devrites 2.6.1 → 3.0.1

package/scripts/check-reply-contract.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# check-reply-contract.sh — keep user-facing rite-* completion replies normalized.
+
+set -u
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SKILLS="${DEVRITES_SKILLS_DIR:-$ROOT/pack/.claude/skills}"
+CONTRACT="devrites-lib/reference/reply-contract.md"
+fail=0
+
+bad() {
+  printf 'FAIL: %s\n' "$*"
+  fail=1
+}
+
+for f in "$SKILLS"/rite*/SKILL.md; do
+  [ -f "$f" ] || continue
+  rel="${f#"$ROOT"/}"
+
+  if grep -qE '^## Output' "$f"; then
+    if ! grep -q "$CONTRACT" "$f" && ! grep -q 'Reply-contract exception:' "$f"; then
+      bad "$rel has ## Output but does not reference $CONTRACT or declare Reply-contract exception"
+    fi
+  fi
+
+  case "$rel" in
+    pack/.claude/skills/rite/SKILL.md)
+      continue
+      ;;
+  esac
+
+  # Obvious menu-style next actions make lifecycle replies hard to scan. The
+  # contract allows one command only; alternates belong in Open/Alternative.
+  if grep -nE '^Next:[^`]*(/rite-[^[:space:]]+)[^`]*([[:space:]]or[[:space:]]|[[:space:]]/[[:alnum:]_-]+| · |→)' "$f" >/tmp/dr_reply_next 2>/dev/null; then
+    bad "$rel has ambiguous Next: wording:"
+    sed "s|$ROOT/||" /tmp/dr_reply_next
+  fi
+
+  if grep -q 'Reply-contract exception:' "$f" || [ "$rel" = "pack/.claude/skills/rite-status/SKILL.md" ]; then
+    continue
+  fi
+  if awk '
+    /^```/ {
+      if (inside && done && bad) exit 0
+      inside = !inside
+      done = bad = 0
+      next
+    }
+    inside && /^Done:/ { done = 1 }
+    inside && tolower($0) ~ /(^|[^a-z])(fail|not run|blocker|blocked|unproven|awaiting|spec drift|re-prove needed)([^a-z]|$)/ { bad = 1 }
+    inside && /Critical <n>|principle violations <n>|boundary held <yes\|no>/ { bad = 1 }
+    END { exit !(inside && done && bad) }
+  ' "$f"; then
+    bad "$rel puts an unresolved state in a Done template; use Awaiting/Stopped/NO-GO"
+  fi
+done
+
+if [ "$fail" -eq 0 ]; then
+  printf 'reply-contract: PASS\n'
+else
+  printf 'reply-contract: FAIL\n'
+fi
+
+exit "$fail"

package/scripts/check-rule-uniqueness.sh

@@ -18,8 +18,9 @@ PACK="$ROOT/pack/.claude"
 
 # Format: <grep-pattern>|<canonical-relative-path>
 PRINCIPLES=(
-  '^## Reuse before you write|pack/.claude/rules/coding-style.md'
-  '^## Trust boundary (three tiers)|pack/.claude/rules/security.md'
+  '^## Reuse before you write|pack/.claude/skills/devrites-lib/reference/standards/coding-style.md'
+  '^## Trust boundary (three tiers)|pack/.claude/skills/devrites-lib/reference/standards/security.md'
+  '^## Universal rationalizations|pack/.claude/skills/devrites-lib/reference/standards/anti-patterns.md'
 )
 
 fail=0
@@ -30,7 +31,7 @@ for entry in "${PRINCIPLES[@]}"; do
   # Use literal-string grep (-F) to avoid regex meta-char surprises in headings.
   # Match anchored to line start by adding the '## ' prefix ourselves.
   needle="${pattern#^}"
-  matches="$(grep -rln -F -- "$needle" "$PACK"/rules "$PACK"/skills "$PACK"/agents 2>/dev/null | sort -u)"
+  matches="$(grep -rln -F -- "$needle" "$PACK"/skills "$PACK"/agents 2>/dev/null | sort -u)"
   count="$(printf '%s\n' "$matches" | grep -c .)"
   if [ "$count" -eq 1 ] && [ "$matches" = "$ROOT/$canonical" ]; then
     printf 'ok: unique heading "%s" (canonical: %s)\n' "$needle" "$canonical"
@@ -41,33 +42,4 @@ for entry in "${PRINCIPLES[@]}"; do
   fi
 done
 
-# Anti-rationalization table: core.md keeps a minimal 5-row subset that MUST be
-# byte-identical to the matching rows in anti-patterns.md (the single source of
-# the full table). The unique-heading check above can't see this — the rows live
-# under the same heading in both files — so assert the 5 shared excuse strings
-# (the excuse-column text, stable across both files) appear verbatim in both.
-# These cover the five rows core.md duplicates:
-#   tests-later / small-refactor / special-case / user-will-tell / lint-and-build.
-CORE="$PACK/rules/core.md"
-ANTI="$PACK/rules/anti-patterns.md"
-SHARED_EXCUSES=(
-  '"I'\''ll add the tests later."'
-  '"It'\''s only a small refactor while I'\''m in here."'
-  '"This is a special case, the pattern doesn'\''t apply."'
-  '"The user will tell me if something is wrong."'
-  '"Lint and build pass — that proves quality."'
-)
-for excuse in "${SHARED_EXCUSES[@]}"; do
-  in_core=0; in_anti=0
-  grep -qF -- "$excuse" "$CORE" 2>/dev/null && in_core=1
-  grep -qF -- "$excuse" "$ANTI" 2>/dev/null && in_anti=1
-  if [ "$in_core" -eq 1 ] && [ "$in_anti" -eq 1 ]; then
-    printf 'ok: shared excuse present in core.md + anti-patterns.md: %s\n' "$excuse"
-  else
-    printf 'FAIL: shared excuse must appear verbatim in BOTH core.md and anti-patterns.md: %s (core=%d anti=%d)\n' \
-      "$excuse" "$in_core" "$in_anti" >&2
-    fail=1
-  fi
-done
-
 exit "$fail"

package/scripts/codex-generate.sh

@@ -0,0 +1,300 @@
+#!/usr/bin/env bash
+# codex-generate.sh — shared Claude-to-Codex surface generators.
+#
+# This file is a shell library, not a standalone installer. Callers provide
+# TMP_GEN_DIR and then invoke the gen_* helpers below.
+
+gen_codex_markdown_file() {
+  local _src="$1" _out="$2"
+  mkdir -p "$(dirname "$_out")"
+  sed -E \
+    -e 's#pack/\.claude/skills/devrites-lib/scripts/#.agents/skills/devrites-lib/scripts/#g' \
+    -e 's#pack/\.claude/skills/#.agents/skills/#g' \
+    -e 's#pack/\.claude/agents/(devrites-[A-Za-z0-9_-]+)\.md#.codex/agents/\1.toml#g' \
+    -e 's#pack/\.claude/agents/#.codex/agents/#g' \
+    -e 's#\.claude/skills/devrites-lib/scripts/#.agents/skills/devrites-lib/scripts/#g' \
+    -e 's#\.claude/skills/#.agents/skills/#g' \
+    -e 's#\.claude/agents/(devrites-[A-Za-z0-9_-]+)\.md#.codex/agents/\1.toml#g' \
+    -e 's#\.claude/agents/#.codex/agents/#g' \
+    -e 's#\.\./\.\./\.\./agents/(devrites-[A-Za-z0-9_-]+)\.md#.codex/agents/\1.toml#g' \
+    -e 's#\.\./\.\./agents/(devrites-[A-Za-z0-9_-]+)\.md#.codex/agents/\1.toml#g' \
+    -e 's#(^|[^A-Za-z0-9_./-])/(rite(-[a-z0-9-]+)?)([^A-Za-z0-9_-]|$)#\1$\2\4#g' \
+    "$_src" > "$_out"
+}
+
+gen_codex_skill_file() {
+  _src="$1"; _out="$2"; _internal="${3:-0}"
+  _tmp="$TMP_GEN_DIR/codex-skill-raw-$(basename "$(dirname "$_src")").md"
+  mkdir -p "$(dirname "$_out")"
+  # Internal (explicit-only) skills: replace the frontmatter description with a short stub in the
+  # Codex mirror. Codex uses the description ONLY to build its 2% skills-list for implicit matching;
+  # an explicit-only skill is never matched, so its full description is pure budget waste. Stubbing
+  # the 12 internal skills frees that budget so the user-facing rite-* descriptions fit un-shortened
+  # and keep matching reliably. Explicit `$name` invocation and the full SKILL.md body are untouched.
+  awk -v internal="$_internal" '
+    BEGIN { fm = 0; inserted = 0 }
+    NR == 1 && $0 == "---" { print; fm = 1; next }
+    fm && internal == "1" && /^description:/ {
+      print "description: Internal DevRites skill; DevRites agents invoke it explicitly, not by prompt match."
+      next
+    }
+    fm && $0 == "---" {
+      print
+      print ""
+      print "## Codex compatibility"
+      print ""
+      print "This is the Codex mirror of a DevRites skill. In Codex:"
+      print ""
+      print "- Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them."
+      print "- Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation."
+      print "- When this skill asks for a DevRites specialist or writer agent, **explicitly** spawn the matching Codex custom agent from `.codex/agents/devrites-*.toml` through Codex subagents (`spawn_agent`), then wait for its result and reconcile it as the skill instructs. Do not do the review inline just because the instruction to spawn is embedded here — Codex under-fires embedded spawn/skill instructions (openai/codex #23496), so treat the spawn as required, not optional."
+      print "- The independence of a fresh-context subagent is the point. If Codex genuinely cannot spawn subagents in the current surface, run the documented inline fallback and **label the result an inline fallback, not an independent review** — an inline pass shares the calling context and is weaker evidence."
+      print "- Codex project hooks are installed in `.codex/hooks.json`. Review and trust them with `/hooks` before relying on hook enforcement."
+      print "- When this skill asks a HITL question via `AskUserQuestion`: Codex'\''s equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers — NEVER silently pick an option yourself; auto-picking is AFK'\''s contract, gated by the `.devrites/AFK` sentinel."
+      print ""
+      fm = 0
+      inserted = 1
+      next
+    }
+    { print }
+    END {
+      if (!inserted) {
+        print ""
+        print "## Codex compatibility"
+        print ""
+        print "Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`, use matching `.codex/agents/devrites-*.toml` custom agents for DevRites subagent dispatch, and trust `.codex/hooks.json` with `/hooks` before relying on hooks."
+      }
+    }
+  ' "$_src" > "$_tmp"
+  gen_codex_markdown_file "$_tmp" "$_out"
+}
+
+toml_escape() {
+  printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'
+}
+
+# Generate a Codex custom-agent TOML file from a Claude Code markdown agent.
+# Codex does not consume .claude/agents/*.md directly; it loads project agents
+# from .codex/agents/*.toml.
+gen_codex_agent() {
+  local _src="$1" _out="$2"
+  local _name _desc _desc_tmp _desc_codex _tools _body_tmp _body_codex
+  _name="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^name:[[:space:]]*/{sub(/^name:[[:space:]]*/, ""); print; exit}' "$_src")"
+  _desc="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^description:[[:space:]]*/{sub(/^description:[[:space:]]*/, ""); print; exit}' "$_src")"
+  [ -n "$_name" ] || _name="$(basename "$_src" .md)"
+  [ -n "$_desc" ] || _desc="DevRites custom agent."
+  _desc_tmp="$TMP_GEN_DIR/codex-agent-desc-$(basename "$_src").txt"
+  _desc_codex="$TMP_GEN_DIR/codex-agent-desc-$(basename "$_src").codex.txt"
+  printf '%s' "$_desc" > "$_desc_tmp"
+  gen_codex_markdown_file "$_desc_tmp" "$_desc_codex"
+  _desc="$(cat "$_desc_codex")"
+  _tools="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^tools:[[:space:]]*/{sub(/^tools:[[:space:]]*/, ""); print; exit}' "$_src")"
+  mkdir -p "$(dirname "$_out")"
+  {
+    printf 'name = "%s"\n' "$(toml_escape "$_name")"
+    printf 'description = "%s"\n' "$(toml_escape "$_desc")"
+    case "$_tools" in
+      *Edit*|*Write*|*MultiEdit*) : ;;
+      *) printf 'sandbox_mode = "read-only"\n' ;;
+    esac
+    printf "%s\n" "developer_instructions = '''"
+    printf 'You are the Codex custom-agent version of DevRites `%s`.\n' "$_name"
+    printf 'Follow the source agent instructions below. Treat any Claude Code-specific hook/tool metadata as unavailable in Codex unless the current session exposes an equivalent capability.\n\n'
+    _body_tmp="$TMP_GEN_DIR/codex-agent-body-$(basename "$_src").md"
+    _body_codex="$TMP_GEN_DIR/codex-agent-body-$(basename "$_src").codex.md"
+    awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{fm=0; body=1; next} body{print}' "$_src" > "$_body_tmp"
+    gen_codex_markdown_file "$_body_tmp" "$_body_codex"
+    cat "$_body_codex"
+    printf "\n%s\n" "'''"
+  } > "$_out"
+}
+
+gen_codex_agents_bridge() {
+  _out="$1"
+  cat > "$_out" <<'EOF'
+<!-- BEGIN DEVRITES CODEX -->
+## DevRites For Codex
+
+This project has DevRites installed for both Claude Code and Codex.
+
+## Codex usage
+
+- **Inspect before trust.** Codex skips project-scoped `.codex/` hooks, agents, and rules in an untrusted project. Before enabling them, inspect `.codex/hooks.json`, `.codex/agents/`, and the project guidance; use `/hooks` to review the commands Codex would run. The human operator decides whether to trust the folder. Until then, use DevRites only through explicitly inspected commands and treat hook enforcement as unavailable.
+- DevRites workflow skills are available to Codex from `.agents/skills`.
+- Use `$rite` or `$rite-<verb>` through Codex skills, or open `/skills` and select the matching DevRites skill.
+- If the user mentions a DevRites slash command such as `/rite spec`, `/rite-build`, or `/rite-seal`, treat that as an explicit request to use the corresponding DevRites skill.
+- DevRites runtime helpers run through the installed `devrites-engine` binary.
+- Before using any DevRites workflow skill, read `.agents/skills/devrites-lib/reference/standards/core.md`. Load other `.agents/skills/devrites-lib/reference/standards/*.md` files when the skill or rule index asks for them. These are DevRites engineering standards, not Codex exec-policy `.rules` files.
+- Custom Codex subagents generated from the DevRites review agents live in `.codex/agents`.
+- When DevRites skill prose asks for a DevRites specialist or writer agent, use the matching Codex custom agent from `.codex/agents/devrites-*.toml` through Codex subagents. If Codex subagents are unavailable in the current surface, run the skill's documented inline fallback and say that the result was not an independent subagent review.
+- Claude Code agent hook metadata is not active in Codex. The generated Codex agents preserve read-only intent with Codex sandbox settings where possible; still follow DevRites' scope and no-mutation rules explicitly.
+
+## Workflow contract
+
+- Keep all feature state in `.devrites/work/<slug>/` and preserve `.devrites/ACTIVE`.
+- Follow the DevRites lifecycle: spec -> define -> build -> prove -> polish -> review -> seal -> ship.
+- Claims of completion need recorded evidence in the feature workspace, not confidence alone.
+<!-- END DEVRITES CODEX -->
+EOF
+}
+
+gen_codex_hooks_json() {
+  _out="$1"
+  cat > "$_out" <<'EOF'
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec env DEVRITES_REVIEWER_AGENT_REQUIRED=1 devrites-engine hook reviewer-readonly --harness=codex",
+            "statusMessage": "DevRites: checking reviewer read-only boundary"
+          }
+        ]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook allow --harness=codex",
+            "statusMessage": "DevRites: checking read-only helper approval"
+          }
+        ]
+      },
+      {
+        "matcher": "Edit|Write|apply_patch",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook a1-guard --harness=codex",
+            "statusMessage": "DevRites: checking build write boundary"
+          },
+          {
+            "type": "command",
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec env DEVRITES_WRIGHT_AGENT_REQUIRED=1 devrites-engine hook wright-scope --harness=codex",
+            "statusMessage": "DevRites: checking slice file scope"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook redwatch --harness=codex",
+            "statusMessage": "DevRites: checking test/build result"
+          }
+        ]
+      }
+    ],
+    "PreCompact": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook handoff-snapshot",
+            "statusMessage": "DevRites: snapshotting active handoff"
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook stop-gate --harness=codex",
+            "statusMessage": "DevRites: checking workspace stop gate"
+          }
+        ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook refresh-indexes",
+            "statusMessage": "DevRites: refreshing code indexes"
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook cursor --harness=codex"
+          }
+        ]
+      }
+    ],
+    "SubagentStart": [
+      {
+        "matcher": "devrites-.*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook subagent-orient --harness=codex",
+            "statusMessage": "DevRites: injecting subagent discipline"
+          }
+        ]
+      },
+      {
+        "matcher": "devrites-slice-wright",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "printf '%s\\n' 'DevRites: this subagent is the single write-capable slice-wright. Stay within the current slice contract and touched-files.md; write no .devrites bookkeeping.'"
+          }
+        ]
+      },
+      {
+        "matcher": "devrites-(code|test|frontend|security|performance|devex|doubt|simplifier|strategy|plan|spec)-reviewer|devrites-retrospector|devrites-forge-judge",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "printf '%s\\n' 'DevRites: this subagent is read-only. Inspect with read/search/test commands and return findings only; do not mutate the tree.'"
+          }
+        ]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "matcher": "devrites-slice-wright|devrites-.*reviewer|devrites-retrospector|devrites-forge-judge",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "printf '%s\\n' 'DevRites: reconcile this subagent result against the active DevRites skill contract before claiming completion.'"
+          },
+          {
+            "type": "command",
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook event subagent-stop"
+          }
+        ]
+      }
+    ],
+    "SessionStart": [
+      {
+        "matcher": "startup|resume|clear|compact",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook orient --harness=codex",
+            "statusMessage": "DevRites: loading project orientation"
+          }
+        ]
+      }
+    ]
+  }
+}
+EOF
+# NOTE: no SessionEnd entry — Codex does not emit a SessionEnd hook event (its lifecycle events
+# are SessionStart/SubagentStart/PreToolUse/PermissionRequest/PostToolUse/PreCompact/PostCompact/
+# UserPromptSubmit/SubagentStop/Stop). The `hook event session-end` trace is Claude-only; re-add
+# here if Codex ever ships the event.
+}

package/scripts/devrites-detect.sh

@@ -56,7 +56,7 @@ for f in "${FILES[@]}"; do
       case "$f" in
         REVIEW.md|CHANGELOG.md|res.md)                                 continue ;;
         .review-notes/*|*/.review-notes/*)                             continue ;;
-        pack/.claude/rules/*|*/pack/.claude/rules/*)                   continue ;;
+        pack/.claude/skills/devrites-lib/reference/standards/*|*/pack/.claude/skills/devrites-lib/reference/standards/*)                   continue ;;
         pack/.claude/skills/*|*/pack/.claude/skills/*)                 continue ;;
       esac
       SCAN_MD+=("$f")
@@ -92,6 +92,7 @@ RULES=(
   '\bcatch[[:space:]]*\([[:space:]]*\)[[:space:]]*\{[^}]*\}'                       'high'  'Blanket catch with no narrow handling — likely swallowing errors.'
   '\bcatch[[:space:]]*\([[:space:]]*[A-Za-z][A-Za-z0-9_]*[[:space:]]*\)[[:space:]]*\{[[:space:]]*\}'  'high'  'Empty catch body — silently swallows errors. Catch narrow; recover or rethrow.'
   '//[[:space:]]*helper function|//[[:space:]]*increment'                          'low'   'Tutorial-style comment — restates code; remove.'
+  '^[[:space:]]*(//|#)[[:space:]]*(Now (I('"'"'ll| will)|we('"'"'ll| will))|Updated|Added|Changed|Modified|As requested|Step [0-9]+:)'  'low'   'Diff-narrating comment — describe the current constraint or delete it.'
   '\bfunction[[:space:]]+(process|handle|do)(Data|Item|Thing|It)?\b'               'high'  'Generic AI naming (`processData` / `handleItem` / `doIt`) — name for intent.'
   '\bfunction[[:space:]]+get[A-Z][a-zA-Z]*\([^)]*\)[[:space:]]*\{[[:space:]]*return[[:space:]]+[A-Z][a-zA-Z]+\.find'  'low'   'Useless wrapper around a single ORM call — inline.'
   '//[[:space:]]*TODO:[[:space:]]*(improve|cleanup|refactor)[[:space:]]+(this|later)'  'low'   '"TODO: improve this later" — without owner/issue, this rots.'

package/scripts/eval-runner.py

@@ -37,7 +37,7 @@ What it does per query
 Outputs
 -------
 A per-query line and a final accuracy summary. Exit code 1 if accuracy is
-below `--min-accuracy` (default 0.85).
+below `--min-accuracy` (default 0.90).
 
 Usage
 -----
@@ -187,7 +187,7 @@ def main() -> int:
     parser.add_argument("eval_files", nargs="+", type=Path, help="Eval JSON files to execute")
     parser.add_argument("--model", default=os.environ.get("DEVRITES_EVAL_MODEL", "claude-haiku-4-5-20251001"))
     parser.add_argument("--min-accuracy", type=float, default=0.90,
-                        help="Per-eval minimum correct/total (default: 0.90 ≈ 18/20)")
+                        help="Per-eval minimum correct/total (default: 0.90)")
     parser.add_argument("--max-false-positives", type=int, default=2,
                         help="Per-eval max should_not_trigger queries that fired (default: 2)")
     parser.add_argument("--verbose", action="store_true", help="Print every per-query line")
@@ -219,6 +219,8 @@ def main() -> int:
     summary_lines: list[str] = []
 
     for eval_path in args.eval_files:
+        if eval_path.name == "routing-baseline.json":
+            continue
         if not eval_path.is_file():
             sys.stderr.write(f"skip: {eval_path} not a file\n")
             continue

package/scripts/eval-scorer.mjs

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+// Deterministic fixture scorer for DevRites evals: no LLM judge, no deps.
+import { readFileSync } from 'node:fs';
+
+function norm(s) {
+  return String(s || '')
+    .normalize('NFKC')
+    .toLowerCase()
+    .replace(/[\p{P}\p{S}]+/gu, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+function hit(text, kw) {
+  const t = norm(text);
+  const k = norm(kw);
+  if (!k) return false;
+  if (t.includes(k)) return true;
+  const parts = k.split(' ').filter(Boolean);
+  return parts.length > 1 && parts.every((p) => t.includes(p));
+}
+
+export function matchFinding(output, keywords) {
+  const kws = Array.isArray(keywords) ? keywords : [];
+  const matches = kws.filter((k) => hit(output, k)).length;
+  const needed = Math.max(2, Math.ceil(kws.length * 0.4));
+  return { matches, needed, matched: kws.length > 0 && matches >= Math.min(needed, kws.length) };
+}
+
+export function score(output, groundTruth) {
+  const findings = Array.isArray(groundTruth?.findings) ? groundTruth.findings : [];
+  const rows = findings.map((f) => ({ id: f.id || f.name || '', ...matchFinding(output, f.keywords || []) }));
+  const found = rows.filter((r) => r.matched).length;
+  return { found, total: findings.length, score: findings.length ? found / findings.length : 1, rows };
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const [, , outputPath, truthPath] = process.argv;
+  if (!outputPath || !truthPath) {
+    console.error('usage: node scripts/eval-scorer.mjs <model-output.txt> <ground-truth.json>');
+    process.exit(2);
+  }
+  const result = score(readFileSync(outputPath, 'utf8'), JSON.parse(readFileSync(truthPath, 'utf8')));
+  console.log(JSON.stringify(result, null, 2));
+  process.exit(result.found === result.total ? 0 : 1);
+}

package/scripts/grade-feature.sh

@@ -10,7 +10,7 @@
 #
 # Live evidence-freshness (mtime: does proof post-date code?) is NOT graded here
 # — git fixtures don't preserve mtimes; that gate is enforced on a live
-# workspace by pack/.claude/skills/devrites-lib/scripts/evidence-fresh.sh.
+# workspace by the `devrites-engine evidence-fresh` engine gate.
 #
 # Usage: grade-feature.sh <workspace-dir>
 #   e.g. evals/golden/shippable-feature | .devrites/work/<slug> | .devrites/archive/<slug>
@@ -28,6 +28,7 @@
 
 set -euo pipefail
 
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 ws="${1:-}"
 if [ -z "$ws" ] || [ ! -d "$ws" ]; then
   printf 'usage: grade-feature.sh <workspace-dir>\n' >&2
@@ -85,13 +86,29 @@ else
 fi
 
 # 8 — executable acceptance criteria: every spec [ACn] proven + checked in seal
-SELF="$(cd "$(dirname "$0")" && pwd)"
-AC="$SELF/../pack/.claude/skills/devrites-lib/scripts/check-acceptance.sh"
-[ -f "$AC" ] || AC=".claude/skills/devrites-lib/scripts/check-acceptance.sh"
-if [ -f "$AC" ]; then
-  if ! acout=$(bash "$AC" "$ws" 2>&1); then
-    problems+=("acceptance: $(printf '%s' "$acout" | tail -1 | sed 's/^check-acceptance: //')")
+run_acceptance_check() {
+  if [ -n "${DEVRITES_CLI:-}" ]; then
+    "$DEVRITES_CLI" check-acceptance "$ws"
+    return $?
   fi
+  if command -v devrites-engine >/dev/null 2>&1; then
+    devrites-engine check-acceptance "$ws"
+    return $?
+  fi
+  if [ -x "$ROOT/engine/devrites" ]; then
+    "$ROOT/engine/devrites" check-acceptance "$ws"
+    return $?
+  fi
+  if [ -d "$ROOT/engine" ] && command -v go >/dev/null 2>&1; then
+    ( cd "$ROOT/engine" && go run . check-acceptance "$ws" )
+    return $?
+  fi
+  printf 'check-acceptance: devrites-engine unavailable (install devrites or run from a checkout with Go)\n' >&2
+  return 127
+}
+
+if ! acout=$(run_acceptance_check 2>&1); then
+  problems+=("acceptance: $(printf '%s' "$acout" | tail -1 | sed 's/^check-acceptance: //')")
 fi
 
 slug="$(basename "$ws")"