devrites 3.0.7 → 3.2.0

package/pack/.claude/skills/rite-build/reference/wright-dispatch.md

@@ -1,140 +1,135 @@
 # Slice-wright dispatch
 
-How `/rite-build` hands the **build core** of one slice to `devrites-slice-wright`: the
-fresh-context, **write-capable** executor under `.claude/agents/`. Loaded on demand by
-`/rite-build`; not a skill itself. Sibling of
-[`../../devrites-lib/reference/parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md)
-(the read-only reviewer fan-out): same isolation principle, opposite direction: this one
-**writes**.
-
-Pattern: the orchestrator owns the **gates and the workspace**; the wright owns the **writing**.
-Brief it precisely, in a clean context, with only the slice contract, then doubt, record, and
-gate its return.
-
-## Why a fresh context writes the slice
-The orchestrator's window is full of spec investigation, planning, prior slices, and tool
-output: the exact "lost-in-the-middle" load that degrades instruction-following and pulls the
-model toward generic code. The wright starts clean and sees only the contract, so it holds the
-slice boundary strictly and writes to the *project's* idiom instead of drifting. Single-threaded
-by design: **one** wright per slice, never a parallel fan-out of writers *sharing a tree*:
-concurrent writers on one working tree make conflicting implicit decisions and produce incoherent
-code. The one sanctioned exception is a **forge** slice, which competes K candidates in *isolated*
-worktrees and lands exactly one: no tree ever has two authors, so the invariant holds (see
-[Forge](#forge--competing-candidates-the-deliberate-exception)).
-
-## The contract `/rite-build` sends
-One `Task` call to `devrites-slice-wright` carrying everything the writer needs and nothing it
-doesn't:
+`/rite-build` delegates one settled slice or correction set to
+`devrites-slice-wright`. The root orchestrator owns scope, human questions,
+`.devrites/**`, gates, reconciliation, and routing. The wright is the only source/test
+writer and never invokes another agent.
+
+The universal packet, result, budget, await, retry, and host fallback contract is
+[`standards/agents.md`](../../devrites-lib/reference/standards/agents.md). This file adds
+only the source-write lifecycle.
+
+## Prepare and dispatch
+
+1. Derive the smallest exact file allowlist from the selected slice, current code
+   placement, and accepted correction set. Entries are normalized project-relative file
+   paths: no directories, globs, traversal, symlink escapes, duplicates, or
+   `.devrites/**`.
+2. Write that list, one path per line, to
+   `.devrites/work/<slug>/.wright-allowlist` (or the active compatibility workspace).
+   The root owns this file; the wright's returned `Files changed` is evidence, never
+   authorization. If a necessary unlisted path appears, the wright stops and returns it.
+3. Create `agent-packet/v1` for `devrites-slice-wright`. Put the identical paths in
+   `scope.allowed_repo_writes`; include the slice goal, verbatim acceptance, boundary,
+   exact context paths, test-plan targets, and applicable standards. Do not include the
+   root's implementation reasoning.
+4. Immediately before a serial dispatch:
+
+   ```bash
+   devrites-engine reconcile snapshot
+   devrites-engine stuck log "$(cat .devrites/ACTIVE 2>/dev/null)" dispatch "<slice id>"
+   ```
+
+   A Forge slice runs `forge plan` first, then takes this same snapshot; see
+   [`forge.md`](forge.md). The first snapshot captures the original dirty-tree baseline, private Git objects,
+   allowlist, and canonical-state fingerprint. A later snapshot after a clean check
+   refreshes only the dispatch boundary; it retains the original slice baseline.
+5. Fresh-context dispatch the wright through the capability ladder and await its typed
+   result. Never run two possible writers in one tree.
+
+## Forge candidate binding
+
+[`forge.md`](forge.md) owns the state machine. This file owns the candidate packet:
+use the same project-relative allowlist and slice contract, add only the manifest-recorded
+candidate strategy, and set all five bindings before the first tool call:
+
+```text
+DEVRITES_FORGE_RUN_ID
+DEVRITES_FORGE_CANDIDATE
+DEVRITES_FORGE_WORKER_ID
+DEVRITES_FORGE_WORKER_PID
+DEVRITES_FORGE_PROCESS_START
+```
+
+The candidate cwd must equal its manifest worktree, and the environment is all-or-none.
+Only a real adapter declared as `manifest-env-v1` may supply it. The live PID,
+engine `forge process-token` value, and worker ID must match the prior `forge record ... started`
+transition. A partial or mismatched binding denies the writer; return to the orchestrator
+instead of widening scope. The candidate writes only source/tests in its own tree and
+returns the normal typed artifact.
+
+## Validate the return before accepting it
+
+Validate the `agent-result/v1` identity, baseline, budget, payload type, side effects,
+and exact changed-file set. Before the root writes any canonical record, run:
 
+```bash
+devrites-engine reconcile check; echo "reconcile rc=$?"
+devrites-engine test-integrity; echo "test-integrity rc=$?"
+devrites-engine package-existence; echo "package-existence rc=$?"
 ```
-Build one slice of the active DevRites feature. You have a clean context — this contract is
-the whole job.
-
-Workspace: .devrites/work/<slug>/
-Slice: <id — name>
-Goal: <one or two sentences>
-Acceptance criteria: <the slice's criteria, verbatim>
-UI visual acceptance: <if UI — state × viewport × input + target R-id/brief rule, verbatim from tasks.md>
-Scope boundary: <what it WILL and will NOT touch>
-Mode: <HITL | AFK>   (+ AFK budget note if a cap is set)
-
-Targets (stay inside these — from touched-files.md): <paths>
-Interfaces / signatures to match: <if any>
-Read yourself: spec.md, plan.md, decisions.md, assumptions.md, rite-polish/reference/anti-ai-slop.md<, design-brief.md if UI>
-Rules in scope (.claude/skills/devrites-lib/reference/standards/): coding-style, error-handling, testing, patterns<, security if input/auth/data><, performance if hot path / query / large payload>
-Test completeness: write ≥1 asserting test for EVERY interactive element + user flow in this
-  slice's test-plan.md interaction inventory, each at the right level (fields/elements →
-  unit/component; critical journeys → one E2E; never one-per-field). No element ships
-  unverified — testing.md "Completeness". If the slice has no test-plan inventory, derive the
-  element/flow list from the slice's own UI surface and cover it the same way.
-
-Apply your documented discipline (orient → RED → implement smallest complete → verify →
-return). Frontend slice → build to design-brief.md with devrites-frontend-craft and close
-the slice's visual-acceptance deltas before returning. Uncertain
-framework fact → verify at the source. Code + tests only — do NOT write the workspace
-bookkeeping files; return that data. Return your structured artifact, not your transcript.
+
+- Reconcile `5`: reject the result. Preserve pre-snapshot user work; restore only the
+  unauthorized slice delta; never widen scope from the writer's self-report.
+- Test integrity `3`: a test was deleted, muted, focused, or de-asserted. Treat it as a
+  Critical protocol failure and correct it through the wright.
+- Package existence `3`: verify the exact package/version and fix the bounded workflow
+  or dependency defect through recovery. It is not a reason to ask for retry approval.
+- A setup/corrupt-baseline error blocks acceptance; never fall back silently to `HEAD`.
+
+The clean reconcile check records that source has not changed since inspection. The
+baseline and private object database stay open until every later gate succeeds.
+
+## Decisions, failures, and bounded recovery
+
+After the immediate check, independently doubt every `Decisions stood` item. Human-owned
+product, policy, public-contract, irreversible-risk, or human-only access decisions use
+their real gate. Objective red tests, browser/runtime failures, missing technical
+coverage, package-scanner defects, and review corrections stay agent-owned.
+
+Classify each causal fingerprint through
+[`cleanup-and-classify.md`](../../devrites-debug-recovery/reference/cleanup-and-classify.md).
+The engine route is canonical; technical defects stay agent-owned.
+Each objective root cause then shares one durable three-attempt budget:
+
+```bash
+devrites-engine recovery route <class>
+devrites-engine recovery record --class <class> "<root cause>" "<exact failure>" <slug>
+devrites-engine recovery check "<root cause>" <slug>
 ```
 
-Rules:
-- **One `Task` call, one wright.** Never dispatch two writers on the same slice.
-- **No author reasoning beyond the contract.** Give the slice spec, not your analysis of *how*
-  to code it: a clean, undirected read is the point.
-- **Name the boundary explicitly.** The scope boundary is the single most load-bearing field; an
-  underspecified one is the main cause of drift.
-
-## On return: the orchestrator's job (don't delegate these)
-**You never edit source here.** The wright is the only writer of code + tests; you write only
-`.devrites/` bookkeeping. Every remedy below is **continue the same wright once** or **stop +
-escalate**: never an inline patch. You snapshotted the tree before dispatch (`devrites-engine reconcile snapshot`); the reconcile check in step 4 proves no source changed outside the wright's claimed
-set.
-
-1. **Doubt the surfaced decisions.** For each entry in the wright's `Decisions stood`, apply
-   `devrites-doubt` (→ `devrites-doubt-reviewer`) before accepting: the writer must not grade
-   its own decisions. The wright's return is the not-yet-load-bearing moment (slice not `built`,
-   not merged), so this post-return doubt is still pre-commit. Irreversible-risk items always
-   pause, and an irreversible item that the wright filed under `Decisions stood` instead of
-   `Escalation` is a protocol violation: pause and re-dispatch with it flagged out-of-bounds,
-   don't doubt-and-accept.
-2. **Honor escalations.** A non-empty `Escalation` → do **not** mark the slice built. Write the
-   `questions.md` entry + `state.md` `Awaiting human` (blocking gate), or route a scope change
-   through `/rite-plan repair` (Spec Drift Guard). You are the canonical writer of these files.
-3. **Fail-on-red.** If `Gates` show red (or the wright couldn't verify), the slice is **not
-   built**, and you do **not** fix the code. First remedy: **continue the same wright once**
-   (`SendMessage`, carrying the failing gate + real output) so it fixes in its own context:
-   objective failures only (red gate / type / lint / missing coverage / UI browser-proof fail),
-   never a contested decision. Still red after that one retry → blocking question (AFK) or
-   blocking gate (HITL); `Next: /rite-plan unblock`.
-   An interactive element or user flow in the slice's test-plan interaction inventory left with
-   **no asserting test** has the same standing as red: an unverified-element gap blocks the
-   slice (don't mark it built). Continue the same wright to cover it, or record a blocker.
-4. **Reconcile, then record.** First prove A1 held: write the wright's `Files changed` paths
-   (one per line) to `.devrites/work/<slug>/.reconcile-claimed` and run `devrites-engine reconcile check`.
-   **Exit 5 → STOP**: a source file changed outside the wright's claimed set (A1 breach); revert
-   it and re-dispatch, don't mark the slice built. Then persist the wright's artifact to
-   `state.md`, `evidence.md`, `touched-files.md` (and `browser-evidence.md` for UI) per
-   [`evidence-standard.md`](evidence-standard.md). Evidence is the wright's real command output,
-   not its say-so. Add a concern-ordered `## Review trail` to `touched-files.md` from the wright's changed paths and summary so a human can review by design intent instead of file order. **Persist every `Decisions stood` entry to a `## Decisions stood` section in
-   `decisions.md`, one line each ending `— doubt: <accept | reject-resolved | MISSING>`**:
-   independent of the doubt step (step 1 above), so a skipped decision still lands on record for
-   the seal's doubt-coverage cross-check (`- none` when the wright stood nothing). Then tick AFK if
-   `.devrites/AFK` is present (`devrites-engine tick-afk`; exit 3 → STOP).
-
-## Forge: competing candidates (the deliberate exception)
-
-The single-writer rule forbids parallel writers **sharing one tree**. A `Forge: yes` slice
-(flagged by `/rite-vet` as a genuine architecture fork at Complexity ≥4) is the one sanctioned
-fan-out, and it keeps the rule intact by **isolation**: each candidate wright works in its own
-`git worktree`, sees the identical slice contract plus one **distinct strategy**, and never
-touches another candidate's tree. A read-only [`devrites-forge-judge`](../../../agents/devrites-forge-judge.md)
-then scores the finished candidates against acceptance + `test-plan.md` + `.devrites/principles.md`
-+ the anti-slop charter, and the orchestrator lands **exactly one** winner's diff in the working
-tree. No tree ever has two authors; exactly one author's work ships. Everything downstream (doubt,
-fail-on-red, reconcile against the winner's claimed set, record) runs on the winner as if a single
-wright had built it.
-
-Full mechanics (strategy derivation, worktree setup, the judge contract, landing + grafting the
-winner, `forge-report.md`, AFK budgeting, and the worktree-unavailable fallback) live in
-[`forge.md`](forge.md).
-
-## Fallback
-If the `Task` tool / sub-agent dispatch is unavailable, `/rite-build` runs the wright's
-discipline **inline** in its own context and flags it as a fallback (no clean-context benefit).
-The slice still gets the full one-slice cycle (orient → RED → implement → verify) under the
-same anti-slop charter; it just doesn't get the isolation. In this path the orchestrator is
-legitimately the writer, so write `.devrites/work/<slug>/.reconcile-inline` before editing: the
-reconcile gate (step 4) skips when that sentinel is present. Mirrors the reviewer-dispatch
-fallback in
-[`../../devrites-lib/reference/parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md).
-
-## Optional pre-block hook (defense in depth)
-`devrites-engine reconcile` is the **post-hoc** gate. It always runs and catches an A1 breach at record time.
-A companion **pre-block** hook, `devrites-engine hook a1-guard` (a `PreToolUse` matcher on
-`Edit|Write|MultiEdit`), stops the breach *before* the write lands. It is armed only inside the
-mid-build window (between `devrites-engine reconcile snapshot` and a clean `check`, keyed on `.reconcile-base`),
-allows the wright (subagent calls carry `agent_id`), the inline fallback (`.reconcile-inline`),
-and any `.devrites/` write, so it never touches `/rite-polish`, `/rite-quick`, or ordinary
-manual edits. It ships **observe-only** (logs would-be blocks to `.a1-guard.log`, never blocks);
-flip to enforce with `DEVRITES_A1_HOOK=enforce` or a `.devrites/work/<slug>/.a1-enforce` file once
-the log confirms it never flags the wright's own edits (older Claude Code builds may not populate
-`agent_id`: the log is the proof before you enforce). The post-hoc gate stands on its own; the
-hook is belt-and-suspenders.
+Before every retry:
+
+1. update `.wright-allowlist` only for an accepted path still inside the settled slice;
+2. run `devrites-engine reconcile snapshot`.
+
+That refresh requires the prior clean check, re-fingerprints root-owned state, and keeps
+the original source baseline. Re-dispatch with the exact output, attempt count, and dead
+ends. Then repeat reconcile and both integrity gates from zero. Clear recovery only after
+green with `recovery clear --class <class> "<root cause>" <slug>`. An exhausted objective
+failure becomes a technical blocker with its reproduction, not a `rite-resolve` question.
+
+## Close and record
+
+When reconciliation, integrity, package, proof, and doubt gates all pass:
+
+```bash
+devrites-engine reconcile close
+```
+
+Only then persist `state.md`, `evidence.md`, `touched-files.md`, decision/doubt records,
+and browser evidence. Keep the retained window across a genuine human wait that will
+resume the same slice. Close it before abandoning the slice for a scope/plan transition.
+
+## Host fallback
+
+Use named wright → safely enforced generic fresh worker → labelled inline fallback from
+`standards/agents.md`. A generic worker is eligible only when the host preserves
+recognized wright identity plus exact allowlist enforcement, or contains it in an
+isolated/staged checkout. Post-hoc reconciliation alone cannot authorize an
+instruction-only shared-tree writer.
+
+When no safe fresh-context writer rung is callable, the root may execute the same bounded
+wright discipline inline. Write `.reconcile-inline` after the initial snapshot so the legacy
+A1 pre-hook recognizes the authorized fallback; reconciliation does **not** skip. The
+same allowlist, baseline, integrity gates, and close command remain mandatory.

package/pack/.claude/skills/rite-clarify/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: rite-clarify
+description: Run the topology-first decision-coverage scan after rite-spec and before strategy or architecture. Audit actors, journeys, states, data, integrations, operations, proof, assumptions, and must-NOT boundaries; close Partial/Missing rows and emit decision-coverage.md CLEAR. Use for missing/stale coverage or a missed pre-build product decision.
+argument-hint: "[feature-slug]"
+user-invocable: true
+---
+
+# /rite-clarify: resolve product decisions
+
+Run this required pass between spec and strategy. If the spec covers every material
+decision, ask no questions. Otherwise stay until each material decision has an
+owner. This phase settles behavior and constraints; `/rite-define` settles
+implementation.
+
+Reuse [`devrites-interview`](../devrites-interview/SKILL.md) in `/clarify mode`. Write
+`decision-coverage.md` as scan evidence, not an interview transcript.
+
+## Rules consulted
+
+Read `devrites-lib/reference/standards/core.md`, its `afk-hitl.md`, and
+[`reference/decision-coverage.md`](reference/decision-coverage.md). Fresh evidence
+dispatch uses
+[`agents.md`](../devrites-lib/reference/standards/agents.md).
+
+## Rules
+
+- Search code/docs/contracts first. Facts and reversible implementation/test choices
+  are agent-owned; ask only about product, scope, policy, irreversible risk, or human-only access.
+- Enumerate the full topology before details so no sibling surface is omitted.
+- Ask one coherent human-owned decision packet at a time. One packet may close several rows
+  only when owner and trade-off match; never ask permission for routine repair/retry.
+- One scan may cap at five packets for cognitive load, but readiness has no question cap:
+  re-scan until clear.
+- Material assumptions carry evidence, confidence, owner, validation, and consequence.
+
+## Workflow
+
+0. **Orient.** Run `devrites-engine preamble` and `snapshot`. Require `spec.md` plus
+   `Spec gate: passed`; otherwise STOP → `/rite-spec`. For a later-phase retrofit, run
+   `devrites-engine clarify-return enter <slug>` **before any pause**; this persists the
+   return cursor and enters `Phase: clarify`.
+1. **Enumerate topology** from the spec, references, live code, and prior decisions: actors,
+   journeys/components, states, data lifecycles, interfaces/integrations, operations, and
+   proof. Add omitted surfaces to the spec. **Completion:** every material surface appears
+   once with a source or canonical spec reference.
+2. **Scan coverage** with `devrites-interview /clarify mode` and the reference taxonomy.
+   Mark each surface Clear/Partial/Missing with evidence; include must-NOT and out-of-scope
+   behavior. Unmentioned never means not applicable. **Completion:** the matrix records every
+   surface with evidence.
+3. **Eliminate factual unknowns** through code intelligence, project/decision docs,
+   manifests/lockfiles, and authoritative external docs. Dispatch independent topology/fact
+   questions to `devrites-evidence-scout` (maximum three at once), await the cited dossiers,
+   and reconcile them in the root context. The root folds accepted facts into `spec.md` or
+   `assumptions.md`; the scout never asks or writes. **Completion:** each factual unknown is
+   source-backed or reclassified as an owned decision/assumption.
+4. **Audit assumptions and decisions.** Record the fields required above. For high-cost or
+    hard-to-reverse product/constraint choices, present two or three viable options, recommendation
+   first. A genuinely undecidable behavior may take one bounded `/rite-prototype` detour.
+5. **Close human-owned gaps** using the shared option-set contract: one highest-impact packet
+   per turn. Persist answers immediately in `spec.md` plus `decisions.md`/`questions.md`.
+   AFK remains within its gate ceiling; irreversible risk and principle exceptions pause.
+6. **Re-scan after edits** until each material row is `closed`, `agent-owned`,
+   `not-applicable`, or justified `deferred-nonblocking` with owner and validation gate.
+   Partial/Missing, an unowned material assumption, or an open blocking/escalating question
+   means `NEEDS CLARIFICATION`.
+7. **Write the verdict.** Update `decision-coverage.md`; success requires exactly one
+   `DevRites contract: devrites.readiness-artifacts.v2` field and exactly
+   `Decision coverage: CLEAR`. Normal state is `Phase: clarify`, `Next step: /rite-temper`.
+   A contract-neutral retrofit runs `devrites-engine clarify-return restore <slug>`; a
+   changed behavior/acceptance contract leaves the return cursor unconsumed, writes
+   `drift.md`, and routes `/rite-plan repair`. Normal first-pass flow sets `/rite-temper`.
+8. **STOP.** Run `devrites-engine progress`; hand off only on `CLEAR`.
+
+## Output
+
+Run `devrites-engine progress`, then use the shared completion reply contract
+([`devrites-lib/reference/reply-contract.md`](../devrites-lib/reference/reply-contract.md)):
+
+```text
+Done: decision coverage closed for <slug>; <n> topology surfaces scanned.
+Changed: decision-coverage.md, spec.md, decisions.md, assumptions.md, questions.md
+Evidence: Decision coverage: CLEAR; human packets <n>; agent-owned facts <n>
+Open: none blocking; deferred-nonblocking <n>
+Next: /rite-temper
+Record: .devrites/work/<slug>/decision-coverage.md
+↻ Hygiene: /clear before /rite-temper
+```
+
+If not clear, name the exact rows and next genuine decision packet. An objective spec defect
+or factual search task never routes through `/rite-resolve`.

package/pack/.claude/skills/rite-clarify/reference/decision-coverage.md

@@ -0,0 +1,61 @@
+# Decision coverage contract
+
+`decision-coverage.md` proves a topology-first scan ran; reference canonical IDs instead of
+duplicating their prose.
+
+## Coverage taxonomy
+
+For each material surface scan: outcome/scope/must-NOT; behavior, permissions, and all states;
+domain/data lifecycle/invariants/order/concurrency; interfaces/integrations and failure
+contracts; security/privacy/compliance/accessibility/performance/reliability/compatibility;
+configuration/observability/support/rollout/rollback; and executable acceptance proof,
+environment, credentials/approvals, and evidence limits.
+
+## Status vocabulary
+
+- `closed`: the canonical artifact records the decision.
+- `agent-owned`: a reversible technical choice is explicitly delegated to define/vet.
+- `not-applicable`: evidence shows the dimension does not apply.
+- `deferred-nonblocking`: pre-code evidence is impossible or the item is an explicit
+  non-goal; owner and validation gate are named.
+
+`Partial`, `Missing`, open, unknown, or ownerless rows never produce `CLEAR`.
+
+## Artifact shape
+
+```markdown
+# Decision coverage
+
+DevRites contract: devrites.readiness-artifacts.v2
+Decision coverage: <CLEAR | NEEDS CLARIFICATION>
+Coverage inputs SHA-256: <exact value from `devrites-engine readiness-digest coverage <slug>`>
+
+## Topology
+| Surface | Kind | Related IDs | Evidence |
+| --- | --- | --- | --- |
+
+## Coverage matrix
+| Surface | Dimension | Status | Canonical reference | Owner / validation gate | Consequence if wrong |
+| --- | --- | --- | --- | --- | --- |
+
+## Assumption audit
+| Assumption | Evidence | Confidence | Owner | Validation | Consequence if wrong |
+| --- | --- | --- | --- | --- | --- |
+
+## Residual uncertainty
+| Item | Why nonblocking | Owner | Validation gate |
+| --- | --- | --- | --- |
+
+## Readiness verdict
+No Partial, Missing, unowned material assumption, or unresolved blocking/escalating
+question remains.
+```
+
+Combine rows only when one decision and owner genuinely close them.
+
+Run the digest command only after `brief.md`, `spec.md`, `decisions.md`,
+`assumptions.md`, and `questions.md` are final for this clarification pass, then
+write the current contract field exactly once and copy the digest's complete field line
+verbatim. The build gate recomputes the digest and
+rejects stale coverage. Any open blocking, validating, or escalating question
+also prevents `CLEAR`.

package/pack/.claude/skills/rite-converge/SKILL.md

@@ -5,20 +5,19 @@ argument-hint: "[feature-slug]"
 user-invocable: true
 ---
 
-# /rite-converge: make the code and the intent converge
+# /rite-converge: compare live code with intent
 
-Read `spec.md` + `plan.md` + `tasks.md` as the **sole source of intent** (with
+Read `spec.md`, `plan.md`, and `tasks.md` as the **sole source of intent** (with
 `.devrites/principles.md` as governing constraints), assess what the **live codebase**
 implements, and **append every unmet piece as a new traceable `SLICE-###`** at the
-bottom of `tasks.md` so `/rite-build` can finish it. The recovery bridge for work that fell
-out of sync with its plan: a half-built feature picked up cold, a `/rite-adopt`'d codebase
-that drifted from its derived spec, or a build that stalled mid-slice. **Read the active
+bottom of `tasks.md` so `/rite-build` can finish it. Use this for a resumed half-built
+feature, an adopted codebase that drifted from its derived spec, or a build that stalled
+mid-slice. **Read the active
 workspace first**; if there's no `spec.md`/`plan.md`/`tasks.md`, tell the user which
 prerequisite skill to run.
 
-> **Not a diff tool.** `/rite-converge` assesses the **present state** of the code against
-> intent: no git, no branch comparison, no history. "What does this codebase do *now* vs
-> what the artifacts asked for", not "what changed since commit X". For a change-scoped
+> **This is not a diff tool.** `/rite-converge` compares current code with intent. It
+> does not use git history or compare branches. For a change-scoped
 > review use `/rite-review`; to prove a finished feature use `/rite-prove`.
 
 ## Rules consulted (read on demand from `.claude/skills/devrites-lib/reference/standards/`)
@@ -41,16 +40,20 @@ Pull on demand:
 - **Clean means byte-for-byte unchanged.** When the code already satisfies everything, leave
   `tasks.md` untouched (no empty convergence header) and report a clean result. Recommend
   `/rite-prove`.
-- **Intent is the artifacts, not your memory.** The spec/plan/tasks (+ principles) are the
+- **Use artifacts as intent.** The spec, plan, tasks, and principles are the
   contract. If assessing reveals the *spec* is wrong (the code is right and the requirement is
   stale), that's **Spec Drift**: stop and route it through the Spec Drift Guard
   (`rite-build/reference/spec-drift-guard.md`) + a recorded decision; never paper over a spec
-  bug by appending a task that "fixes" the code to a wrong requirement.
+  bug by appending a task that changes correct code to match a wrong requirement.
 - **Partial is not done.** Code that exists but is untested, half-wired, or covers only the
   happy path is an unmet gap: enqueue the remainder, don't round it up.
 - **Principles are non-negotiable.** A live violation of a declared invariant with no recorded
   exception is the top-severity gap, walked first. Absent/empty principles file → none declared
   → skip the check gracefully, never block for its absence.
+- **Scout observes; root classifies and writes.** Use
+  [`agents.md`](../devrites-lib/reference/standards/agents.md). The evidence scout returns
+  live-code citations only; the controlling chat owns built/partial/absent calls and append-only
+  workspace changes.
 
 ## Workflow
 0. **Read `.claude/skills/devrites-lib/reference/standards/core.md`** first (the always-on
@@ -59,14 +62,16 @@ Pull on demand:
    any is missing, **STOP** and name the prerequisite (`/rite-spec` for a missing spec,
    `/rite-define` for a missing plan/tasks, `/rite-adopt` to onboard existing code). Do not
    produce partial output.
+   Require `decision-coverage.md` with `Decision coverage: CLEAR`; otherwise STOP →
+   `/rite-clarify`.
 2. **Load intent:** [`reference/convergence-assessment.md`](reference/convergence-assessment.md).
    From `spec.md`: buildable `AC-###` / `### Requirement:` scenarios (skip `## Success metrics`);
    from `plan.md`: architecture decisions + named touch-points (files/components the plan says
    get built); from `tasks.md`: existing slices + their `Satisfies:`; from
    `.devrites/principles.md`: the invariants.
    **Completion:** every buildable criterion, touch-point, slice output, and principle is in the assessment inventory.
-3. **Run the mechanical backbone**, then read the code. `devrites-engine analyze` gives coverage +
-   consistency; `devrites-engine coverage` gives the AC→slice→proven matrix. They catch *unmapped*
+3. **Run the mechanical checks**, then read the code. `devrites-engine analyze` gives coverage
+   and consistency; `devrites-engine coverage` gives the AC→slice→proven matrix. They catch *unmapped*
    criteria; they do **not** see whether mapped code is built and correct, for that,
    read the live code (code-intelligence index per `tooling.md`).
    ```bash
@@ -78,7 +83,9 @@ Pull on demand:
    [`reference/convergence-assessment.md`](reference/convergence-assessment.md)): every
    acceptance criterion / scenario, every plan touch-point, and every existing slice's stated
    Produces. A principle violated in the current code is its own top-severity gap.
-   **Completion:** every inventory unit is classified once with live-code evidence.
+   Dispatch up to three independent inventory partitions to `devrites-evidence-scout` on the
+   same frozen candidate, await their dossiers, then reconcile the cited facts in the root
+   context. **Completion:** every inventory unit is classified once with live-code evidence.
 5. **Enqueue the remainder as new slices.** For each *partial* or *absent* unit, append a
    `## SLICE-###` (continue the numbering after the highest existing id) in the `rite-define`
    slice grammar, each with a `Satisfies:` line tracing to the AC/REQ it closes and a
@@ -87,10 +94,14 @@ Pull on demand:
    **Completion:** every partial/absent unit has one traceable appended slice, or the file is byte-for-byte unchanged.
 6. **Write append-only + bookkeeping.** Append the slice batch to `tasks.md` (nothing else in
    that file changes); refresh `traceability.md` (`devrites-engine coverage` → new rows for the
-   appended slices); update `state.md` (`Phase: converge`, `Next step: /rite-build`; or, when
-   nothing was unmet, `Next step: /rite-prove`). Append `decisions.md` for any material call.
+   appended slices). Appending a slice changes the plan input, so invalidate the prior vet:
+   update `state.md` to `Phase: plan`, `Next step: /rite-vet`, and set an existing
+   `eng-review.md` field to `Implementation readiness: NEEDS REPLAN`. When nothing was unmet,
+   leave the plan/vet verdict untouched and set `Next step: /rite-prove`. Append
+   `decisions.md` for any material call.
 7. **STOP.** Report units assessed, built / partial / absent counts, slices appended, and any
-   principle violation found; recommend `/rite-build` (or `/rite-prove` if the code already
+   principle violation found; recommend `/rite-vet` when slices were appended (or
+   `/rite-prove` if the code already
    converged).
 
 ## Appended slice format
@@ -105,11 +116,9 @@ Convergence: 2026-07-07      # marks this as a convergence-appended slice, not a
 <all remaining canonical slice fields>
 ```
 
-> **Mid-flight discipline.** When tempted to rewrite an existing slice instead of appending, to
-> edit the code directly "while you're in there", to mark a happy-path-only implementation as
-> built, or to enqueue a task that bends the code to a spec you suspect is wrong: see
-> [`reference/anti-patterns.md`](reference/anti-patterns.md). Load it the moment you reach for
-> the excuse.
+> **Mid-flight discipline.** Do not rewrite an existing slice, edit source, mark a
+> happy-path-only implementation as built, or add work for a spec you suspect is wrong.
+> See [`reference/anti-patterns.md`](reference/anti-patterns.md).
 
 ## Output
 
@@ -118,14 +127,15 @@ Convergence: 2026-07-07      # marks this as a convergence-appended slice, not a
 Default success shape:
 ```
 Done: convergence assessed for <slug>; <n> slices appended.
-Changed: tasks.md <appended|unchanged>, traceability.md, state.md
+Changed: tasks.md <appended|unchanged>, traceability.md, state.md, eng-review.md <invalidated|unchanged>
 Evidence: units <built>/<total> built · <partial> partial · <absent> absent · principle violations 0
 Open: none
-Next: /rite-build
+Next: /rite-vet
 Record: .devrites/work/<slug>/tasks.md
-↻ Hygiene: /clear before /rite-build
+↻ Hygiene: /clear before /rite-vet
 ```
 When nothing was unmet, render the same green form with `Next: /rite-prove`.
 If spec drift or another blocker remains, use the shared `Stopped / blocked` form
 and route `Fix:` to `/rite-plan`; do not recommend `/rite-build`.
-**DO NOT write application code, rewrite existing slices, or edit spec.md/plan.md here**: convergence assesses and enqueues; `/rite-build` implements.
+**DO NOT write application code, rewrite existing slices, or edit spec.md/plan.md here.**
+This phase assesses and enqueues; `/rite-build` implements.