devrites 2.6.1 → 3.0.0

package/pack/.claude/skills/rite-seal/reference/go-no-go.md

@@ -17,16 +17,16 @@ the two in sync.
   human-approved exception — same standing as an unproven criterion (absent / empty file →
   none declared → not a blocker).
 - A **stood decision was never independently doubted** — a `## Decisions stood` entry in
-  `decisions.md` carrying `doubt: MISSING` (or `doubt-coverage.sh` rc=3) — when that decision
+  `decisions.md` carrying `doubt: MISSING` (or `devrites-engine doubt-coverage` rc=3) — when that decision
   is irreversible-risk (auth / public-API / migration). Severity rides the undoubted decision,
   not the exit code.
 - Any `questions.md` entry with `gate: validating` and `status: open` — **NO-GO
   regardless of behavior impact** (an open validating gate is merge-blocking by
   definition). A slice marked `built (pending review)` is not done.
-- A **test was weakened to go green** (`test-integrity.sh` exit 3 — a test deleted, skipped,
+- A **test was weakened to go green** (`devrites-engine test-integrity` exit 3 — a test deleted, skipped,
   `xfail`-ed, or de-asserted since the slice base). A suite that passes on a lowered bar is not
   proof; this is a Critical NO-GO.
-- Under `DEVRITES_MUTATION=enforce`, a **mutation score below threshold** (`mutation-gate.sh`
+- Under `DEVRITES_MUTATION=enforce`, a **mutation score below threshold** (`devrites-engine mutation-gate`
   exit 3 — survived mutants are behaviours no test actually checks).
 
 ## GO requires

package/pack/.claude/skills/rite-seal/reference/output.md

@@ -0,0 +1,7 @@
+# rite-seal output
+
+Run `devrites-engine progress` first, then render the canonical
+[`GO`](../../devrites-lib/reference/reply-contract.md#go) or
+[`NO-GO`](../../devrites-lib/reference/reply-contract.md#no-go) typed template.
+
+Do not imply anything shipped. `/rite-seal` decides only; `/rite-ship` executes.

package/pack/.claude/skills/rite-seal/reference/phase-contract.md

@@ -0,0 +1,211 @@
+# rite-seal phase contract
+
+## Execution spine
+
+Run the engine gates at these moments:
+
+```bash
+devrites-engine preamble
+
+devrites-engine spec-validate .devrites/work/<slug>; echo "spec-validate rc=$?"
+devrites-engine check-acceptance .devrites/work/<slug>; echo "check-acceptance rc=$?"
+devrites-engine evidence-fresh <slug>; echo "evidence-fresh rc=$?"
+devrites-engine doubt-coverage <slug>; echo "doubt-coverage rc=$?"
+
+devrites-engine footprint log <slug> reviewer devrites-<x>-reviewer
+devrites-engine footprint log <slug> skip devrites-<x>-reviewer
+devrites-engine footprint roster <slug>; echo "roster rc=$?"
+devrites-engine review-integrity <slug>; echo "review-integrity rc=$?"
+devrites-engine review-fingerprints --write <slug>
+
+devrites-engine footprint render <slug>
+devrites-engine learnings add "<slug>" "<dismissed-as-intentional class or dead-end>" dismiss
+devrites-engine health record <0..10> "<GO|NO-GO evidence summary>" --note "<top blocker or green proof>"
+devrites-engine timeline log completed --skill rite-seal --slug <slug> --outcome "<go|no-go>" --decision "<verdict>"
+
+devrites-engine progress
+```
+
+Conditional calls still obey the detailed rules below: reviewer and skip
+footprints must account for the whole roster; learnings run only on GO; progress
+is rendered before the final response from [`output.md`](output.md). Seal decides
+only; `/rite-ship` owns irreversible git/publish/deploy actions.
+
+1. **Run the shared orientation preamble** — it prints `state.md`, the artifacts present,
+   the run mode (HITL/AFK), and the open-question tally by gate, so you orient deterministically
+   instead of re-deriving state from raw Markdown:
+   ```bash
+   devrites-engine preamble
+   ```
+   Then read all artifacts: `brief.md`, `spec.md`, `plan.md`, `tasks.md`, `state.md`,
+   `decisions.md`, `assumptions.md`, `questions.md`, `drift.md`, `evidence.md`,
+   `browser-evidence.md`, `polish-report.md`, `review.md`, `design-brief.md` (if UI),
+   `devex.md` (if a developer-facing surface), `strategy.md` (if present), and the **final diff**. If a code-intelligence index is available
+   (see `.claude/skills/devrites-lib/reference/standards/tooling.md`), use it for
+   blast-radius checks on the final diff in step 5; context7 if available can confirm a current
+   external-API signature a reviewer flags.
+2. Check **acceptance criteria one by one** — first run `devrites-engine spec-validate .devrites/work/<slug>`;
+   unresolved or unproven `resolved/test` prohibitions are a NO-GO until the linked evidence exists.
+   Then use [final-evidence](final-evidence.md).
+   Each gets a checkbox + the evidence that proves it (or "unproven"). Verify each criterion
+   **independently against the evidence artifact** — the slice report or the build narrative is not
+   proof; the `devrites-spec-reviewer` + `devrites-test-analyst` fan-out in step 7 is the
+   independent cross-check (a verifier that never saw the optimistic narrative).
+3. Verify tests, build/typecheck/lint, and browser proof are present and green for the
+   scope. Re-run if cheap and in doubt. **For a UI feature with a `design-brief.md`**, read the
+   `## Visual Verdict` table in `browser-evidence.md`: a `FAIL` on an **acceptance-mapped**
+   criterion is an unmet acceptance criterion (NO-GO, per the severity gate), a declared-state
+   `FAIL` is **Important**, and a UI build whose brief exists but whose verdict is **absent** is an
+   Important evidence gap (the scorecard should have been emitted at browser-proof).
+4. Check unresolved **questions** and **drift** — any open item that changes product
+   behavior blocks. **Any `questions.md` entry with `gate: validating` and `status: open`
+   is a NO-GO regardless of behavior impact** (an open validating gate is merge-blocking by
+   definition); a slice marked `built (pending review)` is not done.
+4a. **Doubt coverage — every stood decision was independently doubted.** Run the deterministic
+   check, then judge it against `decisions.md`:
+   ```bash
+   devrites-engine doubt-coverage <slug>; echo "doubt-coverage rc=$?"
+   ```
+   The script reads two records `/rite-build` writes — the `## Decisions stood` ledger in
+   `decisions.md` (each entry ends `— doubt: <accept | reject-resolved | MISSING>`) and the `doubt`
+   footprint. Read the exit code:
+   - **rc=3** — the ledger records a stood decision with `doubt: MISSING`: doubt was definitively
+     skipped for a decision on record. **Important**; **NO-GO** when that decision is irreversible-risk
+     (auth / public-API / migration). This is the per-slice skip the footprint count alone can't catch.
+   - **rc=1** — zero doubt dispatched across the build. A **prompt to verify, not a finding**: confirm
+     against the ledger — an every-slice-trivial feature (`- none`) is a valid pass; a stood triggering
+     decision (boundary / data-model / auth / public-API / migration / branching) with no verdict is
+     the finding, same severity as rc=3.
+   - **rc=0** — covered, or not assessable (an inline build logs no dispatch — verify the ledger's
+     verdicts by hand).
+   Either way, walk the `## Decisions stood` ledger yourself: severity rides the unverified
+   **decision**, never the exit code alone.
+5. Check **security, data, migration, rollback** risk —
+   [risk-and-rollback](risk-and-rollback.md). If `strategy.md` exists (from
+   `/rite-temper`), confirm its **top pre-mortem risks are mitigated** in the diff/evidence and
+   that no **Non-goal / deferred item crept into the diff** (scope creep) — either is a finding
+   (an unmitigated top risk or smuggled-in out-of-scope work).
+   - **Principles** (`principles.md`): score the final diff against each declared invariant in
+     `.devrites/principles.md`. A violation with no matching, human-approved exception in the
+     register is a **Critical** finding and a NO-GO; an exception that is stale (past its review
+     trigger) or wider than its stated scope is itself a finding. No file / no principles → skip.
+   - **Observability** (`observability.md`): if the diff added a runtime surface (endpoint,
+     job, integration, user flow, error path), a feature shipping with no way to debug it in
+     prod is an **Important** finding, not a pass — `evidence.md` should show telemetry observed
+     to emit (`/rite-prove` step 5b).
+   - **Developer experience** (`developer-experience.md`): if the diff ships a developer-facing
+     surface, reconcile `devex.md` (the `/rite-vet` predicted scorecard vs the `/rite-prove`
+     measured one — the boomerang). A broken public dev contract (a documented command that errors,
+     a getting-started flow that can't complete) or an unexplained measured DX regression is
+     **Important** — **Critical** on a frozen public surface (`principles.md`). No surface → skip.
+   - **Removal / migration** (`deprecation.md`): if the diff deletes or migrates code, an API,
+     or data, confirm it followed expand→contract, proved the old path unused before removing it,
+     and carries a rollback for every destructive step. A surprise deletion or a one-shot
+     breaking migration is a finding (and trips the irreversible-risk gate, `afk-hitl.md`).
+6. Check **frontend polish** if UI is involved (states, a11y, responsive, design-system,
+   browser evidence).
+7. **Independent review** — seal is the final gate, not a re-run of `/rite-review`.
+   It **always re-spawns** the axes `/rite-review` did not cover: `devrites-test-analyst`,
+   `devrites-security-auditor`, `devrites-performance-reviewer`, and
+   `devrites-frontend-reviewer` (UI). It **only re-runs the Spec and Code-review axes**
+   (`devrites-spec-reviewer`, `devrites-code-reviewer`) when the diff changed since
+   `/rite-review` ran (compare against `review.md`); if the diff is unchanged, carry
+   review's verdicts on those axes forward rather than re-litigating them.
+   If subagents are available, fan out **in parallel** (one `Task` block, multiple tool
+   calls) to the **roster** — the seven reviewers and their checkable triggers are the single
+   source in [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md) (dispatch
+   shape + reconciliation there too; `.claude/skills/devrites-lib/reference/standards/agents.md` — "Run independent reviewers in
+   parallel"). Dispatch every always-on reviewer and every conditional whose trigger the diff
+   meets; `devrites-devex-reviewer` runs in **measure mode** — grade the measured DX scorecard
+   and reconcile the boomerang against the `/rite-vet` prediction. Give each the workspace path +
+   diff *without the author's reasoning*. If subagents are unavailable, run the equivalent
+   reviews sequentially yourself and flag each as a fallback.
+   The reviewer **AGENTS** here (fresh context, no author reasoning) are the seal
+   GATE; `devrites-audit` is the inline single-axis pass run during build/polish.
+   The two paths are intentional, not divergent — the inline audit catches issues
+   early; the fresh-context agents are the independent gate before ship.
+   **Footprint — account for the whole roster.** For each reviewer you dispatch, append
+   `devrites-engine footprint log <slug> reviewer devrites-<x>-reviewer` (the reviewer's **exact agent name** —
+   the roster gate matches on it, so a freehand label like `spec` will read as unaccounted); for
+   each roster reviewer you consciously do **not** dispatch, append
+   `devrites-engine footprint log <slug> skip devrites-<x>-reviewer` and note the one-line reason in `seal.md`.
+   A conditional reviewer that does not apply is a *recorded skip*, never a silent omission — step 7b
+   proves the roster complete before the verdict.
+7a. **Reconcile findings — confidence over volume.** Band each reviewer finding by confidence
+   (1–10); a low-confidence (≤4) finding that can't be verified against the diff is **suppressed**
+   to a `Suppressed (low-confidence): n` line, not a blocker. Every Critical/Important must cite
+   the `file:line` (or spec line) that proves it. Surface genuine cross-reviewer disagreement
+   **explicitly** rather than averaging it away, and don't let a pile of low-confidence nits
+   inflate the verdict — the gate is `Critical == 0` + acceptance + drift, not "few findings".
+   (A seal that fires noise teaches the next one to be ignored.)
+7b. **Account for the roster — no reviewer silently skipped.** Before the verdict, prove every
+   roster reviewer carries a decision (dispatched or skip-recorded in step 7's footprint):
+   ```bash
+   devrites-engine footprint roster <slug>; echo "roster rc=$?"
+   ```
+   - **rc=3** — a roster reviewer was neither dispatched nor skip-recorded: the silent omission
+     this gate exists to catch. **NO-GO** on the review's *completeness* (not the diff) — dispatch
+     the missing reviewer or record a justified skip, then re-run. Same standing as an unproven
+     criterion (severity gate).
+   - **rc=1** — an always-on axis (Spec / Code-review) was skip-recorded: legitimate **only** as a
+     carry-forward of `/rite-review`'s verdict on an **unchanged** diff (step 7). Confirm that;
+     otherwise dispatch it.
+   - **rc=0** — every reviewer accounted for; proceed.
+7c. **No silent reviewer — a zero-findings axis is justified, not assumed.** Confirm no adversarial
+   axis rubber-stamped: an axis that reported nothing must carry a `No-findings:` justification.
+   ```bash
+   devrites-engine review-integrity <slug>; echo "review-integrity rc=$?"
+   ```
+   - **rc=1** — an axis in `review.md` is silent (no finding, no justification): **Important** on the
+     review's completeness. Re-run that axis or record its `No-findings:` account, then re-seal.
+   - **rc=0** — every axis has findings or a justified clean bill; proceed. (No `review.md`, or a
+     freeform one, is a clean pass — the gate keys on per-axis sections.)
+   Then write stable finding IDs for learning and recurring-dismissal correlation:
+   ```bash
+   devrites-engine review-fingerprints --write <slug>
+   ```
+8. Decide GO / NO-GO — [go-no-go](go-no-go.md) — and write `seal.md`. Then render the
+   **fan-out footprint** into `seal.md` and the output — deterministic run-weight (subagents
+   dispatched · slices · wall-clock), **never a token or dollar figure** (DevRites can't
+   truthfully source one):
+   ```bash
+   devrites-engine footprint render <slug>
+   ```
+   Also emit a machine-readable verdict block into `seal.md` (so `/rite-autocomplete` can gate
+   without parsing prose):
+   ```json
+   { "feature": "<slug>", "verdict": "GO | NO-GO | CONDITIONAL-GO", "criticals": 0, "important": 0,
+     "acceptance": "<proven>/<total>", "test_integrity": "ok | weakened", "mutation": "<score | n/a>",
+     "blockers": ["<one line each, empty on GO>"] }
+   ```
+9. **On GO only — record proven conventions** to the local ledger
+   (`.devrites/conventions.md`) so later slices stop re-deriving this project's idioms:
+   the durable, *evidence-proven* commands / idioms / placement / gotchas this feature
+   established. Evidence-gated like the seal itself; the band is earned, not guessed; the
+   step degrades gracefully when unavailable. Full contract + command:
+   [conventions-ledger](conventions-ledger.md). (Skip entirely on NO-GO.)
+9a. **On GO only — auto-capture learnings** (`.devrites/learnings.md`). Learning is automatic, not a
+   command anyone must remember: append this feature's durable signal so the **next** feature's
+   review starts warmer — (a) any reviewer finding the gate **dismissed as intentional here** (a
+   "don't re-flag X in this project" class, tag `dismiss`); (b) a recurring correction or dead-end
+   worth not repeating (tag `note`). The review skills load this ledger **before** they fan out, so a
+   dismissed-finding class stops recurring. It is an untrusted prior — live code always overrides
+   (`.claude/skills/devrites-lib/reference/standards/security.md`). Promotion of a recurring lesson to a *project rule* stays the
+   human's call (`/rite-learn` — propose, don't impose). Skip on NO-GO.
+   ```bash
+   devrites-engine learnings add "<slug>" "<dismissed-as-intentional class or dead-end>" dismiss
+   ```
+10. **Record the durable phase traces.** Before the final output, record the health signal and
+    verdict event. The score is evidence-backed, not decorative: high for GO with green proof,
+    lower for NO-GO or unresolved blockers.
+    ```bash
+    devrites-engine health record <0..10> "<GO|NO-GO evidence summary>" --note "<top blocker or green proof>"
+    devrites-engine timeline log completed --skill rite-seal --slug <slug> --outcome "<go|no-go>" --decision "<verdict>"
+    ```
+
+## `seal.md` template
+
+Loaded on demand from [`seal-template.md`](seal-template.md). Fill in
+each section + write to `.devrites/work/<slug>/seal.md` as the durable record.
+
+> **Mid-flight discipline.** When tempted to round NO-GO up to GO, bypass the y/N prompt, average reviewer disagreements, or seal with unresolved drift — see [`anti-patterns`](anti-patterns.md). Load it the moment you reach for the excuse.

package/pack/.claude/skills/rite-seal/reference/seal-template.md

@@ -32,5 +32,5 @@ Verdict: GO / NO-GO
 <one paragraph: verdict + why>
 
 ## Footprint
-<deterministic fan-out from footprint.sh — subagents · slices · wall-clock; never tokens/cost>
+<deterministic fan-out from devrites-engine footprint — subagents · slices · wall-clock; never tokens/cost>
 ```

package/pack/.claude/skills/rite-ship/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: rite-ship
-description: Ship the sealed feature and close the task. Use when the user says "ship it" or "close the task", or right after /rite-seal returns GO. Not for the GO/NO-GO decision itself (use /rite-seal) or an unsealed feature.
+description: Ship the sealed feature: commit, push, tag, archive, close. Use when the user says "ship it", "push the branch", "tag the release", or "close the task" after /rite-seal GO. Not for GO/NO-GO readiness.
 argument-hint: "[feature-slug]"
 user-invocable: true
 ---
@@ -13,41 +13,32 @@ first**; if none, tell the user to run `/rite-spec <feature>`.
 
 Refuses to ship unless `seal.md` records a **GO** verdict.
 
-## Rules consulted (read on demand from `.claude/rules/`)
-**Step 0:** Read `.claude/rules/core.md` first. Then pull on demand:
+## Rules consulted (read on demand from `.claude/skills/devrites-lib/reference/standards/`)
+**Step 0:** Read `.claude/skills/devrites-lib/reference/standards/core.md` first. Then pull on demand:
 - `git-workflow.md` — Conventional Commits, atomic commits, the never-commit list.
 - `afk-hitl.md` — type-GO is the irreversible-action gate.
+- `definition-of-done.md` — final acceptance, evidence, drift, rollback, and documentation bar.
+- [`release/ship-checklist.md`](../devrites-lib/reference/standards/release/ship-checklist.md) — compact final ship and archive pass/fail sweep.
 
 ## Operating rules
 - **Seal GO is a precondition.** No GO in `seal.md` → stop, point at `/rite-seal`.
 - **Evidence must be fresh.** If any file in `touched-files.md` changed after
   `evidence.md` was written, the proof is stale → stop, point at `/rite-prove`. Enforced
-  deterministically by `evidence-fresh.sh` in step 1 (exit 3 = STALE), not by eyeballing
-  mtimes (see `.claude/rules/development-workflow.md`).
+  deterministically by `devrites-engine evidence-fresh` in step 1 (exit 3 = STALE), not by eyeballing
+  mtimes (see `.claude/skills/devrites-lib/reference/standards/development-workflow.md`).
 - **type-GO before anything irreversible.** Render the prompt verbatim and wait for
   the literal `GO`. Last safety net — render it every time, even under auto-trigger.
 - **Never delete the audit trail.** Closing *archives* the workspace; it never erases
   the `.md` files.
 
 ## Workflow
-1. **Run the shared orientation preamble** — it prints `state.md`, the artifacts present,
-   the run mode (HITL/AFK), and the open-question tally by gate, so you orient deterministically
-   instead of re-deriving state from raw Markdown:
-   ```bash
-   P=.claude/skills/devrites-lib/scripts/preamble.sh
-   [ -f "$P" ] || P="${CLAUDE_SKILL_DIR:-}/../devrites-lib/scripts/preamble.sh"
-   [ -f "$P" ] || P=pack/.claude/skills/devrites-lib/scripts/preamble.sh
-   [ -f "$P" ] && bash "$P" || echo "(orientation preamble unavailable on this install — read state.md directly to orient)"
-   ```
+1. **Orient.** Run `devrites-engine preamble` for deterministic workspace orientation.
    Then read `seal.md`, `state.md`, `spec.md`, `touched-files.md`, `evidence.md`, and
    `design-brief.md` (if the feature is UI — the design-memory rollup in step 2a reads it).
    Confirm the verdict is **GO**, then run the deterministic evidence-freshness gate rather than
    eyeballing mtimes (mirrors `/rite-seal`):
    ```bash
-   E=.claude/skills/devrites-lib/scripts/evidence-fresh.sh
-   [ -f "$E" ] || E="${CLAUDE_SKILL_DIR:-}/../devrites-lib/scripts/evidence-fresh.sh"
-   [ -f "$E" ] || E=pack/.claude/skills/devrites-lib/scripts/evidence-fresh.sh
-   [ -f "$E" ] && { bash "$E"; echo "evidence-fresh rc=$?"; } || echo "(evidence-fresh gate unavailable — compare mtimes by hand)"
+   devrites-engine evidence-fresh; echo "evidence-fresh rc=$?"
    ```
    **Exit 3 → STALE proof: STOP**, point at `/rite-prove` (a polish/review edit made after
    `/rite-prove` invalidates the proof). Not GO → stop with the single resume command.
@@ -55,68 +46,56 @@ Refuses to ship unless `seal.md` records a **GO** verdict.
    a stale `ACTIVE` or corrupt workspace here risks shipping or closing the wrong feature.
    Advisory: surface issues, don't block.
    ```bash
-   D=.claude/skills/devrites-lib/scripts/doctor.sh
-   [ -f "$D" ] || D="${CLAUDE_SKILL_DIR:-}/../devrites-lib/scripts/doctor.sh"
-   [ -f "$D" ] || D=pack/.claude/skills/devrites-lib/scripts/doctor.sh
-   [ -f "$D" ] && { bash "$D"; echo "doctor rc=$?"; } || true
+   devrites-engine doctor; echo "doctor rc=$?"
    ```
    If it flags the active feature, confirm you're shipping the intended slug before proceeding.
 2. Build the git plan from `git-workflow.md` + the project's own convention: the
-   Conventional-Commit message(s), the target branch, and whether a tag / PR applies.
-   Scope the commit to `touched-files.md`; never stage secrets or out-of-scope files.
-2a. **Design memory (optional, UI features only).** If the feature shipped UI, offer to roll
-   its *proven* design language up into a project-level `DESIGN.md` so the next feature
-   inherits the system instead of re-discovering it
-   ([reference/design-memory.md](reference/design-memory.md)). **Opt-in and confirmed** —
-   present the option set (default **skip**; persisting beyond feature scope is the user's
-   call), and on yes append `DESIGN.md` to `touched-files.md` so it ships *in this commit*.
-   Skip silently when there's no UI. Record the outcome in `ship.md`.
+   Conventional-Commit message(s), commit trailers for non-trivial work, the target branch, and
+   whether a tag / PR applies. Derive trailers from `decisions.md`, `assumptions.md`, `seal.md`,
+   and `evidence.md`: `Constraint`, `Rejected`, `Confidence`, `Scope-risk`, `Not-tested` when
+   present; skip trailers for trivial typo/formatting commits. Scope the commit to
+   `touched-files.md`; never stage secrets or out-of-scope files.
+   **Completion:** message, trailers, target branch, tag/PR choice, and exact staged scope are explicit.
+2a. **Design memory (UI only).** Follow
+   [`reference/design-memory.md`](reference/design-memory.md). Completion: the confirmed
+   outcome is recorded, and any `DESIGN.md` edit is in `touched-files.md`; non-UI skips.
+2b. **Capability ledger sync.** Follow [`reference/ledger.md`](reference/ledger.md).
+   Completion: proven capability deltas are previewed, the confirmed outcome is recorded,
+   and every synced ledger file is in `touched-files.md`.
+2c. **Credential guard (blocking for HIGH).** Before the irreversible type-GO prompt, scan staged
+   and touched files plus any PR body draft. HIGH blocks ship and tells the user to rotate/redact;
+   MEDIUM asks for confirmation and records the exception in `ship.md`; LOW is FYI.
+   ```bash
+   devrites-engine secret-scan --staged; echo "secret-scan rc=$?"
+   ```
+   **rc=3 → STOP**: do not type-GO, commit, push, or archive.
 3. **Render the type-GO prompt** ([reference/git-ship.md](reference/git-ship.md)) and
    wait. Only the literal `GO` proceeds; anything else cancels — record the cancel in
    `ship.md` and stop (do not retry without the user asking).
 4. On `GO`: run the git ladder — commit → push → tag / PR as applicable
    ([reference/git-ship.md](reference/git-ship.md)). Capture the commit SHA(s),
    branch, and tag/PR URL.
-4a. **When opening a PR, render a structured body** — not just the commit message:
-   **Summary** (what shipped + acceptance n/total) · **Risk & rollback** (the migration /
-   destructive / auth touches + how to revert, from `seal.md`'s risk scan) · **What to scrutinize**
-   (point reviewers at the highest-blast-radius hunks) · **Evidence** (a condensed `evidence.md` +
-   the seal's reconciled reviewer-verdict digest, linking the full `.devrites/archive/<slug>/`
-   bundle). **Delete any N/A section** — an empty Risk block is noise.
-4b. **Promote architecturally-significant decisions to ADRs.** For each `decisions.md` ADR that
-   records a *durable* architecture / interface choice (not a slice-local call), append it to a
-   persistent `docs/adr/ADR-NNN.md` — Nygard shape (Context · Decision · Status `accepted` ·
-   Consequences), **append-only**, never rewritten; supersede with a new ADR that links the old.
-   The per-feature `decisions.md` is archived with the workspace; the ADR keeps the load-bearing
-   *why* discoverable in the repo. Skip if the project keeps no `docs/adr/` and the user doesn't want one.
+4a. **PR branch only.** Render the structured body from
+   [`reference/git-ship.md`](reference/git-ship.md#pull-request-body); omit empty sections.
+4b. **Durable architecture decisions only.** Apply
+   [`reference/adr-promotion.md`](reference/adr-promotion.md); slice-local decisions stay in
+   the archived workspace.
 5. Write `ship.md` ([reference/ship-template.md](reference/ship-template.md)): what
    shipped, SHA(s), branch, tag/PR, acceptance summary (n/total), link to `seal.md`,
    follow-ups.
 6. **Close the task** ([reference/close-out.md](reference/close-out.md)): set
    `state.md` phase `done`, then run
-   `bash .claude/skills/devrites-lib/scripts/close-out.sh <slug>` to archive
+   `devrites-engine close-out <slug>` to archive
    `.devrites/work/<slug>/` → `.devrites/archive/<slug>/` and clear `.devrites/ACTIVE`.
-   Every `.md` is preserved in the archive.
-6a. **Cross-feature retro (automatic, cadence-gated, advisory).** The just-shipped feature is now in
-   the archive, so this is where the **cross-feature** learning loop closes on its own — the synthesis
-   that otherwise waits for a human to run `/rite-learn`. Run the cheap cadence gate first; it stays
-   silent unless a finding/drift class recurs across **>=2 shipped features** with new signal since the
-   last review (so it never fires on an early or one-off ship):
+   Every `.md` is preserved in the archive. Then refresh any managed project context block so
+   `AGENTS.md` / `CLAUDE.md` no longer advertise a closed active workspace:
    ```bash
-   L=.claude/skills/devrites-lib/scripts/learnings.sh
-   [ -f "$L" ] || L="${CLAUDE_SKILL_DIR:-}/../devrites-lib/scripts/learnings.sh"
-   [ -f "$L" ] || L=pack/.claude/skills/devrites-lib/scripts/learnings.sh
-   [ -f "$L" ] && bash "$L" nudge || true
+   devrites-engine context sync || true
    ```
-   **If the nudge emits** (a recurring pattern crossed the threshold), dispatch the read-only
-   `devrites-retrospector` (`.claude/agents/`) over `.devrites/archive/` for the cross-feature
-   synthesis. Persist its digest to `.devrites/retro.md` (append a dated entry — the project-level
-   retro ledger, never rewritten) and surface the **graduation candidates** with a one-line pointer
-   to `/rite-learn`, which is where the human confirms a promotion to a rule / principle / convention.
-   **Propose, never impose:** retro **drafts**; it never auto-writes a rule or principle (a principle
-   is a gate, amended deliberately and dated — `principles.md` governance), and it never blocks the
-   ship, which has already happened. If the nudge is silent, skip — no retro this close. Then `touch
-   .devrites/.learnings-reviewed` only when the human acts on it via `/rite-learn`, not here.
+6a. **Cross-feature retro.** Run the cadence-gated advisory branch in
+   [`reference/close-out.md`](reference/close-out.md#cross-feature-retro). Completion: a
+   silent nudge does nothing; a real recurrence is appended to `.devrites/retro.md` and
+   surfaced to `/rite-learn`, never auto-promoted.
 
 > **Mid-flight discipline.** When tempted to ship without a GO seal, skip the type-GO,
 > stage files outside `touched-files.md`, or delete the workspace instead of archiving
@@ -125,17 +104,8 @@ Refuses to ship unless `seal.md` records a **GO** verdict.
 
 ## Output
 
-**Footer first** — render the flow ribbon by running the progress footer (`progress.sh`, resolved like the step-0 preamble — canonical snippet in `devrites-lib/SKILL.md`); at ship it reads `ship ✓` across the spine. Keep the fact lines below it terse (`key value · key value`). Then:
-```
-Shipped: <feature>
-Commit:  <sha> on <branch>    Tag/PR: <ref | none>
-Acceptance: <n/total> proven
-Archived: .devrites/archive/<slug>/    ·    ACTIVE cleared
-ship.md:  .devrites/archive/<slug>/ship.md
-Retro:    <n graduation candidates drafted → .devrites/retro.md · promote with /rite-learn | quiet (no cross-feature signal yet)>
-```
+**Progress first** — run `devrites-engine progress`, then use the Shipped typed template from
+the shared completion reply contract
+([`reply-contract.md` § Shipped](../devrites-lib/reference/reply-contract.md#shipped)).
 If the user declined type-GO: state that nothing shipped, the seal still reads GO, and
 the resume command (`/rite-ship`).
-
-End with `↻ Hygiene: /clear` — the feature is closed; start the next with
-`/rite-spec <feature>`. See `.claude/rules/context-hygiene.md`.

package/pack/.claude/skills/rite-ship/reference/adr-promotion.md

@@ -0,0 +1,9 @@
+# ADR promotion
+
+Promote only durable architecture or interface decisions from `decisions.md`; slice-local
+calls remain in the archived workspace. If the project has no `docs/adr/`, ask before
+creating that convention.
+
+Write the next append-only `docs/adr/ADR-NNN.md` with Context, Decision, Status
+`accepted`, and Consequences. Never rewrite an accepted ADR; supersede it with a new ADR
+that links the old one. Add every promoted ADR to `touched-files.md` before shipping.

package/pack/.claude/skills/rite-ship/reference/anti-patterns.md

@@ -4,7 +4,7 @@ Load this before any irreversible action — `git commit`, `push`, `tag`, publis
 — or when tempted to skip the close-out.
 
 Pack-wide rationalizations + red flags: see
-[rules/anti-patterns.md](../../../rules/anti-patterns.md).
+[standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-patterns.md).
 
 ## Phase-specific rationalizations
 

package/pack/.claude/skills/rite-ship/reference/close-out.md

@@ -9,7 +9,7 @@ deleted. DevRites keeps the full audit trail; it just moves out of the live path
    of `/rite-spec <next feature>`.
 2. **Archive.** Run the deterministic script:
    ```bash
-   bash .claude/skills/devrites-lib/scripts/close-out.sh <slug>
+   devrites-engine close-out <slug>
    ```
    It moves `.devrites/work/<slug>/` → `.devrites/archive/<slug>/` (every `.md`
    intact) and clears `.devrites/ACTIVE` **only if** ACTIVE still points at `<slug>`.
@@ -29,3 +29,14 @@ deleted. DevRites keeps the full audit trail; it just moves out of the live path
 To resume archived work, move it back:
 `mv .devrites/archive/<slug> .devrites/work/<slug>` and write `<slug>` into
 `.devrites/ACTIVE`. Nothing is lost — close-out is reversible by design.
+
+## Cross-feature retro
+
+After archive, run `devrites-engine learnings nudge`. It stays silent until a
+finding/drift class recurs across at least two shipped features with new signal.
+
+When it emits, dispatch the read-only `devrites-retrospector` over
+`.devrites/archive/`, append its dated digest to `.devrites/retro.md`, and surface
+graduation candidates to `/rite-learn`. The retro proposes; only `/rite-learn` may
+promote a rule, principle, or convention. Mark `.devrites/.learnings-reviewed` only
+after the human acts there.

package/pack/.claude/skills/rite-ship/reference/design-memory.md

@@ -16,8 +16,8 @@ language → feature N+1 builds to it.
 - **At ship, GO sealed, after the git plan, before type-GO** (step 2a) — so the user sees
   the full staged change set (code + `DESIGN.md`) under the single type-GO that ships it.
 - **Opt-in and confirmed.** Persisting to a project-wide artifact is outside feature scope
-  (`rules/core.md` rule 7) — so it is *never silent*. Present a ranked option set
-  (`rules/afk-hitl.md` — Option set); **default is skip**. The user opts to persist.
+  (`standards/core.md` rule 7) — so it is *never silent*. Present a ranked option set
+  (`standards/afk-hitl.md` — Option set); **default is skip**. The user opts to persist.
 - **AFK**: first-time `DESIGN.md` *creation* is treated as a `validating` gate (a new
   persistent project artifact) — propose + queue, don't auto-create. An *append* to an
   existing `DESIGN.md` is `advisory` and may auto-proceed when `allow_gates` permits, since

package/pack/.claude/skills/rite-ship/reference/git-ship.md

@@ -26,13 +26,32 @@ Rules for the prompt:
 
 ## The git ladder
 
-Follow `.claude/rules/git-workflow.md` and the project's own convention. Do not invent
+Follow `.claude/skills/devrites-lib/reference/standards/git-workflow.md` and the project's own convention. Do not invent
 a release flow the project doesn't use.
 
+0. **Collapse checkpoints** (only if checkpoint mode ran — see
+   [rite-build/reference/checkpoint.md](../../rite-build/reference/checkpoint.md)). Local
+   `WIP(<slug>)` commits are scratch; fold them into the working tree so the ship is one
+   atomic feature commit. `reset --soft` moves only the branch pointer — index and worktree
+   are untouched, so no change is ever lost:
+   ```bash
+   base=$(git rev-parse --abbrev-ref '@{upstream}' 2>/dev/null) || base=main
+   mb=$(git merge-base HEAD "$base" 2>/dev/null)
+   if [ -n "$mb" ] && git log --format='%s' "$mb..HEAD" | grep -q '^WIP('; then
+     git log --format='%s' "$mb..HEAD" | grep -qv '^WIP(' \
+       && echo "history since $base mixes WIP + real commits — surface and confirm before collapsing" \
+       || git reset --soft "$mb"   # fold every WIP commit since the branch point → staged
+   fi
+   ```
+   No WIP commits (checkpoint mode was off) → this is a silent no-op.
 1. **Stage** only the files in `touched-files.md`. Never `git add -A`; never stage
    secrets, `.env`, or out-of-scope files (see the never-commit list in `git-workflow.md`).
 2. **Commit** with a Conventional Commit message derived from the feature (`feat(scope):
    …` / `fix(scope): …`). Atomic — one logical change. Put the *why* in the body.
+   For non-trivial features, append trailers from the workspace record:
+   `Constraint:` from binding principles/irreversible risks, `Rejected:` from material alternatives,
+   `Confidence:` from `seal.md`, `Scope-risk:` from the blast-radius scan, and `Not-tested:` for
+   known proof gaps. Skip trailers for typos and pure formatting.
 3. **Push** to the target branch (the feature branch, or per the project's trunk
    convention).
 4. **Tag / PR** only if the project does it: cut a tag when the project tags releases,
@@ -40,3 +59,15 @@ a release flow the project doesn't use.
    is the ship.
 
 Capture the resulting commit SHA(s), branch, and tag/PR URL for `ship.md`.
+
+## Pull request body
+
+When this ship opens a PR, include only applicable sections:
+
+- **Summary** — what shipped and acceptance proven.
+- **Risk & rollback** — migration/auth/destructive risk and reversal from `seal.md`.
+- **What to scrutinize** — highest-blast-radius review stops.
+- **Evidence** — condensed proof plus the archived evidence bundle.
+
+For an agent-owned staged rollout, apply [`rollout.md`](rollout.md). CI-owned deploys
+skip that branch. Delete empty sections rather than writing `N/A`.

package/pack/.claude/skills/rite-ship/reference/ledger.md

@@ -0,0 +1,56 @@
+# Capability ledger — the living "what the system does now" layer
+
+The ledger is DevRites' cumulative spec store: `.devrites/specs/<capability>/spec.md`, a flat
+list of proven `### Requirement:` blocks per capability. Unlike a feature workspace — which is
+archived away on close — the ledger **persists** and accumulates, so feature N+1 starts from the
+proven contract of every feature before it instead of re-deriving from code.
+
+It lives outside `.devrites/work/`, so close-out's archival never touches it. It is written only
+here, on ship, and only from behavior that just passed the seal GO + evidence-freshness gate — so
+the ledger records *proven* truth, never merely proposed.
+
+## Fold semantics
+
+A feature's `spec.md` carries **deltas** grouped under capability-tagged H2 sections
+(`## ADDED Requirements — capability: <c>`, `MODIFIED`, `REMOVED`) — see
+[`spec-grammar.md`](../../devrites-lib/reference/standards/spec-grammar.md) § Delta form.
+`devrites-engine ledger sync` groups them by capability and folds each into its ledger spec:
+
+- **ADDED** → append the block (upsert: replaces in place on a re-sync, so sync is idempotent)
+- **MODIFIED** → replace the same-named block with the full new version
+- **REMOVED** → delete the block (an emptied capability spec is dropped)
+
+Matching is by **requirement header identity**. A flat feature spec (no delta H2 sections) folds
+as all-ADDED into the capability named by the feature slug.
+
+## Sync workflow (rite-ship step 2b)
+
+Runs **before the commit** so the ledger change ships in the same commit as the code that proves it.
+
+1. Preview the fold — deterministic, zero-token:
+   ```bash
+   devrites-engine ledger diff .devrites/work/<slug>
+   ```
+2. **Opt-in and confirmed** (mirrors the design-memory rollup): present the option set — default
+   is to sync, since a shipped feature's proven behavior belongs in the ledger; the escape hatch
+   is skip (the feature ships without updating the living spec — a deliberate call, e.g. an
+   internal-only change with no capability contract).
+3. On yes:
+   ```bash
+   devrites-engine ledger sync .devrites/work/<slug>
+   ```
+   Then append each written `.devrites/specs/<capability>/spec.md` to `touched-files.md` so it is
+   staged and committed at the git ladder (step 4). Record the synced capabilities in `ship.md`.
+   **The ledger must be git-tracked.** Most of `.devrites/` is runtime state a project gitignores;
+   `specs/` is the exception (durable shared truth). If a `git status` / `git check-ignore` shows
+   the ledger path ignored, the commit would silently drop it — carve it out first:
+   `.devrites/*` + `!.devrites/specs/`. Surface this rather than shipping a ledger that never lands.
+4. Skip when the feature declares no requirements (a pure refactor / chore with no spec deltas).
+
+## Reading the ledger (earlier phases)
+
+`/rite-spec` and `/rite-adopt` consult the ledger before writing a new spec:
+```bash
+devrites-engine ledger list            # capabilities + requirement counts
+devrites-engine ledger show <capability>   # the proven contract to write deltas against
+```