devrites 3.0.7 → 3.2.0

package/pack/generated/codex/skills/rite-vet/reference/review-axes.md

@@ -1,57 +1,53 @@
-# The vet review: scope challenge, four axes, required outputs
+# Vet review: scope, four axes, and outputs
 
-The body of `$rite-vet`. Run §0 first as a blocking gate, then the four axes one at a time,
-then the required outputs. Apply the senior-engineer lenses in [`eng-lenses.md`](eng-lenses.md)
-throughout. They're how you *see* the findings, not a separate checklist. Every finding is
-calibrated and gated (see "Confidence + verification gate" below) before it reaches the human.
+Run §0 first as a blocking gate, then review the four axes in order and produce the
+required outputs. Apply the engineering lenses in [`eng-lenses.md`](eng-lenses.md)
+throughout rather than as a separate checklist. Calibrate every finding through the
+confidence and verification gate before presenting it.
 
 ---
 
-## §0. Scope Challenge (blocking gate: runs before any axis)
+## §0. Scope challenge (blocking gate)
 
-Before reviewing *how* the plan builds, challenge *whether it should build this much*. This is
-implementation-scope discipline (the spec's ambition is settled, that was `$rite-temper`).
+Before reviewing implementation details, check whether the plan includes more work than
+the settled spec requires.
 
 1. **What already exists?** For each sub-problem in the plan, find the existing code/flow that
    already solves it (use a code-intelligence index if available: see `../../devrites-lib/reference/standards/tooling.md`).
    Can the plan **capture outputs from an existing
    flow** instead of building a parallel one? Reuse → extend → build new, in that order
    (`coding-style.md`). List every reuse opportunity the plan misses.
-2. **Minimum diff.** What's the smallest set of changes that meets the spec's *acceptance
-   criteria*? Flag any planned work that can be deferred without blocking acceptance. Be ruthless
-   about implementation scope creep, but never cut an acceptance criterion (that's a Drift Guard
-   matter, not a trim).
+2. **Minimum diff.** Find the smallest set of changes that meets the spec's acceptance
+   criteria. Flag work that can be deferred without blocking acceptance. Do not cut an
+   acceptance criterion; that requires the Drift Guard.
 3. **Complexity smell.** If `plan.md` touches **>8 files** or adds **>2 new services / modules /
    classes**, treat it as a smell. Check the plan's complexity gate justifies it. If it doesn't
-   → **STOP**: name what's overbuilt, propose a smaller version that meets acceptance, and ask
-   via `AskUserQuestion` whether to reduce or proceed. Do not start the axes until answered.
+   → harden to the smallest acceptance-preserving plan. Ask only if reduction changes
+   acceptance or explicit architecture policy; never start the axes unresolved.
 4. **Built-in check.** For each new pattern / infra component / concurrency approach the plan
    introduces, verify a framework/runtime built-in doesn't already do it, and that the choice is
-   current best practice with no known footgun: dispatch `devrites-source-driven` to confirm at
+   current best practice with no known footgun: invoke `devrites-source-driven` to confirm at
    the source and record the citation. A custom roll where a built-in exists is a scope-reduction
    finding.
-5. **Completeness check.** Is the plan doing the complete version or a shortcut? With AI-assisted
-   coding the cost of completeness (full edge-case handling, complete error paths, real test
-   coverage) is a fraction of what it was: a shortcut that saves human-hours but only saves
-   minutes here is a false economy. Prefer the complete option; flag shortcuts that exist only to
-   save effort that AI has already made cheap.
+5. **Completeness check.** Identify shortcuts in edge-case handling, error paths, and
+   test coverage. Prefer the complete option when AI-assisted implementation makes the
+   additional work small. Flag shortcuts that save little time but leave known gaps.
 6. **Distribution check.** If the plan introduces a new artifact (CLI binary, package, container,
    deployable), does it include how it gets built / published / installed? If distribution is
    deferred, say so explicitly in "NOT in scope": don't let it silently drop.
 
-> **STOP discipline.** If the complexity smell trips, the `AskUserQuestion` is a tool call, not
-> prose. Naming the 80%-solution in chat and continuing is the failure this gate exists to prevent.
+> **STOP discipline.** Fold technical reduction into the plan; ask and stop only for a
+> human-owned choice.
 
 If the smell does not trip, present the §0 findings and proceed to Axis 1.
 
 ---
 
-## The four axes (one at a time, ≤8 findings each)
+## Four axes (one at a time, at most 8 findings each)
 
-For each axis: evaluate, then **walk each finding WITH the human** via `AskUserQuestion` (one
-issue per call: see "How to ask" below). HITL pauses on each material finding; AFK auto-applies
-within the gate ceiling (`depth.md`). If an axis genuinely has no issue, say "No issues,
-moving on" and continue: don't manufacture findings.
+For each axis, fold verified technical findings into the plan, then walk each human-owned
+decision via one coherent `AskUserQuestion` packet. Supporting findings may combine only
+with one owner/trade-off. HITL pauses there; AFK follows `depth.md`. Never invent findings.
 
 ### 1. Architecture
 - Component boundaries, coupling, data-flow patterns, single points of failure. Architecture records invariants, not scaffolding: each medium+ decision should state `Binds:` and `Prevents:` so the builder knows what divergence it prevents.
@@ -72,7 +68,7 @@ moving on" and continue: don't manufacture findings.
   change will make stale.
 
 ### 3. Test-coverage design
-The differentiator: design the tests *before* the code, so the build writes them alongside.
+Design tests before code so the build writes them alongside the implementation.
 - **Framework detection:** find the project's existing test runner + conventions; match them
   (never introduce a new runner to prove one change: `testing.md`).
 - **Map acceptance → tests.** Every spec acceptance criterion must map to ≥1 planned, surface-anchored test (the API response/UI state/CLI output the criterion names, not an internal proxy).
@@ -117,22 +113,21 @@ acceptance criteria covered ✓" and continue.
 
 ---
 
-## Confidence + verification gate (applies to every finding, all axes)
+## Confidence and verification gate
 Tag each finding `[severity] (confidence: N/10) <plan/task/spec ref> — finding`:
 - **9-10** verified against a quoted line · **7-8** strong pattern match → report normally.
 - **5-6** moderate → report with "verify this is real".
 - **≤4** speculative → **suppress from the walk-through**, appendix only.
 
-**The gate:** before raising a finding, quote the line(s) that motivate it. Can't quote it →
-force confidence ≤4 and suppress. This kills the "the plan doesn't handle X" finding when the
-plan *does* and you skimmed. Don't fabricate 7+ to dodge it. (Same discipline the reviewer agent
-runs: `devrites-plan-reviewer`.)
+Before raising a finding, quote the lines that support it. If no line supports it, set
+confidence to 4 or lower and suppress it. Do not inflate confidence to avoid suppression.
+`devrites-plan-reviewer` follows the same rule.
 
 ---
 
-## How to ask (the interactive walk)
+## Present human-owned decisions
 Use `AskUserQuestion` per the pack's standard. Plan-review specifics:
-- **One finding = one call.** Never batch findings into one question.
+- **One decision = one call.** Never ask about agent work or batch unrelated choices.
 - Concrete: name the plan/task section + the quoted line.
 - 2-3 options, including "do nothing / proceed as-is" where reasonable.
 - Per option, one line: **effort** (human ~X / with the build agent ~Y), **risk**, **maintenance**.
@@ -144,8 +139,10 @@ Use `AskUserQuestion` per the pack's standard. Plan-review specifics:
   happy-path), add `Completeness: N/10` per option. If they differ in *kind* (two different
   architectures), skip the score and note "options differ in kind, not coverage". Never fabricate
   a score on a kind question.
-- Every material finding ends as a **recorded decision**: a resolved `questions.md` qid for HITL
-  or a `decisions.md` ADR for AFK. The walk must leave an auditable trail, not just chat.
+- Every material call ends as a **recorded decision**: behavior-preserving technical hardening
+  goes to `decisions.md`; a human-owned HITL choice gets a resolved `questions.md` qid; AFK
+  records the allowed recommendation in `decisions.md`. The review must leave an auditable
+  trail without turning agent work into questions.
 
 ---
 
@@ -164,4 +161,9 @@ Use `AskUserQuestion` per the pack's standard. Plan-review specifics:
    parallel lanes (shared module → same lane/sequential; independent → separate lanes), execution
    order, and conflict flags where two lanes touch the same module dir. This feeds `$rite-build`'s
    isolation strategy and the autocomplete loop. (Shape in [`artifacts.md`](artifacts.md).)
-5. **Completion summary:** the one-glance recap (shape in [`artifacts.md`](artifacts.md)).
+5. **Build-entry preflight:** commands/cwds, tools, package state, parser/browser smoke,
+   prerequisites, and provenance ([`artifacts.md`](artifacts.md)).
+6. **Implementation readiness:** goal-backward coverage, wiring, dependency simulation,
+   alignment, operations, and rollback verdict.
+7. **Completion summary:** the compact recap defined in
+   [`artifacts.md`](artifacts.md).

package/pack/generated/codex/skills/rite-zoom-out/SKILL.md

@@ -12,9 +12,13 @@ This is the Codex mirror of a DevRites skill. In Codex:
 
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- When this skill asks for a DevRites specialist or writer agent, **explicitly** spawn the matching Codex custom agent from `.codex/agents/devrites-*.toml` through Codex subagents (`spawn_agent`), then wait for its result and reconcile it as the skill instructs. Do not do the review inline just because the instruction to spawn is embedded here: Codex under-fires embedded spawn/skill instructions (openai/codex #23496), so treat the spawn as required, not optional.
-- The independence of a fresh-context subagent is the point. If Codex genuinely cannot spawn subagents in the current surface, run the documented inline fallback and **label the result an inline fallback, not an independent review**: an inline pass shares the calling context and is weaker evidence.
-- Codex project hooks are installed in `.codex/hooks.json`. Review and trust them with `/hooks` before relying on hook enforcement.
+- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
+- For every DevRites specialist or writer dispatch, first call `spawn_agent` with the named `devrites-<role>` custom role. The matching project contract is `.codex/agents/devrites-<role>.toml`.
+- If `spawn_agent` is callable but a named read-only role is unavailable, use generic `explorer` only when the host proves that run has a runtime-enforced read-only sandbox. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. A missing read-only custom role is not evidence that spawning is unavailable.
+- Never dispatch generic `worker` for `devrites-slice-wright` unless the host proves that worker run carries exact DevRites identity and the same `.wright-allowlist` enforcement as the named role. Codex reports a generic run as `agent_type=worker`, so the generated global hooks cannot prove that binding. Reject that unsafe rung and use the documented labelled inline wright path with `.reconcile-inline` plus the full reconcile gate.
+- If the host cannot prove the generic explorer is runtime read-only, reject that rung too. Only when no spawn primitive exists or a higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, and apply every fallback risk gate. An unbound generic wright or unconfined generic explorer is such a safety rejection, not evidence that no agents exist.
+- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
+- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "3.0.7",
+  "version": "3.2.0",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",

package/scripts/build-release-tarball.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
-# Build the DevRites release tarball: the artifact attached to the GitHub Release
-# by semantic-release. Extracting yields a `devrites-v<version>/` directory with
-# everything an end-user needs (pack/, install.sh, uninstall.sh, scripts/, docs).
+# Build the archive that semantic-release attaches to a GitHub Release.
+# It extracts to `devrites-v<version>/` with the pack, engine, scripts,
+# documentation, and install tools.
 #
 # Usage: build-release-tarball.sh <version>
 set -euo pipefail
@@ -11,20 +11,31 @@ if [[ -z "$VERSION" ]]; then
   echo "usage: build-release-tarball.sh <version>" >&2
   exit 1
 fi
+if [[ ! "$VERSION" =~ ^[0-9A-Za-z][0-9A-Za-z._+-]*$ ]]; then
+  echo "error: version must be a portable release asset name" >&2
+  exit 1
+fi
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 DIST="${DEVRITES_RELEASE_DIST_DIR:-$ROOT/dist}"
 NAME="devrites-v${VERSION}"
-STAGE="$DIST/$NAME"
 
 cd "$ROOT"
+mkdir -p "$DIST"
+DIST="$(cd "$DIST" && pwd -P)"
+case "$DIST/" in
+  "$ROOT/pack/"* | "$ROOT/engine/"* | "$ROOT/scripts/"* | "$ROOT/mcp/"* | "$ROOT/docs/"*)
+    echo "error: release output directory overlaps the release payload" >&2
+    exit 1
+    ;;
+esac
+STAGE="$(mktemp -d "$DIST/.devrites-release-stage.XXXXXX")"
+cleanup() { rm -rf "$STAGE"; }
+trap cleanup EXIT
 
 echo "Building release tarball: ${NAME}.tar.gz"
 
-rm -rf "$STAGE"
-mkdir -p "$STAGE"
-
-# Files and directories shipped to end-users.
+# Release contents.
 PAYLOAD=(
   pack
   engine
@@ -60,17 +71,23 @@ for item in "${PAYLOAD[@]}"; do
   fi
 done
 
-# Ship the same prebuilt host-native artifacts that npm pack includes.
+# Include the same prebuilt host artifacts as the npm package.
 DEVRITES_HOST_ARTIFACT_DIR="$STAGE/pack/generated" bash "$ROOT/scripts/build-host-artifacts.sh" >/dev/null
 
-# Drop dev-only artifacts that may have been copied transitively.
+# Remove development files copied with the payload.
 rm -rf "$STAGE/docs/internal" "$STAGE/scripts/.cache" 2>/dev/null || true
 
-tar -C "$DIST" -czf "$DIST/${NAME}.tar.gz" "$NAME"
-rm -rf "$STAGE"
+(
+  cd "$ROOT/engine"
+  go run ./cmd/releasepack \
+    -root "$STAGE" \
+    -output "$DIST/${NAME}.tar.gz" \
+    -prefix "$NAME" \
+    -epoch "${SOURCE_DATE_EPOCH:-0}"
+)
 
-# Emit a sibling checksum so install.sh can verify the artifact when present.
-# Write just "<sha256>  <filename>" (no path) so it verifies from any cwd.
+# Write a sibling checksum for install.sh to verify when available.
+# Store only "<sha256>  <filename>" so verification works from any directory.
 (
   cd "$DIST"
   if command -v shasum >/dev/null 2>&1; then

package/scripts/check-authority-drift.py

@@ -0,0 +1,125 @@
+#!/usr/bin/env python3
+"""Compare generated JSON authorities with their short documentation blocks."""
+
+import argparse
+import json
+import re
+import sys
+from pathlib import Path
+
+
+def table(headers, rows):
+    return "\n".join(
+        [
+            "| " + " | ".join(headers) + " |",
+            "| " + " | ".join("---" for _ in headers) + " |",
+            *["| " + " | ".join(row) + " |" for row in rows],
+        ]
+    )
+
+
+def replace_block(path, name, wanted, write):
+    text = path.read_text()
+    start = f"<!-- authority:{name}:start -->"
+    end = f"<!-- authority:{name}:end -->"
+    pattern = re.compile(re.escape(start) + r"\n.*?\n" + re.escape(end), re.DOTALL)
+    replacement = f"{start}\n{wanted}\n{end}"
+    if not pattern.search(text):
+        raise ValueError(f"{path}: missing {name} authority markers")
+    if pattern.search(text).group(0) == replacement:
+        return
+    if write:
+        path.write_text(pattern.sub(replacement, text, count=1))
+        return
+    raise ValueError(f"{path}: {name} authority block is stale")
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--root", type=Path, default=Path(__file__).resolve().parents[1])
+    parser.add_argument("--write", action="store_true")
+    args = parser.parse_args()
+    root = args.root.resolve()
+
+    manifest = json.loads((root / "engine/internal/state/workflow_manifest.json").read_text())
+    readiness = json.loads((root / "engine/internal/lib/readiness_contract.json").read_text())
+    phases = manifest["phases"]
+    reasons = readiness["reasons"]
+    policy = manifest["authorityPolicy"]
+
+    ids = [phase["id"] for phase in phases]
+    rights = [phase["transitionRight"] for phase in phases]
+    if len(ids) != len(set(ids)) or len(rights) != len(set(rights)):
+        raise ValueError("workflow manifest has duplicate phase IDs or transition rights")
+    resumes = {phase["id"]: phase.get("resumeVerb", "") for phase in phases}
+    if resumes.get("define") != "define" or resumes.get("plan") != "vet":
+        raise ValueError("workflow manifest violates ADR-0011 define/plan routing")
+    codes = [reason["code"] for reason in reasons]
+    if len(codes) != len(set(codes)):
+        raise ValueError("readiness contract has duplicate exit codes")
+
+    lifecycle = "`" + " → ".join(phase.upper() for phase in ids) + "`"
+    phase_rows = []
+    for phase in phases:
+        required = ", ".join(f"`{section}`" for section in phase.get("requiredSections", [])) or "*(none)*"
+        resume = f"`/rite-{phase['resumeVerb']}`" if phase.get("resumeVerb") else "*(terminal)*"
+        phase_rows.append([f"`{phase['id']}`", resume, required, phase["transitionRight"]])
+    reason_rows = [
+        [
+            f"`{reason['code']}`",
+            f"`{reason['id']}`",
+            reason["condition"],
+            f"`/rite-{reason['remediationVerb']}`" if reason["remediationVerb"] else "*(none)*",
+        ]
+        for reason in reasons
+    ]
+    tracking = (
+        "Git-tracked shared state: "
+        + ", ".join(f"`{path}`" for path in policy["trackedState"])
+        + ". Per-clone runtime state: "
+        + ", ".join(f"`{path}`" for path in policy["localState"])
+        + "."
+    )
+    clarify_rows = [[f"`{item['field']}`", item["policy"]] for item in manifest["clarifyReturnFields"]]
+
+    blocks = [
+        ("docs/quick-reference.md", "lifecycle", lifecycle),
+        ("docs/engine/state-schema.md", "schema-version", f"`schemaVersion: {manifest['schemaVersion']}`."),
+        (
+            "docs/engine/state-schema.md",
+            "phase-contract",
+            table(["phase", "normal resume", "required sections", "transition right"], phase_rows),
+        ),
+        ("docs/engine/state-schema.md", "state-tracking", tracking),
+        (
+            "docs/engine/state-schema.md",
+            "clarify-return-fields",
+            table(["field", "policy"], clarify_rows),
+        ),
+        (
+            "docs/cli.md",
+            "readiness-reasons",
+            table(["exit", "reason", "condition", "remediation"], reason_rows),
+        ),
+        ("SECURITY.md", "principles-trust", policy["principlesTrust"]),
+        (
+            "pack/.claude/skills/devrites-lib/reference/standards/core.md",
+            "principles-trust",
+            policy["principlesTrust"],
+        ),
+    ]
+    for relative, name, wanted in blocks:
+        replace_block(root / relative, name, wanted, args.write)
+
+    state_schema = (root / "docs/engine/state-schema.md").read_text()
+    if re.search(r"schema(?:Version| version| v)[: ]+1\b", state_schema, re.IGNORECASE):
+        raise ValueError("docs/engine/state-schema.md still claims schema v1")
+    print("authority-drift: current docs match workflow and readiness authorities")
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (KeyError, OSError, ValueError, json.JSONDecodeError) as exc:
+        print(f"authority-drift: {exc}", file=sys.stderr)
+        sys.exit(1)

package/scripts/check-instruction-size-baseline.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// Per-file and aggregate byte ratchet for canonical prompt/instruction docs.
+// Track canonical instruction files individually and skills as a group.
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
 import { dirname, join, relative, resolve } from 'node:path';
 
@@ -12,6 +12,7 @@ function option(name, fallback) {
 const root = resolve(option('--root', defaultRoot));
 const baselinePath = resolve(option('--baseline', join(root, 'tests', 'instruction-size-baseline.json')));
 const write = argv.includes('--write');
+const ratchetLimit = 855_000;
 
 function lfBytes(text) {
   return Buffer.byteLength(text.replace(/\r\n/g, '\n'));
@@ -28,12 +29,7 @@ function markdownFiles(dir) {
   return files;
 }
 
-function collect() {
-  const roots = [
-    join(root, 'pack', '.claude', 'skills'),
-    join(root, 'pack', '.claude', 'agents'),
-    join(root, 'pack', '.claude', 'rules'),
-  ];
+function collect(roots) {
   const out = {};
   for (const file of roots.flatMap(markdownFiles)) {
     out[relative(root, file)] = lfBytes(readFileSync(file, 'utf8'));
@@ -41,13 +37,25 @@ function collect() {
   return Object.fromEntries(Object.entries(out).sort(([a], [b]) => a.localeCompare(b)));
 }
 
-const files = collect();
-const totalBytes = Object.values(files).reduce((sum, bytes) => sum + bytes, 0);
+const skillRoot = join(root, 'pack', '.claude', 'skills');
+const files = collect([
+  skillRoot,
+  join(root, 'pack', '.claude', 'agents'),
+  join(root, 'pack', '.claude', 'rules'),
+]);
+const skillFiles = collect([skillRoot]);
+const totalBytes = Object.values(skillFiles).reduce((sum, bytes) => sum + bytes, 0);
 const current = { version: 2, total_bytes: totalBytes, files };
+if (totalBytes > ratchetLimit) {
+  console.error(`FAIL: canonical skill Markdown is ${totalBytes} bytes (ratchet ${ratchetLimit})`);
+  process.exit(1);
+}
 if (write) {
   mkdirSync(dirname(baselinePath), { recursive: true });
   writeFileSync(baselinePath, JSON.stringify(current, null, 2) + '\n');
-  console.log(`instruction-size: wrote ${relative(root, baselinePath)} (${Object.keys(files).length} files, ${totalBytes} bytes)`);
+  console.log(
+    `instruction-size: wrote ${relative(root, baselinePath)} (${Object.keys(files).length} instruction files, ${totalBytes} skill bytes)`,
+  );
   process.exit(0);
 }
 
@@ -75,5 +83,5 @@ for (const file of Object.keys(baseline.files)) {
 if (totalBytes > baseline.total_bytes) {
   fail(`aggregate instruction payload grew by ${totalBytes - baseline.total_bytes} bytes (${baseline.total_bytes} -> ${totalBytes})`);
 }
-console.log(`instruction-size: ${Object.keys(files).length} files checked, ${totalBytes} bytes`);
+console.log(`instruction-size: ${Object.keys(files).length} instruction files checked, ${totalBytes} skill bytes`);
 process.exit(failures ? 1 : 0);

package/scripts/check-invocation-integrity.py

@@ -26,6 +26,8 @@ NONSKILL = {
     "devrites-engine",
     # a git commit-trailer marker ("[devrites-context]" body in a WIP checkpoint), not a skill
     "devrites-context",
+    # typed contract schemas and a generated-hook diagnostic marker, not skills
+    "devrites-forge", "devrites-git-authority", "devrites-codex-leaf-guard",
 }
 # names a skill deliberately mentions as NON-existent (self-documenting prose).
 DOCUMENTED_NONEXISTENT = {"rite-use"}