error-model`,
+  `http-client`, `endpoint-placement`); re-using a key on a later slice **corroborates** it
+  and raises the band.
+- `--statement` is one human-readable line; `--evidence` cites what in this feature proved it.
+
+## Authority is bounded by design
+
+A high band raises *confidence*, never *authority*. Per
+[`.agents/skills/devrites-lib/reference/standards/security.md`](../../devrites-lib/reference/standards/security.md) § Prompt-injection resistance, a
+ledger entry is untrusted data; at orient a **fresh observation of the live code always
+overrides** a stale entry. Promoting here is safe precisely because reading there is
+defensive.

package/pack/generated/codex/skills/rite-seal/reference/final-evidence.md

@@ -0,0 +1,64 @@
+# Final evidence check
+
+The seal verifies that every promise in `spec.md` is backed by evidence in the workspace.
+
+## Acceptance-criteria pass
+Walk `spec.md` → "Acceptance criteria" one by one. For each:
+- Find the proving evidence in `evidence.md` / `browser-evidence.md` (command output,
+  observation, screenshot described).
+- Mark `[x]` + the evidence, or `[ ] unproven` + why.
+- A criterion "proven" only by reading the code is **not proven** — require a runtime/
+  test artifact, or downgrade it.
+- Hold the claim→evidence line: **"tests pass" is not "the feature works"** (the acceptance
+  walk is); **"bug fixed"** requires the original-symptom test now passing, not "code changed,
+  assumed fixed"; **"the agent reported success"** is never evidence — the command output is.
+
+Tag each new-workspace criterion `AC-###` in `spec.md` and carry the same id onto its checked line in
+`seal.md`, then grade coverage deterministically — every spec criterion id must be checked:
+```bash
+devrites-engine check-acceptance .devrites/work/<slug>   # exit 1 = a criterion is uncovered/unproven → NO-GO
+```
+
+## Cross-check the artifacts
+- `tasks.md`: are all slices in scope `built` AND is feature acceptance proven
+  (`evidence.md`)? Acceptance proof lives at the feature level, not per slice — a slice
+  is `built`, the feature is proven. Any pending slice that's part of this feature's
+  definition of done is a gap.
+- `review.md`: are all **Critical** and **Important** findings resolved (or accepted)?
+- `drift.md`: every entry marked resolved? Open drift blocks.
+- `questions.md`: any open question that changes behavior? Blocks. **Any entry with
+  `gate: validating` and `status: open` is a NO-GO regardless of behavior impact** — an
+  open validating gate is merge-blocking by definition; a slice marked
+  `built (pending review)` is not done.
+- `polish-report.md` (if UI): normalize+polish done, browser evidence present.
+- `references/` (if the spec gathered design references): does the built UI **match the
+  agreed references**? A mismatch on a referenced screen is a finding.
+
+## Evidence freshness — a GATE, not a courtesy
+Evidence must post-date the code it proves. **If `evidence.md` or `browser-evidence.md`
+predates the latest edit to any file in `touched-files.md`** (e.g. a polish- or
+review-phase edit landed after `$rite-prove`), a fresh `$rite-prove` run is **REQUIRED
+before GO** — stale evidence is not proof. Compare the evidence timestamps against the
+touched-files mtimes; if any code edit is newer, the proof is stale and this is a NO-GO
+until re-proven. Record the fresh result.
+
+Run the deterministic check rather than eyeballing mtimes:
+```bash
+devrites-engine evidence-fresh   # exit 3 = STALE proof → NO-GO until $rite-prove re-runs
+```
+
+## Test integrity & mutation — the suite must be real
+Stale proof isn't the only path to a false GO; a *weakened* test suite is. Run the deterministic
+gates:
+```bash
+devrites-engine test-integrity; echo "test-integrity rc=$?"   # exit 3 = a test deleted/skipped/loosened → Critical NO-GO
+devrites-engine mutation-gate   # changed-files mutation score — band the verdict; survivors are unproven behaviours
+devrites-engine package-existence; echo "package-existence rc=$?"   # exit 3 = a new import isn't declared in any manifest (hallucinated/typo-squatted dep) → Critical NO-GO
+```
+A test weakened since the slice base is a **Critical NO-GO** — the suite went green by lowering the
+bar, not by the code being right. Record the mutation score in `seal.md`; under
+`DEVRITES_MUTATION=enforce` a sub-threshold score blocks GO.
+
+## Output into seal.md
+The "Acceptance Criteria" and "Verification Evidence" sections of `seal.md` come
+straight from this check. Unproven critical criteria → list them as **blockers**.

package/pack/generated/codex/skills/rite-seal/reference/go-no-go.md

@@ -0,0 +1,53 @@
+# GO / NO-GO
+
+The seal verdict is binary and evidence-based. When in doubt, NO-GO with a clear blocker
+list beats a hopeful GO. The **authoritative gate is the severity table in
+[`../SKILL.md`](../SKILL.md) ("Severity gate")**; this file is the rationale behind it — keep
+the two in sync.
+
+## NO-GO if any of these hold
+- A **critical acceptance criterion is unproven** (no evidence, or evidence shows fail).
+- **Tests or build fail** without an explicit, user-accepted risk.
+- The UI **cannot be verified** and the UI risk is material (visible/important surface), or a
+  Visual Verdict `FAIL` lands on an acceptance-mapped UI criterion (`browser-evidence.md`).
+- **Unresolved spec drift** remains (a known-wrong plan or an open behavior question).
+- A **security-critical issue** remains (auth bypass, data exposure, injection).
+- A **data migration or destructive change lacks a rollback plan**.
+- A **declared project principle is violated** (`.devrites/principles.md`) with no recorded,
+  human-approved exception — same standing as an unproven criterion (absent / empty file →
+  none declared → not a blocker).
+- A **stood decision was never independently doubted** — a `## Decisions stood` entry in
+  `decisions.md` carrying `doubt: MISSING` (or `devrites-engine doubt-coverage` rc=3) — when that decision
+  is irreversible-risk (auth / public-API / migration). Severity rides the undoubted decision,
+  not the exit code.
+- Any `questions.md` entry with `gate: validating` and `status: open` — **NO-GO
+  regardless of behavior impact** (an open validating gate is merge-blocking by
+  definition). A slice marked `built (pending review)` is not done.
+- A **test was weakened to go green** (`devrites-engine test-integrity` exit 3 — a test deleted, skipped,
+  `xfail`-ed, or de-asserted since the slice base). A suite that passes on a lowered bar is not
+  proof; this is a Critical NO-GO.
+- Under `DEVRITES_MUTATION=enforce`, a **mutation score below threshold** (`devrites-engine mutation-gate`
+  exit 3 — survived mutants are behaviours no test actually checks).
+
+## GO requires
+- Every critical acceptance criterion checked with evidence attached.
+- Tests + build green for the scope (or documented, user-accepted exceptions).
+- Browser proof present for material UI (or an explicit, accepted manual-only note).
+- No open questions/drift that change product behavior.
+- Security/data/migration risks either resolved or explicitly accepted by the user with
+  a rollback path.
+
+## Important findings (`Critical == 0`, `Important > 0`)
+Open `Important` findings do not auto-pass. With acceptance proven and drift resolved, render
+the interactive prompt *"`Important > 0` open. Proceed to seal? [y/N]"* — default **N**. `y`
+→ GO; otherwise NO-GO with the open Important findings listed as blockers-by-policy. Don't
+silently fold Important findings into a GO.
+
+## Conditional GO
+If only **non-blocking follow-ups** remain, it's a GO with a recorded follow-up list —
+not a NO-GO. Distinguish "must fix to ship" (blocker) from "should do next" (follow-up).
+
+## Honesty
+- Don't upgrade a NO-GO to GO to please the user. State blockers plainly.
+- Don't claim evidence you don't have. "Unproven" is a valid, important status.
+- If subagent reviewers disagree, surface the disagreement and decide explicitly.

package/pack/generated/codex/skills/rite-seal/reference/output.md

@@ -0,0 +1,7 @@
+# rite-seal output
+
+Run `devrites-engine progress` first, then render the canonical
+[`GO`](../../devrites-lib/reference/reply-contract.md#go) or
+[`NO-GO`](../../devrites-lib/reference/reply-contract.md#no-go) typed template.
+
+Do not imply anything shipped. `$rite-seal` decides only; `$rite-ship` executes.