devrites 3.0.4 → 3.0.6

package/scripts/grade-feature.sh

@@ -2,14 +2,14 @@
 # Deterministic OUTCOME grader for a finished DevRites feature workspace.
 #
 # The trigger evals (evals/*.json) test whether the right SKILL *fires*. This
-# grades whether a finished run actually reached a *shippable* state — the
+# grades whether a finished run reached a *shippable* state: the
 # product claim DevRites sells ("won't claim done without proof"). It reads only
 # committed Markdown artifacts (no API key, no Claude Code harness), so it runs
 # in CI against a golden fixture and is the kind of deterministic grader
 # Anthropic's eval guidance recommends for coding agents.
 #
 # Live evidence-freshness (mtime: does proof post-date code?) is NOT graded here
-# — git fixtures don't preserve mtimes; that gate is enforced on a live
+#: git fixtures don't preserve mtimes; that gate is enforced on a live
 # workspace by the `devrites-engine evidence-fresh` engine gate.
 #
 # Usage: grade-feature.sh <workspace-dir>
@@ -39,9 +39,9 @@ seal="$ws/seal.md"; ev="$ws/evidence.md"; rev="$ws/review.md"
 q="$ws/questions.md"; st="$ws/state.md"
 problems=()
 
-# 1 / 2 / 3 — seal verdict, acceptance, blockers
+# 1 / 2 / 3: seal verdict, acceptance, blockers
 if [ ! -f "$seal" ]; then
-  problems+=("seal.md missing — feature never sealed")
+  problems+=("seal.md missing: feature never sealed")
 else
   grep -qiE '^[[:space:]]*Verdict:[[:space:]]*GO[[:space:]]*$' "$seal" \
     || problems+=("seal.md Verdict is not GO")
@@ -58,24 +58,24 @@ else
   fi
 fi
 
-# 4 — evidence
-{ [ -f "$ev" ] && [ -s "$ev" ]; } || problems+=("evidence.md missing or empty — acceptance unproven")
+# 4: evidence
+{ [ -f "$ev" ] && [ -s "$ev" ]; } || problems+=("evidence.md missing or empty: acceptance unproven")
 
-# 5 — review
-[ -f "$rev" ] || problems+=("review.md missing — feature not reviewed")
+# 5: review
+[ -f "$rev" ] || problems+=("review.md missing: feature not reviewed")
 
-# 6 — open validating gate (merge-blocking by definition)
+# 6: open validating gate (merge-blocking by definition)
 if [ -f "$q" ]; then
   if awk '
       /^## q-/{ if(inq && s=="open" && g=="validating") bad=1; inq=1; s=""; g=""; next }
       inq && /^status:/{ v=$0; sub(/^status:[[:space:]]*/,"",v); s=v }
       inq && /^gate:/  { v=$0; sub(/^gate:[[:space:]]*/,"",v);   g=v }
       END{ if(inq && s=="open" && g=="validating") bad=1; exit(bad?0:1) }' "$q"; then
-    problems+=("open 'gate: validating' question — merge-blocking by definition (NO-GO)")
+    problems+=("open 'gate: validating' question: merge-blocking by definition (NO-GO)")
   fi
 fi
 
-# 7 — state phase / status
+# 7: state phase / status
 if [ -f "$st" ]; then
   ph="$(python3 "$ROOT/scripts/workflow_schema.py" field "$st" phase 2>/dev/null || true)"
   stt="$(python3 "$ROOT/scripts/workflow_schema.py" field "$st" status 2>/dev/null || true)"
@@ -87,7 +87,7 @@ else
   problems+=("state.md missing")
 fi
 
-# 8 — executable acceptance criteria: every spec [ACn] proven + checked in seal
+# 8: executable acceptance criteria: every spec [ACn] proven + checked in seal
 run_acceptance_check() {
   if [ -n "${DEVRITES_CLI:-}" ]; then
     "$DEVRITES_CLI" check-acceptance "$ws"
@@ -115,9 +115,9 @@ fi
 
 slug="$(basename "$ws")"
 if [ "${#problems[@]}" -eq 0 ]; then
-  printf 'GO    %s — shippable: sealed GO, acceptance proven, no blockers, no open validating gate.\n' "$slug"
+  printf 'GO    %s: shippable: sealed GO, acceptance proven, no blockers, no open validating gate.\n' "$slug"
   exit 0
 fi
-printf 'NO-GO %s — %d blocker(s):\n' "$slug" "${#problems[@]}"
+printf 'NO-GO %s: %d blocker(s):\n' "$slug" "${#problems[@]}"
 for p in "${problems[@]}"; do printf '  - %s\n' "$p"; done
 exit 1

package/scripts/install-lib.sh

@@ -142,7 +142,7 @@ dr_manifest_contains() {
 }
 
 # Is $1 (canonical) equal to, or inside, a global agent home?
-# Used to refuse global writes. No write verbs here — read-only comparison.
+# Used to refuse global writes. No write verbs here: read-only comparison.
 dr_is_global_claude() {
   _t="$1"
   _home_claude="$HOME/.claude"
@@ -178,7 +178,7 @@ argument-hint: "[args]"
 user-invocable: true
 ---
 
-# /$_name — alias of /$_to
+# /$_name: alias of /$_to
 
 This command **delegates to DevRites \`/$_to\`**. State that to the user, then load and
 run \`$_to/SKILL.md\` with the given arguments, following it exactly.

package/scripts/pin.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# scripts/pin.sh — manage user-pinned slash aliases for DevRites.
+# scripts/pin.sh: manage user-pinned slash aliases for DevRites.
 #
 # Adopts the same "thin wrapper SKILL.md that delegates" pattern as the engine
 # installer uses for --short-aliases=all, but exposes it as a runtime verb so
@@ -66,15 +66,15 @@ done
 [ -z "$SUBCMD" ] && dr_die "missing subcommand (add | remove | list)"
 
 TARGET="$(dr_abspath_dir "$TARGET")" || dr_die "target dir not found: $TARGET"
-dr_is_global_claude "$TARGET" && dr_die "refusing to operate on ~/.claude — DevRites is project-local only"
-dr_is_global_codex "$TARGET" && dr_die "refusing to operate on ~/.codex — DevRites is project-local only"
+dr_is_global_claude "$TARGET" && dr_die "refusing to operate on ~/.claude: DevRites is project-local only"
+dr_is_global_codex "$TARGET" && dr_die "refusing to operate on ~/.codex: DevRites is project-local only"
 
 SKILLS_DIR="$TARGET/.claude/skills"
 CODEX_SKILLS_DIR="$TARGET/.agents/skills"
 MF="$TARGET/$DR_MANIFEST_NAME"
 
-[ -d "$SKILLS_DIR" ] || dr_die "no .claude/skills at $TARGET — run install.sh first?"
-[ -f "$MF" ]         || dr_die "no manifest at $MF — run install.sh first?"
+[ -d "$SKILLS_DIR" ] || dr_die "no .claude/skills at $TARGET: run install.sh first?"
+[ -f "$MF" ]         || dr_die "no manifest at $MF: run install.sh first?"
 
 # ---- helpers -------------------------------------------------------------
 valid_alias_name() {
@@ -108,7 +108,7 @@ is_pinned_alias_file() {
 # ---- subcommands ---------------------------------------------------------
 do_add() {
   valid_alias_name "$ALIAS"    || dr_die "invalid alias name '$ALIAS' (lowercase / digits / hyphens; not 'rite' or 'rite-*')"
-  is_known_target "$DEST"      || dr_die "unknown target '$DEST' — not a rite-* skill in $SKILLS_DIR"
+  is_known_target "$DEST"      || dr_die "unknown target '$DEST': not a rite-* skill in $SKILLS_DIR"
   [ "$ALIAS" = "$DEST" ]       && dr_die "alias and target are the same"
 
   ALIAS_DIR="$SKILLS_DIR/$ALIAS"
@@ -120,16 +120,16 @@ do_add() {
 
   if [ -e "$ALIAS_FILE" ]; then
     if is_pinned_alias "$ALIAS"; then
-      dr_warn "already pinned: /$ALIAS — overwriting"
+      dr_warn "already pinned: /$ALIAS: overwriting"
     else
-      dr_die "$ALIAS_FILE exists and is NOT a pinned alias — refusing to overwrite"
+      dr_die "$ALIAS_FILE exists and is NOT a pinned alias: refusing to overwrite"
     fi
   fi
   if [ -d "$CODEX_SKILLS_DIR" ] && [ -e "$CODEX_ALIAS_FILE" ]; then
     if is_pinned_alias_file "$CODEX_ALIAS_FILE"; then
-      dr_warn "already pinned for Codex: /$ALIAS — overwriting"
+      dr_warn "already pinned for Codex: /$ALIAS: overwriting"
     else
-      dr_die "$CODEX_ALIAS_FILE exists and is NOT a pinned alias — refusing to overwrite"
+      dr_die "$CODEX_ALIAS_FILE exists and is NOT a pinned alias: refusing to overwrite"
     fi
   fi
 
@@ -164,12 +164,12 @@ do_remove() {
   CODEX_ALIAS_REL=".agents/skills/$ALIAS/SKILL.md"
 
   [ -f "$ALIAS_FILE" ]      || dr_die "no pinned alias at $ALIAS_FILE"
-  is_pinned_alias "$ALIAS"  || dr_die "$ALIAS_FILE exists but is not a pinned alias — refusing to remove"
+  is_pinned_alias "$ALIAS"  || dr_die "$ALIAS_FILE exists but is not a pinned alias: refusing to remove"
 
   rm -f "$ALIAS_FILE"
   rmdir "$ALIAS_DIR" 2>/dev/null || true
   if [ -f "$CODEX_ALIAS_FILE" ]; then
-    is_pinned_alias_file "$CODEX_ALIAS_FILE" || dr_die "$CODEX_ALIAS_FILE exists but is not a pinned alias — refusing to remove"
+    is_pinned_alias_file "$CODEX_ALIAS_FILE" || dr_die "$CODEX_ALIAS_FILE exists but is not a pinned alias: refusing to remove"
     rm -f "$CODEX_ALIAS_FILE"
     rmdir "$CODEX_ALIAS_DIR" 2>/dev/null || true
   fi

package/scripts/run-behavioral-evals.sh

@@ -1,17 +1,17 @@
 #!/usr/bin/env bash
-# scripts/run-behavioral-evals.sh — validate the SHAPE of DevRites behavioral evals.
+# scripts/run-behavioral-evals.sh: validate the SHAPE of DevRites behavioral evals.
 #
 # Trigger evals (run-evals.sh) test whether the right skill *fires*. Behavioral
-# evals test whether a gating skill's discipline *holds under pressure* — does it
+# evals test whether a gating skill's discipline *holds under pressure*: does it
 # resist the rationalizations it documents in `standards/anti-patterns.md` (and its own
 # `reference/anti-patterns.md`), or does the agent talk itself past the gate. Each
 # scenario pairs a pressure prompt with the resistance a holding response shows and
 # the capitulation markers a failed one shows.
 #
-# This script is the DETERMINISTIC, zero-token CI gate — the analog of run-evals.sh's
+# This script is the DETERMINISTIC, zero-token CI gate: the analog of run-evals.sh's
 # schema path and the engine spec-validate gate: it checks that every behavioral eval is well-formed
 # so a malformed one can't reach the live grader. It does NOT invoke a model. Executing
-# the scenarios against a live Claude (does the skill actually resist?) is the labeled /
+# the scenarios against a live Claude (does the skill resist?) is the labeled /
 # nightly rung documented in evals/behavioral/README.md.
 #
 # In addition to the original DevRites pressure schema, scenarios may carry the
@@ -23,7 +23,7 @@
 #   scripts/run-behavioral-evals.sh                                  # validate every evals/behavioral/*.json
 #   scripts/run-behavioral-evals.sh evals/behavioral/rite-prove.json # validate one file
 #
-# Exit: 0 all valid (or no behavioral evals present — opt-in, never a failure) ·
+# Exit: 0 all valid (or no behavioral evals present: opt-in, never a failure) ·
 #       1 shape violation(s) · 2 missing parser
 
 set -euo pipefail
@@ -37,7 +37,7 @@ if [[ $# -gt 0 ]]; then
   FILES=("$@")
 else
   if [[ ! -d "$BEHAVIORAL_DIR" ]]; then
-    echo "No evals/behavioral/ directory — behavioral evals are opt-in; nothing to validate."
+    echo "No evals/behavioral/ directory: behavioral evals are opt-in; nothing to validate."
     exit 0
   fi
   FILES=()
@@ -48,7 +48,7 @@ else
 fi
 
 if [[ ${#FILES[@]} -eq 0 ]]; then
-  echo "No behavioral eval files — behavioral evals are opt-in; nothing to validate."
+  echo "No behavioral eval files: behavioral evals are opt-in; nothing to validate."
   exit 0
 fi
 
@@ -89,9 +89,9 @@ if not isinstance(scenarios, list):
     errors.append("scenarios is not a list")
     scenarios = []
 elif len(scenarios) == 0:
-    errors.append("scenarios is empty — a behavioral eval needs at least one")
+    errors.append("scenarios is empty: a behavioral eval needs at least one")
 
-# Metric fields (optional — default to the regression discipline). A behavioral
+# Metric fields (optional: default to the regression discipline). A behavioral
 # eval is a regression gate by nature (the discipline must hold every trial ->
 # pass^k = 100%); a capability eval is the exploratory pass@k variant.
 ec = data.get("eval_class", "regression")
@@ -196,7 +196,7 @@ if [[ $FAILED -gt 0 ]]; then
 fi
 
 echo
-echo "Note: this is shape validation only — it does not execute the scenarios."
-echo "To grade whether the skills actually resist under pressure (live model):"
-echo "  see evals/behavioral/README.md — the labeled / nightly rung."
+echo "Note: this is shape validation only: it does not execute the scenarios."
+echo "To grade whether the skills resist under pressure (live model):"
+echo "  see evals/behavioral/README.md: the labeled / nightly rung."
 exit 0

package/scripts/run-evals.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# scripts/run-evals.sh — validate the structure of DevRites trigger evals.
+# scripts/run-evals.sh: validate the structure of DevRites trigger evals.
 #
 # Schema check + summary. Does NOT invoke a model unless --live is passed.
 # Live execution requires CLAUDE_API_KEY and is manual-only, never CI default.

package/scripts/run-outcome-evals.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Outcome-eval harness — proves the deterministic feature grader BOTH passes a
+# Outcome-eval harness: proves the deterministic feature grader BOTH passes a
 # known-shippable workspace AND fails a known-blocked one (see-it-fail-first:
 # a grader that never returns NO-GO proves nothing). Runs in CI; no API key.
 #
@@ -18,9 +18,9 @@ trap 'rm -rf "$tmp"' EXIT
 
 echo "== grade golden/shippable-feature (expect GO) =="
 if bash "$GRADER" "$good"; then
-  echo "  PASS — graded GO"
+  echo "  PASS: graded GO"
 else
-  echo "  FAIL — a known-shippable workspace should grade GO"; fail=1
+  echo "  FAIL: a known-shippable workspace should grade GO"; fail=1
 fi
 
 echo
@@ -39,28 +39,28 @@ cat > "$canonical/state.md" <<'MD'
 | next_action | archived |
 MD
 if bash "$GRADER" "$canonical"; then
-  echo "  PASS — canonical cursor graded GO"
+  echo "  PASS: canonical cursor graded GO"
 else
-  echo "  FAIL — canonical cursor should grade GO"; fail=1
+  echo "  FAIL: canonical cursor should grade GO"; fail=1
 fi
 
 echo
 echo "== grade golden/blocked-feature (expect NO-GO) =="
 if bash "$GRADER" "$bad"; then
-  echo "  FAIL — a known-blocked workspace should NOT grade GO"; fail=1
+  echo "  FAIL: a known-blocked workspace should NOT grade GO"; fail=1
 else
-  echo "  PASS — correctly graded NO-GO"
+  echo "  PASS: correctly graded NO-GO"
 fi
 
 echo
 echo "== grade golden/near-miss-unproven-ac (expect NO-GO on ONE invariant) =="
 # Isolates invariant 2 (every acceptance criterion proven): identical to the
 # shippable fixture except a single AC is left unchecked. Proves that gate fails
-# independently — not only when six invariants trip at once.
+# independently: not only when six invariants trip at once.
 if bash "$GRADER" "$nearmiss"; then
-  echo "  FAIL — an unproven acceptance criterion must grade NO-GO"; fail=1
+  echo "  FAIL: an unproven acceptance criterion must grade NO-GO"; fail=1
 else
-  echo "  PASS — correctly graded NO-GO on the lone unchecked AC"
+  echo "  PASS: correctly graded NO-GO on the lone unchecked AC"
 fi
 
 echo
@@ -83,9 +83,9 @@ Evidence exists.
 none
 MD
 if bash "$GRADER" "$wrongac"; then
-  echo "  FAIL — checked unrelated acceptance items must not prove spec [ACn] criteria"; fail=1
+  echo "  FAIL: checked unrelated acceptance items must not prove spec [ACn] criteria"; fail=1
 else
-  echo "  PASS — correctly graded NO-GO when spec [ACn] ids are missing from seal.md"
+  echo "  PASS: correctly graded NO-GO when spec [ACn] ids are missing from seal.md"
 fi
 
 echo

package/scripts/scan-pack-security.py

@@ -13,7 +13,7 @@ Exits non-zero if any finding is reported.
 
 Two finding classes:
 
-  1. Hidden unicode (always a finding — no legitimate reason to exist in a
+  1. Hidden unicode (always a finding: no legitimate reason to exist in a
      Markdown/shell instruction file): bidi controls, zero-width characters,
      other invisibles, and homoglyph confusables (a word that mixes ASCII with
      look-alike Cyrillic/Greek letters).
@@ -23,7 +23,7 @@ Two finding classes:
      permission escalation, and data-exfiltration phrasing.
 
 Suppression (for DevRites' own files that legitimately *discuss* injection
-defensively — e.g. security.md, the reviewer agents): put a marker on the same
+defensively: e.g. security.md, the reviewer agents): put a marker on the same
 line OR anywhere in the file:
 
     ... ignore previous instructions ...   <!-- pack-scan-ignore: defensive doc -->
@@ -33,7 +33,7 @@ A whole file can opt a class out with a top-of-file marker:
     <!-- pack-scan-ignore-file: injection -->
 
 Suppressions live in the file, so every exception is visible in the diff and
-reviewable — consistent with DevRites' "no silent state" thesis. Hidden-unicode
+reviewable: consistent with DevRites' "no silent state" thesis. Hidden-unicode
 findings can be suppressed the same way but should essentially never be.
 """
 import os
@@ -132,7 +132,7 @@ def find_injection(text, file_suppressed):
 
 
 _LINE_SUPPRESS = re.compile(r"pack-scan-ignore\b(?!-file)", re.IGNORECASE)
-# Class list is word/comma/space only — a trailing "-->" comment closer must not
+# Class list is word/comma/space only: a trailing "-->" comment closer must not
 # get swallowed into the captured class name.
 _FILE_SUPPRESS = re.compile(r"pack-scan-ignore-file\s*:\s*([\w, ]+)", re.IGNORECASE)
 

package/scripts/scan-supply-chain-iocs.py

@@ -3,12 +3,12 @@
 
 Dependabot manages version *updates*; this gate catches a *known-malicious* installed
 version (a compromised release that slipped in). It checks every name@version in the
-lockfile against the bundled IOC dataset (scripts/supply-chain-iocs.json) — an offline,
+lockfile against the bundled IOC dataset (scripts/supply-chain-iocs.json): an offline,
 always-available advisory source, so CI is deterministic and needs no network.
 
-`--online` additionally queries the OSV API per package and is best-effort: if the
+`--online` also queries the OSV API per package and is best-effort: if the
 advisory source is unreachable it prints a notice and falls back to the bundled dataset
-(it never fails the build on a network error — only on a real IOC match).
+(it never fails the build on a network error: only on a real IOC match).
 
 Usage: scan-supply-chain-iocs.py [LOCKFILE] [--iocs FILE] [--online]
   LOCKFILE defaults to package-lock.json.
@@ -87,7 +87,7 @@ def main(argv):
     lockfile = args[0] if args else "package-lock.json"
 
     if not os.path.isfile(lockfile):
-        print("OK    no lockfile at %s — nothing to scan" % lockfile)
+        print("OK    no lockfile at %s: nothing to scan" % lockfile)
         return 0
     try:
         index = load_iocs(iocs_path)
@@ -100,7 +100,7 @@ def main(argv):
     for name, ver in pkgs:
         e = index.get(name)
         if e and ver in e.get("versions", []):
-            findings.append("FINDING %s@%s — %s (%s)" % (name, ver, e["note"], e["source"]))
+            findings.append("FINDING %s@%s: %s (%s)" % (name, ver, e["note"], e["source"]))
 
     if online:
         offline_notice = False
@@ -110,9 +110,9 @@ def main(argv):
                 offline_notice = True
                 break
             if res:
-                findings.append("FINDING %s@%s — %s" % (name, ver, res))
+                findings.append("FINDING %s@%s: %s" % (name, ver, res))
         if offline_notice:
-            print("note: OSV unreachable — fell back to the bundled IOC dataset only")
+            print("note: OSV unreachable: fell back to the bundled IOC dataset only")
 
     if findings:
         for f in sorted(set(findings)):

package/scripts/skills-inventory.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// skills-inventory.mjs — verify authored DevRites skill inventory and docs counts.
+// skills-inventory.mjs: verify authored DevRites skill inventory and docs counts.
 import { readdirSync, readFileSync, statSync } from 'node:fs';
 import { join, relative } from 'node:path';
 
@@ -7,6 +7,7 @@ const root = new URL('..', import.meta.url).pathname.replace(/\/$/, '');
 const skillsDir = join(root, 'pack', '.claude', 'skills');
 const docsSkills = join(root, 'docs', 'skills.md');
 const docsCommandMap = join(root, 'docs', 'command-map.md');
+const docsFlow = join(root, 'docs', 'flow.md');
 const readme = join(root, 'README.md');
 const arch = join(root, 'docs', 'architecture.md');
 
@@ -82,17 +83,33 @@ function assertPublicSkillLinks(path, label) {
   }
 }
 
+function assertPublicSkillMentions(path, label) {
+  const text = readFileSync(path, 'utf8');
+  for (const skill of skills.filter((s) => s.invocable === 'true')) {
+    const escaped = skill.name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const token = new RegExp(`(^|[^a-z0-9-])${escaped}([^a-z0-9-]|$)`, 'im');
+    if (!token.test(text)) {
+      fail(`${relative(root, path)}: missing ${label} entry for ${skill.name}`);
+    }
+  }
+}
+
 assertDocContains(docsSkills, `# All ${total} skills`, 'total skill heading');
-assertDocContains(docsSkills, `**${total} skills total**`, 'total skill prose');
+assertDocContains(docsSkills, `The pack contains ${total} skills`, 'total skill prose');
 assertDocContains(docsSkills, `${publicRiteCount} user-invocable \`rite-*\``, 'public rite-* count');
 assertDocContains(docsSkills, `${modelInvokedInternalCount} model-invoked \`devrites-*\` specialists`, 'model-invoked internal count');
 assertDocContains(docsSkills, 'npx devrites', 'npx distribution contract');
 assertDocContains(docsCommandMap, 'npx devrites', 'npx distribution contract');
-assertDocContains(readme, `**${total} skills total**`, 'README total skill prose');
-assertDocContains(readme, `# skills/  ${total} skills`, 'README layout total count');
+assertDocContains(readme, `The pack ships ${total} skills`, 'README total skill prose');
+assertDocContains(readme, `${publicCount} public and ${internalCount} internal`, 'README public/internal count');
+assertDocContains(readme, '[skills catalogue](docs/skills.md)', 'README skills catalogue link');
 assertDocContains(arch, `${publicRiteCount} public \`rite-*\` skills (${total} total)`, 'architecture surface count');
+assertDocContains(docsFlow, `: ${publicCount} skills`, 'flow public count');
+assertDocContains(docsFlow, `: ${internalCount} skills`, 'flow internal count');
 assertPublicSkillLinks(docsSkills, 'skills catalogue');
 assertPublicSkillLinks(docsCommandMap, 'command map');
+assertPublicSkillMentions(docsFlow, 'flow namespace');
+assertPublicSkillMentions(arch, 'architecture surface');
 
 console.log(`skills total: ${total}`);
 console.log(`public skills: ${publicCount}`);

package/scripts/sync-version.sh

@@ -39,7 +39,7 @@ for (const u of updates) {
 const readmePath = path.resolve('README.md');
 const readme = fs.readFileSync(readmePath, 'utf8');
 const statusLine =
-  `**Status:** [\`v${version}\`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v${version}) — ` +
+  `**Status:** [\`v${version}\`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v${version}): ` +
   "see [`CHANGELOG.md`](CHANGELOG.md) for release notes.";
 const re = /\*\*Status:\*\*[^\n]*(?:\n(?!\n)[^\n]*)*/;
 if (re.test(readme)) {
@@ -49,6 +49,6 @@ if (re.test(readme)) {
     console.log('  → README.md');
   }
 } else {
-  console.warn('  ! README.md status line not found — skipping');
+  console.warn('  ! README.md status line not found: skipping');
 }
 NODE

package/scripts/validate-workflow-security.py

@@ -4,12 +4,14 @@
 DevRites' publish (release.yml) and auto-merge paths are high-value targets, so this
 gate fails CI when a workflow:
 
-  - uses any non-local action not pinned to a full 40-char commit SHA — a moving
+  - uses any non-local action not pinned to a full 40-char commit SHA: a moving
     tag like `@v2` lets a compromised upstream inject code into the pipeline;
-  - declares no `permissions:` scope anywhere — the default token is broad;
+  - declares no `permissions:` scope anywhere: the default token is broad;
   - uses `permissions: write-all` (over-broad);
   - uses `pull_request_target`, except for a Dependabot-only workflow that never
     checks out PR code.
+  - leaves an internal `: ` unquoted in a workflow or step name, which makes the
+    workflow invalid YAML and prevents every job from starting.
 
 Usage: validate-workflow-security.py [DIR]   (default: .github/workflows)
 Exit: 0 clean; 1 on any finding.
@@ -26,6 +28,7 @@ DEPENDABOT_ONLY_RE = re.compile(
     r"['\"]dependabot\[bot\]['\"]",
     re.MULTILINE,
 )
+UNQUOTED_NAME_COLON_RE = re.compile(r"^\s*(?:-\s*)?name:\s+[^'\"].*:\s+\S")
 
 
 def safe_dependabot_target(text):
@@ -43,15 +46,18 @@ def scan_text(path, text):
     lines = text.splitlines()
     dependabot_target_is_safe = safe_dependabot_target(text)
     if not re.search(r"^\s*permissions:", text, re.MULTILINE):
-        findings.append("%s: no permissions: scope — the default GITHUB_TOKEN is broad; "
+        findings.append("%s: no permissions: scope: the default GITHUB_TOKEN is broad; "
                         "add an explicit least-privilege permissions block" % path)
     for i, line in enumerate(lines, 1):
+        if UNQUOTED_NAME_COLON_RE.match(line):
+            findings.append("%s:%d: name contains an unquoted colon: quote the complete "
+                            "name so GitHub can parse the workflow" % (path, i))
         if "write-all" in line:
-            findings.append("%s:%d: permissions: write-all is over-broad — scope to the "
+            findings.append("%s:%d: permissions: write-all is over-broad: scope to the "
                             "minimum needed" % (path, i))
         if "pull_request_target" in line and not dependabot_target_is_safe:
             findings.append("%s:%d: pull_request_target runs with secrets on untrusted PR "
-                            "code — only a Dependabot-only workflow without checkout is allowed"
+                            "code: only a Dependabot-only workflow without checkout is allowed"
                             % (path, i))
         m = USES_RE.match(line)
         if not m:
@@ -63,7 +69,7 @@ def scan_text(path, text):
         pin = at[1] if len(at) == 2 else ""
         if not SHA_RE.match(pin):
             findings.append("%s:%d: action '%s' not pinned to a full commit "
-                            "SHA — pin it (a moving tag is a supply-chain risk)"
+                            "SHA: pin it (a moving tag is a supply-chain risk)"
                             % (path, i, ref))
     return findings
 

package/scripts/validate-workspace-schema.py

@@ -170,7 +170,7 @@ def existing_or_alias(workspace: Path, name: str) -> bool:
 
 def find_local_workspaces(root: Path) -> list[Path]:
     # A devrites workspace is identified by its devrites-specific artifacts, NOT by
-    # README.md — every repo root has a README.md, and matching on it here both
+    # README.md: every repo root has a README.md, and matching on it here both
     # misclassifies the repo root as a workspace and short-circuits the .devrites/work
     # scan below (return [root] before the loop ever runs).
     if root.is_dir() and any((root / name).exists() for name in ("spec.md", "state.md", "feature.md")):
@@ -440,7 +440,7 @@ def main(argv: list[str]) -> int:
         print(f"workspace-schema: {len(errors)} error(s) across {len(set(workspaces))} workspace(s)", file=sys.stderr)
         return 1
 
-    print(f"workspace-schema: OK — {len(set(workspaces))} workspace(s) validated")
+    print(f"workspace-schema: OK: {len(set(workspaces))} workspace(s) validated")
     return 0
 
 

package/scripts/validate.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# validate.sh — static validation of the DevRites pack (no install required).
+# validate.sh: static validation of the DevRites pack (no install required).
 # Run from anywhere. Exits non-zero if any hard check fails.
 
 set -u
@@ -207,7 +207,7 @@ fi
 section "no global ~/.claude writes"
 if bash "$ROOT/scripts/check-no-global-writes.sh" >/tmp/dr_glob 2>&1; then good "no-global-writes check passed"; else bad "no-global-writes check failed"; cat /tmp/dr_glob; fi
 
-# ---- 11. principle uniqueness — each canonical heading appears exactly once
+# ---- 11. principle uniqueness: each canonical heading appears exactly once
 section "principle uniqueness"
 if bash "$ROOT/scripts/check-rule-uniqueness.sh" >/tmp/dr_uniq 2>&1; then
   cat /tmp/dr_uniq
@@ -254,7 +254,7 @@ fi
 # ---- 12. no runtime-broken pack/.claude/ path in installed prose ---------
 # After install the leading pack/ is stripped, so any literal pack/.claude/skills/devrites-lib/reference/standards/
 # or pack/.claude/skills/ in shipped SKILL.md / reference prose is a dead path
-# at runtime. (Repo README/docs links are out of scope — they're GitHub links.)
+# at runtime. (Repo README/docs links are out of scope: they're GitHub links.)
 section "no literal pack/.claude/ paths in shipped skill prose"
 # Exclude the intentional resolution-snippet fallback (`... || P=pack/.claude/...`): the
 # preamble snippet tries the installed `.claude/` path first, then `${CLAUDE_SKILL_DIR}`
@@ -273,7 +273,7 @@ fi
 section "no false session-start autoload claim"
 AUTOLOAD_HITS="$(grep -rl 'autoloaded by Claude Code' "$ROOT/pack" "$ROOT/docs" "$ROOT/README.md" 2>/dev/null || true)"
 if [ -n "$AUTOLOAD_HITS" ]; then
-  bad "false 'autoloaded by Claude Code' claim — the pack ships no autoload wiring:"
+  bad "false 'autoloaded by Claude Code' claim: the pack ships no autoload wiring:"
   printf '%s\n' "$AUTOLOAD_HITS" | sed "s|$ROOT/||"
 else
   good "no false session-start autoload claim in pack/ docs/ README.md"
@@ -327,18 +327,18 @@ fi
 # ---- 15. shellcheck (error = blocking, warning = advisory) ---------------
 # CI runners ship shellcheck, so the error-level gate is enforced on every PR.
 # Locally it self-skips when shellcheck is absent (the gate is non-blocking only
-# where the tool isn't installed — never silently downgraded where it is).
+# where the tool isn't installed: never silently downgraded where it is).
 section "shellcheck (-S error blocking · -S warning advisory)"
 if command -v shellcheck >/dev/null 2>&1; then
   for f in $SH_LIST; do
     if shellcheck -S error "$f"; then good "shellcheck ${f#"$ROOT"/}"; else bad "shellcheck (error) ${f#"$ROOT"/}"; fi
   done
-  # warning-level is informational — surfaced per file, never fails the build.
+  # warning-level is informational: surfaced per file, never fails the build.
   for f in $SH_LIST; do
     shellcheck -S warning "$f" >/dev/null 2>&1 || echo "  advisory (warning-level): ${f#"$ROOT"/}"
   done
 else
-  echo "skip: shellcheck not installed locally (optional — CI enforces the error-level gate)"
+  echo "skip: shellcheck not installed locally (optional: CI enforces the error-level gate)"
 fi
 
 # ---- summary -------------------------------------------------------------