devrites 3.0.3 → 3.0.5

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [3.0.5](https://github.com/ViktorsBaikers/DevRites/compare/v3.0.4...v3.0.5) (2026-07-21)
+
+### Fixed
+
+* **deps:** update fast-uri ([1e14101](https://github.com/ViktorsBaikers/DevRites/commit/1e14101284496277f56d4560d5a59d87297f7daf))
+* **devrites:** normalize Git root centrally ([a89ec40](https://github.com/ViktorsBaikers/DevRites/commit/a89ec408b6133629db3547dcb7960f29bec6a723))
+* **devrites:** normalize Git root path ([38dccf0](https://github.com/ViktorsBaikers/DevRites/commit/38dccf0bac0bdf58f5fdcf171cac231c296af171))
+* **devrites:** resolve packages by source ([ae21d9b](https://github.com/ViktorsBaikers/DevRites/commit/ae21d9b50b0b631fb4352e5820f1176213614b78))
+* **release:** reconnect v3.0.4 lineage ([7b6f853](https://github.com/ViktorsBaikers/DevRites/commit/7b6f853a73bcd3bc6ea72fd4b6b10c024c69a468))
+* **skills:** format human gate decisions clearly ([0781d99](https://github.com/ViktorsBaikers/DevRites/commit/0781d99ce081f76f5e69237396e99e78e1b027f9))
+
+### Documentation
+
+* **repo:** sync current behavior ([9555fbb](https://github.com/ViktorsBaikers/DevRites/commit/9555fbbe26ce896a5c99723e46a8c04b7fba06f4))
+
+## [3.0.4](https://github.com/ViktorsBaikers/DevRites/compare/v3.0.3...v3.0.4) (2026-07-21)
+
+### Fixed
+
+* **ci:** harden supply chain checks ([d902574](https://github.com/ViktorsBaikers/DevRites/commit/d902574a7d30168fcef94aa4a3dae7707191fe8d))
+* **deps:** update fast-uri ([1e14101](https://github.com/ViktorsBaikers/DevRites/commit/1e14101284496277f56d4560d5a59d87297f7daf))
+* **devrites:** normalize canonical workspace files ([e70221f](https://github.com/ViktorsBaikers/DevRites/commit/e70221f5dd9fbda0f3a73c500a493497bc023a91))
+* **devrites:** normalize Git root centrally ([a89ec40](https://github.com/ViktorsBaikers/DevRites/commit/a89ec408b6133629db3547dcb7960f29bec6a723))
+* **devrites:** normalize Git root path ([38dccf0](https://github.com/ViktorsBaikers/DevRites/commit/38dccf0bac0bdf58f5fdcf171cac231c296af171))
+* **devrites:** resolve packages by source ([ae21d9b](https://github.com/ViktorsBaikers/DevRites/commit/ae21d9b50b0b631fb4352e5820f1176213614b78))
+* **skills:** format human gate decisions clearly ([0781d99](https://github.com/ViktorsBaikers/DevRites/commit/0781d99ce081f76f5e69237396e99e78e1b027f9))
+
+### Documentation
+
+* **repo:** sync current behavior ([9555fbb](https://github.com/ViktorsBaikers/DevRites/commit/9555fbbe26ce896a5c99723e46a8c04b7fba06f4))
+
 ## [3.0.3](https://github.com/ViktorsBaikers/DevRites/compare/v3.0.2...v3.0.3) (2026-07-20)
 
 ### Fixed

package/README.md

@@ -67,9 +67,9 @@ memory). Both hit the same skill — `/rite spec foo` ≡ `/rite-spec foo`.
 | # | Phase | Menu form | Direct shortcut | Does |
 |---|---|---|---|---|
 | 1 | SPEC | `/rite spec` | [`/rite-spec`](pack/.claude/skills/rite-spec/SKILL.md) | investigate + write spec.md |
-| — | TEMPER | `/rite temper` | [`/rite-temper`](pack/.claude/skills/rite-temper/SKILL.md) | _optional, big features_ — strategic review: scope mode + pre-mortem, hardens the spec (mandatory in autocomplete) |
+| — | TEMPER | `/rite temper` | [`/rite-temper`](pack/.claude/skills/rite-temper/SKILL.md) | _optional, big features_ — strategic review: scope mode + pre-mortem, hardens the spec (always run by autocomplete) |
 | 2 | PLAN | `/rite define` | [`/rite-define`](pack/.claude/skills/rite-define/SKILL.md) | spec → plan + slices (each tagged AFK \| HITL + gate) |
-| — | VET | `/rite vet` | [`/rite-vet`](pack/.claude/skills/rite-vet/SKILL.md) | _recommended, every feature_ — engineering plan review: scope · architecture · tests · perf, hardens the plan + writes `test-plan.md`; depth scales to stakes, never skipped (always in autocomplete) |
+| — | VET | `/rite vet` | [`/rite-vet`](pack/.claude/skills/rite-vet/SKILL.md) | _mandatory, every plan_ — engineering review: scope · architecture · tests · perf, hardens the plan + writes `test-plan.md`; depth scales from light to full |
 | 3 | BUILD ×N | `/rite build` | [`/rite-build`](pack/.claude/skills/rite-build/SKILL.md) | one slice, then stop (HITL slices pause pre-code) |
 | — | CONVERGE | `/rite converge` | [`/rite-converge`](pack/.claude/skills/rite-converge/SKILL.md) | _recovery_ — assess live code vs intent, append the remaining work as new slices (resumed / adopted / stalled feature) |
 | 4 | PROVE | `/rite prove` | [`/rite-prove`](pack/.claude/skills/rite-prove/SKILL.md) | tests + browser proof |
@@ -95,27 +95,27 @@ before resuming.
 
 ```mermaid
 flowchart LR
-    S[/rite-spec/] --> D[/rite-define/] --> B[/rite-build ×N/] --> P[/rite-prove/] --> Po[/rite-polish/] --> R[/rite-review/] --> Sl[/rite-seal/]
+    S[/rite-spec/] --> D[/rite-define/] --> V[/rite-vet/] --> B[/rite-build ×N/] --> P[/rite-prove/] --> Po[/rite-polish/] --> R[/rite-review/] --> Sl[/rite-seal/]
     S -.->|big feature| T[/rite-temper/] -.-> D
-    D -.->|every feature| V[/rite-vet/] -.-> B
     Sl -->|GO| Sh[/rite-ship/]
     Sh -->|type-GO| Ship([ship: commit · push · tag])
+    B -.->|resumed · adopted · stalled| C[/rite-converge/] -.-> B
     B -.->|Spec Drift Guard| Re[/rite-plan repair/]
     Re --> B
 
     classDef phase fill:#1f2937,stroke:#60a5fa,color:#f9fafb
     classDef ship fill:#064e3b,stroke:#34d399,color:#ecfdf5
     classDef repair fill:#4c1d95,stroke:#a78bfa,color:#f5f3ff
-    class S,D,B,P,Po,R,Sl,Sh,T phase
+    class S,D,V,B,P,Po,R,Sl,Sh,T phase
     class Ship ship
-    class Re repair
+    class C,Re repair
 ```
 
 Full diagram set (lifecycle, polish orchestrator, review fan-out, debug loop,
 rules carrier, workspace state, namespace map) →
 [`docs/flow.md`](docs/flow.md).
 
-**Status:** [`v3.0.3`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.0.3) — see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v3.0.5`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.0.5) — see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 ## Contents
 
@@ -151,17 +151,19 @@ specialists (`devrites-*`) that fire on triggers.
 **Naming:** the `devrites-` prefix is a **namespace** for collision avoidance against
 bundled Claude Code skill names (`prototype`, `handoff`, `triage`, `diagnose`, …) —
 it does not signal "internal." Visibility is governed by each skill's
-`user-invocable:` flag, not by the prefix. See
+`user-invocable:` flag, while `disable-model-invocation` independently controls
+automatic loading. See
 [`docs/flow.md` § Public vs internal namespace](docs/flow.md#8-public-vs-internal-namespace).
 
 Full rationale: [`docs/architecture.md`](docs/architecture.md).
 
 ## Install
 
-DevRites installs **into a project** (project-local only — it never writes to
-`~/.claude` or `~/.codex`). Install with `npx` (recommended) or the `curl | bash`
-one-liner — both run the same installer and ship Claude Code skills, Codex skills,
-agents, **rules**, and aliases.
+DevRites installs its host artifacts **into a project** — it never writes skills,
+agents, or hooks to `~/.claude` or `~/.codex`. Install with `npx` (recommended)
+or the `curl | bash` bootstrap. Both delegate to the same engine-owned install
+semantics and ship Claude Code/Codex skills, agents, standards, hooks, and aliases;
+the optional shared engine binary is the only global artifact.
 
 ### Installing
 
@@ -180,11 +182,14 @@ npx devrites@latest update
 npx devrites@latest uninstall
 ```
 
-`npx devrites` is a thin wrapper over the same installer below — the pack is bundled in the
-package, so the install runs **offline** and is **pinned** to the version you request
-(`@latest`, `@1.18.0`, …). It accepts every flag the bash installer does and is still
-project-local (it never writes to `~/.claude` or `~/.codex`). Requires `bash` — built in on macOS/Linux;
-on Windows run it inside Git Bash or WSL, or use the `curl | bash` one-liner below.
+`npx devrites` is a native Node 18+ shim over the engine-owned installer. The host
+payload is bundled and pinned to the package version you request (`@latest` or
+an exact published version). To launch the engine, the shim first tries the matching checksummed
+release binary, then a local Go build, then an existing `devrites-engine`. It does
+not invoke `install.sh` and does not require Bash. Installed Claude/Codex artifacts
+stay in the target project; unless `--no-binary` is set, the installer may also
+place the shared engine binary in the configured user/system bin directory.
+Prebuilt binaries ship for macOS arm64/amd64, Linux arm64/amd64, and Windows amd64.
 
 **One-liner over the network** — no `git clone` or Node required:
 
@@ -199,7 +204,7 @@ curl -fsSL https://raw.githubusercontent.com/ViktorsBaikers/DevRites/main/instal
 curl -fsSL https://raw.githubusercontent.com/ViktorsBaikers/DevRites/main/install.sh | bash -s -- --dry-run
 
 # Pin to a specific release
-curl -fsSL https://raw.githubusercontent.com/ViktorsBaikers/DevRites/main/install.sh | DEVRITES_REF=v0.1.0 bash
+curl -fsSL https://raw.githubusercontent.com/ViktorsBaikers/DevRites/main/install.sh | DEVRITES_REF=vX.Y.Z bash
 ```
 
 The script is self-bootstrapping: when piped through `bash` it auto-downloads the latest
@@ -261,16 +266,16 @@ From a local checkout:
 ./update.sh                          # upgrade install in current directory
 ./update.sh --target /path/to/proj   # upgrade install elsewhere
 ./update.sh --check                  # report installed vs latest, change nothing
-./update.sh --to v0.2.0              # pin to a specific tag
+./update.sh --to vX.Y.Z              # pin to a specific release tag
 ./update.sh --pre                    # allow pre-release tags
 ./update.sh --force                  # reinstall even when already current
 ```
 
-`update.sh` reads the installed version + original flags from
-`.claude/devrites.manifest`, asks the GitHub API for the latest release tag,
-downloads the release tarball, and re-runs the bundled `install.sh` with the
-same flags + `--force`. `.devrites/` (active feature, work) is preserved
-because the installer only touches manifest-tracked paths.
+`update.sh` resolves the requested/latest release during bootstrap, acquires its
+bundle and engine, then delegates to `devrites-engine update`. The engine replays
+the original flags from `.claude/devrites.manifest` with force semantics.
+`.devrites/` (active feature and work) is preserved because update only manages
+the installed artifact set.
 
 ### Uninstalling
 
@@ -315,7 +320,7 @@ the npm `devrites` shim owns install/update/uninstall and proxies engine subcomm
 authoritative. Workspace-operating lifecycle skills read `core.md` in step 0 and disclose
 phase rules on demand; compact utilities keep their narrower contract local.
 
-**Claude Code invocation.** Every user-invocable skill responds to **both** `/rite <verb>` (menu form — type `/rite` to discover) and `/rite-<verb>` (direct shortcut — muscle memory). The forms are equivalent: `/rite build slice-2` ≡ `/rite-build slice-2`. Use whichever reads more naturally. Installation merges DevRites event hooks into an existing `.claude/settings.json` without replacing user entries; an existing non-DevRites `statusLine` is preserved with a warning because Claude exposes one status-line slot.
+**Claude Code invocation.** Every public `rite-*` workflow responds to **both** `/rite <verb>` (through the `rite` menu/router) and `/rite-<verb>` (direct shortcut). The forms are equivalent: `/rite build slice-2` ≡ `/rite-build slice-2`. Use whichever reads more naturally. Installation merges DevRites event hooks into an existing `.claude/settings.json` without replacing user entries; an existing non-DevRites `statusLine` is preserved with a warning because Claude exposes one status-line slot.
 
 **Codex invocation.** The installer mirrors the same skills to `.agents/skills/`, mirrors DevRites rules to `.agents/skills/devrites-lib/reference/standards/`, injects a Codex compatibility block after each skill's front matter, generates project custom agents in `.codex/agents/`, installs Codex hooks in `.codex/hooks.json`, and creates or merges the needed Codex guidance into `AGENTS.md`. If `AGENTS.md` already exists, DevRites adds a marked block instead of replacing your guidance. In Codex, invoke DevRites via `$rite`, `$rite-spec`, or `/skills`; if you prefer a Claude-only footprint, install with `--no-codex`. Codex must trust the project `.codex/` layer and review the hooks via `/hooks` before non-managed hooks run.
 
@@ -337,16 +342,17 @@ Pinned aliases live at `.claude/skills/<alias>/SKILL.md` and mirror to `.agents/
 
 ### Full skill + agent inventory
 
-**Public `rite-*` skills (29)** — slash-command surface:
+**Public command skills (30: `rite` + 29 `rite-*`)** — slash-command surface:
 
 | Group | Skills |
 |---|---|
-| Lifecycle (8) | `rite-spec` · `rite-define` · `rite-build` · `rite-prove` · `rite-polish` · `rite-review` · `rite-seal` · `rite-ship` |
+| Core lifecycle (8) | `rite-spec` · `rite-define` · `rite-build` · `rite-prove` · `rite-polish` · `rite-review` · `rite-seal` · `rite-ship` |
 | On-ramp (optional) | `rite-adopt` — onboard an existing codebase: reverse-derive `spec.md`, seed the conventions ledger + propose project principles, then hand off to the lifecycle |
 | Strategic (optional) | `rite-temper` — strategic spec review between spec and define; mandatory in `rite-autocomplete` |
 | Engineering (every feature) | `rite-vet` — engineering plan review between define and build; depth scales to stakes, never skipped; always in `rite-autocomplete` |
-| Resume / replan | `rite-resolve` · `rite-plan` |
-| Utility | `rite-status` · `rite-doctor` · `rite-customize` · `rite-pov` · `rite-dogfood` · `rite-pr-feedback` · `rite-zoom-out` · `rite-prototype` · `rite-handoff` · `rite-pressure-test` · `rite-autocomplete` |
+| Recovery / replan | `rite-resolve` · `rite-plan` · `rite-converge` |
+| Express / pre-flight | `rite-quick` · `rite-frame` |
+| Utility | `rite-status` · `rite-doctor` · `rite-customize` · `rite-explain` · `rite-pov` · `rite-dogfood` · `rite-pr-feedback` · `rite-zoom-out` · `rite-prototype` · `rite-handoff` · `rite-pressure-test` · `rite-autocomplete` |
 | Learning (optional) | `rite-learn` — cross-feature learning loop: mine shipped features for recurring mistakes + dismissed-finding classes, propose project-local lessons into `.devrites/learnings.md`, and promote recurring invariants to `.devrites/principles.md` |
 | Menu | `rite` |
 
@@ -445,6 +451,7 @@ drop the sentinel for the bulk stretch. Always cap iterations. Full contract:
 # start a feature
 /rite-spec add-csv-export     # investigate deeply → spec.md (asks you; gathers design refs)
 /rite-define                  # spec → plan.md + tasks.md + state.md
+/rite-vet                     # mandatory plan review; light or full based on stakes
 
 # build loop — one slice at a time
 /rite-build                   # slice 1, stops with evidence
@@ -507,7 +514,7 @@ turns the request + any references (screenshots, Figma, video) into a feature-le
 **`design-brief.md`** — design direction (color strategy · scene sentence · named anchor
 references), key states, interaction model, and an optional Figma/image **visual-direction
 probe** — and pauses for you to confirm the direction (HITL) or asserts a best guess (AFK).
-That brief is the **build target**, woven into spec → define → build, not a separate phase.
+That brief is the **build target**, woven into spec → define → vet → build, not a separate phase.
 
 Then `devrites-frontend-craft` builds **to** the brief: detect the surface register (brand
 vs product), refine the brief per slice (all states — default / loading / empty / error /
@@ -520,7 +527,9 @@ real UI state, and **prove both layers** (contract tests + browser proof).
 
 ## Safety & scope
 
-- **Project-local only.** Never writes to `~/.claude` or `~/.codex`. Manifest-managed install/uninstall.
+- **Project-local host artifacts.** Never writes skills, agents, or hook settings to
+  `~/.claude` or `~/.codex`. Install/uninstall is manifest-managed; the shared
+  `devrites-engine` binary is the sole optional global artifact (`--no-binary` skips it).
 - **Feature scope only.** Review/simplify/polish/security stay within the active feature
   and touched files — no project-wide refactors, no drive-by cleanup.
 - **One slice at a time.** `/rite-build` stops after a single verified slice.
@@ -533,7 +542,7 @@ real UI state, and **prove both layers** (contract tests + browser proof).
 ```
 devrites/
   bin/                 # devrites.mjs — npx CLI entry point (acquires/proxies devrites-engine)
-  .github/             # workflows/ (ci, release, dependabot-auto-merge) + dependabot.yml
+  .github/             # ci (including release job) · evals · commitlint · Dependabot automation
   .husky/              # commit-msg hook (Conventional Commits via commitlint)
   .releaserc.json      # semantic-release config (CHANGELOG, version sync, tarball, GitHub Release)
   install.sh  uninstall.sh  update.sh  # self-contained bundle/binary bootstrap shims
@@ -546,10 +555,9 @@ devrites/
                        # (standards live inside skills/devrites-lib/reference/standards/)
   installed projects   # .claude/ runtime assets; .agents/skills + .codex/agents
                        # + .codex/hooks.json + AGENTS.md for Codex
-  evals/               # trigger evals (20/skill) + golden/ outcome-eval fixtures
-  docs/                # architecture · skills · command-map · usage · flow · release · cli
-    internal/          # research, development notes (gitignored)
-  tests/               # install/uninstall smoke · install fixture · pack validation
+  evals/               # branch-shaped routing corpora + behavioral/ + golden/ outcome fixtures
+  docs/                # user guides + engine/ contracts + agents/ process + adr/ + dated research/
+  tests/               # auto-discovered repository shell suite (install, runtime, pack, release)
   dist/                # release tarballs built by semantic-release (gitignored)
   CHANGELOG.md  SECURITY.md  CODE_OF_CONDUCT.md  CODEOWNERS  NOTICE.md  LICENSE
   package.json  commitlint.config.js   # husky/commitlint/semantic-release toolchain
@@ -568,13 +576,15 @@ Cross-links: [architecture](docs/architecture.md) ·
 
 DevRites is auditable Markdown + a small engine binary. The complete security
 policy, including private vulnerability reporting and recommended managed-deployment
-settings, lives in [`SECURITY.md`](SECURITY.md). Highlights: **project-local only**
-(installer refuses global Claude/Codex agent homes); **bounded installer network access**
+settings, lives in [`SECURITY.md`](SECURITY.md). Highlights: **project-local host artifacts**
+(installer refuses global Claude/Codex agent homes; only the shared engine binary may be global);
+**bounded installer network access**
 for the release tarball and verified `devrites-engine` asset, with `--no-binary` /
-`DEVRITES_NO_BINARY=1` available for fully project-file-only installs; **no network
-access in skills**; **`!` shell injection removed** from `/rite` and `/rite-status`
+`DEVRITES_NO_BINARY=1` available for fully project-file-only installs; **no hidden
+skill-side networking** (external research goes through explicit host tools);
+**`!` shell injection removed** from `/rite` and `/rite-status`
 (state loaded via read-only engine subcommands over DevRites' own state under
-`.devrites/`); **auto-trigger** is a deliberate design choice mitigated by body
+`.devrites/`); **model invocation is per-skill frontmatter** and bounded by body
 discipline + readiness gates + the interactive `type-GO` confirmation in `/rite-ship`
 before irreversible git actions; **no `defaultMode: bypassPermissions`** is shipped or
 written by the installer (cf. CVE-2026-33068).
@@ -583,9 +593,11 @@ written by the installer (cf. CVE-2026-33068).
 
 - **Changelog:** [`CHANGELOG.md`](CHANGELOG.md) — Keep-a-Changelog + SemVer, regenerated by semantic-release on every release.
 - **Code of conduct:** [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md) (Contributor Covenant 2.1).
-- **Code owners:** [`CODEOWNERS`](CODEOWNERS) — review required on `pack/`, `scripts/`, `install.sh`, `uninstall.sh`, `bin/`.
+- **Code owners:** [`CODEOWNERS`](CODEOWNERS) — maintainer review covers all tracked paths.
 - **Notices:** [`NOTICE.md`](NOTICE.md).
-- **CI:** GitHub Actions runs `scripts/validate.sh`, install/uninstall smoke, fixture install, commitlint, and the eval suite on every PR.
+- **CI:** GitHub Actions runs validation, the full shell suite, routing evals,
+  commitlint, strict Go quality/security checks, Windows tests, and release-target
+  cross-compilation on every PR.
 - **Commits:** Conventional Commits enforced via husky + commitlint.
 - **Release pipeline:** semantic-release on every push to `main` — full details in [`docs/release.md`](docs/release.md).
 

package/SECURITY.md

@@ -23,25 +23,19 @@ the acknowledgement unless a shorter or longer window is mutually agreed.
 
 ## Supported versions
 
-DevRites is pre-1.0. Only the latest minor release line receives security
-updates.
-
-| Version | Supported |
-|---|---|
-| `0.1.x` | yes |
-| earlier | no |
-
-Once a `1.0` release ships, the latest two minor lines will be supported.
+Only the latest published DevRites release receives security fixes. Older
+releases are unsupported; upgrade before reporting a version-specific finding
+unless the issue also reproduces on the latest release.
 
 ## DevRites security model
 
 ### Scope
 
 DevRites is a skills pack plus the local `devrites-engine` control-plane binary:
-Markdown skill files, helper scripts, a bash installer, and a thin `npx` CLI
-wrapper (`bin/devrites.mjs`) that bootstraps or proxies the engine. It ships no
-network service. The attack surface is the content of the skill files, the
-installer, generated host artifacts, hooks, and the local engine binary.
+Markdown skill files, helper scripts, Bash bootstrap shims, and a native Node
+`npx` shim (`bin/devrites.mjs`) that acquires and proxies the engine. It ships no
+network service. The attack surface is the content of the skill files, bootstrap
+and install paths, generated host artifacts, hooks, and the local engine binary.
 
 ### Supply-chain self-scan (shipped pack)
 
@@ -65,10 +59,11 @@ reviewable; never suppress a hidden-unicode finding you can't explain.
 
 ### State loading (engine subcommands, no `!` injection)
 
-`/rite`, `/rite-status`, and every workspace-operating skill load state by running
-a **read-only `devrites-engine` subcommand via the `Bash` tool** — *not* Claude Code's
+`/rite-status` and workspace-operating skills load state by running a **read-only
+`devrites-engine` subcommand via the `Bash` tool** — *not* Claude Code's
 preprocessing-only `` !`<command>` `` dynamic-context injection, which DevRites
-**removed** for cross-harness portability:
+**removed** for cross-harness portability. The no-argument `/rite` menu runs
+`devrites-engine first-task` instead; a routed verb hands control to its owning skill.
 
 ```bash
 command -v devrites-engine >/dev/null 2>&1 && devrites-engine preamble || echo "(unavailable — read state.md directly)"
@@ -77,20 +72,23 @@ command -v devrites-engine >/dev/null 2>&1 && devrites-engine preamble || echo "
 `devrites-engine preamble` is a project-local read of DevRites' own `.devrites/`
 state: no user input is concatenated into a command, no network access, no write
 side effects. The gate subcommands (`build-readiness`, `evidence-fresh`,
-`check-acceptance`) are likewise read-only; only explicit mutators (`resolve`,
-`tick-afk`, `close-out`, and the MCP `use` helper) write, and only under
-`.devrites/`.
+`check-acceptance`) are likewise read-only. Mutating commands are explicit and
+scoped: for example, `resolve`, `tick-afk`, and `close-out` write only DevRites
+state, while `/rite use <slug>` deliberately repoints `.devrites/ACTIVE` inline.
 
-If your environment disallows skill-initiated shell execution, the scripts simply
+If your environment disallows skill-initiated shell execution, the commands simply
 don't run — each skill degrades gracefully to reading `state.md` directly (the
 `|| echo "(… unavailable …)"` fallback above), and the rest of the pack is
 unaffected.
 
-### Auto-trigger is deliberate
+### Model invocation is per skill
 
-All `rite-*` skills are **auto-invocable** by Claude when their descriptions
-match the user's intent. This is a conscious DevRites design choice (see
-`DECISIONS.md` Q3). The safety nets are:
+Public skills are always user-invocable, but model invocation is set per skill.
+Skills without `disable-model-invocation: true` may be selected when their
+descriptions match the user's intent; explicit utilities carry that frontmatter
+flag and load only when the user invokes them. The checked-in frontmatter and
+[`docs/command-map.md`](docs/command-map.md) are the source of truth. The safety
+nets for model-invocable rites are:
 
 - **Body discipline**: every skill stops at its phase boundary. `rite-build`
   stops after one slice, `rite-prove` runs proofs only when all slices are
@@ -100,31 +98,39 @@ match the user's intent. This is a conscious DevRites design choice (see
 - **Spec Drift Guard**: any deviation from the spec halts and routes to
   `rite-plan`.
 - **Interactive type-GO confirmation** in `rite-ship` before irreversible
-  git actions (commit, push, tag) — present even with auto-trigger; `rite-seal`
+  git actions (commit, push, tag) — present even after model invocation; `rite-seal`
   only decides GO/NO-GO.
 
-If you prefer explicit-only invocation in a given project, add a Claude Code
-`permissions` rule disabling `Skill(rite-*)` auto-invocation in that
-project's `.claude/settings.json`.
+Claude documents the invocation controls in its official
+[skills reference](https://code.claude.com/docs/en/slash-commands). DevRites uses
+`disable-model-invocation: true` rather than an undocumented settings key.
 
 ### Installer safety
 
-The bash installer (`install.sh`) refuses any target under `~/.claude`
-(`GUARD:no-global` block) and writes only to a manifest-tracked file list.
-`./uninstall.sh` removes exactly the manifested files. The
+The Bash installer (`install.sh`) refuses any target under `~/.claude`
+(`GUARD:no-global` block). Project host files are manifest-tracked;
+`./uninstall.sh` removes exactly those managed files. The
 `.devrites/` runtime state in the target project is preserved across
 uninstall.
 
-The installer touches no global state. It does not invoke `sudo`, modify
-shell rc files, fetch remote code, or alter Claude Code settings.
+Skills, agents, standards, and hook configuration stay in the target project.
+The installer merges DevRites entries into project-local `.claude/settings.json`
+and `.codex/hooks.json` without replacing unrelated user settings. Its only
+sanctioned global artifact is the shared `devrites-engine` executable, installed
+to `DEVRITES_BIN_DIR`, a writable `~/.local/bin`, or a writable
+`/usr/local/bin`; `--no-binary` / `DEVRITES_NO_BINARY=1` skips it. The bootstrap
+path may fetch the release bundle and checksummed engine assets. It never invokes
+`sudo` or edits shell startup files.
 
 ### npx install path
 
 When installed via `npx devrites@latest`, the CLI (`bin/devrites.mjs`) is a thin
-shim that runs the **bundled** `install.sh` against the pack shipped inside the npm
-package — no remote code is fetched at install time, and the install is pinned to
-the requested package version. It has no runtime npm dependencies and makes no
-global writes; the same project-local guarantees as the bash installer apply.
+Node shim that delegates directly to `devrites-engine`; it does not execute
+`install.sh`. The host payload is bundled and pinned to the requested npm package
+version. To start the engine, the shim tries the matching release binary plus its
+SHA-256 sidecar, then a local Go build, then an existing engine. It has no runtime
+npm dependencies. Project-artifact and optional shared-binary boundaries are the
+same as the Bash path.
 
 ### Recommended Claude Code permissions for managed deployments
 
@@ -133,44 +139,50 @@ For organizations evaluating DevRites under a managed Claude Code policy:
 ```jsonc
 {
   "permissions": {
-    "Skill(rite-seal)": "ask",
-    "Bash(git push *)": "ask",
-    "Bash(git tag *)": "ask"
-  },
-  "disableSkillShellExecution": true
+    "ask": [
+      "Bash(git commit *)",
+      "Bash(git push *)",
+      "Bash(git tag *)"
+    ]
+  }
 }
 ```
 
-The first three lines surface a confirmation prompt before any irreversible
-git action; the last disables the `/rite` and `/rite-status` dynamic-state
-read described above (DevRites still works).
+This follows the current
+[Claude Code permissions schema](https://code.claude.com/docs/en/permissions)
+and surfaces a host confirmation before the git mutation ladder. DevRites'
+separate type-`GO` workflow gate still applies.
 
 ### Hooks (approval, orientation, and local guards)
 
-DevRites ships JSON-configured hooks installed by the npm flow into the
+DevRites ships JSON-configured hooks installed by the engine-owned flow into the
 project-local host artifacts (`.claude/settings.json` for Claude Code and
 `.codex/hooks.json` for Codex). They call `devrites-engine` behind an inline
 fail-open guard:
 
 - **`allow` (PreToolUse/Bash)** — auto-approves *only* the read-only engine
-  orientation/gate subcommands (`preamble`, `progress`, `readiness`,
-  `evidence-fresh`, `check-acceptance`) so they stop prompting on every skill run.
+  orientation/gate subcommands (`check-acceptance`, `doubt-coverage`,
+  `evidence-fresh`, `preamble`, `progress`, `readiness`, `review-integrity`),
+  `footprint render|roster`, `ledger diff|validate|list|show`, and
+  `reviewer-stats report`, so they stop prompting on every skill run.
   It never denies, and it emits `allow` only when the parsed command is one of those
   subcommands and contains no dangerous/exfiltration tokens (`rm`, redirects,
   `curl`/`wget`, `sudo`, `chmod`, command substitution, `eval`, package managers,
   `git push/commit/reset`, etc.). Mutating subcommands (`resolve`, `tick-afk`,
   `close-out`) are deliberately excluded and still prompt.
-- **Read-only context hooks** — `orient`, `cursor`, and `subagent-orient` inject
-  active-workspace context and stay silent when no `.devrites/` workspace is active.
-- **Local guard hooks** — `a1-guard`, `redwatch`, `stop-gate`, `source-cache-*`,
-  and `refresh-indexes` run through the engine and are fail-open by default. New
-  blocking guards are observe-first unless explicitly enforced with the documented
-  `DEVRITES_*` environment switches.
+- **Context and continuity hooks** — `orient`, `cursor`, `subagent-orient`,
+  `statusline`, and `handoff-snapshot` inject bounded workspace context; `event`
+  and `auq` append lifecycle/HITL events. They stay silent when no workspace is active.
+- **Local guards and caches** — `a1-guard`, `wright-scope`,
+  `reviewer-readonly`, `redwatch`, `stop-gate`, `source-cache-*`, and
+  `refresh-indexes` run through the engine. Guard hooks are fail-open or
+  observe-first unless explicitly enforced with the documented `DEVRITES_*`
+  controls; source-cache network I/O is the bounded exception in ADR-0008.
 
 Delete the project-local hook file (`.claude/settings.json` for Claude Code, or
 the DevRites-managed entries in `.codex/hooks.json` for Codex) to remove hooks.
-The seeded settings file is never overwritten on update, so your own permission
-rules are safe.
+Updates merge DevRites entries rather than replacing unrelated project settings,
+so user permission rules remain intact.
 
 ### Third-party trust
 
@@ -206,10 +218,12 @@ visibly justified.
 
 ### Known non-issues
 
-- **`!` injection in `/rite`** — local read of own state; safe. See above.
+- **Historical `!` injection in `/rite`** — no longer present; current state
+  orientation uses structurally bounded, read-only engine commands.
 - **`Write` / `Edit` tool allowance in `rite-*` skills** — required to
   author `.devrites/` and project files. No skill grants `Bash(*)`.
-- **Auto-trigger** — deliberate design choice; mitigated as above.
+- **Per-skill model invocation** — deliberate and frontmatter-controlled;
+  model-invocable rites remain bounded by the gates above.
 
 ### CVE relevance
 

package/docs/adr/0001-go-engine-as-control-plane.md

@@ -0,0 +1,43 @@
+# ADR-0001: Go engine as deterministic control plane
+
+- **Status:** Accepted
+- **Date:** 2026-07-08 (backfilled; decision predates the ADR log)
+
+> Network scope was narrowed by [ADR-0008](0008-sanctioned-engine-network-boundary.md):
+> deterministic workspace operations remain network-free, while explicit
+> updater/source-cache I/O is isolated in `internal/iohooks`.
+
+## Context
+
+DevRites orchestrates an LLM through a spec-driven lifecycle. Two kinds of work
+are entangled: **judgment** (is this spec good? is this code right?) which only
+a model can do, and **bookkeeping** (which phase are we in? are the required
+sections present? what's the next question id?) which must be exact, fast, and
+identical every run. Letting the model do the bookkeeping makes the process
+non-reproducible and burns context on arithmetic.
+
+## Decision
+
+Ship a single statically-linked Go binary (`CGO_ENABLED=0`, stdlib-only, zero
+third-party deps in the hot path) as the **control plane**: it owns all
+deterministic state transitions, gates, and derivations over `.devrites/`. It
+makes **no** model or network calls. The filesystem is the data plane; the LLM
+supplies judgment. Commands are a hand-rolled `switch` dispatch, not a CLI
+framework.
+
+## Alternatives considered
+
+| Option | Why not |
+|--------|---------|
+| Bookkeeping inside the agent prompt | Non-deterministic, context-hungry, unauditable — the exact failure this system exists to remove. |
+| Node/TS engine (like the reference system GSD Core) | Drags a package tree + supply-chain surface; the pure-Go single binary has none and cross-compiles to every target from one runner. |
+| Cobra / urfave CLI framework | A dependency and a config surface for a switch statement the stdlib already handles. |
+
+## Consequences
+
+- Reproducible process: same state in, same verdict out, no wall-clock or
+  network variance (the one remaining wall-clock read is now seamed — ADR-0006).
+- Zero-dependency binary: trivial supply chain, `go install`-able, no runtime.
+- Cost: the engine can express only what's deterministic. Anything needing
+  judgment must round-trip to the model — by design.
+- The engine is the trust root, so it carries the strictest CI gates (ADR-0006).

package/docs/adr/0002-dual-host-harness.md

@@ -0,0 +1,34 @@
+# ADR-0002: Dual-host harness (Claude + Codex)
+
+- **Status:** Accepted
+- **Date:** 2026-07-08 (backfilled)
+
+## Context
+
+Each AI coding host (Claude Code, Codex, and — in adjacent tools — Cursor,
+Cline, Copilot) speaks its own hook dialect: different stdin shapes, exit-code
+conventions, and settings surfaces. The lifecycle logic (orient, gate, hook
+decisions) is host-independent; only the edge translation differs.
+
+## Decision
+
+Support exactly **two** hosts today — `claude` and `codex` — behind a thin
+`internal/harness` adapter that translates each host's hook stdin/exit
+conventions into the shared `orient` + `gate` core. Host support is
+enumerated in code, not open-ended. `harness-matrix --check` keeps
+`docs/harness-compliance.md` in sync with the adapters (drift is a CI failure).
+
+## Alternatives considered
+
+| Option | Why not |
+|--------|---------|
+| A generic declarative capability/adapter registry now (the GSD Core model) | Real ceiling-raiser for N hosts, but a large refactor unjustified at N=2. Recorded as a Proposed follow-up, not built. See the adoption study in `docs/research/gsd-core-adoption.md` §3.1. |
+| Claude-only | Codex users are already real; single-host would strand them. |
+| Per-host forks of the logic | Duplicates the lifecycle core across edges — the thing the adapter exists to prevent. |
+
+## Consequences
+
+- Adding a host today means editing `harness.go` — acceptable friction at N=2,
+  the calcification risk rises with N (hence the Proposed registry follow-up).
+- The shared core is tested once; only edge translation is host-specific.
+- `harness-matrix --check` makes host-support drift visible in CI.

package/docs/adr/0003-gate-model-hitl-pause.md

@@ -0,0 +1,38 @@
+# ADR-0003: Gates block as a HITL pause, never a crash
+
+- **Status:** Accepted
+- **Date:** 2026-07-08 (backfilled)
+
+## Context
+
+A gate is a deterministic completeness check — e.g. "does this feature have the
+sections required to leave the current phase?" When a gate is not satisfied the
+engine must stop the agent, but *how* it stops matters. A crash (non-zero,
+stderr stack) reads as a tool failure and invites the agent to retry blindly or
+route around it. The intended meaning is the opposite: **the work is
+incomplete, pause and involve the human.**
+
+## Decision
+
+A blocked gate is a structured **human-in-the-loop pause**: a specific
+"missing X" message on stdout and a distinct, reserved **exit code 3** — never a
+crash, never a generic non-zero. Gates are **transition-fired** (they run only
+when explicitly invoked at a phase boundary, not on every tool call). Two
+kinds: `Readiness` (sections needed to leave the current phase) and `Seal` (the
+full seal set). `StopGate` enforces the rest-point invariant: a feature claiming
+completion with empty proof, or with `.red` set, cannot end the turn.
+
+## Alternatives considered
+
+| Option | Why not |
+|--------|---------|
+| Exit 1 / crash on an unmet gate | Indistinguishable from a real error; agents retry or route around it instead of pausing for the human. |
+| Run gates on every tool call | Turns a transition check into per-action overhead and noise; gates are boundary events. |
+| Auto-advance past a soft-missing section | Defeats the completeness guarantee the gate exists to provide. |
+
+## Consequences
+
+- Exit 3 is a reserved, load-bearing contract — the harness and hooks branch on
+  it. Its guard test (`tests/adr_0003_gate_exit_code_test.go`) locks it.
+- Blocks are legible: the agent (and human) see exactly which section is missing.
+- Gate authors must classify a stop as "incomplete" (exit 3) vs a true error.