devrites 2.6.1 → 3.0.0

package/pack/generated/codex/skills/rite-temper/SKILL.md

@@ -0,0 +1,138 @@
+---
+name: rite-temper
+description: Temper a readied spec before planning. Use when the user says "temper this", "strategy review", "pre-mortem the spec", or asks if we are over/under-building. Not for code review or final seal.
+argument-hint: "[feature-slug] [--mode expand|selective|hold|reduce]"
+user-invocable: true
+---
+
+## Codex compatibility
+
+This is the Codex mirror of a DevRites skill. In Codex:
+
+- Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
+- Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
+- When this skill asks for a DevRites specialist or writer agent, **explicitly** spawn the matching Codex custom agent from `.codex/agents/devrites-*.toml` through Codex subagents (`spawn_agent`), then wait for its result and reconcile it as the skill instructs. Do not do the review inline just because the instruction to spawn is embedded here — Codex under-fires embedded spawn/skill instructions (openai/codex #23496), so treat the spawn as required, not optional.
+- The independence of a fresh-context subagent is the point. If Codex genuinely cannot spawn subagents in the current surface, run the documented inline fallback and **label the result an inline fallback, not an independent review** — an inline pass shares the calling context and is weaker evidence.
+- Codex project hooks are installed in `.codex/hooks.json`. Review and trust them with `/hooks` before relying on hook enforcement.
+- When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers — NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
+
+
+# $rite-temper — temper the spec before you plan
+
+Take a readied spec and **temper** it: heat it (raise ambition on the *outcome*), then
+quench it (pre-mortem + prune the *solution surface*) — stronger and less brittle. The one
+DevRites step that decides scope/ambition on a written spec and folds the result into the
+canonical contract, so `$rite-define` plans the **hardened** spec. Optional for small work
+(significance-gated — auto-skips low-stakes specs), but always invoked inside
+`$rite-autocomplete`. **Read the active workspace first**; if there's no readied
+`spec.md`, tell the user to run `$rite-spec`.
+
+## Rules consulted (read on demand from `.agents/skills/devrites-lib/reference/standards/`)
+Pull on demand: `patterns.md` +
+`coding-style.md` (the over-engineering / YAGNI rubric — reuse the pack's standard, don't
+invent one), `documentation.md` (ADR-style `decisions.md` entries), `afk-hitl.md`
+(irreversible-risk list + gate ceiling), `elicitation.md` (the move-set to deepen a section
+that needs more than the default pre-mortem — selected by the section's risk).
+
+## Operating rules
+- **Ambition on outcomes, minimalism on the surface.** Raise the success bar and solve the
+  *real* problem; never add speculative capability/abstraction. The reconciliation hinge —
+  bigger ambition, smaller surface.
+- **Every scope change routes through the Spec Drift Guard** — it only becomes real by being
+  written into `spec.md` as a recorded, confirmable decision. Expansion is **opt-in** (HITL
+  confirm; AFK pauses — see autocomplete policy). Nothing auto-grows into the build.
+- **Bound ambition by reversibility.** Auth / migration / public-API / data-model touches get
+  the *opposite* of ambition — maximum conservatism; they always pause (irreversible-risk list).
+- **Honest verdict.** Never round "needs work" up to "ready"; record every scope call's *why*.
+- **You write; the reviewer judges.** You are the single canonical writer (`strategy.md` +
+  the spec edits); the reviewer agent is read-only.
+- **Demand the spec-quality checklists for big features.** `$rite-temper` only fires on
+  significant specs — exactly where vague requirement prose is most expensive. Before hardening,
+  confirm `checklists/<domain>.md` exist and pass (`rite-spec/reference/spec-checklists.md`); a
+  scope expansion you fold in **adds its own** rows (new Success/Acceptance criteria get
+  "unit-tested for English" too). A folded expansion with an unquantified criterion is a CRITICAL
+  fail that re-opens the readiness gate.
+
+## Workflow
+0. **Read `.agents/skills/devrites-lib/reference/standards/core.md`**, then run
+   `devrites-engine preamble` for deterministic workspace orientation.
+   Then read the workspace: `spec.md` (+ `decisions.md`,
+   `assumptions.md`, `design-brief.md` if UI), `state.md`. Require `Spec gate: passed` — else
+   STOP → `$rite-spec`. If a plan already exists, scope changes route through `$rite-plan
+   repair` (record in `drift.md`), not a blind spec edit.
+1. **Significance test** — [`reference/significance.md`](reference/significance.md). Low-stakes
+   / shape-not-meaning work → write the one-line `skipped — low stakes (<trigger>)` verdict to `strategy.md`,
+   set `state.md` `Next step: $rite-define`, and recommend it. Otherwise fire the full pass below.
+2. **FORWARD pass + mode selection** — [`reference/scope-modes.md`](reference/scope-modes.md).
+   First, the **one-sentence-intent test**: state the whole change's intent in a single sentence.
+   If you can't without an "and" that joins two unrelated outcomes, it is **two features** — the
+   sharpest scope-creep signal there is; recommend splitting the spec (or narrowing this one) before
+   tempering further. Then diverge on the *outcome* (the 10-star version of the real problem), and
+   commit **exactly one** scope mode (`expand` opt-in · `selective` · `hold-rigor` · `reduce-to-MVP`)
+   with its rationale and the **hinge** (what would change the call). `$ARGUMENTS` `--mode` is a
+   hint, not a command.
+3. **INVERSION pass** — pre-mortem in past tense ("it shipped and failed — what went wrong"),
+   each top risk carrying likelihood + mitigation + the slice it will bind to; then the **YAGNI
+   ledger** (each candidate scope item gets the "imagine the later refactor" test; defer unless
+   now-cost is trivial AND deferred-cost is large).
+   - **Deepen on demand.** When a specific scope call, requirement, or risk needs sharper thinking
+     than the default pre-mortem gives, pull the 3–5 techniques from
+     [`elicitation.md`](../devrites-lib/reference/standards/elicitation.md) whose *when-to-reach-for-it* matches that
+     section's risk (irreversible decision → Red-Team/Blue-Team + Assumption Audit; sizing → Delphi;
+     vague requirement → Steelman-then-Attack), offer them, and run the chosen one **on that one
+     section**. Record what it changed, not that you ran it. Optional — the default passes stand on
+     their own.
+4. **Score the 9 dimensions** — [`reference/review-dimensions.md`](reference/review-dimensions.md).
+   Cite evidence *before* the band; **gate on the floor** (the weakest dimension, not an average).
+   **Completion:** all nine dimensions have cited evidence, a band, and one explicit floor verdict.
+5. **Walk the findings WITH the human — do not batch-dump.** The artifact is the *output* of an
+   interactive review, not a substitute for it: surface each material scope call / finding via
+   `AskUserQuestion`, one at a time, best-guess + **why**. Each material scope call ends as a
+   **recorded decision** — a resolved `questions.md` qid (HITL) or a `decisions.md` ADR (AFK) —
+   so the walk leaves an auditable trail, not just chat. (AFK gate policy is single-sourced in
+   [`reference/significance.md`](reference/significance.md): `hold-rigor` + `reduce-to-MVP`
+   auto-apply, **any `expand` is a blocking pause**, irreversible-risk always pauses.)
+6. **Write `strategy.md` + fold back** — [`reference/strategy-template.md`](reference/strategy-template.md).
+   **One drift rule (decide by whether a plan exists):** *no `plan.md` yet* (the normal pre-define
+   case) → update `spec.md` **through the Spec Drift Guard** — *Success criteria* **and**
+   *Acceptance criteria* for each opt-in expansion / cut, **Non-goals** for every deferred item,
+   *Constraints* **and** *Risks* the pre-mortem demands, and the gaps/decisions table; *`plan.md`
+   already exists* → do **not** edit `spec.md` here — write the deltas to `drift.md` and hand off
+   to `$rite-plan repair`. Either way, append `decisions.md` (one ADR per scope call: context ·
+   decision · why-not · what-would-change-it) and `assumptions.md` (every "we'll probably need X" →
+   assumption-to-verify). **Every scope delta must carry a recorded human decision** — a resolved
+   `questions.md` qid (HITL) or a `decisions.md` ADR (AFK within the ceiling); a folded change with
+   no recorded decision is the batch-dump failure. **Re-check the spec Readiness gate** (it fails if
+   any folded scope delta lacks its decision). Update `state.md`: `Phase: temper`,
+   `Next step: $rite-define`; on a blocking pause (expand / irreversible / a dimension still below
+   bar) write the `Awaiting human` block + `Status: awaiting_human` before stopping.
+7. **Adversarial verification loop** — dispatch [`devrites-strategy-reviewer`](.codex/agents/devrites-strategy-reviewer.toml)
+   (fresh context, **only** the hardened spec + the rubric — no authoring reasoning). Resolve
+   actionable findings by editing `spec.md`/`strategy.md`, re-dispatch; **cap ≤3 iterations**. A
+   dimension still below bar after 3 → blocking question (HITL) or AFK gate-ceiling entry;
+   irreversible-risk findings always pause. If sub-agents are unavailable, do the independent
+   rubric pass yourself in a separate read, discarding the authoring reasoning (a flagged
+   fallback, not an independent review).
+8. **STOP.** Report the mode, the scope deltas, and the floor verdict; recommend `$rite-define`.
+
+> **Mid-flight discipline.** When tempted to dump findings into `strategy.md` and skip the
+> walk-through, expand the surface (not the outcome), grow scope without the Drift Guard, or
+> score before citing evidence — see [`reference/anti-patterns.md`](reference/anti-patterns.md).
+
+## Output
+
+**Progress first** — run `devrites-engine progress`, then use the shared completion reply contract
+([`devrites-lib/reference/reply-contract.md`](../devrites-lib/reference/reply-contract.md)).
+Default success shape:
+```
+Done: spec tempered for <slug>; mode <expand|selective|hold-rigor|reduce-to-MVP|skipped-low-stakes>.
+Changed: strategy.md, spec.md, decisions.md, assumptions.md
+Evidence: dimension floor <band>; reviewer loop <n>; spec readiness re-checked pass
+Open: <none | n deferred non-goals>
+Next: $rite-define
+Record: .devrites/work/<slug>/strategy.md
+↻ Hygiene: /clear before $rite-define
+```
+If readiness is blocked, use the shared `Stopped / blocked` form and route `Fix:`
+to `$rite-spec`; do not recommend `$rite-define`.
+**DO NOT plan, slice, or write code here** — that's `$rite-define` and `$rite-build`.

package/pack/generated/codex/skills/rite-temper/reference/anti-patterns.md

@@ -0,0 +1,29 @@
+# $rite-temper — anti-patterns
+
+Universal rationalizations + red flags live in
+[`../../devrites-lib/reference/standards/anti-patterns.md`](../../devrites-lib/reference/standards/anti-patterns.md) — read it when the
+reluctance is broader than this phase. Below are the temper-specific ones.
+
+## Phase rationalizations
+
+| Excuse | Rebuttal |
+|---|---|
+| "I'll write all the findings into `strategy.md` and let the user read it." | The artifact is the *output* of an interactive review, not a substitute for it. A finding's path to "done" goes **through `AskUserQuestion`**, one at a time, with a recommendation + why. Dumping findings into one write and moving on is the exact failure mode this skill exists to prevent. |
+| "Bigger is better — let's add the extra capability while we're thinking big." | Ambition belongs on the **outcome**, not the **solution surface**. A speculative capability/abstraction is gold plating. Expand the problem + acceptance; never the machinery. |
+| "The user obviously wants the ambitious version — I'll add it to the spec." | Expansion is **opt-in**, recorded, and confirmed (HITL) or paused (AFK). Adding acceptance the human didn't approve is silent scope growth — route it through the Spec Drift Guard or don't add it. |
+| "It's over-scoped, I'll just trim those criteria." | Reducing scope is **still a spec change**. Cut acceptance only as a recorded Spec-Drift-Guard decision, and park the rest in Non-goals with a revisit note — never a silent trim. |
+| "This dimension is weak but the others are strong — net it's fine." | The gate is the **floor**, not the average. A spec `broken` on risk does not pass because it's `strong` on clarity. |
+| "I can see it's adequate — I'll note the band, evidence is obvious." | Cite the evidence (the spec line or its absence) **before** the band. Score-first-justify-later is how a reviewer rationalizes a spec it already likes. |
+| "It's a strategy doc, the implementation concerns don't apply yet." | Cross-cutting concerns (security/data/observability/modifiability) are where strategy breaks down. Address each or mark it explicitly N/A — silent omission is a gap. |
+| "This greenfield design is elegant." | Elegant for a codebase that doesn't exist. Ground ambition in the real seams + blast radius; flag a new dependency / second design system for an explicit decision. |
+
+## Red flags
+- `strategy.md` written but `spec.md` acceptance/Non-goals **not** updated — the build follows
+  the spec, so the review changed nothing.
+- An `expand` decision auto-applied in AFK (it must pause), or any irreversible-risk touch that
+  didn't pause.
+- A pre-mortem with risks listed but no mitigation + owning slice — a risk without an owner is a
+  wish.
+- The reviewer loop running past 3 iterations, or the reviewer being handed the author's
+  reasoning (defeats the fresh-context point).
+- The skill writing a `plan.md`, slicing, or touching code — that's `$rite-define` / `$rite-build`.

package/pack/generated/codex/skills/rite-temper/reference/review-dimensions.md

@@ -0,0 +1,65 @@
+# Review dimensions + the floor-gate rubric
+
+The spec is scored on nine dimensions. Each catches a *different* failure mode — strength in
+one never compensates for collapse in another, so the gate is the **floor**, not an average.
+
+## The nine dimensions
+1. **Problem altitude & ambition** — is this solving the *right* problem at the right altitude,
+   or timidly improving the obvious path / over-reaching past the real need? Here, *under-
+   reaching* on the outcome is a failure, not just over-building.
+2. **Scope honesty & boundary** — are Non-goals explicit? Is there a Minimum Usable Subset and a
+   clear IN/OUT line? Flags grab-bags and a missing "Won't-have-this-time".
+3. **Premise & alternatives** — are the load-bearing premises stated and challenged, and is at
+   least one genuinely different approach (different data model / flow / boundary) considered
+   with its trade-off? ("Alternatives considered" is one of the most valuable parts of a spec.)
+4. **Pre-mortem risk coverage** — run in prospective hindsight; each top risk carries likelihood
+   + mitigation + the slice that owns it. **Unmitigated top risks are gating.**
+5. **Over-engineering / YAGNI** — speculative capability, unused extension points, premature
+   abstraction, second-system bloat. Apply the pack's standard (`patterns.md`) + the "imagine
+   the later refactor" test. Defer unless now-cost is trivial AND deferred-cost is large.
+6. **Acceptance testability & done-ness** — every acceptance criterion measurable, technology-
+   agnostic, and comparable **down to a baseline** ("better than the current workaround"), not
+   up to an unbounded ideal. Vague adjectives ("fast/robust/intuitive") and "handles X
+   gracefully" are flagged.
+7. **Irreversibility & blast radius** — are auth / migration / public-API / data-model touches
+   treated with conservatism + rollback, and is the blast radius understood (from a
+   code-intelligence index if available)?
+8. **Cross-cutting coverage** — security/trust-boundary, data & migration, observability, and
+   modifiability each explicitly addressed **or explicitly N/A** — no silent omission.
+9. **Convention fit & placement realism** — does the ambition fit the codebase's existing seams
+   and patterns, or assume greenfield freedom a constrained space doesn't have? Prefer existing
+   conventions; flag a new dependency / second design system for explicit decision.
+
+UI specs additionally inherit `rite-polish/reference/anti-ai-slop.md` at the cross-cutting
+dimension (design-system fit, anti-AI-slop) — but `$rite-temper` reviews the *spec/design-brief*,
+not pixels; the built UI is judged later by `devrites-frontend-reviewer`.
+
+## The rubric — coarse bands, evidence first
+Score each dimension on a **labeled band**, never a 1-10 float or a composite number (labels do
+the work — matches the pack's severity-vocabulary stance):
+
+| Band | Meaning |
+|---|---|
+| **strong** | Addressed well; no action needed. |
+| **adequate** | Addressed; minor sharpening only (Suggestion/Nit). |
+| **thin** | Under-addressed; a real gap to close before planning (Important). |
+| **broken** | Missing or wrong in a way that will cost a redo (Critical). |
+
+**Cite evidence before the band** — name the spec line / absence that justifies it; never score
+first and rationalize after. Borderline dimensions may be sampled twice; take the **lower** band
+(don't average up).
+
+## The floor-gate
+- **Pass** only when every dimension is `adequate` or `strong` **and** no unmitigated top
+  pre-mortem risk remains. The verdict is the **weakest** dimension — a spec strong on clarity
+  but `broken` on risk does **not** pass.
+- Individual findings carry the pack's standard severity labels (**Critical / Important /
+  Suggestion / Nit / FYI**) so they compose with `$rite-review` and `$rite-seal`. `broken` →
+  Critical, `thin` → Important; **FYI is band-independent** — an observation on a `strong` /
+  `adequate` dimension, not a failing band.
+- **Don't double-count overlap.** Some dimensions key on the same evidence (e.g. #7
+  irreversibility & #9 convention-fit both touch codebase realism; #1 ambition & #2 scope both
+  touch over/under-reach). Don't fail two dimensions for the *same* root cause — cite the
+  evidence once, band it once, so one problem isn't laundered into two floor failures.
+- Below-bar dimension after the ≤3-iteration reviewer loop → blocking question (HITL) or AFK
+  gate-ceiling entry. Irreversible-risk findings always pause regardless of band.

package/pack/generated/codex/skills/rite-temper/reference/scope-modes.md

@@ -0,0 +1,53 @@
+# Scope modes + the two passes
+
+The heart of `$rite-temper`: two ordered passes (heat, then quench), converging on exactly
+one scope mode. Ambition is a **generative** move followed by a **required convergence** — the
+divergence is never the spec; the converged sweet spot is.
+
+## Pass 1 — FORWARD (heat: raise ambition on the outcome)
+Diverge on the *real problem*, not the obvious path. Ask:
+- What would an order-of-magnitude-better **outcome** look like (the 10-star version)? Design
+  the extreme, then come back to the feasible sweet spot — don't ship the extreme.
+- Is a **premise** load-bearing and wrong? Name the assumptions the spec rests on; challenge
+  the one that, if false, changes everything.
+- Where is **under-reaching** the real risk — a timid improvement to a path we should reframe?
+
+Ambition aims at the **outcome** (problem definition, success bar, user value) and at
+complexity-**neutral** future-proofing. It never aims at the **solution surface** (that's Pass 2's
+job to prune). Ground every ambitious idea in the codebase's real seams and blast radius (a code-intelligence
+index if available — see `../../devrites-lib/reference/standards/tooling.md`) — don't invent greenfield scope a
+constrained codebase can't absorb.
+
+## Pass 2 — INVERSION (quench: pre-mortem + prune)
+Invert. Two subtractive moves:
+- **Pre-mortem (prospective hindsight).** State it in past tense: *"It's six months out. This
+  shipped and failed. What went wrong?"* List the top failure modes; for each: likelihood,
+  mitigation, and the slice that will own the mitigation. Unmitigated top risks are **gating**.
+- **YAGNI ledger.** Each candidate scope item gets the "imagine the later refactor" test: if
+  adding it *later* isn't materially more expensive, **defer it** (with a revisit note).
+  Bias hard toward defer — most presumed-needed features are never actually used. Reuse the
+  pack's existing standard — `patterns.md` ("no abstraction before two real callers",
+  "speculative generality") — don't invent a new YAGNI rule.
+
+## The four modes — commit exactly one
+Mode selection is the first convergence move. Record the chosen mode + rationale + the
+**hinge** (what would change the call) in `strategy.md` and `decisions.md`.
+
+| Mode | When | What it does | YAGNI / Drift Guard |
+|---|---|---|---|
+| **EXPAND** *(opt-in, default OFF)* | Under-reaching on the outcome is the real risk | Raise the success bar / reframe to the deeper problem; thinner-but-more-complete path to a bigger target | Expands the *problem + acceptance*, not machinery. Each added criterion is a Drift-Guard-recorded, human-confirmed (HITL) decision — never auto-grown |
+| **SELECTIVE** | One or two high-leverage dimensions deserve more; the rest is right | Expand only the high-upside dimension; hold the rest at spec scope | Each selected expansion routes through the Guard; everything not selected is parked in Non-goals so it's neither dropped nor re-injected mid-build |
+| **HOLD-RIGOR** | The spec is right-sized (default for irreversible-risk-heavy or already-tight specs) | No scope change — pure hardening: pre-mortem, risk mitigations, acceptance sharpening, cross-cutting coverage | Adds zero surface; trivially Drift-Guard-clean (no acceptance change) |
+| **REDUCE-TO-MVP** | Over-scoped: second-system bloat, ~all must-haves, gold-plating | Hammer scope to the Minimum Usable Subset; move the rest to Non-goals with one-line reasons + revisit notes | Strongest YAGNI alignment. Cutting acceptance is **still a spec change** — record it via the Guard, never a silent trim |
+
+## Bound ambition by reversibility
+The bigger the bet, the more it must be reversible. Irreversible-risk areas (auth, migrations,
+public API, data model) get the **opposite** of ambition — maximum conservatism, explicit
+rollback, and they **always pause** regardless of mode (the `afk-hitl.md` irreversible-risk
+list is honored verbatim). Size big bets so that if the whole thing vanished tomorrow, you'd be
+fine.
+
+## Effort foresight (frame it now, not "later")
+While choosing scope, surface the late-stage questions early: *"What will surprise us at
+integration? What will we wish we'd planned for at polish/test time?"* Turn each into a
+constraint, a risk, or a deferred Non-goal **now** — not a "figure it out later".

package/pack/generated/codex/skills/rite-temper/reference/significance.md

@@ -0,0 +1,46 @@
+# Significance test — fire the full review, or skip it
+
+`$rite-temper` is **significance-gated**: full strategic rigor only when the work is big
+enough to earn it, a one-line skip otherwise. This is the shared definition used by both the
+optional `$rite-temper` path and the always-run (significance-gated) `$rite-autocomplete` step,
+so they agree on when it fires.
+
+A strategic review of a five-line, reversible change is theatre; a strategic review of an
+auth rewrite is the cheapest insurance you'll buy. Gate on stakes and shape, not uniformly.
+
+## Fire the FULL review when ANY trips
+- **Irreversible-risk contact** — the slice/spec touches anything on the `afk-hitl.md`
+  irreversible-risk list: destructive data migration, auth/authz boundary, public-API break,
+  external-service contract, filesystem destruction outside the workspace.
+- **Data model** — new/changed entities, relationships, or persistence shape.
+- **Cross-module blast radius** — the impact (from a code-intelligence index if available — see
+  `../../devrites-lib/reference/standards/tooling.md` — or an honest estimate) crosses
+  module/service boundaries or has many dependents.
+- **Greenfield / ambiguous scope** — a new surface with no existing seam to follow, or a spec
+  whose "right size" is genuinely open (multiple defensible scopes).
+- **Multi-slice / multi-day** — the work decomposes into several slices (large enough that a
+  wrong scope call is expensive to unwind).
+- **The user asked** — "think bigger", "is this ambitious enough", "scope check", "pre-mortem",
+  an explicit `$rite-temper` invocation, or a chosen `--mode`. An explicit ask always fires.
+
+## Skip (low stakes) when ALL hold
+- Single-module, reversible, behavior-shaped-not-structural change.
+- No irreversible-risk contact; blast radius contained to the touched files.
+- Scope is unambiguous — there's one obvious right size and the spec already has it.
+
+On skip, **don't run the passes**. Write only the one-line verdict to `strategy.md`:
+
+```markdown
+# Strategy: <slug>
+Significance: skipped — low stakes (<the trigger that was NOT met, e.g. "single-module, reversible, scope unambiguous">)
+Next: $rite-define
+```
+
+Then recommend `$rite-define`. A skip is a *recorded* decision, not a silent omission — the
+seal can see the call was made deliberately.
+
+## In `$rite-autocomplete`
+Autocomplete runs the significance test every feature. On skip → straight to `$rite-define`
+(no pause). On fire → run the full review under the AFK gate ceiling: `hold-rigor` and
+`reduce-to-MVP` auto-apply (they never grow acceptance); **any `expand` is a blocking pause**;
+irreversible-risk findings always pause. Expansion is never auto-grown unattended.

package/pack/generated/codex/skills/rite-temper/reference/strategy-template.md

@@ -0,0 +1,90 @@
+# `strategy.md` template + fold-back rules
+
+`$rite-temper` produces two kinds of output. The `strategy.md` artifact is the durable
+**record** of the review; the **fold-back edits** are what the build actually follows. The
+record without the fold-back is dead prose — the build reads `spec.md`, not `strategy.md`.
+
+## `strategy.md` — the record
+Write to `.devrites/work/<slug>/strategy.md`. If one exists for the slug, **update** it, don't
+clobber.
+
+```markdown
+# Strategy: <slug>
+Tempered: <iso>
+
+## 1. Significance
+full | skipped — low stakes (<trigger>)        # if skipped, stop here (see significance.md)
+
+## 2. Scope mode
+Mode: expand | selective | hold-rigor | reduce-to-MVP
+Rationale: <why this mode>
+Hinge: <what evidence/answer would change the call>
+
+## 3. Forward pass (ambition)
+10-star outcome (the deliberate overshoot): <one or two lines>
+Premises challenged: <load-bearing assumption(s) + verdict>
+Converged sweet spot: <where we landed and why — this, not the overshoot, is what folds in>
+
+## 4. Pre-mortem (inversion)
+| Failure mode (past tense) | Likelihood | Mitigation | Owning slice/criterion |
+|---|---|---|---|
+| It shipped and <…> | high/med/low | <mitigation> | <slice or FR it binds to> |
+
+## 5. YAGNI ledger
+| Candidate scope item | later-refactor cost | Verdict |
+|---|---|---|
+| <item> | trivial / large | build-now / defer (revisit: <trigger>) |
+
+## 6. Cross-cutting coverage
+| Concern | Addressed? |
+|---|---|
+| Security / trust boundary | <how | N/A — why> |
+| Data & migration | <… | N/A> |
+| Observability | <… | N/A> |
+| Modifiability | <… | N/A> |
+
+## 7. Dimension scores (floor-gate)
+| Dimension | Band | Evidence |
+|---|---|---|
+| Problem altitude & ambition | strong/adequate/thin/broken | <spec line / absence> |
+| … (all 9) | … | … |
+Floor verdict: <weakest band> on <dimension> → pass | blocked
+
+## 8. Deferred / Won't-have-this-time
+- <item> — <one-line reason> (revisit when: <trigger>)
+
+## 9. Reviewer loop
+- iter 1: <findings → resolution> · iter 2: … (≤3)
+- Final: floor = <band>; unresolved → <none | blocking qid>
+```
+
+## Fold-back — the part the build follows
+Apply through the **Spec Drift Guard** (these are spec changes, not free edits). If a plan
+already exists, record in `drift.md` and route via `$rite-plan repair` instead of editing
+`spec.md` blind.
+
+- **`spec.md`** (these are the spec template's actual section headings — edit each named one,
+  don't collapse pairs):
+  - *Success criteria* **and** *Acceptance criteria* (separate sections) — add to **both** for
+    every opt-in **expansion**; remove (via the Guard) from both for every **reduction**. Each
+    must stay measurable + technology-agnostic.
+  - *Non-goals* — append every deferred item (from the YAGNI ledger + the Deferred register), so
+    it is neither silently dropped nor silently re-injected mid-build.
+  - *Constraints* **and** *Risks* (separate sections) — tighten *Constraints* where the pre-mortem
+    demands; add the top failure modes + mitigations to *Risks*.
+  - *Gaps, issues & decisions* table — one row per scope call (options offered → decision → owner).
+  - **Re-run the Readiness gate** at the bottom of the spec after edits; it must still pass, and
+    **every folded scope delta must trace to a recorded decision** (a `questions.md` qid or a
+    `decisions.md` ADR) — an untraceable change is the batch-dump failure.
+- **`decisions.md`** — one ADR-style entry per scope call and accepted trade-off:
+  `context · decision · why-not-the-alternative · what-would-change-it`.
+- **`assumptions.md`** — every "we'll probably need X" demoted to an explicit
+  **assumption-to-verify**, never smuggled into scope as a fact.
+
+## Write discipline
+- **Single canonical writer.** The skill writes `strategy.md` and edits the canonical files; the
+  `devrites-strategy-reviewer` agent is **read-only** and only returns findings + bands.
+- **No silent scope.** An expansion that the human didn't opt into, or a reduction that drops an
+  acceptance criterion without a recorded decision, is a defect — not a convenience.
+- Add `strategy.md` to the workspace between `spec.md` and `plan.md`; `$rite-define`,
+  `$rite-review`, and `$rite-seal` read it.

package/pack/generated/codex/skills/rite-vet/SKILL.md

@@ -0,0 +1,187 @@
+---
+name: rite-vet
+description: Vet a defined plan before code with senior-engineer engineering review. Use when the user says "vet the plan", "engineering review", "lock in the plan", or before building. Not for code review or final seal.
+argument-hint: "[slug] [--cross-model] [--full]"
+user-invocable: true
+---
+
+## Codex compatibility
+
+This is the Codex mirror of a DevRites skill. In Codex:
+
+- Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
+- Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
+- When this skill asks for a DevRites specialist or writer agent, **explicitly** spawn the matching Codex custom agent from `.codex/agents/devrites-*.toml` through Codex subagents (`spawn_agent`), then wait for its result and reconcile it as the skill instructs. Do not do the review inline just because the instruction to spawn is embedded here — Codex under-fires embedded spawn/skill instructions (openai/codex #23496), so treat the spawn as required, not optional.
+- The independence of a fresh-context subagent is the point. If Codex genuinely cannot spawn subagents in the current surface, run the documented inline fallback and **label the result an inline fallback, not an independent review** — an inline pass shares the calling context and is weaker evidence.
+- Codex project hooks are installed in `.codex/hooks.json`. Review and trust them with `/hooks` before relying on hook enforcement.
+- When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers — NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
+
+
+# $rite-vet — vet the plan before you build
+
+Take a defined plan and **vet** it the way a senior staff engineer would in a plan review:
+challenge the scope, walk architecture / plan code-quality / test-coverage / performance,
+calibrate every finding by confidence (and refuse to emit one you can't trace to a quoted
+line), design the test coverage the build will target, and map the failure modes and
+parallel lanes — *before* `$rite-build` writes a line. The one DevRites step that hardens
+the **implementation plan** at the engineering level and folds the result into the canonical
+contract, so the build follows a reviewed plan. Runs on **every** plan (depth scales to
+stakes; never skipped) and is always part of `$rite-autocomplete`; `--cross-model` adds a
+different-model second opinion. **Read the active workspace first**; if there's no
+`plan.md`, tell the user to run `$rite-define`.
+
+This is the engineering counterpart to `$rite-temper` (which is strategic, on the *spec*).
+Temper decides *the right thing*; vet decides *the right way to build it*.
+
+## Rules consulted (read on demand from `.agents/skills/devrites-lib/reference/standards/`)
+Pull on demand: `principles.md` (the project
+invariants gate — how `.devrites/principles.md` is scored pass/fail), `patterns.md` +
+`coding-style.md` (the over-engineering / reuse-first / YAGNI rubric — reuse the pack's
+standard), `testing.md` (the test-coverage axis) + `spec-grammar.md` (when the spec uses
+structured Requirement/Scenario blocks, each scenario is a coverage unit `test-plan.md` must
+map), `performance.md` (the perf axis),
+`error-handling.md` (failure-mode coverage), `development-workflow.md` (parallel lanes,
+definition of done), `afk-hitl.md` (irreversible-risk list + gate ceiling),
+`developer-experience.md` (when the plan ships a developer-facing surface — API / CLI / SDK /
+webhook / config / error messages / getting-started — predict the DX scorecard here),
+`elicitation.md` (the move-set to deepen an axis finding or a risky design choice — selected by
+the section's risk: Tournament for two viable designs, Delphi for a shaky estimate, Assumption
+Audit for a plan resting on unstated beliefs).
+- `definition-of-done.md` — standing Done bar: acceptance mapped, fresh proof, no open hard gates, scoped edits, rollback/docs where needed.
+
+
+## Operating rules
+- **Review the plan, not the spec's ambition.** The spec's scope/ambition is `$rite-temper`'s
+  job and is treated as settled here. Vet asks *given this scope, is this the right, simplest,
+  best-tested, lowest-risk way to build it* — and challenges only implementation scope creep.
+- **You harden the plan directly; the reviewer judges.** Vet *is* the plan-hardening phase, so
+  behavior-preserving plan refinements (test requirements, tightened scope boundaries, ordering,
+  parallel lanes, error-handling + failure-mode coverage) are written straight into
+  `plan.md` / `tasks.md` / `test-plan.md` — you are the single canonical writer. A finding that
+  changes **acceptance criteria or product behavior** is *not* a plan refinement: it routes
+  through the **Spec Drift Guard** (record in `drift.md`, recorded decision, then `$rite-plan
+  repair` for any structural reslice). Nothing that grows the build's scope lands without a
+  recorded human decision.
+- **Confidence over assertion.** Every finding carries a confidence band; a finding you cannot
+  back by quoting the plan/spec line (or the code it references) is forced to low confidence and
+  suppressed from the main report — see the verification gate in [`reference/review-axes.md`](reference/review-axes.md).
+- **Bound rigor by reversibility.** Auth / migration / public-API / data-model touches get
+  maximum conservatism and always pause (irreversible-risk list), regardless of run mode.
+- **Honest verdict, gated on the floor.** Never round "thin" up to "ready"; the axis verdict is
+  the weakest finding, not an average. Record every call's *why*.
+
+## Workflow
+0. **Read `.agents/skills/devrites-lib/reference/standards/core.md`** first.
+   Then **run the shared orientation preamble** — it prints `state.md`, the artifacts present,
+   the run mode (HITL/AFK), and the open-question tally by gate, so you orient deterministically
+   instead of re-deriving state from raw Markdown:
+   ```bash
+   devrites-engine preamble
+   devrites-engine snapshot
+   ```
+   Then the workspace: `plan.md`, `tasks.md`, `spec.md`
+   (for intent + acceptance), `strategy.md` (if `$rite-temper` ran), `decisions.md`,
+   `assumptions.md`, `design-brief.md` (if UI), `state.md`. Require a `plan.md` whose
+   Readiness gate passes (or `Plan approved`) — else STOP → `$rite-define`. Prefer a
+   code-intelligence index if available (see
+   `.agents/skills/devrites-lib/reference/standards/tooling.md`) for placement / blast-radius / reuse checks.
+1. **Calibrate depth — never skip** — [`reference/depth.md`](reference/depth.md). Every plan is
+   vetted; what scales is the *depth*. A simple, single-module, reversible plan with no
+   irreversible-risk / data-model / new-pattern trigger → **light pass** (brief scope check + a
+   one-line scan per axis + the acceptance→test map). Any full-pass trigger (or `--full`) → the
+   **full pass** below. There is no skip: every feature leaves a recorded engineering verdict and
+   a `test-plan.md` coverage map.
+2. **Scope Challenge (blocking gate)** — [`reference/review-axes.md`](reference/review-axes.md)
+   §0. Search prior archived decisions for the plan's main nouns before asking the human to re-decide:
+   `devrites-engine decisions search "<2-4 plan nouns>"` (run `decisions index` first if needed).
+   What already exists that solves a sub-problem (reuse vs rebuild)? The minimum diff for the
+   stated acceptance? Complexity smell (the plan touches **>8 files** or adds **>2 new
+   services/modules**) → **STOP and ask** before any axis. Verify each new pattern / infra choice
+   against a built-in (dispatch `devrites-source-driven`); completeness check (with AI, full
+   coverage is ~100× cheaper than the human-hours saved by a shortcut — prefer complete); and a
+   distribution check for any new artifact.
+2a. **Cross-artifact analyze gate + principles / charter / conventions gate.** Before the axes, run
+   one read-only consistency+coverage pass over `spec.md` + `plan.md` + `tasks.md` (+ `traceability.md`
+   if present); any **CRITICAL** — an acceptance criterion with no slice, a slice satisfying no
+   criterion, a contradiction across artifacts, a requirement stated twice with conflicting terms —
+   **blocks `$rite-build`** until resolved. The engine covers the deterministic floor (AC coverage,
+   orphan slices, vague adjectives); you add the semantic passes it can't: **terminology drift**
+   (the same concept named differently across artifacts — normalize to the spec's term) and
+   **duplicated or conflicting requirements**. Then score
+   the three project gates as explicit **pass/fail** on the planned approach:
+   - **Principles** (`.devrites/principles.md`, rubric in [`principles.md`](../devrites-lib/reference/standards/principles.md))
+     — the authored invariants the project will not break. A plan that bakes in a violation of a
+     declared principle with **no recorded, human-approved exception** is a **top-severity** finding,
+     walked **first**, and **blocks `$rite-build`**. Absent or empty file → none declared → passes;
+     **never block for the absence of principles**. A genuine need to break one routes to a scoped,
+     dated exception in the principles register — never a silent work-around (adding the exception is
+     an irreversible-risk decision: it always pauses for a human, even in AFK).
+   - **The anti-slop charter** (`coding-style.md` + `prose-style.md`) and **the conventions ledger**
+     (`.devrites/conventions.md`) — a plan that bakes in a god-module, a speculative abstraction with
+     no second caller, or a dependency where an in-repo option exists is a **top-severity** violation.
+   **Re-check all three after the axes harden the plan** (post-design). Write the result to `analysis.md`.
+   ```bash
+   devrites-engine analyze; echo "analyze rc=$?"
+   ```
+3. **Four-axis review** — [`reference/review-axes.md`](reference/review-axes.md), through the
+   senior-engineer lenses in [`reference/eng-lenses.md`](reference/eng-lenses.md): **Architecture
+   → Plan code-quality → Test-coverage design → Performance**, ≤8 findings per axis, each
+   `[severity] (confidence: N/10) <ref> — finding`. **Walk findings WITH the human, one at a
+   time** via `AskUserQuestion` (best-guess + why + options with effort/risk/maintenance, mapped
+   to a rule) — the artifact is the *output* of the review, not a substitute for it.
+   When an axis finding hinges on a genuinely open design choice or a shaky estimate, deepen that
+   one finding with a fitting technique from
+   [`elicitation.md`](../devrites-lib/reference/standards/elicitation.md) (Tournament for two viable
+   designs, Delphi for the estimate, Assumption Audit for unstated beliefs) before you band it. (AFK ceiling
+   single-sourced in [`reference/depth.md`](reference/depth.md): hardening /
+   coverage-increasing findings auto-apply; **anything that grows scope or changes acceptance is a
+   blocking pause**; irreversible-risk always pauses.)
+4. **Required outputs** — write every shape and fold-back required by
+   [`reference/artifacts.md`](reference/artifacts.md), using the review rules in
+   [`reference/review-axes.md`](reference/review-axes.md). Ground parallelization in:
+   ```bash
+   devrites-engine lanes plan "$(cat .devrites/ACTIVE 2>/dev/null)"
+   ```
+   Completion: every scenario and acceptance criterion maps to planned proof, every slice is
+   one-pass implementable, and developer-facing plans have a predicted `devex.md` scorecard.
+4a. **Forge gate (only when `Forge: yes`).** Apply the eligibility and scorecard contract in
+   [`rite-build/reference/forge.md`](../rite-build/reference/forge.md). Confirm and record
+   genuinely distinct strategies, or clear the flag; an ineligible Forge never reaches build.
+5. **Write `eng-review.md` + `test-plan.md`, fold back** — [`reference/artifacts.md`](reference/artifacts.md).
+   `eng-review.md` is the durable record; `test-plan.md` is the build-readable coverage target
+   (`$rite-build` and `$rite-prove` read it). Harden `plan.md` / `tasks.md` directly for
+   behavior-preserving refinements; route every acceptance/behavior-changing delta through the
+   **Spec Drift Guard** (`drift.md` + recorded decision + `$rite-plan repair`). Append
+   `decisions.md` (one ADR per material call) and `assumptions.md`. Update `state.md`:
+   `Phase: vet`, `Next step: $rite-build`; on a blocking pause write the `Awaiting human` block +
+   `Status: awaiting_human` before stopping.
+6. **Adversarial verification loop.** Apply the light/full branching contract in
+   [`reference/depth.md`](reference/depth.md). Full mode dispatches the fresh-context plan
+   reviewer, plus the devex predictor when applicable, for at most three repair iterations;
+   [`reference/cross-model.md`](reference/cross-model.md) owns the optional outside voice.
+   Completion: the final axis floor clears or a blocking gate is recorded.
+7. **STOP.** Report the scope verdict, the per-axis floor, the coverage gaps closed, and the
+   failure-mode criticals; recommend `$rite-build`.
+
+> **Mid-flight discipline.** When tempted to batch-dump findings into `eng-review.md` and skip
+> the walk-through, harden the plan past a finding that actually changes acceptance, score before
+> quoting the source, or wave through a complexity smell "to keep moving" — see
+> [`reference/anti-patterns.md`](reference/anti-patterns.md).
+
+## Output
+
+**Progress first** — run `devrites-engine progress`, then use the shared completion reply contract
+([`devrites-lib/reference/reply-contract.md`](../devrites-lib/reference/reply-contract.md)).
+Default success shape:
+```
+Done: plan vetted for <slug>; depth <light|full> with axis floor <band>.
+Changed: eng-review.md, test-plan.md, plan.md, decisions.md
+Evidence: coverage <x/y> planned; open findings Critical 0 / Important 0 / Suggestion <n>; reviewer loop <n>; outside-voice <ran|skipped-unavailable|disabled>
+Open: none
+Next: $rite-build
+Record: .devrites/work/<slug>/eng-review.md
+↻ Hygiene: /clear before $rite-build
+```
+If a blocker or Spec Drift Guard delta remains, use the shared `Stopped / blocked`
+form and route `Fix:` to `$rite-plan`; do not recommend `$rite-build`.
+**DO NOT write code, slice, or run the build here** — that's `$rite-build`. Vet reviews and hardens the plan; it never implements.