devrites 3.0.4 → 3.0.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (41) hide show
  1. package/CHANGELOG.md +25 -1
  2. package/README.md +55 -43
  3. package/SECURITY.md +72 -58
  4. package/docs/agents/issue-driven-rites.md +5 -5
  5. package/docs/architecture.md +61 -45
  6. package/docs/capability-surface-selection.md +3 -1
  7. package/docs/cli.md +9 -2
  8. package/docs/command-map.md +6 -2
  9. package/docs/engine/agent-contract.md +5 -3
  10. package/docs/engine/commands.md +27 -14
  11. package/docs/engine/state-schema.md +8 -4
  12. package/docs/engine/workspace-schema.md +5 -4
  13. package/docs/flow.md +18 -7
  14. package/docs/porting-to-a-new-harness.md +6 -2
  15. package/docs/release.md +10 -9
  16. package/docs/skills.md +1 -1
  17. package/docs/templates/CRITIC_REVIEW_PACKET_TEMPLATE.md +35 -0
  18. package/docs/usage.md +26 -16
  19. package/engine/internal/lib/packageexistence.go +729 -52
  20. package/engine/internal/lib/packageexistence_test.go +343 -0
  21. package/engine/internal/lib/util.go +1 -1
  22. package/pack/.claude/skills/devrites-lib/SKILL.md +7 -9
  23. package/pack/.claude/skills/devrites-lib/reference/reply-contract.md +11 -3
  24. package/pack/.claude/skills/devrites-lib/reference/standards/development-workflow.md +2 -3
  25. package/pack/.claude/skills/rite/SKILL.md +6 -7
  26. package/pack/.claude/skills/rite/reference/menu.md +5 -5
  27. package/pack/.claude/skills/rite-adopt/SKILL.md +2 -3
  28. package/pack/generated/claude/skills/devrites-lib/SKILL.md +7 -9
  29. package/pack/generated/claude/skills/devrites-lib/reference/reply-contract.md +11 -3
  30. package/pack/generated/claude/skills/devrites-lib/reference/standards/development-workflow.md +2 -3
  31. package/pack/generated/claude/skills/rite/SKILL.md +6 -7
  32. package/pack/generated/claude/skills/rite/reference/menu.md +5 -5
  33. package/pack/generated/claude/skills/rite-adopt/SKILL.md +2 -3
  34. package/pack/generated/codex/skills/devrites-lib/SKILL.md +7 -9
  35. package/pack/generated/codex/skills/devrites-lib/reference/reply-contract.md +11 -3
  36. package/pack/generated/codex/skills/devrites-lib/reference/standards/development-workflow.md +2 -3
  37. package/pack/generated/codex/skills/rite/SKILL.md +6 -7
  38. package/pack/generated/codex/skills/rite/reference/menu.md +5 -5
  39. package/pack/generated/codex/skills/rite-adopt/SKILL.md +2 -3
  40. package/package.json +1 -1
  41. package/scripts/skills-inventory.mjs +18 -0
@@ -0,0 +1,35 @@
1
+ # Critic review packet
2
+
3
+ Use only when an independent critic review is requested. Keep the packet
4
+ bounded; omit conversation history, raw logs, abandoned approaches, secrets,
5
+ private data, and broad repository scans.
6
+
7
+ ## Candidate
8
+
9
+ - Repository:
10
+ - Base commit:
11
+ - Candidate commit or immutable snapshot:
12
+ - Changed files:
13
+
14
+ ## Purpose and boundaries
15
+
16
+ - Requested outcome:
17
+ - Explicit exclusions:
18
+ - Acceptance checklist:
19
+ - Direct authority files/sections:
20
+
21
+ ## Evidence
22
+
23
+ - Focused tests and results:
24
+ - Known risks or unresolved questions:
25
+
26
+ ## Requested report
27
+
28
+ Return one consolidated report containing:
29
+
30
+ 1. Critical/high findings with exact file/line or reproducible evidence.
31
+ 2. Impact and required correction for each finding.
32
+ 3. Lower-severity observations separately.
33
+ 4. Final disposition: accept, accept after listed corrections, or reject.
34
+
35
+ Do not edit the candidate and do not report style preferences as blocking.
package/docs/usage.md CHANGED
@@ -1,9 +1,10 @@
1
1
  # DevRites — usage
2
2
 
3
- Worked workflows. Every feature starts with `/rite-spec` (it investigates,
4
- writes the spec, and creates the workspace). Every later phase reads the
5
- active workspace (`.devrites/ACTIVE` `.devrites/work/<slug>/`) first; if
6
- none exists it tells you to run `/rite-spec <feature>`.
3
+ Worked workflows. A full greenfield lifecycle starts with `/rite-spec`; a
4
+ brownfield codebase may enter through `/rite-adopt`, while `/rite-quick` and
5
+ `/rite-frame` deliberately handle bounded work outside the full feature arc.
6
+ Workspace-operating phases read the active workspace (`.devrites/ACTIVE`
7
+ `.devrites/work/<slug>/`) first and report the appropriate on-ramp when none exists.
7
8
 
8
9
  - **Full command reference** → [`command-map.md`](command-map.md)
9
10
  - **Flow diagrams** → [`flow.md`](flow.md)
@@ -28,10 +29,10 @@ survives compaction and new sessions:
28
29
  | `plan.md` | `/rite-define` | approach, dependency graph, checkpoints, rollback |
29
30
  | `tasks.md` | `/rite-define` | ordered `SLICE-###` vertical slices, each mapped to `AC-###` and tagged `Mode: AFK \| HITL` + gate fields |
30
31
  | `traceability.md` | `/rite-define` | AC/REQ → slices → tests/proofs → evidence → touched files matrix |
31
- | `eng-review.md` | `/rite-vet` | engineering plan review (optional): scope challenge, axis findings, failure modes, parallelization |
32
+ | `eng-review.md` | `/rite-vet` | mandatory engineering plan review, light or full by stakes: scope challenge, axis findings, failure modes, parallelization |
32
33
  | `test-plan.md` | `/rite-vet` | build-readable coverage target: coverage diagram, per-gap test requirements, acceptance→test map (read by `/rite-build` + `/rite-prove`) |
33
- | `status.md` | every phase | canonical status checkpoint |
34
34
  | `state.md` | every phase | working ledger: phase, active slice + slice mode, risk, next step; plus `Awaiting human` block when paused (run mode is derived from `.devrites/AFK`, not stored here) |
35
+ | `status.md` | every phase | compatibility alias for the canonical `state.md` cursor |
35
36
  | `questions.md` | every phase | append-only Q&A — qid, slice, gate, status (`open` / `answered` / `dropped`), proposed answer, raised/answered timestamps |
36
37
  | `decisions.md` / `assumptions.md` | every phase | running logs |
37
38
  | `drift.md` | Spec Drift Guard | drift events + resolutions |
@@ -53,7 +54,8 @@ on under `.devrites/archive/<slug>/`.
53
54
  Backward compatibility: older `.devrites/features/<slug>/` workspaces remain
54
55
  readable; migration should add the canonical `.devrites/work` shape without
55
56
  deleting the old files. `feature.md`/`index.md` can still act as the workspace
56
- map, and `proof.md` can still act as the proof alias for `evidence.md`.
57
+ map, `status.md` as the cursor alias for `state.md`, and `proof.md` as the proof
58
+ alias for `evidence.md`.
57
59
 
58
60
  Project-root sentinel (outside the workspace):
59
61
 
@@ -82,6 +84,10 @@ You: I want some kind of reporting thing for admins.
82
84
  → reads the approved spec
83
85
  → writes plan.md + vertical task slices + state
84
86
  → stops for confirmation
87
+
88
+ /rite-vet
89
+ → reviews every defined plan; uses a light or full pass based on stakes
90
+ → writes eng-review.md + test-plan.md before build
85
91
  ```
86
92
 
87
93
  ## 2) Normal feature — the build loop
@@ -89,6 +95,7 @@ You: I want some kind of reporting thing for admins.
89
95
  ```text
90
96
  /rite-spec add-csv-export # investigate → spec.md
91
97
  /rite-define # spec → plan + vertical slices + state
98
+ /rite-vet # mandatory plan review; light or full based on stakes
92
99
  /rite-build # slice 1 ("export endpoint returns CSV"); stops with evidence
93
100
  /rite-build # slice 2 ("download button + states"); repeat for each slice
94
101
  /rite-prove # ONCE all slices built: full tests + browser proof
@@ -139,6 +146,9 @@ You: 2
139
146
  /rite-define
140
147
  → spec → slices; UI slice marked frontend-craft + browser-proof
141
148
 
149
+ /rite-vet
150
+ → hardens the UI plan + acceptance-to-test coverage before code
151
+
142
152
  /rite-build
143
153
  → UI slice → devrites-frontend-craft: register = product surface, **match
144
154
  the saved references**, shape the states (default/loading/empty/error/
@@ -167,6 +177,7 @@ with exact steps — the seal then weighs the UI risk.
167
177
  ```text
168
178
  /rite-spec rate-limit-api # investigate → spec.md (no UI)
169
179
  /rite-define # spec → plan + slices
180
+ /rite-vet # mandatory plan review; checks architecture, tests, perf
170
181
  /rite-build # no UI → no frontend craft / browser proof
171
182
  /rite-prove # targeted tests + build/typecheck; runtime check of the limiter
172
183
  /rite-polish # reference/code.md only (no UI scope detected)
@@ -324,15 +335,14 @@ it stops. Args: `[idea] [--ship|--yolo] [--max-slices N]`.
324
335
  read-only config: it toggles your local session mode and sets the initial
325
336
  `max_slices` budget; nothing else. The mutable remaining-slice count lives
326
337
  in `state.md` (`AFK slices remaining`), never in the sentinel.
327
- - One feature active at a time (`ACTIVE`). To start or switch, run
328
- `/rite-spec <other>` (it creates/selects that workspace and writes its
329
- spec).
338
+ - One feature active at a time (`ACTIVE`). Start a new workspace with
339
+ `/rite-spec <feature>`; switch to an existing one with `/rite use <slug>`.
330
340
  - **Recommended AFK progression**: HITL first to refine the prompt and plan,
331
341
  then drop the sentinel for the bulk stretch. Always cap iterations
332
342
  (`max_slices: 10` is a reasonable default).
333
- - Let the specialists fire on their triggers you don't invoke `devrites-*`
334
- directly. The exceptions are the three public utilities: `/rite-zoom-out`,
335
- `/rite-prototype`, `/rite-handoff`.
336
- - The `devrites-` prefix is a namespace, not a privacy marker — whether a
337
- skill is public is the `user-invocable:` flag, documented for each in
338
- [`command-map.md`](command-map.md).
343
+ - Invoke public `rite` / `rite-*` skills directly; let the model-invocable
344
+ `devrites-*` specialists fire from their documented triggers. `devrites-lib`
345
+ is an internal reference library, not a workflow.
346
+ - Prefixes are namespaces, not invocation policy. `user-invocable` and
347
+ `disable-model-invocation` frontmatter are authoritative; the effective policy
348
+ for every skill is catalogued in [`command-map.md`](command-map.md).