devrites 3.0.7 → 3.1.0

package/pack/generated/codex/skills/rite-define/reference/plan-template.md

@@ -1,12 +1,11 @@
 # `plan.md` template
 
-Write **how** to build what `spec.md` defines. The plan is **living, not sacred**:
-`$rite-plan` repairs it when reality disagrees. This is where technology choices live
-(they're banned from the spec).
+Write **how** to build what `spec.md` defines. Use `$rite-plan` when evidence requires
+an update. Technology choices belong here, not in the spec.
 
 ```markdown
 # Plan: <Feature>
-Spec: ./spec.md   Date: <date>
+Spec: ./spec.md   Decision coverage: ./decision-coverage.md   Date: <date>
 
 ## Summary
 1–2 sentences: the primary requirement + the chosen approach.
@@ -17,7 +16,8 @@ Spec: ./spec.md   Date: <date>
 - Storage / data: <...>
 - Testing tools + commands: <from spec "Commands discovered">
 - Target / platform / constraints: <...>
-- `[NEEDS CLARIFICATION: ...]` for any unknown that affects the approach.
+- Any product/constraint unknown that affects the approach routes to `$rite-clarify`;
+  do not carry `[NEEDS CLARIFICATION]` into an approvable plan.
 
 ## Global constraints
 Project-wide requirements from the spec that every slice implicitly includes — version
@@ -26,6 +26,8 @@ values **verbatim from spec.md** (a paraphrased constraint drifts by the time sl
 
 ## Approach
 The strategy in a few sentences. Why this over the alternatives considered.
+For high-cost/hard-to-reverse boundaries, models, contracts, or dependencies compare ≥2
+viable `Option · Drivers · Trade-offs · Consequence`; skip theater for routine choices.
 
 ## Slice strategy
 How the feature is split into vertical `SLICE-###` increments, why the order is
@@ -36,9 +38,9 @@ green, or name the integration branch + final verify slice.
 ## Architecture decisions
 Key decisions + rationale (mirror into decisions.md). New pattern vs reuse — prefer
 reuse of existing project conventions. Record architecture as invariants, not scaffolding:
-include a decision only when two implementing slices could otherwise choose incompatibly. For each
-medium+ decision, include `Binds:` (what future work must follow) and `Prevents:` (the divergence
-or failure it avoids).
+include a decision only when slices could choose incompatibly. Medium+ decisions include
+`Binds:` and `Prevents:`. Cross-boundary interfaces name invariants, I/O, ordering/idempotency,
+errors, versioning, config, and relevant budgets.
 
 ## Dependency graph
 What must exist before what (text is fine):
@@ -55,6 +57,7 @@ slices above the cut, and no slice above it depends on one below.
 ## Validation strategy
 After which slices to run tests / build / browser proof. For UI slices, name the visual
 acceptance targets from `design-brief.md`, not a generic "looks good" check.
+Each proof names exact command/cwd/signal, prerequisites, and mutable provenance inputs.
 
 **Key links** — the wiring the assembled feature must exhibit, one row each:
 `<from> → <to> via <mechanism>` (route → handler via registration; producer → consumer via
@@ -81,14 +84,19 @@ Framework/library docs to consult (triggers devrites-source-driven). Record URLs
 decisions.md / evidence.md when used.
 
 ## Readiness gate  *(must pass before $rite-build)*
+- [ ] `decision-coverage.md` says `Decision coverage: CLEAR`
 - [ ] Every spec acceptance criterion is covered by a slice
 - [ ] Dependency order is acyclic and risk-first
 - [ ] An `MVP cut` is named, self-contained (ACs above the cut proven above the cut, no dependency reaching below), and marks a genuinely shippable scope
 - [ ] No unjustified deviation remains in the complexity gate
 - [ ] Rollback exists for every destructive / migration step
 - [ ] Every `Mode: HITL` slice has `Gate`, `SLA`, and `Checkpoint` populated
+- [ ] Human-owned choices are resolved; surviving checkpoints need unavailable pre-code
+      evidence or action-time approval
+- [ ] Slice proof commands, cwd, prerequisites, and provenance inputs are preflightable
 - [ ] Every UI slice names `Design brief states` and binary `Visual acceptance`
 - [ ] `Key links` rows cover every cross-slice wiring (or state `none`)
+- [ ] Cross-boundary contracts name producer, consumer, invariants/errors/order, and proof
 - [ ] Any wide mechanical refactor is sliced expand → migrate batches → contract, with green migrate batches or an integration branch + final verify slice
 - [ ] No `Gate: blocking` slice is implicitly chained behind an AFK slice without surfacing the dependency
 ```

package/pack/generated/codex/skills/rite-doctor/SKILL.md

@@ -11,9 +11,13 @@ This is the Codex mirror of a DevRites skill. In Codex:
 
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- When this skill asks for a DevRites specialist or writer agent, **explicitly** spawn the matching Codex custom agent from `.codex/agents/devrites-*.toml` through Codex subagents (`spawn_agent`), then wait for its result and reconcile it as the skill instructs. Do not do the review inline just because the instruction to spawn is embedded here: Codex under-fires embedded spawn/skill instructions (openai/codex #23496), so treat the spawn as required, not optional.
-- The independence of a fresh-context subagent is the point. If Codex genuinely cannot spawn subagents in the current surface, run the documented inline fallback and **label the result an inline fallback, not an independent review**: an inline pass shares the calling context and is weaker evidence.
-- Codex project hooks are installed in `.codex/hooks.json`. Review and trust them with `/hooks` before relying on hook enforcement.
+- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
+- For every DevRites specialist or writer dispatch, first call `spawn_agent` with the named `devrites-<role>` custom role. The matching project contract is `.codex/agents/devrites-<role>.toml`.
+- If `spawn_agent` is callable but a named read-only role is unavailable, use generic `explorer` only when the host proves that run has a runtime-enforced read-only sandbox. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. A missing read-only custom role is not evidence that spawning is unavailable.
+- Never dispatch generic `worker` for `devrites-slice-wright` unless the host proves that worker run carries exact DevRites identity and the same `.wright-allowlist` enforcement as the named role. Codex reports a generic run as `agent_type=worker`, so the generated global hooks cannot prove that binding. Reject that unsafe rung and use the documented labelled inline wright path with `.reconcile-inline` plus the full reconcile gate.
+- If the host cannot prove the generic explorer is runtime read-only, reject that rung too. Only when no spawn primitive exists or a higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, and apply every fallback risk gate. An unbound generic wright or unconfined generic explorer is such a safety rejection, not evidence that no agents exist.
+- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
+- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
 
 

package/pack/generated/codex/skills/rite-dogfood/SKILL.md

@@ -12,9 +12,13 @@ This is the Codex mirror of a DevRites skill. In Codex:
 
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- When this skill asks for a DevRites specialist or writer agent, **explicitly** spawn the matching Codex custom agent from `.codex/agents/devrites-*.toml` through Codex subagents (`spawn_agent`), then wait for its result and reconcile it as the skill instructs. Do not do the review inline just because the instruction to spawn is embedded here: Codex under-fires embedded spawn/skill instructions (openai/codex #23496), so treat the spawn as required, not optional.
-- The independence of a fresh-context subagent is the point. If Codex genuinely cannot spawn subagents in the current surface, run the documented inline fallback and **label the result an inline fallback, not an independent review**: an inline pass shares the calling context and is weaker evidence.
-- Codex project hooks are installed in `.codex/hooks.json`. Review and trust them with `/hooks` before relying on hook enforcement.
+- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
+- For every DevRites specialist or writer dispatch, first call `spawn_agent` with the named `devrites-<role>` custom role. The matching project contract is `.codex/agents/devrites-<role>.toml`.
+- If `spawn_agent` is callable but a named read-only role is unavailable, use generic `explorer` only when the host proves that run has a runtime-enforced read-only sandbox. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. A missing read-only custom role is not evidence that spawning is unavailable.
+- Never dispatch generic `worker` for `devrites-slice-wright` unless the host proves that worker run carries exact DevRites identity and the same `.wright-allowlist` enforcement as the named role. Codex reports a generic run as `agent_type=worker`, so the generated global hooks cannot prove that binding. Reject that unsafe rung and use the documented labelled inline wright path with `.reconcile-inline` plus the full reconcile gate.
+- If the host cannot prove the generic explorer is runtime read-only, reject that rung too. Only when no spawn primitive exists or a higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, and apply every fallback risk gate. An unbound generic wright or unconfined generic explorer is such a safety rejection, not evidence that no agents exist.
+- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
+- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
 
 

package/pack/generated/codex/skills/rite-explain/SKILL.md

@@ -12,9 +12,13 @@ This is the Codex mirror of a DevRites skill. In Codex:
 
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- When this skill asks for a DevRites specialist or writer agent, **explicitly** spawn the matching Codex custom agent from `.codex/agents/devrites-*.toml` through Codex subagents (`spawn_agent`), then wait for its result and reconcile it as the skill instructs. Do not do the review inline just because the instruction to spawn is embedded here: Codex under-fires embedded spawn/skill instructions (openai/codex #23496), so treat the spawn as required, not optional.
-- The independence of a fresh-context subagent is the point. If Codex genuinely cannot spawn subagents in the current surface, run the documented inline fallback and **label the result an inline fallback, not an independent review**: an inline pass shares the calling context and is weaker evidence.
-- Codex project hooks are installed in `.codex/hooks.json`. Review and trust them with `/hooks` before relying on hook enforcement.
+- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
+- For every DevRites specialist or writer dispatch, first call `spawn_agent` with the named `devrites-<role>` custom role. The matching project contract is `.codex/agents/devrites-<role>.toml`.
+- If `spawn_agent` is callable but a named read-only role is unavailable, use generic `explorer` only when the host proves that run has a runtime-enforced read-only sandbox. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. A missing read-only custom role is not evidence that spawning is unavailable.
+- Never dispatch generic `worker` for `devrites-slice-wright` unless the host proves that worker run carries exact DevRites identity and the same `.wright-allowlist` enforcement as the named role. Codex reports a generic run as `agent_type=worker`, so the generated global hooks cannot prove that binding. Reject that unsafe rung and use the documented labelled inline wright path with `.reconcile-inline` plus the full reconcile gate.
+- If the host cannot prove the generic explorer is runtime read-only, reject that rung too. Only when no spawn primitive exists or a higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, and apply every fallback risk gate. An unbound generic wright or unconfined generic explorer is such a safety rejection, not evidence that no agents exist.
+- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
+- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
 
 

package/pack/generated/codex/skills/rite-frame/SKILL.md

@@ -11,9 +11,13 @@ This is the Codex mirror of a DevRites skill. In Codex:
 
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- When this skill asks for a DevRites specialist or writer agent, **explicitly** spawn the matching Codex custom agent from `.codex/agents/devrites-*.toml` through Codex subagents (`spawn_agent`), then wait for its result and reconcile it as the skill instructs. Do not do the review inline just because the instruction to spawn is embedded here: Codex under-fires embedded spawn/skill instructions (openai/codex #23496), so treat the spawn as required, not optional.
-- The independence of a fresh-context subagent is the point. If Codex genuinely cannot spawn subagents in the current surface, run the documented inline fallback and **label the result an inline fallback, not an independent review**: an inline pass shares the calling context and is weaker evidence.
-- Codex project hooks are installed in `.codex/hooks.json`. Review and trust them with `/hooks` before relying on hook enforcement.
+- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
+- For every DevRites specialist or writer dispatch, first call `spawn_agent` with the named `devrites-<role>` custom role. The matching project contract is `.codex/agents/devrites-<role>.toml`.
+- If `spawn_agent` is callable but a named read-only role is unavailable, use generic `explorer` only when the host proves that run has a runtime-enforced read-only sandbox. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. A missing read-only custom role is not evidence that spawning is unavailable.
+- Never dispatch generic `worker` for `devrites-slice-wright` unless the host proves that worker run carries exact DevRites identity and the same `.wright-allowlist` enforcement as the named role. Codex reports a generic run as `agent_type=worker`, so the generated global hooks cannot prove that binding. Reject that unsafe rung and use the documented labelled inline wright path with `.reconcile-inline` plus the full reconcile gate.
+- If the host cannot prove the generic explorer is runtime read-only, reject that rung too. Only when no spawn primitive exists or a higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, and apply every fallback risk gate. An unbound generic wright or unconfined generic explorer is such a safety rejection, not evidence that no agents exist.
+- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
+- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
 
 

package/pack/generated/codex/skills/rite-frame/reference/failure-modes.md

@@ -1,9 +1,8 @@
-# The four failure modes: mapped to their DevRites cure
+# Four failure modes and their DevRites controls
 
-The lens behind `rite-frame`. Each mode is a thing LLMs reliably get wrong; each already
-has a cure somewhere in the pack. The value of naming them here is a **portable
-vocabulary**: a fast self-check you can run on ad-hoc or express-lane work that never
-reaches the gates where those cures normally fire.
+`rite-frame` checks four common LLM failure modes. Existing DevRites controls address
+each one. Use these names for quick checks on ad hoc or express-lane work that does not
+reach the normal gates.
 
 ## The map
 
@@ -11,18 +10,17 @@ reaches the gates where those cures normally fire.
 |---|---|---|---|
 | 1 | **Silent assumption** | A value, contract, edge case, or interpretation was *guessed* and run with: no note, no question. The ask had two readings and one was picked silently. | `core.md` #2 (no silent assumptions) / #3 (no guessing through confusion); the Spec Drift Guard; `devrites-doubt` for a single high-stakes call; `devrites-interview` when the ask is underspecified. |
 | 2 | **Overcomplication** | An abstraction, flag, config knob, or indirection nobody asked for. 200 lines where 50 would do. A single-use factory. Defensive `try/catch` + null checks inside trusted code. A dependency added where an in-repo option exists. | `coding-style.md` (simplicity, reuse-first), `patterns.md` (avoid over-engineering), `devrites-audit simplify` (deletion test, Chesterton's Fence), the "over-defensive guarding is slop" anti-pattern. |
-| 3 | **Out-of-scope edit** | Touched code, comments, or formatting outside the ask. A "while I'm here" refactor. Renamed something orthogonal. Reflowed an import block. | `core.md` #7 (feature scope only), `touched-files.md` (the recorded diff boundary), `devrites-engine reconcile` (hard-stops a source file changed outside the claimed set), the "it's only a small refactor" anti-pattern. |
+| 3 | **Out-of-scope edit** | Touched code, comments, or formatting outside the ask. A "while I'm here" refactor. Renamed something orthogonal. Reflowed an import block. | `core.md` #7 (feature scope only), root-owned `.wright-allowlist` (the authorized write boundary), `touched-files.md` (the resulting diff record), `devrites-engine reconcile` (hard-stops a source file outside the captured allowlist), the "it's only a small refactor" anti-pattern. |
 | 4 | **Unverifiable goal** | "It works" with no command, no output, no test. A success criterion that can't be false ("make it better"). A tautological test that passes no matter what. | `rite-spec/reference/acceptance-criteria.md` (measurable acceptance), `core.md` #6 (evidence over confidence), `testing.md` (assertion strength, see it fail first), the TDD wright. |
 
-The first three are the **diseases** Karpathy named; the fourth is the **leverage**: a
-falsifiable criterion is what lets the model loop to done without a human in the loop every
-few minutes. FRAME front-loads mode 4 so the AUDIT of modes 1-3 has something to check
-against.
+Karpathy named the first three. The fourth supplies the falsifiable criterion needed
+for an agent to work without repeated human confirmation. FRAME defines that criterion
+before auditing the other three modes.
 
-## FRAME: the imperative → falsifiable reframe
+## FRAME: rewrite an imperative as a falsifiable condition
 
-The move is to rewrite the *verb* as a *condition that can be false*. If you can't, the ask
-is ambiguous. That's mode 1, caught before the diff instead of after.
+Rewrite the request as a condition that can be false. If that is impossible, the
+request is ambiguous and triggers mode 1 before any diff exists.
 
 | Imperative ask | Weak (still a wish) | Falsifiable criterion + verify |
 |---|---|---|
@@ -33,8 +31,8 @@ is ambiguous. That's mode 1, caught before the diff instead of after.
 | "Handle errors" | "add error handling" | "On `<failure F>` the system fails closed with `<observable>`; a test forces F." → that test |
 | "Improve the UX" | "make it nicer" | *(no falsifiable check → ambiguous → `devrites-ux-shape` / ask which states/flows)* |
 
-A criterion passes the bar when a reviewer could run the verify command and get a clear
-pass or fail without asking you what you meant. If they'd have to ask, sharpen it.
+A criterion is ready when a reviewer can run the verification command and get a clear
+pass or fail without asking what it means.
 
 ## AUDIT: worked finding lines
 
@@ -49,20 +47,20 @@ utils.ts:5  FYI        mode 3 (scope): reflowed an unrelated import block. → r
 sum.spec:12 Important  mode 4 (unverifiable): test asserts `mock.called`, not the result — passes if the fn is empty. → assert the value; see it fail first (testing.md).
 ```
 
-Clean lanes say so explicitly (`1 assumption: clean`) so the audit is a positive
-statement, not a silent skip.
+Record clean modes explicitly (`1 assumption: clean`) so an empty result is not mistaken
+for a skipped check.
 
-## How this differs from the heavier tools (so you don't reach past it)
+## Related tools
 
 - **`devrites-doubt`:** adversarial *fresh-context subagent* pre-mortem on **one** decision.
-  Heavier, independent, anti-anchoring. rite-frame is *self-applied* and covers the four modes
-  broadly; escalate a single load-bearing claim to doubt.
+  It is independent and avoids anchoring. rite-frame is self-applied and covers all four
+  modes; use doubt for one consequential claim.
 - **`devrites-audit <axis>`:** *fresh-context subagent* review of an **active feature's** diff
   on one axis (security / perf / simplify). Needs a `.devrites/` workspace. rite-frame needs no
-  workspace and runs in your own context: cheaper, less independent.
+  workspace and runs in the current context, with less independence.
 - **`$rite-review` · `$rite-seal`:** the **gates**: parallel reviewer fan-out, blocking
   severities, written verdict. rite-frame is the inline reflex for work that never reaches a
-  gate; it does not replace one. If the work is a real feature, the gate is the answer.
+  gate and does not replace one.
 
-The point is not redundancy. It's a tiered ladder. rite-frame is the cheapest rung: a lens
-you run yourself in seconds. Climb to doubt / audit / the gates as the stakes rise.
+Use rite-frame for the quickest self-check. Use doubt, audit, or the full gates when the
+work needs independent or feature-level review.

package/pack/generated/codex/skills/rite-handoff/SKILL.md

@@ -12,9 +12,13 @@ This is the Codex mirror of a DevRites skill. In Codex:
 
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- When this skill asks for a DevRites specialist or writer agent, **explicitly** spawn the matching Codex custom agent from `.codex/agents/devrites-*.toml` through Codex subagents (`spawn_agent`), then wait for its result and reconcile it as the skill instructs. Do not do the review inline just because the instruction to spawn is embedded here: Codex under-fires embedded spawn/skill instructions (openai/codex #23496), so treat the spawn as required, not optional.
-- The independence of a fresh-context subagent is the point. If Codex genuinely cannot spawn subagents in the current surface, run the documented inline fallback and **label the result an inline fallback, not an independent review**: an inline pass shares the calling context and is weaker evidence.
-- Codex project hooks are installed in `.codex/hooks.json`. Review and trust them with `/hooks` before relying on hook enforcement.
+- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
+- For every DevRites specialist or writer dispatch, first call `spawn_agent` with the named `devrites-<role>` custom role. The matching project contract is `.codex/agents/devrites-<role>.toml`.
+- If `spawn_agent` is callable but a named read-only role is unavailable, use generic `explorer` only when the host proves that run has a runtime-enforced read-only sandbox. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. A missing read-only custom role is not evidence that spawning is unavailable.
+- Never dispatch generic `worker` for `devrites-slice-wright` unless the host proves that worker run carries exact DevRites identity and the same `.wright-allowlist` enforcement as the named role. Codex reports a generic run as `agent_type=worker`, so the generated global hooks cannot prove that binding. Reject that unsafe rung and use the documented labelled inline wright path with `.reconcile-inline` plus the full reconcile gate.
+- If the host cannot prove the generic explorer is runtime read-only, reject that rung too. Only when no spawn primitive exists or a higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, and apply every fallback risk gate. An unbound generic wright or unconfined generic explorer is such a safety rejection, not evidence that no agents exist.
+- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
+- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
 
 

package/pack/generated/codex/skills/rite-learn/SKILL.md

@@ -12,9 +12,13 @@ This is the Codex mirror of a DevRites skill. In Codex:
 
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- When this skill asks for a DevRites specialist or writer agent, **explicitly** spawn the matching Codex custom agent from `.codex/agents/devrites-*.toml` through Codex subagents (`spawn_agent`), then wait for its result and reconcile it as the skill instructs. Do not do the review inline just because the instruction to spawn is embedded here: Codex under-fires embedded spawn/skill instructions (openai/codex #23496), so treat the spawn as required, not optional.
-- The independence of a fresh-context subagent is the point. If Codex genuinely cannot spawn subagents in the current surface, run the documented inline fallback and **label the result an inline fallback, not an independent review**: an inline pass shares the calling context and is weaker evidence.
-- Codex project hooks are installed in `.codex/hooks.json`. Review and trust them with `/hooks` before relying on hook enforcement.
+- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
+- For every DevRites specialist or writer dispatch, first call `spawn_agent` with the named `devrites-<role>` custom role. The matching project contract is `.codex/agents/devrites-<role>.toml`.
+- If `spawn_agent` is callable but a named read-only role is unavailable, use generic `explorer` only when the host proves that run has a runtime-enforced read-only sandbox. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. A missing read-only custom role is not evidence that spawning is unavailable.
+- Never dispatch generic `worker` for `devrites-slice-wright` unless the host proves that worker run carries exact DevRites identity and the same `.wright-allowlist` enforcement as the named role. Codex reports a generic run as `agent_type=worker`, so the generated global hooks cannot prove that binding. Reject that unsafe rung and use the documented labelled inline wright path with `.reconcile-inline` plus the full reconcile gate.
+- If the host cannot prove the generic explorer is runtime read-only, reject that rung too. Only when no spawn primitive exists or a higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, and apply every fallback risk gate. An unbound generic wright or unconfined generic explorer is such a safety rejection, not evidence that no agents exist.
+- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
+- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
 
 

package/pack/generated/codex/skills/rite-plan/SKILL.md

@@ -11,16 +11,21 @@ This is the Codex mirror of a DevRites skill. In Codex:
 
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- When this skill asks for a DevRites specialist or writer agent, **explicitly** spawn the matching Codex custom agent from `.codex/agents/devrites-*.toml` through Codex subagents (`spawn_agent`), then wait for its result and reconcile it as the skill instructs. Do not do the review inline just because the instruction to spawn is embedded here: Codex under-fires embedded spawn/skill instructions (openai/codex #23496), so treat the spawn as required, not optional.
-- The independence of a fresh-context subagent is the point. If Codex genuinely cannot spawn subagents in the current surface, run the documented inline fallback and **label the result an inline fallback, not an independent review**: an inline pass shares the calling context and is weaker evidence.
-- Codex project hooks are installed in `.codex/hooks.json`. Review and trust them with `/hooks` before relying on hook enforcement.
+- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
+- For every DevRites specialist or writer dispatch, first call `spawn_agent` with the named `devrites-<role>` custom role. The matching project contract is `.codex/agents/devrites-<role>.toml`.
+- If `spawn_agent` is callable but a named read-only role is unavailable, use generic `explorer` only when the host proves that run has a runtime-enforced read-only sandbox. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. A missing read-only custom role is not evidence that spawning is unavailable.
+- Never dispatch generic `worker` for `devrites-slice-wright` unless the host proves that worker run carries exact DevRites identity and the same `.wright-allowlist` enforcement as the named role. Codex reports a generic run as `agent_type=worker`, so the generated global hooks cannot prove that binding. Reject that unsafe rung and use the documented labelled inline wright path with `.reconcile-inline` plus the full reconcile gate.
+- If the host cannot prove the generic explorer is runtime read-only, reject that rung too. Only when no spawn primitive exists or a higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, and apply every fallback risk gate. An unbound generic wright or unconfined generic explorer is such a safety rejection, not evidence that no agents exist.
+- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
+- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
 
 
 # $rite-plan: (re)plan an active feature
 
-Reshape the plan when reality and the plan disagree. **Read the active workspace
-first.** If `.devrites/ACTIVE` is empty or its workspace is missing, stop and tell the
+Update an existing plan when implementation evidence, drift, or a user decision makes it
+wrong. **Read the active workspace first.** If `.devrites/ACTIVE` is empty or its workspace
+is missing, stop and tell the
 user to run `$rite-spec <feature>`. **Revise mode is artifact-only**: reconcile
 `spec.md` / `architecture.md` / `plan.md` / `tasks.md` / `traceability.md` without
 editing source code.
@@ -29,9 +34,11 @@ editing source code.
 Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD criteria.
 
 ## Operating rules
-- Spec is living, not sacred, but never plan around a known-wrong assumption silently.
+- Update the spec when needed, but never plan around a known-wrong assumption.
 - If a change alters product behavior, scope, architecture, data model, UX, security,
-  or migration risk → **ask the user first** (use the Spec Drift Guard question format).
+  or migration risk → search facts first, then route the human-owned contract decision
+  through `$rite-clarify` (using the Spec Drift Guard). Reversible technical repair is
+  agent-owned and must not become a question.
 - Keep each slice small enough for one focused build → prove cycle.
 - **Slice count is derived, never dictated:** reslice when a slice fails the sizing rule
   (multiple "and"s, can't build+prove in one cycle), not to hit a user-named tally. A
@@ -40,13 +47,18 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
 - **Size by complexity, order by dependency.** A slice carries a `Complexity: N/5` score (from
   `$rite-define`); a slice scoring **>3** is a reslice trigger unless its inline reason justifies
   the irreducible complexity. Honor each slice's `depends_on:`: the next *buildable* slice is the
-  lowest pending one whose dependencies are all built (keeps one-slice-at-a-time correct, not parallel).
+  lowest pending one whose dependencies are all built. This preserves one-slice-at-a-time execution.
+- **Root writes; drafter proposes.** Follow
+  [`agents.md`](../devrites-lib/reference/standards/agents.md). The controlling chat owns
+  human questions, decisions, reconciliation, and all planning-artifact writes.
 
 ## Workflow
 0. Read `.agents/skills/devrites-lib/reference/standards/core.md` (operating rules) before reshaping anything.
    Then run `devrites-engine preamble` for deterministic workspace orientation.
-1. Read `spec.md`, `plan.md`, `tasks.md`, `state.md`, `drift.md`, and the current
-   `git diff` (if a repo). Read `decisions.md` and `assumptions.md`. If a code-intelligence
+1. Read `spec.md`, `decision-coverage.md`, `plan.md`, `tasks.md`, `state.md`, `drift.md`,
+   `eng-review.md`, and the current `git diff` (if a repo). Read `decisions.md` and
+   `assumptions.md`. Require `Decision coverage: CLEAR`; otherwise STOP → `$rite-clarify`.
+   If a code-intelligence
    index is available: `codebase-memory-mcp` first, cross-checked with `codegraph`
    (`.codegraph/` / `codegraph_*` tools) + `graphify` (`graphify-out/`), else standard methods
    (LSP / `Read`/`Grep`/`Glob`); see `.agents/skills/devrites-lib/reference/standards/tooling.md`:
@@ -68,28 +80,48 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
      scope, not a new negotiation.
    - **revise:** apply a requested planning-artifact revision and reconcile existing artifacts in
      any direction; propose the file edit set first, confirm each file before writing, and **never
-     edit source code**. **Gate first: revise or new?** Same intent? >50% of existing scope
+     edit source code**. **Gate first: revise or new?** Same intent? More than 50% of existing scope
      survives? original *not* completable without this? Two "no"s → new work: recommend
      sealing/shipping the current workspace (MVP cut if named) then `$rite-spec` for the new
-     intent, and stop. Revise preserves context; a new workspace provides clarity.
+     intent, and stop. Revise preserves context; a new workspace separates the work.
    See [replan-and-repair](reference/replan-and-repair.md) for each mode's steps.
+2a. **Draft the repair from fresh context.** Freeze the inputs and dispatch
+   `devrites-plan-drafter` in `repair` mode with only the selected mode, affected artifact
+   paths, settled contract, and observed failure/drift. Await one atomic `plan-candidate`;
+   the drafter writes nothing and returns human-owned choices separately.
 3. Reason about dependencies: [dependency-graph](reference/dependency-graph.md).
    **Completion:** the slice graph is cycle-free and every dependency names an existing slice.
 4. Re-slice using vertical-slice rules: [slicing](reference/slicing.md) and
    [task-breakdown](reference/task-breakdown.md). Prefer thin, shippable, verifiable.
    **Completion:** every slice is independently shippable/provable or carries an irreducibility reason.
-5. Update `plan.md`, `tasks.md`, `state.md`, and append rationale to `decisions.md`.
-   If you stopped for drift, mark the `drift.md` entry resolved.
-6. If product behavior/acceptance criteria change, confirm with the user before writing.
+5. Reconcile the candidate against steps 3 and 4, then the root updates `plan.md`, `tasks.md`,
+   `state.md`, and appends rationale to `decisions.md`.
+   Any change to `architecture.md`, `plan.md`, `tasks.md`, or `traceability.md` invalidates
+   the previous vet verdict: set `Phase: plan`, `Next step: $rite-vet`, and, when
+   `eng-review.md` exists, set `Implementation readiness: NEEDS REPLAN`. Never retain READY
+   across changed planning inputs. Preserve `Plan approved` only for behavior/acceptance-neutral
+   technical repair; clear and reconfirm it when the contract changed. If you stopped for drift,
+   mark the `drift.md` entry resolved.
+6. If product behavior/acceptance criteria change, confirm through `$rite-clarify` before
+   writing, re-close `decision-coverage.md`, then reconcile the plan. After any edit to
+   `brief.md`, `spec.md`, `decisions.md`, `assumptions.md`, or `questions.md`, including a
+   behavior-neutral technical rationale appended to `decisions.md`, re-scan the affected coverage
+   rows, assumption audit, residual uncertainty, and closed gates. Partial/Missing, an unowned
+   material assumption, or an open blocking/escalating question routes `$rite-clarify`/HITL;
+   never refresh past it. Only after the matrix is re-closed, run
+   `devrites-engine readiness-digest coverage <slug>` and replace the complete
+   `Coverage inputs SHA-256` line in `decision-coverage.md`.
    **Completion:** the change is classified, and every behavior/acceptance change has explicit
    confirmation recorded before the artifacts are updated.
 7. **Done when:** every slice is sized (builds + proves in one cycle; no slice scoring >3
    left unjustified), the dependency order is acyclic, every `drift.md` entry you stopped for
    is marked resolved, revised artifacts agree with each other, no source files changed in
-   `revise` mode, and behavior-change-vs-not is confirmed (`no`, or asked + answered).
+   `revise` mode, behavior-change-vs-not is confirmed (`no`, or clarified), and every changed
+   plan ends at `$rite-vet` rather than returning directly to build.
    If any check fails, loop back: don't hand off a half-reshaped plan.
 
-> **Mid-flight discipline.** When tempted to change product behavior without asking, absorb drift silently, or skip the user: see [`anti-patterns`](reference/anti-patterns.md). Load it the moment you reach for the excuse.
+> **Mid-flight discipline.** Do not change product behavior without confirmation or
+> absorb drift silently. See [`anti-patterns`](reference/anti-patterns.md).
 
 ## Output
 
@@ -98,10 +130,10 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
 Default success shape:
 ```
 Done: plan repaired for <slug> in <mode> mode.
-Changed: plan.md, tasks.md, traceability.md, decisions.md, state.md
+Changed: plan.md, tasks.md, traceability.md, decisions.md, state.md, eng-review.md <invalidated|n/a>
 Evidence: not applicable; slice map now <n> slices and next slice is <name>
 Open: <none | behavior question answered | Alternative: $rite-prove if all built slices need re-verification>
-Next: <single next command: build, re-define, or prove depending on the revision>
+Next: $rite-vet
 Record: .devrites/work/<slug>/plan.md
 ↻ Hygiene: /clear if the repair was large; keep session for small reorder-only repairs
 ```

package/pack/generated/codex/skills/rite-plan/reference/task-breakdown.md

@@ -1,4 +1,4 @@
-# Task breakdown
+# Work-item breakdown
 
 How to turn a spec into ordered, vertical slices in `tasks.md`.
 
@@ -20,6 +20,10 @@ This reference owns decomposition; the shared schema owns field names and meanin
    planned proof, evidence status, and likely touched files.
 6. Sanity check: every acceptance criterion in `spec.md` maps to ≥1 slice; no slice has
    an unowned criterion.
+7. Resolve every foreseeable human-owned checkpoint now. Keep a build-time checkpoint only
+   when it needs evidence unavailable before code or mandatory action-time approval, and say why.
+8. Make every `Tests/proof` entry executable: exact command, working directory, prerequisites,
+   expected signal, and mutable inputs whose provenance evidence must bind.
 
 ## Keep it honest
 - **Interfaces prevent cross-slice drift.** A slice-wright sees only its own contract; the

package/pack/generated/codex/skills/rite-polish/SKILL.md

@@ -11,27 +11,33 @@ This is the Codex mirror of a DevRites skill. In Codex:
 
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- When this skill asks for a DevRites specialist or writer agent, **explicitly** spawn the matching Codex custom agent from `.codex/agents/devrites-*.toml` through Codex subagents (`spawn_agent`), then wait for its result and reconcile it as the skill instructs. Do not do the review inline just because the instruction to spawn is embedded here: Codex under-fires embedded spawn/skill instructions (openai/codex #23496), so treat the spawn as required, not optional.
-- The independence of a fresh-context subagent is the point. If Codex genuinely cannot spawn subagents in the current surface, run the documented inline fallback and **label the result an inline fallback, not an independent review**: an inline pass shares the calling context and is weaker evidence.
-- Codex project hooks are installed in `.codex/hooks.json`. Review and trust them with `/hooks` before relying on hook enforcement.
+- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
+- For every DevRites specialist or writer dispatch, first call `spawn_agent` with the named `devrites-<role>` custom role. The matching project contract is `.codex/agents/devrites-<role>.toml`.
+- If `spawn_agent` is callable but a named read-only role is unavailable, use generic `explorer` only when the host proves that run has a runtime-enforced read-only sandbox. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. A missing read-only custom role is not evidence that spawning is unavailable.
+- Never dispatch generic `worker` for `devrites-slice-wright` unless the host proves that worker run carries exact DevRites identity and the same `.wright-allowlist` enforcement as the named role. Codex reports a generic run as `agent_type=worker`, so the generated global hooks cannot prove that binding. Reject that unsafe rung and use the documented labelled inline wright path with `.reconcile-inline` plus the full reconcile gate.
+- If the host cannot prove the generic explorer is runtime read-only, reject that rung too. Only when no spawn primitive exists or a higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, and apply every fallback risk gate. An unbound generic wright or unconfined generic explorer is such a safety rejection, not evidence that no agents exist.
+- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
+- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
 
 
 # $rite-polish: finish before review
 
-The "finish" phase. **Always** code-polishes; **and** runs UI normalize +
-design polish when the feature touches UI. Self-review the work to ship
-quality *before* handing it to `$rite-review`. The two-phase split (code,
-UI) lives in `reference/code.md` and `reference/ui.md`: read each on demand,
-don't load both up front.
+Polish code for every feature. When the feature touches UI, normalize and polish the
+UI as well. Complete this self-review before `$rite-review`. The code and UI phases
+live in `reference/code.md` and `reference/ui.md`; read only the phase in scope.
 
 ## Operating rules
 
 - **Functionality complete first.** Polish runs after `$rite-prove` (full
   feature proven).
 - Feature scope only.
-- For UI: **NEVER polish without normalizing first**: decoration on drift is
-  banned.
+- For UI, **normalize before polishing**. Do not add decoration on top of drift.
+- **Root selects; wright edits.** The controlling chat assesses and reconciles, but every
+  accepted source/test correction is dispatched to the sole writer,
+  `devrites-slice-wright`, through
+  [`agents.md`](../devrites-lib/reference/standards/agents.md). Never edit source inline or
+  run two correction writers concurrently.
 
 ## Orchestration
 
@@ -48,21 +54,25 @@ don't load both up front.
    `pages/`, `routes/`, `app/`, `views/`, `screens/`), Storybook stories,
    or design-token files. When in doubt, look for visual changes that need
    verification.
-3. **Always** read [`reference/code.md`](reference/code.md) and run **Phase 1
-   (code polish)**; if backend was touched, continue into **Phase 2 (backend
-   polish)** from the same file.
+3. **Always** read [`reference/code.md`](reference/code.md) and assess **Phase 1
+   (code polish)**; if backend was touched, assess **Phase 2 (backend polish)** from
+   the same file. Reconcile the findings, then send accepted corrections as one bounded
+   wright contract.
 4. **If UI scope detected** read [`reference/ui.md`](reference/ui.md), and read
-   `design-brief.md` if present (the UX/UI contract `devrites-ux-shape` shaped at spec and
-   `devrites-frontend-craft` refined while building) so the polish honors the agreed
-   direction + states. **Read the `## Visual Verdict` table in `browser-evidence.md` if present:
-   its `FAIL` and `PARTIAL` rows are the normalize/quality-bar worklist**: fix the root cause of
-   each (a missing state, an off-token CTA, an anti-slop hit), don't decorate around it. Then run
-   **Phase 3 (normalize)** → **Phase 4 (UI polish)**. Honor argument modes:
+   `design-brief.md` if present so the polish follows the direction and states established
+   by `devrites-ux-shape` and refined by `devrites-frontend-craft`. **Read the
+   `## Visual Verdict` table in `browser-evidence.md` if present:
+   its `FAIL` and `PARTIAL` rows are the normalize/quality-bar worklist**: identify the root
+   cause of each (a missing state, an off-token CTA, or an anti-slop hit) rather than
+   hiding it with decoration. Assess **Phase 3 (normalize)** → **Phase 4 (UI polish)**,
+   then send accepted UI
+   corrections to the wright (which invokes the relevant craft skill). Honor argument modes:
    - `bolder | quieter | distill | harden`: passed to Phase 4 as the
      emphasis dial.
-   - `normalize-only`: run Phase 3 and stop (no Phase 4).
-5. **Re-verify after any code edit:** polish edits code, so the proof from
-   `$rite-prove` no longer post-dates it. Run the relevant fast checks (the
+   - `normalize-only`: assess Phase 3 and stop (no Phase 4).
+5. **Re-verify after any code edit:** a wright correction invalidates prior proof, so
+   `$rite-prove` no longer post-dates it. Dispatch `devrites-proof-runner` for the affected
+   fast checks (the
    targeted tests for the touched files + typecheck/lint; browser re-check if UI
    changed) and record a **`Re-verification:`** line in `polish-report.md`. A
    polish that changed code without a green re-verification isn't finished.
@@ -70,10 +80,8 @@ don't load both up front.
 
 ## Refinement modes
 
-When the user (or your own assessment) names a direction the UI should move,
-pass it through to Phase 4. Modes don't bypass normalize + quality-bar work:
-they shape the polish *after* the system is aligned. See `reference/ui.md` for
-the mode table.
+Pass the requested UI direction to Phase 4. Modes do not bypass normalization or the
+quality bar; they apply after the system is aligned. See `reference/ui.md`.
 
 > **Mid-flight discipline.** When tempted to polish UI without normalize, cite
 > clean lint as proof of quality, skip Phase 2 on a backend diff, or delete a