devrites 2.6.0 → 3.0.0

package/pack/.claude/hooks/devrites-redwatch.sh

@@ -1,39 +0,0 @@
-#!/usr/bin/env bash
-# DevRites PostToolUse hook — fail-on-red sentinel. After a Bash command that runs the
-# project's tests / build / typecheck / lint, set or clear .devrites/work/<slug>/.red so the
-# Stop gate (devrites-stop-gate.sh) can refuse to end a turn while the suite is red. Turns
-# "evidence over confidence / fail-on-red" from prose into a tracked flag. Heuristic on the
-# command + its output; FAIL-OPEN and silent on any doubt.
-set -u
-
-input="$(cat)"
-case "$input" in *'"tool_name"'*) : ;; *) exit 0 ;; esac
-root="${CLAUDE_PROJECT_DIR:-$PWD}"
-[ -f "$root/.devrites/ACTIVE" ] || exit 0
-slug="$(tr -d '[:space:]' < "$root/.devrites/ACTIVE" 2>/dev/null)"
-[ -n "$slug" ] || exit 0
-d="$root/.devrites/work/$slug"
-[ -d "$d" ] || exit 0
-
-command -v node >/dev/null 2>&1 || exit 0
-parsed="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{const j=JSON.parse(s);const ti=j.tool_input||{};let r=j.tool_response;if(r&&typeof r==="object")r=JSON.stringify(r);process.stdout.write((j.tool_name||"")+"
"+(ti.command||"")+"
"+(r||""))}catch(e){}})' 2>/dev/null)"
-[ -n "$parsed" ] || exit 0
-tool="${parsed%%$'\001'*}"; rest="${parsed#*$'\001'}"; cmd="${rest%%$'\001'*}"; out="${rest#*$'\001'}"
-[ "$tool" = "Bash" ] || exit 0
-
-# Only react to test/build/lint/typecheck commands.
-printf '%s' "$cmd" | grep -qiE '(npm|pnpm|yarn|bun)([[:space:]]+run)?[[:space:]]+(test|build|lint|typecheck|check)|jest|vitest|pytest|go[[:space:]]+test|cargo[[:space:]]+(test|build|clippy)|\bmvn\b|gradle|eslint|ruff|mypy|\btsc\b|\bmake[[:space:]]+(test|build|check)' || exit 0
-
-red="$d/.red"
-combo="$cmd
-$out"
-if printf '%s' "$combo" | grep -qiE '(^|[^A-Za-z])FAIL([^A-Za-z]|$)|[1-9][0-9]*[[:space:]]+(failed|failing|failures?|errors?)|not ok|panic:|error TS[0-9]|Traceback|AssertionError|✗|✘|BUILD FAILED|exit code [1-9]'; then
-  printf '%s\n' "$cmd" > "$red" 2>/dev/null || true
-  safe="$(printf '%s' "$cmd" | head -c 80 | tr -d '"\\')"
-  printf '{"hookSpecificOutput":{"hookEventName":"PostToolUse","additionalContext":"DevRites: tests/build are RED (%s). Fix to green or record the failure + next step in state.md before stopping — the Stop gate blocks an end-of-turn while .red is set."}}\n' "$safe" 2>/dev/null || true
-  exit 0
-fi
-if printf '%s' "$combo" | grep -qiE 'PASS(ED)?|0[[:space:]]+(failed|failing|errors?)|all tests passed|BUILD SUCC(ESS|EEDED)|succeeded|no (errors|problems|issues)|(^|[^a-z])ok([^a-z]|$)|✓'; then
-  rm -f "$red" 2>/dev/null || true
-fi
-exit 0

package/pack/.claude/hooks/devrites-refresh-indexes.sh

@@ -1,127 +0,0 @@
-#!/usr/bin/env bash
-# DevRites Stop hook — keep the code-intelligence indexes fresh after code changes, so the
-# NEXT structural lookup (see .claude/rules/tooling.md) reads current code, not a stale graph.
-# Reindexes the three optional indexes that track this repo — codebase-memory-mcp, codegraph,
-# graphify — each only if its binary is on PATH AND it already tracks the repo. Missing = no-op.
-#
-# Enhancement, never a dependency: silent on projects with no index, FAIL-OPEN, NEVER blocks.
-# The turn never waits — work runs in a DETACHED background process; the Stop hook returns at
-# once. Self-guards on a change-stamp so idle turns cost nothing. ON by default; disable with
-# DEVRITES_REFRESH_INDEXES=off. Does NOT touch agentmemory (separate, judgment-based store).
-#
-# Modes:
-#   (no args)        trigger: guard on changes, then spawn the detached worker. Used by the hook.
-#   --force [ROOT]   run synchronously NOW, ignore the change-guard, print a report (the skill).
-#   --worker ROOT    internal: the reindex work itself. Detached.
-set -u
-
-[ "${DEVRITES_REFRESH_INDEXES:-on}" = "off" ] && exit 0
-
-# ---- portable bounded-time runner (macOS has no `timeout` by default) ----
-run_timeout() { # <seconds> <cmd...>
-  secs="$1"; shift
-  if   command -v timeout  >/dev/null 2>&1; then timeout  "$secs" "$@"
-  elif command -v gtimeout >/dev/null 2>&1; then gtimeout "$secs" "$@"
-  else "$@"; fi
-}
-
-# ---- state-file locations derived from a repo root (all gitignore-safe) ----
-compute_state() { # <root>
-  ROOT="$1"
-  if   [ -d "$ROOT/.codegraph" ]; then STATE="$ROOT/.codegraph"
-  elif [ -d "$ROOT/.git"       ]; then STATE="$ROOT/.git"
-  else STATE="$ROOT"; fi
-  STAMP="$STATE/.index_refresh_stamp"
-  LOCK="$STATE/.index_refresh.lock"
-  LOG="$STATE/index_refresh.log"
-}
-
-# ---- is this repo tracked by codebase-memory-mcp? ----
-# Cheap repo-local signal first (exported artifact); fall back to the project registry.
-cbm_registered() { # <root>
-  command -v codebase-memory-mcp >/dev/null 2>&1 || return 1
-  [ -d "$1/.codebase-memory" ] && return 0
-  codebase-memory-mcp cli --raw list_projects 2>/dev/null | grep -qF "$1"
-}
-
-# ---- the reindex work; runs detached (or synchronously under --force) ----
-worker() { # <root>
-  _root="$1"
-  echo "[$(date '+%Y-%m-%d %H:%M:%S' 2>/dev/null || echo '?')] refresh start: $_root"
-  if cbm_registered "$_root"; then
-    echo "[codebase-memory] index_repository"
-    run_timeout 300 codebase-memory-mcp cli index_repository "{\"repo_path\": \"$_root\"}" 2>&1 \
-      || echo "[codebase-memory] index failed or timed out"
-  fi
-  if [ -d "$_root/.codegraph" ] && command -v codegraph >/dev/null 2>&1; then
-    echo "[codegraph] sync"
-    run_timeout 120 codegraph sync "$_root" 2>&1 || echo "[codegraph] sync failed or timed out"
-  fi
-  if [ -d "$_root/graphify-out" ] && command -v graphify >/dev/null 2>&1; then
-    echo "[graphify] update"
-    run_timeout 300 graphify update "$_root" 2>&1 || echo "[graphify] update failed or timed out"
-  fi
-  echo "[$(date '+%Y-%m-%d %H:%M:%S' 2>/dev/null || echo '?')] refresh done"
-}
-
-# ============================ entrypoint ============================
-
-# --- worker branch: do the work, release the lock, exit ---
-if [ "${1:-}" = "--worker" ]; then
-  ROOT="${2:-$PWD}"
-  compute_state "$ROOT"
-  worker "$ROOT"
-  rm -rf "$LOCK" 2>/dev/null || true
-  exit 0
-fi
-
-# --- parse mode ---
-FORCE=0
-if [ "${1:-}" = "--force" ]; then FORCE=1; shift; fi
-ROOT="${1:-${CLAUDE_PROJECT_DIR:-$PWD}}"
-compute_state "$ROOT"
-
-# --- availability guard: do nothing unless at least one index tracks this repo ---
-if [ ! -d "$ROOT/.codegraph" ] && [ ! -d "$ROOT/graphify-out" ] && ! cbm_registered "$ROOT"; then
-  exit 0
-fi
-
-# --- change guard: skip if nothing changed since last refresh (trigger mode only) ---
-if [ "$FORCE" -ne 1 ] && [ -f "$STAMP" ]; then
-  changed=$(find "$ROOT" -type f -newer "$STAMP" \
-    -not -path '*/.git/*' \
-    -not -path '*/.codegraph/*' \
-    -not -path '*/graphify-out/*' \
-    -not -path '*/.codebase-memory/*' \
-    -not -path '*/.devrites/*' \
-    -not -path '*/node_modules/*' \
-    -not -path '*/.venv/*' \
-    -not -path '*/__pycache__/*' \
-    -not -path '*/.research/*' \
-    -not -path '*/.cursor/*' \
-    -not -path '*/dist/*' \
-    -not -path '*/build/*' \
-    -print 2>/dev/null | head -n 1)
-  [ -z "$changed" ] && exit 0
-fi
-
-# --- lock: never run two refreshes at once; steal a lock older than 30 min ---
-if ! mkdir "$LOCK" 2>/dev/null; then
-  if [ -d "$LOCK" ] && find "$LOCK" -prune -mmin +30 2>/dev/null | grep -q .; then
-    rm -rf "$LOCK" 2>/dev/null
-    mkdir "$LOCK" 2>/dev/null || exit 0
-  else
-    exit 0   # another refresh in progress
-  fi
-fi
-
-# debounce: stamp now so a no-op turn doesn't re-trigger
-touch "$STAMP" 2>/dev/null || true
-
-if [ "$FORCE" -eq 1 ]; then
-  worker "$ROOT"                                   # synchronous: the skill wants the report
-  rm -rf "$LOCK" 2>/dev/null || true
-else
-  nohup "$0" --worker "$ROOT" >>"$LOG" 2>&1 &      # detached: Stop returns immediately
-fi
-exit 0

package/pack/.claude/hooks/devrites-reviewer-readonly.sh

@@ -1,37 +0,0 @@
-#!/usr/bin/env bash
-# DevRites subagent PreToolUse hook (wired from reviewer-agent frontmatter) — keep the
-# read-only reviewers read-only: deny a Bash command that could mutate the tree or exfiltrate.
-# A fresh-context reviewer reads untrusted source; a silent write path is a prompt-injection
-# surface (rules/security.md). FAIL-OPEN, OBSERVE by default; DEVRITES_REVIEWER_RO=enforce.
-set -u
-
-input="$(cat)"
-case "$input" in *'"tool_name"'*) : ;; *) exit 0 ;; esac
-command -v node >/dev/null 2>&1 || exit 0
-parsed="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{const j=JSON.parse(s);const ti=j.tool_input||{};process.stdout.write([j.tool_name||"",ti.command||"",j.agent_type||""].join("\u0001"))}catch(e){}})' 2>/dev/null)"
-[ -n "$parsed" ] || exit 0
-IFS=$'\001' read -r tool cmd agent_type <<EOF
-$parsed
-EOF
-if [ "${DEVRITES_REVIEWER_AGENT_REQUIRED:-0}" = "1" ]; then
-  case "$agent_type" in
-    devrites-slice-wright|"") exit 0 ;;
-    devrites-*) : ;;
-    *) exit 0 ;;
-  esac
-fi
-[ "$tool" = "Bash" ] || exit 0
-[ -n "$cmd" ] || exit 0
-
-# Mutating / exfiltration tokens — reviewers only ever need read-only inspection. pack-scan-ignore: this is the hook's own defensive deny-list, not a payload.
-printf '%s' "$cmd" | grep -qE '>>|[^0-9 ]>[^>&]|[[:space:]]-i([[:space:]]|$)|sed[[:space:]]+-i|\brm\b|\bmv\b|\btee\b|\btruncate\b|\bdd\b|chmod|chown|git[[:space:]]+(add|commit|push|reset|checkout|rm|mv|stash|tag|apply)|npm[[:space:]]+(install|i|publish|run)|pnpm[[:space:]]+(install|add)|yarn[[:space:]]+add|pip[[:space:]]+install|curl[[:space:]].*[[:space:]]-o\b|\bwget\b|\bscp\b|\bssh\b|\bnc\b' || exit 0
-
-mode="${DEVRITES_REVIEWER_RO:-observe}"
-if [ "$mode" = "enforce" ]; then
-  printf '%s\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"DevRites: reviewers are read-only. This Bash command can mutate or exfiltrate; inspect with Read/Grep/Glob and return findings — do not modify the tree or reach the network. (devrites-reviewer-readonly)"}}'
-  exit 0
-fi
-root="${CLAUDE_PROJECT_DIR:-$PWD}"
-slug="$(tr -d '[:space:]' < "$root/.devrites/ACTIVE" 2>/dev/null || true)"
-[ -n "$slug" ] && printf '%s\tWOULD-BLOCK\t%s\n' "$(date '+%Y-%m-%dT%H:%M:%S' 2>/dev/null || echo '?')" "$(printf '%s' "$cmd" | head -c 80)" >> "$root/.devrites/work/$slug/.reviewer-ro.log" 2>/dev/null || true
-exit 0

package/pack/.claude/hooks/devrites-statusline.sh

@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-# DevRites statusline — one-line workspace HUD for settings.json "statusLine". Ships UNWIRED
-# (opt-in) so it never clobbers a user's own statusline; point a "statusLine" command at it to
-# enable. Reads the session JSON on stdin (ignored) + .devrites/ and prints:
-#   DevRites: <slug> · <phase> · gates:<n> · AFK|HITL
-set -u
-
-cat >/dev/null 2>&1 || true
-root="${CLAUDE_PROJECT_DIR:-$PWD}"
-[ -f "$root/.devrites/ACTIVE" ] || exit 0
-slug="$(tr -d '[:space:]' < "$root/.devrites/ACTIVE" 2>/dev/null)"
-[ -n "$slug" ] || exit 0
-d="$root/.devrites/work/$slug"; state="$d/state.md"
-phase="$(grep -iE '^[-[:space:]]*Phase:' "$state" 2>/dev/null | head -1 | sed -E 's/^[-[:space:]]*Phase:[[:space:]]*//')"
-gates="$(grep -ciE '^[[:space:]]*status:[[:space:]]*open' "$d/questions.md" 2>/dev/null || echo 0)"
-mode="HITL"; [ -f "$root/.devrites/AFK" ] && mode="AFK"
-red=""; [ -f "$d/.red" ] && red=" · RED"
-printf 'DevRites: %s · %s · gates:%s · %s%s\n' "$slug" "${phase:-?}" "${gates:-0}" "$mode" "$red"

package/pack/.claude/hooks/devrites-stop-gate.sh

@@ -1,45 +0,0 @@
-#!/usr/bin/env bash
-# DevRites Stop hook — state-integrity gate. Refuse to end the turn while the active workspace
-# is provably inconsistent: tests are red (.red, set by devrites-redwatch.sh), or an open
-# blocking/validating gate is not surfaced as Awaiting human. Turns "persistence before
-# stopping" + "fail-on-red" from prose into a real gate. FAIL-OPEN, OBSERVE by default (logs to
-# .stop-gate.log); enable with DEVRITES_STOP_GATE=enforce. Loop-guarded by stop_hook_active so
-# it can never wedge the session.
-set -u
-
-input="$(cat)"
-root="${CLAUDE_PROJECT_DIR:-$PWD}"
-[ -f "$root/.devrites/ACTIVE" ] || exit 0
-slug="$(tr -d '[:space:]' < "$root/.devrites/ACTIVE" 2>/dev/null)"
-[ -n "$slug" ] || exit 0
-d="$root/.devrites/work/$slug"
-[ -d "$d" ] || exit 0
-
-# Loop guard: if we already blocked once this stop cycle, let it stop.
-case "$input" in *'"stop_hook_active":true'*) exit 0 ;; esac
-
-reason=""
-# 1) Red tests/build.
-if [ -f "$d/.red" ]; then
-  rc="$(head -c 100 "$d/.red" 2>/dev/null | tr -d '"\\')"
-  reason="tests/build are RED ($rc) — fix to green, or record the failure + the next step in state.md, before stopping"
-fi
-# 2) Open blocking/validating gate not surfaced as awaiting_human.
-if [ -z "$reason" ] && [ -f "$d/questions.md" ]; then
-  if grep -qiE '^[[:space:]]*gate:[[:space:]]*(blocking|validating)' "$d/questions.md" 2>/dev/null \
-     && grep -qiE '^[[:space:]]*status:[[:space:]]*open' "$d/questions.md" 2>/dev/null; then
-    if ! grep -qiE 'Status:[[:space:]]*awaiting_human|## Awaiting human' "$d/state.md" 2>/dev/null; then
-      reason="an open blocking/validating question is not surfaced — write the Awaiting human block to state.md (and set Status: awaiting_human) before stopping"
-    fi
-  fi
-fi
-
-[ -n "$reason" ] || exit 0
-
-mode="${DEVRITES_STOP_GATE:-observe}"
-if [ "$mode" = "enforce" ]; then
-  printf '{"decision":"block","reason":"DevRites stop-gate: %s. (devrites-stop-gate)"}\n' "$reason"
-  exit 0
-fi
-printf '%s\tWOULD-BLOCK\t%s\n' "$(date '+%Y-%m-%dT%H:%M:%S' 2>/dev/null || echo '?')" "$reason" >> "$d/.stop-gate.log" 2>/dev/null || true
-exit 0

package/pack/.claude/hooks/devrites-wright-scope.sh

@@ -1,64 +0,0 @@
-#!/usr/bin/env bash
-# DevRites subagent PreToolUse hook (wired from devrites-slice-wright frontmatter) — fence the
-# wright to its slice: deny Edit/Write to a path not listed in touched-files.md. Feature-scope
-# enforced at the source, the in-subagent companion to the post-hoc reconcile.sh gate. FAIL-OPEN,
-# OBSERVE by default (logs to .wright-scope.log); enable with DEVRITES_WRIGHT_SCOPE=enforce.
-set -u
-
-input="$(cat)"
-case "$input" in *'"tool_name"'*) : ;; *) exit 0 ;; esac
-root="${CLAUDE_PROJECT_DIR:-$PWD}"
-[ -f "$root/.devrites/ACTIVE" ] || exit 0
-slug="$(tr -d '[:space:]' < "$root/.devrites/ACTIVE" 2>/dev/null)"
-[ -n "$slug" ] || exit 0
-d="$root/.devrites/work/$slug"
-tf="$d/touched-files.md"
-[ -f "$tf" ] || exit 0
-
-command -v node >/dev/null 2>&1 || exit 0
-tool="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{process.stdout.write(JSON.parse(s).tool_name||"")}catch(e){}})' 2>/dev/null)"
-fpath="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{const ti=JSON.parse(s).tool_input||{};process.stdout.write(ti.file_path||ti.path||"")}catch(e){}})' 2>/dev/null)"
-agent_type="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{process.stdout.write(JSON.parse(s).agent_type||"")}catch(e){}})' 2>/dev/null)"
-[ -n "$tool" ] || exit 0
-if [ "${DEVRITES_WRIGHT_AGENT_REQUIRED:-0}" = "1" ] && [ "$agent_type" != "devrites-slice-wright" ]; then
-  exit 0
-fi
-case "$tool" in Edit|Write|MultiEdit|NotebookEdit|apply_patch) : ;; *) exit 0 ;; esac
-
-bad_paths=""
-if [ "$tool" = "apply_patch" ]; then
-  bad_paths="$(printf '%s' "$input" | TF="$tf" ROOT="$root" node -e '
-    const fs = require("fs");
-    let s = ""; process.stdin.on("data", d => s += d).on("end", () => {
-      try {
-        const root = process.env.ROOT || "";
-        const tf = process.env.TF || "";
-        const touched = fs.existsSync(tf) ? fs.readFileSync(tf, "utf8") : "";
-        const cmd = (JSON.parse(s).tool_input || {}).command || "";
-        const paths = [...cmd.matchAll(/^\*\*\* (?:(?:Add|Update|Delete) File|Move to): (.+)$/gm)].map(m => m[1]);
-        const bad = paths.filter(p => {
-          if (p.startsWith(".devrites/") || p.includes("/.devrites/")) return false;
-          const rel = p.startsWith(`${root}/`) ? p.slice(root.length + 1) : p;
-          return !touched.includes(rel) && !touched.includes(p);
-        });
-        process.stdout.write(bad.join(", "));
-      } catch {}
-    });
-  ' 2>/dev/null)"
-else
-  [ -n "$fpath" ] || exit 0
-  case "$fpath" in *.devrites/*|.devrites/*) exit 0 ;; esac
-  rel="${fpath#"$root"/}"
-  if ! grep -qF "$rel" "$tf" 2>/dev/null && ! grep -qF "$fpath" "$tf" 2>/dev/null; then
-    bad_paths="$fpath"
-  fi
-fi
-[ -n "$bad_paths" ] || exit 0
-
-mode="${DEVRITES_WRIGHT_SCOPE:-observe}"
-if [ "$mode" = "enforce" ]; then
-  printf '%s\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"DevRites scope: this path is not in touched-files.md. Build only the slice contract; if the slice genuinely needs this file, return an Escalation so the orchestrator routes it through the Spec Drift Guard — do not widen scope yourself. (devrites-wright-scope)"}}'
-  exit 0
-fi
-printf '%s\tWOULD-BLOCK\t%s\n' "$(date '+%Y-%m-%dT%H:%M:%S' 2>/dev/null || echo '?')" "$bad_paths" >> "$d/.wright-scope.log" 2>/dev/null || true
-exit 0

package/pack/.claude/hooks/hooks.json

@@ -1,52 +0,0 @@
-{
-  "hooks": {
-    "PreToolUse": [
-      {
-        "matcher": "Bash",
-        "hooks": [
-          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/pack/.claude/hooks/devrites-allow.sh\"" }
-        ]
-      },
-      {
-        "matcher": "Edit|Write|MultiEdit|NotebookEdit",
-        "hooks": [
-          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/pack/.claude/hooks/devrites-a1-guard.sh\"" }
-        ]
-      }
-    ],
-    "PostToolUse": [
-      {
-        "matcher": "Bash",
-        "hooks": [
-          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/pack/.claude/hooks/devrites-redwatch.sh\"" }
-        ]
-      }
-    ],
-    "Stop": [
-      {
-        "hooks": [
-          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/pack/.claude/hooks/devrites-stop-gate.sh\"" }
-        ]
-      },
-      {
-        "hooks": [
-          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/pack/.claude/hooks/devrites-refresh-indexes.sh\"" }
-        ]
-      }
-    ],
-    "UserPromptSubmit": [
-      {
-        "hooks": [
-          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/pack/.claude/hooks/devrites-cursor.sh\"" }
-        ]
-      }
-    ],
-    "SessionStart": [
-      {
-        "hooks": [
-          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/pack/.claude/hooks/devrites-orient.sh\"" }
-        ]
-      }
-    ]
-  }
-}

package/pack/.claude/rules/code-review.md

@@ -1,48 +0,0 @@
-# Code review
-
-The reviewer's one question: **does this change make the codebase healthier** — clearer
-design, cleaner logic, better tests, fewer risks? If not, it doesn't merge yet.
-
-## Keep changes small
-- One concern per change (a fix, an endpoint, a refactor) — not three at once.
-- Aim for small diffs: under ~200 lines reviews well and merges fast; treat ~400 as a
-  soft ceiling and self-split beyond it. Large diffs hide defects and get rubber-stamped.
-
-## What to check (tests first)
-1. **Tests** — do they exist and prove the behavior + failure modes (empty, error,
-   boundary, concurrency)? Would they fail if the code were wrong?
-2. **Correctness** — logic, edge cases, error paths, race conditions, wrong assumptions.
-3. **Readability** — names, function size, control flow, intent obvious without the author.
-4. **Architecture** — right seam, coupling/cohesion, fits existing patterns, no premature
-   abstraction. How does it fit the bigger system, not just what it does?
-5. **Security** — trust boundaries, input validation, authz, secrets.
-6. **Risk** — migrations, destructive changes, rollback.
-
-## Give actionable feedback
-- Label severity so the author knows what blocks: **Critical / Important / Suggestion /
-  Nit / FYI**.
-- Be specific: point at the line, name the problem, propose the fix. Frame non-blocking
-  ideas as questions ("what about a map here for readability?").
-- Let automation (linters, formatters, CI) catch the trivial stuff so review focuses on
-  design and correctness.
-
-## Scope discipline
-Review the change, not the whole project. Out-of-scope problems become follow-ups, not
-drive-by edits that balloon the diff.
-
-## Principles, charter & conventions are pass/fail gates
-Three project layers are evaluated as explicit pass/fail at `/rite-vet`, re-checked after design
-lands, and re-checked against the diff at `/rite-review` / `/rite-seal` — none are advisory:
-
-1. **Project principles** (`.devrites/principles.md`) — the authored invariants the project will
-   not break ([`principles.md`](principles.md)). A change that violates one with **no recorded,
-   human-approved exception** is a **Critical** finding and a **NO-GO** at seal, the same standing
-   as an unproven acceptance criterion. Check the diff against each principle's scope; an absent
-   or empty file means none are declared (gate passes).
-2. **The anti-slop charter** (`coding-style.md` + `prose-style.md`) — the AI-tells do-not list.
-3. **The conventions ledger** (`.devrites/conventions.md`) — proven project idioms (an untrusted
-   prior; a fresh read of the live code overrides it).
-
-A change that violates a stated convention or trips the charter is a **Critical** finding, not a
-Nit. Record every gate failure with `file:line` and block on it the same as any correctness
-defect.

package/pack/.claude/rules/development-workflow.md

@@ -1,40 +0,0 @@
-# Development workflow
-
-Ship small, integrate often, keep the main branch releasable. This is the general
-engineering loop the DevRites feature lifecycle (spec → define → build → prove → polish →
-review → seal → ship) runs on top of.
-
-## Work in small batches
-- Break work into thin, independently shippable slices and integrate them frequently —
-  ideally merging to the main branch at least once a day.
-- Small batches shrink merge pain, surface integration problems early, and get real
-  reviews. Large batches hide defects and stall.
-
-## Short-lived branches, trunk always green
-- Prefer short-lived branches off the main branch (trunk-based). Long-running branches
-  drift and create painful merges.
-- The main branch is **always in a releasable state**. Validate every change through a
-  **fast, reliable CI pipeline** (tests + build) before it merges.
-- Hide incomplete work behind a **feature flag / toggle** rather than a long branch, so
-  partial work can land without blocking releases or breaking the trunk.
-
-## Review gate
-- Every change is reviewed before merge (see `code-review.md`). Keep reviews fast — slow
-  reviews push people back toward big, risky batches.
-- Set expectations on PR size and merge cadence: small, frequent, single-concern.
-
-## Definition of done
-A slice is done only when:
-- it meets its acceptance criteria with **evidence** (tests/build/runtime — see
-  `testing.md`);
-- tests and build are green in CI;
-- it's reviewed and within scope;
-- docs/comments touched by the change are updated (`documentation.md`);
-- any destructive/migration step has a rollback.
-- evidence post-dates the code it proves; edits made after `/rite-prove` (polish/review)
-  require re-proof before seal — stale evidence is not proof.
-"Code written" is not done. "Proven and reviewed" is.
-
-## Incremental delivery
-Deliver a working end-to-end path each slice, then expand. Avoid the "90% done, nothing
-proven" pile-up — one finished, verified slice beats five half-built ones.

package/pack/.claude/rules/git-workflow.md

@@ -1,35 +0,0 @@
-# Git workflow
-
-History is documentation. Keep it clean, atomic, and readable.
-
-## Conventional Commits
-Format: `type(scope): subject`
-- **type**: `feat fix docs style refactor perf test build ci chore revert` (lower-case).
-- **scope**: the area changed (lower-case).
-- **subject**: imperative mood, no leading capital, no trailing period
-  ("add export endpoint", not "Added export endpoint.").
-- Keep the header short (~50, hard cap ~72). Put the *why* in the body, wrapped, after a
-  blank line. Reference issues in the footer.
-
-```
-feat(export): stream large CSV exports
-
-Buffering the whole file OOM-ed on >100k rows. Stream rows to the
-response instead so memory stays flat.
-
-Refs: #123
-```
-
-## Atomic commits
-- One logical change per commit; it should build and pass tests on its own.
-- Don't mix refactor + behavior change in one commit — split them so each is reviewable
-  and revertible.
-
-## Small, focused branches/PRs
-- One concern per branch. Short-lived; rebase/merge per the project's convention.
-- Keep PRs small (see `code-review.md`) so they get a real review.
-
-## Never commit
-- Secrets, credentials, tokens, or `.env` files. If one lands in history, rotate it and
-  scrub it — deleting the file in a later commit is not enough.
-- Generated artifacts, dependencies, or large binaries that belong in ignore rules.

package/pack/.claude/rules/spec-grammar.md

@@ -1,106 +0,0 @@
-# Spec grammar — testable requirements, parseable by tooling
-
-Acceptance criteria are the contract the seal checks ([`testing.md`](testing.md),
-[`code-review.md`](code-review.md)). Prose criteria work, but a requirement written as free
-text is graded by a human reading carefully — and an ambiguous one ("handle errors
-gracefully") slips past every gate because nothing can falsify it. This rule adds an
-**optional, recommended structure** that makes a behavioral requirement testable by
-construction and parseable by a deterministic linter, so the spec phase catches a malformed
-requirement before `/rite-define` plans against it.
-
-It is the grammar counterpart to [`testing.md`](testing.md): testing says *prove every
-behavior*; this says *write each behavior so it can be proven*.
-
-## Progressive rigor — when to use the structured form
-
-Match the rigor to the stakes; don't pay grammar ceremony for a one-liner.
-
-- **Simple / routine change** — the flat checklist form is correct and stays. One bullet per
-  criterion, each tagged with an `[ACn]` id:
-  ```markdown
-  ## Acceptance criteria
-  - [ ] [AC1] export returns a CSV with a header row
-  - [ ] [AC2] an empty dataset returns 204, not an empty 200
-  ```
-- **Behavioral / high-risk / cross-boundary requirement** — auth, data model, state machine,
-  public API, money, a migration, anything with non-obvious edge cases — use the structured
-  **Requirement / Scenario** grammar below. The act of writing the WHEN/THEN forces the edge
-  cases into the open at spec time, where they're cheapest to resolve.
-
-A spec mixes both: most criteria stay flat bullets; the two or three that carry real risk get
-the structured treatment. **Absence of structured requirements is never a failure** — the
-validator no-ops on a flat-bullet spec, the same discipline as the principles gate
-([`principles.md`](principles.md)).
-
-## The structured form
-
-```markdown
-### Requirement: Session tokens expire after inactivity
-The system SHALL reject any session token older than 15 minutes of inactivity.
-
-#### Scenario: token past the inactivity window
-- [ ] [AC4] **WHEN** a request presents a token whose last use was > 15m ago
-            **THEN** the request is rejected with 401 and the token is revoked
-
-#### Scenario: token within the window
-- [ ] [AC5] **WHEN** a request presents a token last used < 15m ago
-            **THEN** the request is served and the last-use timestamp advances
-```
-
-The rules the validator enforces (`spec-validate.sh`):
-
-- **`### Requirement: <name>`** — a level-3 heading. Its block MUST carry a **SHALL** or
-  **MUST** statement (in the header or the body) describing the core behavior. Keep the name
-  descriptive and under ~50 characters.
-- **Header identity is the key.** Requirement names are **unique** within a spec — tooling (and
-  any future spec sync) matches a requirement by its header text, so two requirements can't
-  share a name. Renaming a requirement is a remove + add, not an in-place edit, so the change
-  is visible.
-- **`#### Scenario: <name>`** — every requirement owns **at least one**. A requirement with no
-  scenario is an assertion no test can target.
-- **WHEN / THEN** — every scenario states a trigger (**WHEN**) and an observable outcome
-  (**THEN**); chain extra conditions with **AND**. Keywords are uppercase so they parse
-  unambiguously. A scenario missing either half isn't falsifiable.
-
-## Behavior first — WHAT, not HOW
-
-A spec requirement describes observable behavior, not the implementation that delivers it
-(the spec stays technology-agnostic — see `rite-spec/reference/spec-template.md`). "**THEN**
-respond 401" is behavior; "**THEN** call `AuthGuard.reject()`" leaks the design and locks the
-plan before `/rite-define` has chosen it. Name the input, the observable output, and the state
-change — not the function, class, or library. Implementation belongs in `plan.md`, not the
-requirement.
-
-## How it composes (no new gate, no duplication)
-
-- **`[ACn]` ids nest inside scenarios.** Tag each scenario's checkable line with an `[ACn]` id
-  exactly as the flat form does. The same `check-acceptance.sh` grades it against `seal.md` at
-  the end of the lifecycle — this grammar checks the requirement's **shape**, that script
-  checks its **proof**. The two compose; neither replaces the other.
-- **`/rite-prove` and `/rite-review` get concrete hooks.** Each scenario is one behavior to
-  prove and the test analyst's unit of "is this actually covered" — the WHEN/THEN maps
-  straight to an arrange/assert ([`testing.md`](testing.md)).
-- **The spec-quality checklists still apply.** The grammar makes a requirement *parseable*; the
-  `checklists/<domain>.md` "unit tests for English" still score whether it's *complete and
-  measurable* ("is 'prominent' quantified?"). Structure doesn't excuse vagueness inside a THEN.
-
-## The validator — `spec-validate.sh`
-
-Deterministic, zero-token. Run it on the workspace (or a spec path) at the spec readiness gate:
-
-```bash
-bash .claude/skills/devrites-lib/scripts/spec-validate.sh .devrites/work/<slug>
-```
-
-Exit codes: `0` valid (or no structured requirements — nothing to lint), `1` grammar
-violation(s) with `file:line` locations, `2` usage, `5` missing `spec.md`. A non-zero exit is a
-blocking spec-readiness failure: fix the requirement, never soften the check. It runs as part
-of `/rite-spec`'s readiness gate and is safe to re-run any time the spec changes.
-
-## Forward note
-
-The Requirement / Scenario block is deliberately the unit a persistent capability ledger would
-store — so if DevRites later grows a living "what the system currently does" layer, today's
-structured specs sync into it without a reformat. That layer is **not** shipped here; for now
-the grammar earns its place purely as testable, lint-checkable acceptance criteria at the spec
-phase.