devrites 3.0.7 → 3.1.0

package/pack/generated/codex/skills/rite-seal/SKILL.md

@@ -11,9 +11,13 @@ This is the Codex mirror of a DevRites skill. In Codex:
 
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- When this skill asks for a DevRites specialist or writer agent, **explicitly** spawn the matching Codex custom agent from `.codex/agents/devrites-*.toml` through Codex subagents (`spawn_agent`), then wait for its result and reconcile it as the skill instructs. Do not do the review inline just because the instruction to spawn is embedded here: Codex under-fires embedded spawn/skill instructions (openai/codex #23496), so treat the spawn as required, not optional.
-- The independence of a fresh-context subagent is the point. If Codex genuinely cannot spawn subagents in the current surface, run the documented inline fallback and **label the result an inline fallback, not an independent review**: an inline pass shares the calling context and is weaker evidence.
-- Codex project hooks are installed in `.codex/hooks.json`. Review and trust them with `/hooks` before relying on hook enforcement.
+- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
+- For every DevRites specialist or writer dispatch, first call `spawn_agent` with the named `devrites-<role>` custom role. The matching project contract is `.codex/agents/devrites-<role>.toml`.
+- If `spawn_agent` is callable but a named read-only role is unavailable, use generic `explorer` only when the host proves that run has a runtime-enforced read-only sandbox. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. A missing read-only custom role is not evidence that spawning is unavailable.
+- Never dispatch generic `worker` for `devrites-slice-wright` unless the host proves that worker run carries exact DevRites identity and the same `.wright-allowlist` enforcement as the named role. Codex reports a generic run as `agent_type=worker`, so the generated global hooks cannot prove that binding. Reject that unsafe rung and use the documented labelled inline wright path with `.reconcile-inline` plus the full reconcile gate.
+- If the host cannot prove the generic explorer is runtime read-only, reject that rung too. Only when no spawn primitive exists or a higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, and apply every fallback risk gate. An unbound generic wright or unconfined generic explorer is such a safety rejection, not evidence that no agents exist.
+- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
+- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
 
 

package/pack/generated/codex/skills/rite-seal/reference/phase-contract.md

@@ -1,36 +1,5 @@
 # rite-seal phase contract
 
-## Execution spine
-
-Run the engine gates at these moments:
-
-```bash
-devrites-engine preamble
-
-devrites-engine spec-validate .devrites/work/<slug>; echo "spec-validate rc=$?"
-devrites-engine check-acceptance .devrites/work/<slug>; echo "check-acceptance rc=$?"
-devrites-engine evidence-fresh <slug>; echo "evidence-fresh rc=$?"
-devrites-engine doubt-coverage <slug>; echo "doubt-coverage rc=$?"
-
-devrites-engine footprint log <slug> reviewer devrites-<x>-reviewer
-devrites-engine footprint log <slug> skip devrites-<x>-reviewer
-devrites-engine footprint roster <slug>; echo "roster rc=$?"
-devrites-engine review-integrity <slug>; echo "review-integrity rc=$?"
-devrites-engine review-fingerprints --write <slug>
-
-devrites-engine footprint render <slug>
-devrites-engine learnings add "<slug>" "<dismissed-as-intentional class or dead-end>" dismiss
-devrites-engine health record <0..10> "<GO|NO-GO evidence summary>" --note "<top blocker or green proof>"
-devrites-engine timeline log completed --skill rite-seal --slug <slug> --outcome "<go|no-go>" --decision "<verdict>"
-
-devrites-engine progress
-```
-
-Conditional calls still obey the detailed rules below: reviewer and skip
-footprints must account for the whole roster; learnings run only on GO; progress
-is rendered before the final response from [`output.md`](output.md). Seal decides
-only; `$rite-ship` owns irreversible git/publish/deploy actions.
-
 1. **Run the shared orientation preamble:** it prints `state.md`, the artifacts present,
    the run mode (HITL/AFK), and the open-question tally by gate, so you orient deterministically
    instead of re-deriving state from raw Markdown:
@@ -80,50 +49,20 @@ only; `$rite-ship` owns irreversible git/publish/deploy actions.
      verdicts by hand).
    Either way, walk the `## Decisions stood` ledger yourself: severity rides the unverified
    **decision**, never the exit code alone.
-5. Check **security, data, migration, rollback** risk:
-   [risk-and-rollback](risk-and-rollback.md). If `strategy.md` exists (from
-   `$rite-temper`), confirm its **top pre-mortem risks are mitigated** in the diff/evidence and
-   that no **Non-goal / deferred item crept into the diff** (scope creep): either is a finding
-   (an unmitigated top risk or smuggled-in out-of-scope work).
-   - **Principles** (`principles.md`): score the final diff against each declared invariant in
-     `.devrites/principles.md`. A violation with no matching, human-approved exception in the
-     register is a **Critical** finding and a NO-GO; an exception that is stale (past its review
-     trigger) or wider than its stated scope is itself a finding. No file / no principles → skip.
-   - **Observability** (`observability.md`): if the diff added a runtime surface (endpoint,
-     job, integration, user flow, error path), a feature shipping with no way to debug it in
-     prod is an **Important** finding, not a pass: `evidence.md` should show telemetry observed
-     to emit (`$rite-prove` step 5b).
-   - **Developer experience** (`developer-experience.md`): if the diff ships a developer-facing
-     surface, reconcile `devex.md` (the `$rite-vet` predicted scorecard vs the `$rite-prove`
-     measured one: the boomerang). A broken public dev contract (a documented command that errors,
-     a getting-started flow that can't complete) or an unexplained measured DX regression is
-     **Important**. **Critical** on a frozen public surface (`principles.md`). No surface → skip.
-   - **Removal / migration** (`deprecation.md`): if the diff deletes or migrates code, an API,
-     or data, confirm it followed expand→contract, proved the old path unused before removing it,
-     and carries a rollback for every destructive step. A surprise deletion or a one-shot
-     breaking migration is a finding (and trips the irreversible-risk gate, `afk-hitl.md`).
+5. Check **security, data, migration, rollback**, strategy scope, principles,
+   observability, developer experience, and removal using
+   [risk-and-rollback](risk-and-rollback.md) and the named standards. Unmitigated top risks,
+   scope creep, missing runtime diagnostics, broken developer contracts, or unsafe removals
+   are findings. An unexcepted declared-principle violation is Critical and NO-GO.
 6. Check **frontend polish** if UI is involved (states, a11y, responsive, design-system,
    browser evidence).
-7. **Independent review:** seal is the final gate, not a re-run of `$rite-review`.
-   It **always re-spawns** the axes `$rite-review` did not cover: `devrites-test-analyst`,
-   `devrites-security-auditor`, `devrites-performance-reviewer`, and
-   `devrites-frontend-reviewer` (UI). It **only re-runs the Spec and Code-review axes**
-   (`devrites-spec-reviewer`, `devrites-code-reviewer`) when the diff changed since
-   `$rite-review` ran (compare against `review.md`); if the diff is unchanged, carry
-   review's verdicts on those axes forward rather than re-litigating them.
-   If subagents are available, fan out **in parallel** (one `Task` block, multiple tool
-   calls) to the **roster**: the seven reviewers and their checkable triggers are the single
-   source in [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md) (dispatch
-   shape + reconciliation there too; `.agents/skills/devrites-lib/reference/standards/agents.md`. "Run independent reviewers in
-   parallel"). Dispatch every always-on reviewer and every conditional whose trigger the diff
-   meets; `devrites-devex-reviewer` runs in **measure mode**: grade the measured DX scorecard
-   and reconcile the boomerang against the `$rite-vet` prediction. Give each the workspace path +
-   diff *without the author's reasoning*. If subagents are unavailable, run the equivalent
-   reviews sequentially yourself and flag each as a fallback.
-   The reviewer **AGENTS** here (fresh context, no author reasoning) are the seal
-   GATE; `devrites-audit` is the inline single-axis pass run during build/polish.
-   The two paths are intentional, not divergent: the inline audit catches issues
-   early; the fresh-context agents are the independent gate before ship.
+7. **Independent review:** apply the complete roster, triggers, dispatch shape, and
+   reconciliation from
+   [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md). Await
+   fresh-context batches of at most three and give reviewers only the workspace path plus
+   immutable diff, without author reasoning. Use named role → safely enforced generic fresh
+   agent → labelled inline; inline output is never independent. Carry Spec/Code verdicts only
+   for an unchanged post-review diff; rerun the other applicable axes.
    **Footprint: account for the whole roster.** For each reviewer you dispatch, append
    `devrites-engine footprint log <slug> reviewer devrites-<x>-reviewer` (the reviewer's **exact agent name**:
    the roster gate matches on it, so a freehand label like `spec` will read as unaccounted); for
@@ -131,13 +70,12 @@ only; `$rite-ship` owns irreversible git/publish/deploy actions.
    `devrites-engine footprint log <slug> skip devrites-<x>-reviewer` and note the one-line reason in `seal.md`.
    A conditional reviewer that does not apply is a *recorded skip*, never a silent omission: step 7b
    proves the roster complete before the verdict.
-7a. **Reconcile findings: confidence over volume.** Band each reviewer finding by confidence
+7a. **Reconcile findings by confidence.** Band each reviewer finding by confidence
    (1-10); a low-confidence (≤4) finding that can't be verified against the diff is **suppressed**
    to a `Suppressed (low-confidence): n` line, not a blocker. Every Critical/Important must cite
    the `file:line` (or spec line) that proves it. Surface genuine cross-reviewer disagreement
    **explicitly** rather than averaging it away, and don't let a pile of low-confidence nits
-   inflate the verdict: the gate is `Critical == 0` + acceptance + drift, not "few findings".
-   (A seal that fires noise teaches the next one to be ignored.)
+   inflate the verdict. The gate is `Critical == 0` + acceptance + drift, not "few findings".
 7b. **Account for the roster: no reviewer silently skipped.** Before the verdict, prove every
    roster reviewer carries a decision (dispatched or skip-recorded in step 7's footprint):
    ```bash
@@ -158,7 +96,7 @@ only; `$rite-ship` owns irreversible git/publish/deploy actions.
    ```
    - **rc=1:** an axis in `review.md` is silent (no finding, no justification): **Important** on the
      review's completeness. Re-run that axis or record its `No-findings:` account, then re-seal.
-   - **rc=0:** every axis has findings or a justified clean bill; proceed. (No `review.md`, or a
+   - **rc=0:** every axis has findings or a justified no-findings result; proceed. (No `review.md`, or a
      freeform one, is a clean pass: the gate keys on per-axis sections.)
    Then write stable finding IDs for learning and recurring-dismissal correlation:
    ```bash
@@ -178,20 +116,10 @@ only; `$rite-ship` owns irreversible git/publish/deploy actions.
      "acceptance": "<proven>/<total>", "test_integrity": "ok | weakened", "mutation": "<score | n/a>",
      "blockers": ["<one line each, empty on GO>"] }
    ```
-9. **On GO only: record proven conventions** to the local ledger
-   (`.devrites/conventions.md`) so later slices stop re-deriving this project's idioms:
-   the durable, *evidence-proven* commands / idioms / placement / gotchas this feature
-   established. Evidence-gated like the seal itself; the band is earned, not guessed; the
-   step degrades gracefully when unavailable. Full contract + command:
-   [conventions-ledger](conventions-ledger.md). (Skip entirely on NO-GO.)
-9a. **On GO only: auto-capture learnings** (`.devrites/learnings.md`). Learning is automatic, not a
-   command anyone must remember: append this feature's durable signal so the **next** feature's
-   review starts warmer: (a) any reviewer finding the gate **dismissed as intentional here** (a
-   "don't re-flag X in this project" class, tag `dismiss`); (b) a recurring correction or dead-end
-   worth not repeating (tag `note`). The review skills load this ledger **before** they fan out, so a
-   dismissed-finding class stops recurring. It is an untrusted prior: live code always overrides
-   (`.agents/skills/devrites-lib/reference/standards/security.md`). Promotion of a recurring lesson to a *project rule* stays the
-   human's call (`$rite-learn`: propose, don't impose). Skip on NO-GO.
+9. **On GO only:** record evidence-proven conventions through
+   [conventions-ledger](conventions-ledger.md).
+9a. **On GO only:** append durable dismissed-finding or dead-end learnings as untrusted
+   priors. Promotion to a project rule remains human-owned.
    ```bash
    devrites-engine learnings add "<slug>" "<dismissed-as-intentional class or dead-end>" dismiss
    ```
@@ -200,7 +128,14 @@ only; `$rite-ship` owns irreversible git/publish/deploy actions.
     lower for NO-GO or unresolved blockers.
     ```bash
     devrites-engine health record <0..10> "<GO|NO-GO evidence summary>" --note "<top blocker or green proof>"
-    devrites-engine timeline log completed --skill rite-seal --slug <slug> --outcome "<go|no-go>" --decision "<verdict>"
+    devrites-engine timeline log run-finished \
+      --slug <slug> \
+      --outcome "<passed|blocked>" \
+      --execution-mode named \
+      --guard-strength n/a \
+      --reason-id "<DRV-GATE-SEAL-PASSED on GO; otherwise the blocking DRV-* reason>" \
+      --host "<claude|codex>" \
+      --evidence .devrites/work/<slug>/seal.md
     ```
 
 ## `seal.md` template

package/pack/generated/codex/skills/rite-seal/reference/risk-and-rollback.md

@@ -25,6 +25,19 @@ For each risky step, state how to back it out:
 - A new external dependency with no failure handling is at least **Important**.
 - Record the chosen rollback path in `seal.md` → "Rollback / Recovery".
 
+## Fresh-context fallback weighting
+
+An inline final-rung review is useful signal but **not independent evidence**:
+
+- Record `independence: fallback` and a roster skip reason; never log it as a dispatched
+  reviewer or a clean fresh-context pass.
+- Preserve its findings at their normal severity. A clean inline result still leaves an
+  **Important assurance gap** and cannot silently satisfy a required axis.
+- Seal remains NO-GO until that axis runs through a fresh-context spawn, or the human
+  explicitly accepts the reduced assurance in `seal.md`. AFK never auto-accepts it.
+- Security or irreversible-risk scope has no reduced-assurance override: unavailable
+  independent review remains NO-GO.
+
 ## Destructive operations
 Confirm any destructive step with the user before shipping. Verify backups exist where
 relevant. Never treat an irreversible action as routine.

package/pack/generated/codex/skills/rite-ship/SKILL.md

@@ -11,9 +11,13 @@ This is the Codex mirror of a DevRites skill. In Codex:
 
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- When this skill asks for a DevRites specialist or writer agent, **explicitly** spawn the matching Codex custom agent from `.codex/agents/devrites-*.toml` through Codex subagents (`spawn_agent`), then wait for its result and reconcile it as the skill instructs. Do not do the review inline just because the instruction to spawn is embedded here: Codex under-fires embedded spawn/skill instructions (openai/codex #23496), so treat the spawn as required, not optional.
-- The independence of a fresh-context subagent is the point. If Codex genuinely cannot spawn subagents in the current surface, run the documented inline fallback and **label the result an inline fallback, not an independent review**: an inline pass shares the calling context and is weaker evidence.
-- Codex project hooks are installed in `.codex/hooks.json`. Review and trust them with `/hooks` before relying on hook enforcement.
+- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
+- For every DevRites specialist or writer dispatch, first call `spawn_agent` with the named `devrites-<role>` custom role. The matching project contract is `.codex/agents/devrites-<role>.toml`.
+- If `spawn_agent` is callable but a named read-only role is unavailable, use generic `explorer` only when the host proves that run has a runtime-enforced read-only sandbox. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. A missing read-only custom role is not evidence that spawning is unavailable.
+- Never dispatch generic `worker` for `devrites-slice-wright` unless the host proves that worker run carries exact DevRites identity and the same `.wright-allowlist` enforcement as the named role. Codex reports a generic run as `agent_type=worker`, so the generated global hooks cannot prove that binding. Reject that unsafe rung and use the documented labelled inline wright path with `.reconcile-inline` plus the full reconcile gate.
+- If the host cannot prove the generic explorer is runtime read-only, reject that rung too. Only when no spawn primitive exists or a higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, and apply every fallback risk gate. An unbound generic wright or unconfined generic explorer is such a safety rejection, not evidence that no agents exist.
+- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
+- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
 
 

package/pack/generated/codex/skills/rite-ship/reference/design-memory.md

@@ -1,69 +1,64 @@
-# Design memory: roll proven design language into project `DESIGN.md`
+# Design memory: record proven design rules in `DESIGN.md`
 
-Optional, UI-only step at `$rite-ship`. A feature's design decisions live in its
-feature-scoped `design-brief.md` and are thrown away when the workspace archives. **Design
-memory** is the deliberate exception: when a UI feature ships, roll the design language it
-*proved* up into a project-level `DESIGN.md`, so the next feature's `devrites-ux-shape`
-inherits the system instead of re-discovering it.
+This optional `$rite-ship` step applies only to UI features. Feature design decisions
+live in `design-brief.md` and archive with the workspace. With the user's approval,
+copy proven, reusable design rules into the project-level `DESIGN.md` for later
+features.
 
-The consumers already exist: `devrites-ux-shape` §1 and
-`devrites-frontend-craft/reference/design-references.md` both read `DESIGN.md` when present.
-This step is the missing **producer**. It closes the loop: feature N seals its design
-language → feature N+1 builds to it.
+`devrites-ux-shape` §1 and
+`devrites-frontend-craft/reference/design-references.md` read `DESIGN.md` when present.
+This step writes that file from sealed feature evidence.
 
 ## When it runs
 - **UI features only.** No UI in the diff → skip silently.
 - **At ship, GO sealed, after the git plan, before type-GO** (step 2a), so the user sees
   the full staged change set (code + `DESIGN.md`) under the single type-GO that ships it.
-- **Opt-in and confirmed.** Persisting to a project-wide artifact is outside feature scope
-  (`standards/core.md` rule 7), so it is *never silent*. Present a ranked option set
+- **Opt in and confirm.** A project-wide artifact is outside feature scope
+  (`standards/core.md` rule 7), so never write it silently. Present a ranked option set
   (see [`afk-hitl.md`](../../devrites-lib/reference/standards/afk-hitl.md), "Option set");
   **default is skip**. The user opts to persist.
-- **AFK**: first-time `DESIGN.md` *creation* is treated as a `validating` gate (a new
-  persistent project artifact): propose + queue, don't auto-create. An *append* to an
+- **AFK:** first-time `DESIGN.md` creation is a `validating` gate because it adds a
+  persistent project artifact. Propose and queue it; do not create it automatically. An append to an
   existing `DESIGN.md` is `advisory` and may auto-proceed when `allow_gates` permits, since
   it only adds evidence-proven entries.
 
 ## Inputs (proven only)
 - `design-brief.md`: direction, color strategy, **calibration** (density / motion), key
   states, named anchors, and the per-slice **Build-time refinements**.
-- The **final diff** + `touched-files.md`: what tokens / components / states *shipped* (the evidence). Roll up only what the diff proves, not what the brief intended.
+- The **final diff** and `touched-files.md`: the tokens, components, and states that
+  shipped. Record only what the diff proves, not everything the brief intended.
 - Existing `DESIGN.md` if present: the merge target.
 
-## What to roll up: the project's *converged* system, evidence-gated
-Only entries the shipped, proven feature establishes. Each is durable, cross-feature design
-language, not this feature's one-off choices.
+## What to record
+Record only reusable rules established by the shipped, proven feature. Exclude choices
+that apply only to this feature.
 - **Tokens introduced + used:** new color roles / spacing steps / type steps / elevation
   / radius that shipped and are reusable. Names and values, mirrored from the code.
-- **Color strategy + calibration baseline:** the strategy (Restrained / Committed / …) and
-  density / motion the project keeps landing on; note a deviation as a deviation, not a new
+- **Color strategy and calibration baseline:** the strategy (Restrained / Committed / …) and
+  established density / motion; record a deviation as a deviation, not a new
   default.
 - **Type & spacing scales** in actual use; **motion** classes + easing; **materiality**
   (elevation set, hairline usage, glass / texture policy).
-- **Component behaviors:** for each shared component this feature established or extended:
-  the states it ships and its interaction model. Grows one feature at a time.
-- **Named-anchor lineage:** the anchors features steered toward, so later work stays
-  coherent with what's already built.
+- **Component behaviors:** for each shared component established or extended by the
+  feature, record its shipped states and interaction model.
+- **Named-anchor lineage:** the anchors used by shipped features.
 - **Anti-slop exceptions:** any banned default the project *intentionally* uses (with the
   why), so build / polish don't "correct" a deliberate choice.
 
 ## Merge discipline
 - **Append, don't overwrite.** Add proven entries; never silently rewrite an existing one.
-- **Conflict is a question, not an edit.** A new token / font / strategy that contradicts an
-  existing `DESIGN.md` entry → surface it to the user (the option set), don't resolve it
-  yourself. One design system per project.
-- **Never invent.** If the feature didn't prove it, it doesn't go in. `DESIGN.md` is design
-  *memory*, not design *aspiration*.
-- **Attribute + keep lean.** Tag each new entry with the feature slug so the lineage is
-  legible; one good line beats a paragraph. The file is read every future spec: keep it
-  scannable.
+- **Ask about conflicts.** If a new token, font, or strategy contradicts an existing
+  `DESIGN.md` entry, present the option set to the user. Do not resolve it yourself.
+  Keep one design system per project.
+- **Never invent.** Include only rules proven by the feature.
+- **Attribute and keep it short.** Tag each new entry with the feature slug. Future
+  specs read this file, so use concise entries.
 
 ## How it commits
-`DESIGN.md` is a tracked project artifact, so it ships **in the feature commit**:
+`DESIGN.md` is a tracked project artifact and ships **in the feature commit**:
 1. Write / update `<project-root>/DESIGN.md` from the template below.
-2. **Append `DESIGN.md` to `touched-files.md`** so the existing ship commit-scoping (SKILL
-   steps 2 + 4) stages it: the design-memory write rides the same commit and the same
-   type-GO, no second commit.
+2. **Append `DESIGN.md` to `touched-files.md`** so the existing commit scope (SKILL
+   steps 2 and 4) stages it under the same type-GO. Do not create a second commit.
 3. Note the rollup in `ship.md` (what was added, or "design-memory: skipped by user").
 
 ## `DESIGN.md` template (project-level, stack-agnostic)