devrites 3.0.3 → 3.0.5

package/docs/engine/state-schema.md

@@ -52,11 +52,13 @@ proven contract is shared, not per-clone. Grammar and delta rules:
 
 Backward compatibility: `.devrites/features/<slug>/` remains readable as a legacy
 workspace location. `feature.md` / `index.md` may stand in for `README.md`, and
-`proof.md` may stand in for `evidence.md`.
+`status.md` may stand in for `state.md`, while `proof.md` may stand in for
+`evidence.md`.
 
-### `feature.md`
+### Workspace maps
 
-The per-feature index. Its YAML frontmatter carries:
+The canonical per-feature index is `README.md`; `feature.md` and `index.md` are
+readable aliases. A map may carry YAML frontmatter with:
 
 | field           | meaning                                        |
 | --------------- | ---------------------------------------------- |
@@ -65,9 +67,9 @@ The per-feature index. Its YAML frontmatter carries:
 | `phase`         | current workflow phase (see below)             |
 | `schemaVersion` | schema version the file was written against    |
 
-A feature exists when it has either a live `state.md` ledger or the transitional
-`feature.md` manifest. The mutable `state.md` cursor is authoritative when both
-declare a phase; an unknown declared phase is an error.
+A feature exists when it has either a live `state.md` ledger or a workspace map.
+The mutable `state.md` cursor is authoritative when both declare a phase; an
+unknown declared phase is an error.
 
 ## Sections
 
@@ -127,9 +129,12 @@ result: incomplete (missing: tasks)
   does not gate — gating is issue 04).
 - Unknown or missing slug → non-zero exit with a clear message on stderr.
 
-The engine makes **zero model or network calls**; `status` is a pure read of the
-files under `DEVRITES_ROOT` (or the nearest `.devrites/` above the working
-directory). A hand edit wins immediately because there is no status cache.
+`status` makes no model or network calls; it is a pure read of the files under
+`DEVRITES_ROOT` (or the nearest `.devrites/` above the working directory). A
+hand edit wins immediately because there is no status cache. Other workspace
+control-plane commands share that deterministic boundary; explicit
+install/update/source-cache I/O is isolated under `engine/internal/iohooks` as
+defined by ADR-0008.
 
 `.devrites/` is ignored **except** the capability ledger at `specs/`, which is
 committed shared truth — the recommended pattern is `.devrites/*` +

package/docs/engine/workspace-schema.md

@@ -34,7 +34,7 @@ Canonical live workspace:
       plan.md                   # technical approach and slice strategy
       tasks.md                  # vertical slices
       traceability.md           # AC/REQ -> slices -> tests/evidence/files matrix
-      state.md                  # compact cursor
+      state.md                  # compact cursor; status.md alias allowed
       evidence.md               # command/action proof; proof.md alias allowed
       browser-evidence.md       # optional UI/runtime browser proof
       drift.md                  # optional spec/plan drift register
@@ -49,8 +49,9 @@ Canonical live workspace:
 
 Backward compatibility: `.devrites/features/<slug>/` remains readable as an alias
 for `.devrites/work/<slug>/`; `feature.md` and `index.md` remain valid workspace
-maps; `proof.md` remains a proof alias for `evidence.md`. Migration should add the
-canonical files without deleting aliases.
+maps; `status.md` remains a cursor alias for `state.md`; `proof.md` remains a
+proof alias for `evidence.md`. Migration should add the canonical files without
+deleting aliases.
 
 ## Read Order
 
@@ -80,7 +81,7 @@ canonical files without deleting aliases.
 | `plan.md` | required from plan | `/rite-define` | implementation approach | 220 lines | Approach, Slice strategy, Validation strategy, Rollback | HOW lives here, not in `spec.md`. `Validation strategy` names the Key links — cross-slice wiring `/rite-prove` walks (or `none` for single-slice features). |
 | `tasks.md` | required from plan | `/rite-define` | build one slice | 280 lines | Slice index | Each `SLICE-###` has goal, AC IDs, likely files, tests/proof, mode, gate, dependencies, done condition. |
 | `traceability.md` | required from plan | `/rite-define` | coverage/review/seal | 220 lines | Coverage matrix | Matrix maps AC/REQ ID, slice IDs, test/proof, evidence ID, touched files, status. |
-| `state.md` | required | all phases | current cursor | 120 lines | Cursor | Compact table/key-value cursor; not an append-only narrative. |
+| `state.md` / `status.md` | required | all phases | current cursor | 120 lines | Cursor | `state.md` is canonical; `status.md` is a compatibility alias. Compact table/key-value cursor; not an append-only narrative. |
 | `evidence.md` / `proof.md` | required from prove | `/rite-build`, `/rite-prove` | proof and seal | 280 lines | Evidence log | `EVID-###`, command/action, result, related AC/slice IDs, limitations. Each acceptance criterion carries a proof class — `test` / `command` / `browser` / `judgment` (untagged reads `judgment`; `judgment` needs its one-line why). |
 | `browser-evidence.md` | UI only | `/rite-prove`, `/rite-polish` | UI/browser proof | 220 lines | Browser evidence, Visual Verdict | Must reference real route/viewports/actions and related IDs. |
 | `drift.md` | drift only | Spec Drift Guard | spec/plan reality mismatch | 160 lines | Drift register | `DRIFT-###`, status, evidence found, resolution, related IDs. |

package/docs/flow.md

@@ -10,22 +10,26 @@ For the full per-skill table, see [`command-map.md`](command-map.md). For the
 
 The happy path. Every arrow assumes the readiness gate of the previous phase
 passed; failures route through `/rite-plan repair` or `devrites-debug-recovery`.
-HITL slices pause before code is written; `/rite-resolve` is the resume verb.
+`/rite-temper` is the optional strategic branch; `/rite-vet` runs on every
+defined plan, with depth scaled to risk. HITL slices pause before code is
+written; `/rite-resolve` is the resume verb.
 
 ```mermaid
 flowchart LR
     Start([user has an idea]) --> Spec[/rite-spec/]
     Spec -.->|UI detected| Shape[devrites-ux-shape<br/>plan UX/UI → design-brief.md]
     Shape -.->|brief confirmed| Spec
+    Spec -.->|big / risky| Temper[/rite-temper/] -.->|strategy.md| Define
     Spec -->|spec.md ready| Define[/rite-define/]
-    Define -->|plan.md + tasks.md<br/>each slice tagged AFK/HITL| Build[/rite-build/]
+    Define -->|plan.md + tasks.md<br/>each slice tagged AFK/HITL| Vet[/rite-vet/]
+    Vet -->|every plan; light or full<br/>eng-review.md + test-plan.md| Build[/rite-build/]
     Build -->|one slice done<br/>+ evidence| Build
     Build -.->|"Forge: yes slice"| Forge[forge: K candidates<br/>→ devrites-forge-judge → 1 winner]
     Forge -.->|winner lands<br/>forge-report.md| Build
     Build -->|HITL gate fires| Await{{Awaiting human<br/>state.md + questions.md}}
     Await -->|"/rite-resolve &lt;qid&gt; &lt;answer&gt;"| Build
     Build -->|all slices built| Prove[/rite-prove/]
-    Define -.->|resumed / adopted / stalled<br/>code vs intent| Converge[/rite-converge/]
+    Build -.->|resumed / adopted / stalled<br/>code vs intent| Converge[/rite-converge/]
     Converge -.->|appends remaining slices| Build
     Prove -->|evidence captured| Polish[/rite-polish/]
     Polish -->|polish-report.md| Review[/rite-review/]
@@ -45,7 +49,7 @@ flowchart LR
     classDef repair fill:#4c1d95,stroke:#a78bfa,color:#f5f3ff
     classDef gate fill:#4c1d95,stroke:#a78bfa,color:#f5f3ff
     classDef internal fill:#0f172a,stroke:#9ca3af,color:#f9fafb
-    class Spec,Define,Build,Prove,Polish,Review,Seal,Ship2 phase
+    class Spec,Temper,Define,Vet,Build,Prove,Polish,Review,Seal,Ship2 phase
     class Shipped done
     class Repair repair
     class Await gate
@@ -291,11 +295,12 @@ The exact list of files per workspace and what each holds is in
 
 The `devrites-` prefix is collision-avoidance against bundled Claude Code
 skills (`prototype`, `handoff`, `triage`, `diagnose`). Visibility is the
-`user-invocable:` flag, not the prefix.
+`user-invocable:` flag, not the prefix; automatic model loading is controlled
+separately by `disable-model-invocation`.
 
 ```mermaid
 flowchart TB
-    subgraph Public["Public (user-invocable: true) — 24 skills"]
+    subgraph Public["Public (user-invocable: true) — 30 skills"]
         direction TB
         R1[/rite/]
         R2[/rite-spec/]
@@ -304,6 +309,7 @@ flowchart TB
         RV[/rite-vet/]
         R4[/rite-plan/]
         R5[/rite-build/]
+        RC[/rite-converge/]
         R6[/rite-prove/]
         R7[/rite-polish/]
         R8[/rite-review/]
@@ -317,6 +323,11 @@ flowchart TB
         RA[/rite-adopt/]
         RL[/rite-learn/]
         RD[/rite-doctor/]
+        RE[/rite-explain/]
+        RCU[/rite-customize/]
+        RDO[/rite-dogfood/]
+        RPOV[/rite-pov/]
+        RPF[/rite-pr-feedback/]
         IPT[/rite-pressure-test/]
         D1[/rite-zoom-out/]
         D2[/rite-prototype/]
@@ -340,7 +351,7 @@ flowchart TB
 
     classDef pub fill:#064e3b,stroke:#34d399,color:#ecfdf5
     classDef int fill:#1f2937,stroke:#9ca3af,color:#f9fafb
-    class R1,R2,RT,R3,RV,R4,R5,R6,R7,R8,R9,R12,R13,R10,R11,RQ,RF,RA,RL,RD,IPT,D1,D2,D3 pub
+    class R1,R2,RT,R3,RV,R4,R5,RC,R6,R7,R8,R9,R12,R13,R10,R11,RQ,RF,RA,RL,RD,RE,RCU,RDO,RPOV,RPF,IPT,D1,D2,D3 pub
     class I1,I2,I3,I4,I5,I6,I7,I8,I9,I10,I11,I12 int
 ```
 

package/docs/porting-to-a-new-harness.md

@@ -1,6 +1,8 @@
 # Porting DevRites to a new harness
 
-DevRites is distributed through `npx devrites` and installs project-local artifacts. Do not add a harness through a Claude/Codex plugin or marketplace path.
+DevRites' canonical distribution path is `npx devrites` (with the documented
+Bash bootstrap as a Node-free alternative), and host artifacts install into the
+target project. Do not add a harness through a Claude/Codex plugin or marketplace path.
 
 Before adding a host, add its thin adapter to `engine/internal/harness/harness.go`,
 update the frozen matrix in `compliance.go`, and prove the host can run DevRites
@@ -20,7 +22,9 @@ The harness must invoke DevRites and route to `/rite-spec` (or the host's explic
 - Session/project orientation runs automatically at startup/compact/resume, or the missing surface is recorded in `docs/harness-compliance.md`.
 - `devrites-engine` hooks/gates are wired, or each degraded gate has an honest fallback and confidence label.
 - Subagent support is mapped; if unavailable, reviewers/wrights use the documented inline fallback and label it.
-- Install, update, and uninstall paths stay project-local; no global writes.
+- Skills, agents, standards, hooks, and harness guidance stay project-local;
+  the optional shared `devrites-engine` executable is the sole sanctioned
+  global artifact and must remain skippable with `--no-binary`.
 - Generated artifacts and `docs/harness-compliance.md` are updated from the same source of truth.
 - Routing eval includes the React todo-list acceptance prompt.
 

package/docs/release.md

@@ -1,15 +1,16 @@
 # Release pipeline
 
-Releases are **fully automated** via [semantic-release](https://semantic-release.gitbook.io/): every push to `main` is analyzed; if the merged commits carry a `feat:`, `fix:`, `perf:`, `refactor:`, `build:`, `docs(README):` (or a `BREAKING CHANGE:` footer) the `.github/workflows/release.yml` job determines the next SemVer version and:
+Releases are **fully automated** via [semantic-release](https://semantic-release.gitbook.io/): every push to `main` is analyzed; if the merged commits carry a `feat:`, `fix:`, `perf:`, `refactor:`, `build:`, `docs(README):` (or a `BREAKING CHANGE:` footer), the `release` job in [`.github/workflows/ci.yml`](../.github/workflows/ci.yml) determines the next SemVer version and:
 
-1. Runs `scripts/validate.sh` + install / uninstall smoke tests.
-2. Syncs the new version into `package.json` and the README status line (`scripts/sync-version.sh`).
-3. Builds a `dist/devrites-v<version>.tar.gz` release artifact via `scripts/build-release-tarball.sh` — the extractable bundle end-users get from the `curl | bash` installer. The bundle includes `pack/generated/` host-native Claude/Codex artifacts rendered from the canonical pack.
-4. Regenerates `CHANGELOG.md` from the commits.
-5. Publishes the `devrites` package to the npm registry (`@semantic-release/npm`, needs the `NPM_TOKEN` secret) — this is what `npx devrites@latest` resolves. `npm pack` renders the same `pack/generated/` artifacts during `prepack`; there is no `postpack` cleanup step.
-6. Commits the version bump + changelog as `chore(release): <version> [skip ci]`, creates a git tag `v<version>`, and publishes a GitHub Release with the tarball attached.
+1. Waits for the workflow's validation, full shell suite, strict Go-engine checks, Linux cross-compile smoke, and Windows Go tests.
+2. Regenerates `CHANGELOG.md` from the commits.
+3. Syncs the new version into `package.json` and the README status line (`scripts/sync-version.sh`).
+4. Builds `dist/devrites-v<version>.tar.gz` plus its SHA-256 sidecar via `scripts/build-release-tarball.sh`. The extractable bundle used by `curl | bash` includes host-native Claude/Codex artifacts regenerated from `pack/.claude/` into `pack/generated/`.
+5. Cross-compiles five `devrites-engine` release binaries (macOS arm64/amd64, Linux arm64/amd64, Windows amd64) plus a SHA-256 sidecar for each.
+6. Publishes the `devrites` package to npm (`@semantic-release/npm`, requiring `NPM_TOKEN`) — this is what `npx devrites@latest` resolves. `npm pack` regenerates the same `pack/generated/` artifacts during `prepack`; there is no `postpack` cleanup step.
+7. Commits the version bump + changelog as `chore(release): <version> [skip ci]`, creates tag `v<version>`, and publishes a GitHub Release with the tarball, checksum, binaries, and binary checksum sidecars attached.
 
-Local dry-run: `npm run release:dry` (shows the version bump + draft notes without publishing). Before publishing, `scripts/release-check.sh` builds the evidence packet: generated pack freshness, tarball checksum presence, `npx-pack-smoke`, install/update/uninstall, `validate-pack`, behavioral eval schema, and a README/docs check that install instructions stay `npx devrites ...` only. DevRites is not shipped through Claude or Codex plugin stores. The release job is gated by passing CI — a broken `main` won't ship.
+Local dry-run: `npm run release:dry` (shows the proposed version + notes without publishing). For a manual preflight, `bash scripts/release-check.sh` builds an evidence packet covering generated-pack freshness, tarball checksum presence, `npx-pack-smoke`, install/update/uninstall, `validate-pack`, behavioral-eval schema, and the documented npm distribution path. This preflight is available to maintainers but is not a hidden semantic-release step. DevRites is not shipped through Claude or Codex plugin stores. The release job is gated by passing CI — a broken `main` won't ship.
 
 ## Authoring commits that trigger releases
 
@@ -25,6 +26,6 @@ Husky + commitlint reject non-conventional messages at commit time, so you can't
 
 ## Dependency updates
 
-Dependabot watches the `npm` and `github-actions` ecosystems and opens a **weekly grouped PR** with all patch + minor bumps (see [`.github/dependabot.yml`](../.github/dependabot.yml)). The [`dependabot-auto-merge.yml`](../.github/workflows/dependabot-auto-merge.yml) workflow auto-approves + enables auto-merge (squash) on those PRs so they land the instant CI is green — no manual click. Major-version bumps stay open with a `needs-review` label so a human can scan the changelog before merging.
+Dependabot watches the `npm` and `github-actions` ecosystems and opens **weekly grouped PRs** for routine patch + minor bumps (see [`.github/dependabot.yml`](../.github/dependabot.yml)). The [`dependabot-auto-merge.yml`](../.github/workflows/dependabot-auto-merge.yml) workflow auto-approves + enables auto-merge (squash) on those PRs so they land when required checks are green. Major-version bumps stay open with a `needs-review` label so a human can scan the changelog before merging.
 
 > GitHub does not allow Dependabot to push directly to `main` — a PR is always opened. Auto-merge is the closest equivalent. Required CI checks still gate the merge.

package/docs/skills.md

@@ -132,7 +132,7 @@ blocks obvious multi-command `Next:` wording.
 |---|---|---|
 | [`rite-review`](../pack/.claude/skills/rite-review/SKILL.md) | Multi-axis feature-scoped review. Parallel **Spec axis** (`devrites-spec-reviewer`) + **Standards axis** (`devrites-code-reviewer`) sub-agents; severity-labeled findings. | Polish done; ready for a final pass. |
 | [`devrites-doubt`](../pack/.claude/skills/devrites-doubt/SKILL.md) | In-flight adversarial review of risky decisions — branching logic, boundaries, data/auth/API changes, migrations. | About to stand a "this is safe / scales / matches spec" claim. |
-| [`devrites-audit`](../pack/.claude/skills/devrites-audit/SKILL.md) | Read-only audit dispatch — picks the right reviewer subagent on the requested axis (`security` / `perf` / `simplify`). Single-axis only; multi-axis parallel fan-out lives inline in `/rite-seal` (see `rite-seal/reference/parallel-dispatch.md`). | Polish Phase 1 (`simplify`); review involves user input / auth / data / external integrations / secrets / permissions (`security`); performance is relevant or regression risk visible (`perf`). |
+| [`devrites-audit`](../pack/.claude/skills/devrites-audit/SKILL.md) | Read-only audit dispatch — picks the right reviewer subagent on the requested axis (`security` / `perf` / `simplify`). Single-axis only; multi-axis parallel fan-out lives inline in `/rite-seal` (see the [shared dispatch contract](../pack/.claude/skills/devrites-lib/reference/parallel-dispatch.md)). | Polish Phase 1 (`simplify`); review involves user input / auth / data / external integrations / secrets / permissions (`security`); performance is relevant or regression risk visible (`perf`). |
 
 ### Seal — GO / NO-GO decision
 

package/docs/templates/CRITIC_REVIEW_PACKET_TEMPLATE.md

@@ -0,0 +1,35 @@
+# Critic review packet
+
+Use only when an independent critic review is requested. Keep the packet
+bounded; omit conversation history, raw logs, abandoned approaches, secrets,
+private data, and broad repository scans.
+
+## Candidate
+
+- Repository:
+- Base commit:
+- Candidate commit or immutable snapshot:
+- Changed files:
+
+## Purpose and boundaries
+
+- Requested outcome:
+- Explicit exclusions:
+- Acceptance checklist:
+- Direct authority files/sections:
+
+## Evidence
+
+- Focused tests and results:
+- Known risks or unresolved questions:
+
+## Requested report
+
+Return one consolidated report containing:
+
+1. Critical/high findings with exact file/line or reproducible evidence.
+2. Impact and required correction for each finding.
+3. Lower-severity observations separately.
+4. Final disposition: accept, accept after listed corrections, or reject.
+
+Do not edit the candidate and do not report style preferences as blocking.

package/docs/usage.md

@@ -1,9 +1,10 @@
 # DevRites — usage
 
-Worked workflows. Every feature starts with `/rite-spec` (it investigates,
-writes the spec, and creates the workspace). Every later phase reads the
-active workspace (`.devrites/ACTIVE` → `.devrites/work/<slug>/`) first; if
-none exists it tells you to run `/rite-spec <feature>`.
+Worked workflows. A full greenfield lifecycle starts with `/rite-spec`; a
+brownfield codebase may enter through `/rite-adopt`, while `/rite-quick` and
+`/rite-frame` deliberately handle bounded work outside the full feature arc.
+Workspace-operating phases read the active workspace (`.devrites/ACTIVE` →
+`.devrites/work/<slug>/`) first and report the appropriate on-ramp when none exists.
 
 - **Full command reference** → [`command-map.md`](command-map.md)
 - **Flow diagrams** → [`flow.md`](flow.md)
@@ -28,10 +29,10 @@ survives compaction and new sessions:
 | `plan.md` | `/rite-define` | approach, dependency graph, checkpoints, rollback |
 | `tasks.md` | `/rite-define` | ordered `SLICE-###` vertical slices, each mapped to `AC-###` and tagged `Mode: AFK \| HITL` + gate fields |
 | `traceability.md` | `/rite-define` | AC/REQ → slices → tests/proofs → evidence → touched files matrix |
-| `eng-review.md` | `/rite-vet` | engineering plan review (optional): scope challenge, axis findings, failure modes, parallelization |
+| `eng-review.md` | `/rite-vet` | mandatory engineering plan review, light or full by stakes: scope challenge, axis findings, failure modes, parallelization |
 | `test-plan.md` | `/rite-vet` | build-readable coverage target: coverage diagram, per-gap test requirements, acceptance→test map (read by `/rite-build` + `/rite-prove`) |
-| `status.md` | every phase | canonical status checkpoint |
 | `state.md` | every phase | working ledger: phase, active slice + slice mode, risk, next step; plus `Awaiting human` block when paused (run mode is derived from `.devrites/AFK`, not stored here) |
+| `status.md` | every phase | compatibility alias for the canonical `state.md` cursor |
 | `questions.md` | every phase | append-only Q&A — qid, slice, gate, status (`open` / `answered` / `dropped`), proposed answer, raised/answered timestamps |
 | `decisions.md` / `assumptions.md` | every phase | running logs |
 | `drift.md` | Spec Drift Guard | drift events + resolutions |
@@ -53,7 +54,8 @@ on under `.devrites/archive/<slug>/`.
 Backward compatibility: older `.devrites/features/<slug>/` workspaces remain
 readable; migration should add the canonical `.devrites/work` shape without
 deleting the old files. `feature.md`/`index.md` can still act as the workspace
-map, and `proof.md` can still act as the proof alias for `evidence.md`.
+map, `status.md` as the cursor alias for `state.md`, and `proof.md` as the proof
+alias for `evidence.md`.
 
 Project-root sentinel (outside the workspace):
 
@@ -82,6 +84,10 @@ You: I want some kind of reporting thing for admins.
   → reads the approved spec
   → writes plan.md + vertical task slices + state
   → stops for confirmation
+
+/rite-vet
+  → reviews every defined plan; uses a light or full pass based on stakes
+  → writes eng-review.md + test-plan.md before build
 ```
 
 ## 2) Normal feature — the build loop
@@ -89,6 +95,7 @@ You: I want some kind of reporting thing for admins.
 ```text
 /rite-spec add-csv-export    # investigate → spec.md
 /rite-define                 # spec → plan + vertical slices + state
+/rite-vet                    # mandatory plan review; light or full based on stakes
 /rite-build                  # slice 1 ("export endpoint returns CSV"); stops with evidence
 /rite-build                  # slice 2 ("download button + states"); repeat for each slice
 /rite-prove                  # ONCE all slices built: full tests + browser proof
@@ -139,6 +146,9 @@ You: 2
 /rite-define
   → spec → slices; UI slice marked frontend-craft + browser-proof
 
+/rite-vet
+  → hardens the UI plan + acceptance-to-test coverage before code
+
 /rite-build
   → UI slice → devrites-frontend-craft: register = product surface, **match
     the saved references**, shape the states (default/loading/empty/error/
@@ -167,6 +177,7 @@ with exact steps — the seal then weighs the UI risk.
 ```text
 /rite-spec rate-limit-api    # investigate → spec.md (no UI)
 /rite-define                 # spec → plan + slices
+/rite-vet                    # mandatory plan review; checks architecture, tests, perf
 /rite-build                  # no UI → no frontend craft / browser proof
 /rite-prove                  # targeted tests + build/typecheck; runtime check of the limiter
 /rite-polish                 # reference/code.md only (no UI scope detected)
@@ -324,15 +335,14 @@ it stops. Args: `[idea] [--ship|--yolo] [--max-slices N]`.
   read-only config: it toggles your local session mode and sets the initial
   `max_slices` budget; nothing else. The mutable remaining-slice count lives
   in `state.md` (`AFK slices remaining`), never in the sentinel.
-- One feature active at a time (`ACTIVE`). To start or switch, run
-  `/rite-spec <other>` (it creates/selects that workspace and writes its
-  spec).
+- One feature active at a time (`ACTIVE`). Start a new workspace with
+  `/rite-spec <feature>`; switch to an existing one with `/rite use <slug>`.
 - **Recommended AFK progression**: HITL first to refine the prompt and plan,
   then drop the sentinel for the bulk stretch. Always cap iterations
   (`max_slices: 10` is a reasonable default).
-- Let the specialists fire on their triggers — you don't invoke `devrites-*`
-  directly. The exceptions are the three public utilities: `/rite-zoom-out`,
-  `/rite-prototype`, `/rite-handoff`.
-- The `devrites-` prefix is a namespace, not a privacy marker — whether a
-  skill is public is the `user-invocable:` flag, documented for each in
-  [`command-map.md`](command-map.md).
+- Invoke public `rite` / `rite-*` skills directly; let the model-invocable
+  `devrites-*` specialists fire from their documented triggers. `devrites-lib`
+  is an internal reference library, not a workflow.
+- Prefixes are namespaces, not invocation policy. `user-invocable` and
+  `disable-model-invocation` frontmatter are authoritative; the effective policy
+  for every skill is catalogued in [`command-map.md`](command-map.md).