devrites 3.2.2 → 3.2.3

package/pack/generated/claude/skills/rite-quick/SKILL.md

@@ -3,6 +3,7 @@ name: rite-quick
 description: Express lane for a small reversible change: typo/copy/config, rate-limit constant, error message, local variable rename, feature flag, README link, one-file/function fix.
 argument-hint: "<what to change>"
 user-invocable: true
+required-agent-roles: none
 ---
 
 # /rite-quick: express lane for small changes

package/pack/generated/claude/skills/rite-resolve/SKILL.md

@@ -4,6 +4,7 @@ description: User-invoked resume verb for answering, dropping, or batch-resolvin
 argument-hint: "<qid> \"<answer>\"  |  --drop <qid> [\"<reason>\"]  |  --batch <path-to-yaml>"
 user-invocable: true
 disable-model-invocation: true
+required-agent-roles: none
 ---
 
 # /rite-resolve: answer the human gate

package/pack/generated/claude/skills/rite-review/SKILL.md

@@ -3,6 +3,7 @@ name: rite-review
 description: Review polished feature diff for correctness, readability, architecture, security, tests proving acceptance, Critical/Important findings, and quality dimensions before seal.
 argument-hint: "[scope: slice N | feature] [--full]"
 user-invocable: true
+required-agent-roles: devrites-spec-reviewer, devrites-code-reviewer
 ---
 
 # /rite-review: feature-scoped review

package/pack/generated/claude/skills/rite-seal/SKILL.md

@@ -3,6 +3,7 @@ name: rite-seal
 description: Decide GO / NO-GO readiness on the active feature. Use when the user asks "seal this", "GO / NO-GO", "decide if we can ship", "can we ship", or "safe to merge". Not for commit/push/tag/close; use /rite-ship.
 argument-hint: "[feature-slug] [--full]"
 user-invocable: true
+required-agent-roles: devrites-test-analyst
 ---
 
 # /rite-seal: GO / NO-GO

package/pack/generated/claude/skills/rite-seal/reference/phase-contract.md

@@ -45,8 +45,7 @@
      against the ledger: an every-slice-trivial feature (`- none`) is a valid pass; a stood triggering
      decision (boundary / data-model / auth / public-API / migration / branching) with no verdict is
      the finding, same severity as rc=3.
-   - **rc=0:** covered, or not assessable (an inline build logs no dispatch: verify the ledger's
-     verdicts by hand).
+   - **rc=0:** covered, or not assessable because no wright was logged.
    Either way, walk the `## Decisions stood` ledger yourself: severity rides the unverified
    **decision**, never the exit code alone.
 5. Check **security, data, migration, rollback**, strategy scope, principles,
@@ -61,7 +60,7 @@
    [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md). Await
    fresh-context batches of at most three and give reviewers only the workspace path plus
    immutable diff, without author reasoning. Use named role → safely enforced generic fresh
-   agent → labelled inline; inline output is never independent. Carry Spec/Code verdicts only
+   agent; if neither is available, seal remains NO-GO. Carry Spec/Code verdicts only
    for an unchanged post-review diff; rerun the other applicable axes.
    **Footprint: account for the whole roster.** For each reviewer you dispatch, append
    `devrites-engine footprint log <slug> reviewer devrites-<x>-reviewer` (the reviewer's **exact agent name**:

package/pack/generated/claude/skills/rite-seal/reference/risk-and-rollback.md

@@ -25,18 +25,16 @@ For each risky step, state how to back it out:
 - A new external dependency with no failure handling is at least **Important**.
 - Record the chosen rollback path in `seal.md` → "Rollback / Recovery".
 
-## Fresh-context fallback weighting
-
-An inline final-rung review is useful signal but **not independent evidence**:
-
-- Record `independence: fallback` and a roster skip reason; never log it as a dispatched
-  reviewer or a clean fresh-context pass.
-- Preserve its findings at their normal severity. A clean inline result still leaves an
-  **Important assurance gap** and cannot silently satisfy a required axis.
-- Seal remains NO-GO until that axis runs through a fresh-context spawn, or the human
-  explicitly accepts the reduced assurance in `seal.md`. AFK never auto-accepts it.
-- Security or irreversible-risk scope has no reduced-assurance override: unavailable
-  independent review remains NO-GO.
+## Fresh-context availability
+
+A required review must run in a fresh spawned agent:
+
+- If neither a named role nor a guarded generic agent is available, record the roster
+  skip reason and keep seal **NO-GO**.
+- Never run the reviewer in the root context or log root work as a dispatched review.
+- AFK never auto-accepts a missing reviewer.
+- Security or irreversible-risk scope remains NO-GO while independent review is
+  unavailable.
 
 ## Destructive operations
 Confirm any destructive step with the user before shipping. Verify backups exist where

package/pack/generated/claude/skills/rite-ship/SKILL.md

@@ -3,6 +3,7 @@ name: rite-ship
 description: Ship the sealed feature: commit, push, tag, archive, close. Use when the user says "ship it", "push the branch", "tag the release", or "close the task" after /rite-seal GO. Not for GO/NO-GO readiness.
 argument-hint: "[feature-slug]"
 user-invocable: true
+required-agent-roles: none
 ---
 
 # /rite-ship: ship + close the task

package/pack/generated/claude/skills/rite-spec/SKILL.md

@@ -3,6 +3,7 @@ name: rite-spec
 description: Spec new or high-risk behavior before code and write its `.devrites/work/<slug>/` workspace. Use for a feature/app, vague product idea, auth or migration work, or a public-API change. Not for approved-spec planning.
 argument-hint: "<feature or idea>"
 user-invocable: true
+required-agent-roles: none
 ---
 
 # /rite-spec: investigate and write the spec

package/pack/generated/claude/skills/rite-status/SKILL.md

@@ -4,6 +4,7 @@ description: User-invoked read-only active-feature report: phase, active slice,
 argument-hint: "[feature-slug]"
 user-invocable: true
 disable-model-invocation: true
+required-agent-roles: none
 ---
 
 # /rite-status: active feature status

package/pack/generated/claude/skills/rite-temper/SKILL.md

@@ -3,6 +3,7 @@ name: rite-temper
 description: Temper a readied spec before planning. Use when the user says "temper this", "strategy review", "pre-mortem the spec", or asks if we are over/under-building. Not for code review or final seal.
 argument-hint: "[feature-slug] [--mode expand|selective|hold|reduce]"
 user-invocable: true
+required-agent-roles: devrites-strategy-reviewer
 ---
 
 # /rite-temper: review scope and risk before planning
@@ -112,8 +113,8 @@ that needs more than the default pre-mortem) selected by the section's risk).
    dimension still below bar after 3 is classified by decision ownership: a product/scope/risk
    choice becomes a blocking question; an objective spec defect stays blocked with the exact
    required edit and routes to `/rite-spec`, not `/rite-resolve`. Irreversible-risk findings
-   always pause. Use the shared capability ladder; an inline final-rung pass is labeled
-   `independence: fallback`, never an independent review. After an accepted edit to a
+   always pause. Use the shared capability ladder; if no fresh-agent rung is available,
+   stop for HITL. After an accepted edit to a
    coverage-bound input, repeat step 6's revalidation and digest refresh before handoff.
 8. **STOP.** Report the mode, the scope deltas, and the floor verdict; recommend `/rite-define`.
 

package/pack/generated/claude/skills/rite-upgrade/SKILL.md

@@ -4,6 +4,7 @@ description: User-invoked semantic upgrade for an active legacy DevRites workspa
 argument-hint: "[feature-slug]"
 user-invocable: true
 disable-model-invocation: true
+required-agent-roles: devrites-upgrade-planner
 ---
 
 # /rite-upgrade: bring an active workspace onto the current contract
@@ -58,7 +59,8 @@ Plan, Vet, Converge, and Build phase contracts needed by the assessment.
    devrites-engine snapshot [feature-slug]
    ```
    If every semantic artifact names the current contract and `build-readiness` passes,
-   report a no-op.
+   mark the candidate as a likely no-op; the fresh upgrade assessment in step 2 must
+   confirm that before reporting it.
 1. **Freeze the preservation baseline.** Create the standard orchestrator-controlled
    `agent-packet/v1` baseline. Include exact paths for current phase/artifact contracts,
    `state.md`, `spec.md`, `decision-coverage.md`, `architecture.md`, `plan.md`, `tasks.md`,

package/pack/generated/claude/skills/rite-vet/SKILL.md

@@ -3,6 +3,7 @@ name: rite-vet
 description: Vet a defined plan before code with senior-engineer engineering review. Use when the user says "vet the plan", "engineering review", "lock in the plan", or before building. Not for code review or final seal.
 argument-hint: "[slug] [--cross-model] [--full]"
 user-invocable: true
+required-agent-roles: devrites-plan-reviewer
 ---
 
 # /rite-vet: review the plan before build

package/pack/generated/claude/skills/rite-zoom-out/SKILL.md

@@ -4,6 +4,7 @@ description: User-invoked read-only structural map of unfamiliar code: modules,
 argument-hint: "[symbol | file | area to map]"
 user-invocable: true
 disable-model-invocation: true
+required-agent-roles: none
 ---
 
 # /rite-zoom-out: step up one abstraction layer

package/pack/generated/codex/AGENTS.md

@@ -13,10 +13,8 @@ This project has DevRites installed for both Claude Code and Codex.
 - Before using any DevRites workflow skill, read `.agents/skills/devrites-lib/reference/standards/core.md`. Load other `.agents/skills/devrites-lib/reference/standards/*.md` files when the skill or rule index asks for them. These are DevRites engineering standards, not Codex exec-policy `.rules` files.
 - Custom Codex subagents generated from the DevRites review agents live in `.codex/agents`.
 - In DevRites guidance, **invoke** means run a skill inline in the current context; **dispatch** means start a fresh agent with `spawn_agent`, wait for it, and reconcile its result.
-- Inspect the current `spawn_agent` role list. Use an exposed named `devrites-<role>` with `fork_turns="none"`; full-history forks inherit the parent type.
-- If a named role is not exposed, use generic `explorer` for read-only work with `fork_turns="none"` and tell it to read `.codex/agents/devrites-<role>.toml`. Trusted `.codex/hooks.json` binds `agent_type=explorer` to the fail-closed reviewer guard.
-- For `devrites-slice-wright`, trusted `.codex/hooks.json` binds generic `worker` (`agent_type=worker`) to the active reconcile window and exact `.wright-allowlist`. Dispatch it with `fork_turns="none"`, the unchanged packet, and `.codex/agents/devrites-slice-wright.toml`.
-- A missing custom role is not evidence that spawning is unavailable. Use the labelled inline `.reconcile-inline` path only when project hooks are unavailable or untrusted, spawning is unavailable, or higher-priority policy rejects the safe rung.
+- Follow the invoked skill's generated **Codex compatibility** section for exact dispatch mechanics: V2 uses the named `devrites-<role>`; V1 alone may use the guarded generic compatibility path. Both use `fork_turns="none"`.
+- The invoked skill's `required-agent-roles` frontmatter arms a fail-closed receipt. If a required dispatch is unavailable or rejected, stop for HITL; never execute a DevRites specialist role in the root context.
 - Claude Code agent hook metadata is not active in Codex. The generated Codex agents preserve read-only intent with Codex sandbox settings where possible; still follow DevRites' scope and no-mutation rules explicitly.
 
 ## Workflow contract

package/pack/generated/codex/hooks.json

@@ -21,14 +21,19 @@
         "hooks": [
           {
             "type": "command",
-            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook a1-guard --harness=codex",
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec env DEVRITES_A1_HOOK=enforce devrites-engine hook a1-guard --harness=codex",
             "statusMessage": "DevRites: checking build write boundary"
           }
         ]
       },
       {
-        "matcher": "Bash|Shell|sh|exec_command|run_command|Edit|Write|MultiEdit|NotebookEdit|apply_patch|exec|js|python|computer|computer_use|write_stdin|run_code|Agent|Task|spawn_agent|delegate|dispatch_agent|create_agent",
+        "matcher": "Bash|Shell|sh|exec_command|run_command|Edit|Write|MultiEdit|NotebookEdit|apply_patch|exec|js|python|computer|computer_use|write_stdin|run_code|Agent|Task|spawn_agent|delegate|dispatch_agent|create_agent|wait|wait_agent",
         "hooks": [
+          {
+            "type": "command",
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook agent-dispatch --harness=codex",
+            "statusMessage": "DevRites: verifying agent dispatch receipt"
+          },
           {
             "type": "command",
             "command": "payload=\"$(cat)\"; if ! command -v devrites-engine >/dev/null 2>&1; then if printf '%s' \"$payload\" | grep -Eq '\"agent_type\"[[:space:]]*:[[:space:]]*\"(explorer|worker)\"'; then printf '%s\\n' 'DevRites: generic Codex leaf guard unavailable; install or repair devrites-engine. (devrites-codex-generic-guard)' >&2; exit 2; fi; exit 0; fi; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || { printf '%s\\n' 'DevRites: cannot resolve the project root for a generic Codex leaf. (devrites-codex-generic-guard)' >&2; exit 2; }; printf '%s' \"$payload\" | DEVRITES_CODEX_GENERIC_AGENT_COMPAT=1 devrites-engine hook reviewer-readonly --harness=codex; rc=$?; case \"$rc\" in 0) exit 0 ;; 2) exit 2 ;; *) printf '%s\\n' 'DevRites: generic Codex reviewer guard unavailable or crashed; install or repair devrites-engine. (devrites-codex-generic-guard)' >&2; exit 2 ;; esac",
@@ -66,6 +71,15 @@
       }
     ],
     "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook agent-dispatch --harness=codex",
+            "statusMessage": "DevRites: checking agent completion receipt"
+          }
+        ]
+      },
       {
         "hooks": [
           {
@@ -88,6 +102,10 @@
     "UserPromptSubmit": [
       {
         "hooks": [
+          {
+            "type": "command",
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook agent-dispatch --harness=codex"
+          },
           {
             "type": "command",
             "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook cursor --harness=codex"
@@ -97,7 +115,7 @@
     ],
     "SubagentStart": [
       {
-        "matcher": "devrites-.*",
+        "matcher": "devrites-.*|explorer|worker",
         "hooks": [
           {
             "type": "command",
@@ -127,11 +145,12 @@
     ],
     "SubagentStop": [
       {
-        "matcher": "devrites-slice-wright|devrites-.*reviewer|devrites-retrospector|devrites-forge-judge",
+        "matcher": "devrites-.*|explorer|worker",
         "hooks": [
           {
             "type": "command",
-            "command": "printf '%s\\n' 'DevRites: reconcile this subagent result against the active DevRites skill contract before claiming completion.'"
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook agent-dispatch --harness=codex",
+            "statusMessage": "DevRites: recording subagent result"
           },
           {
             "type": "command",

package/pack/generated/codex/skills/devrites-api-interface/SKILL.md

@@ -2,6 +2,7 @@
 name: devrites-api-interface
 description: Internal DevRites skill; DevRites agents invoke it explicitly, not by prompt match.
 user-invocable: false
+required-agent-roles: none
 ---
 
 ## Codex compatibility
@@ -11,10 +12,11 @@ This is the Codex mirror of a DevRites skill. In Codex:
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
 - **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- Inspect the current `spawn_agent` role list. When the named `devrites-<role>` is exposed, dispatch it with `fork_turns="none"`; full-history forks inherit the parent type. The matching project contract is `.codex/agents/devrites-<role>.toml`.
-- If a named role is not exposed, use generic `explorer` for every read-only role with `fork_turns="none"`. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. Trusted `.codex/hooks.json` binds `agent_type=explorer` to the fail-closed reviewer read-only guard.
-- For `devrites-slice-wright`, trusted `.codex/hooks.json` binds generic `worker` (`agent_type=worker`) to the active reconcile window and exact `.wright-allowlist`. Dispatch that worker with `fork_turns="none"`, tell it to read `.codex/agents/devrites-slice-wright.toml`, and execute the unchanged packet. Never create `.reconcile-inline` when this safe rung is available.
-- A missing custom role is not evidence that spawning is unavailable. Only when the project hooks are unavailable or untrusted, no spawn primitive exists, or higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, create `.reconcile-inline` only for that path, and apply every fallback risk gate.
+- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. Codex loads that role TOML's `developer_instructions` natively. Because V2 collaboration lifecycle calls bypass hooks, DevRites verifies the current durable parent/child rollout for the exact role, wait, completion, and non-empty delivered result.
+- On MultiAgent V1, when the named role is not exposed, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
+- On MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`; do not substitute `worker` for an exposed V2 named role.
+- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
+- If any required named or generic agent dispatch is unavailable or rejected, stop for HITL. Never execute a DevRites specialist role in the root context.
 - Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
 - Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.

package/pack/generated/codex/skills/devrites-audit/SKILL.md

@@ -3,6 +3,7 @@ name: devrites-audit
 description: Internal DevRites skill; DevRites agents invoke it explicitly, not by prompt match.
 argument-hint: "<security | perf | simplify>"
 user-invocable: false
+required-agent-roles: none
 ---
 
 ## Codex compatibility
@@ -12,10 +13,11 @@ This is the Codex mirror of a DevRites skill. In Codex:
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
 - **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- Inspect the current `spawn_agent` role list. When the named `devrites-<role>` is exposed, dispatch it with `fork_turns="none"`; full-history forks inherit the parent type. The matching project contract is `.codex/agents/devrites-<role>.toml`.
-- If a named role is not exposed, use generic `explorer` for every read-only role with `fork_turns="none"`. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. Trusted `.codex/hooks.json` binds `agent_type=explorer` to the fail-closed reviewer read-only guard.
-- For `devrites-slice-wright`, trusted `.codex/hooks.json` binds generic `worker` (`agent_type=worker`) to the active reconcile window and exact `.wright-allowlist`. Dispatch that worker with `fork_turns="none"`, tell it to read `.codex/agents/devrites-slice-wright.toml`, and execute the unchanged packet. Never create `.reconcile-inline` when this safe rung is available.
-- A missing custom role is not evidence that spawning is unavailable. Only when the project hooks are unavailable or untrusted, no spawn primitive exists, or higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, create `.reconcile-inline` only for that path, and apply every fallback risk gate.
+- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. Codex loads that role TOML's `developer_instructions` natively. Because V2 collaboration lifecycle calls bypass hooks, DevRites verifies the current durable parent/child rollout for the exact role, wait, completion, and non-empty delivered result.
+- On MultiAgent V1, when the named role is not exposed, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
+- On MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`; do not substitute `worker` for an exposed V2 named role.
+- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
+- If any required named or generic agent dispatch is unavailable or rejected, stop for HITL. Never execute a DevRites specialist role in the root context.
 - Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
 - Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
@@ -55,14 +57,12 @@ no cross-pollination and the shared maximum of three concurrent read-only roles.
 
 ## Fallback and scope
 
-Use the capability ladder; inline is allowed only when no safe fresh-context rung
-preserves the role's read-only boundary or policy rejects it, and must say
-`independence: fallback`. Use these role contracts:
+Use the capability ladder. If no safe fresh-context rung preserves the role's
+read-only boundary, stop for HITL. Use these role contracts:
 
 - `.codex/agents/devrites-security-auditor.toml`
 - `.codex/agents/devrites-performance-reviewer.toml`
 - `.codex/agents/devrites-simplifier-reviewer.toml`
 
-Seal weights that fallback under
-[`risk-and-rollback.md`](../rite-seal/reference/risk-and-rollback.md). Stay inside the
-active feature. Critical findings block seal; simplification never changes behavior.
+Stay inside the active feature. Critical findings block seal; simplification never
+changes behavior.

package/pack/generated/codex/skills/devrites-browser-proof/SKILL.md

@@ -2,6 +2,7 @@
 name: devrites-browser-proof
 description: Internal DevRites skill; DevRites agents invoke it explicitly, not by prompt match.
 user-invocable: false
+required-agent-roles: none
 ---
 
 ## Codex compatibility
@@ -11,10 +12,11 @@ This is the Codex mirror of a DevRites skill. In Codex:
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
 - **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- Inspect the current `spawn_agent` role list. When the named `devrites-<role>` is exposed, dispatch it with `fork_turns="none"`; full-history forks inherit the parent type. The matching project contract is `.codex/agents/devrites-<role>.toml`.
-- If a named role is not exposed, use generic `explorer` for every read-only role with `fork_turns="none"`. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. Trusted `.codex/hooks.json` binds `agent_type=explorer` to the fail-closed reviewer read-only guard.
-- For `devrites-slice-wright`, trusted `.codex/hooks.json` binds generic `worker` (`agent_type=worker`) to the active reconcile window and exact `.wright-allowlist`. Dispatch that worker with `fork_turns="none"`, tell it to read `.codex/agents/devrites-slice-wright.toml`, and execute the unchanged packet. Never create `.reconcile-inline` when this safe rung is available.
-- A missing custom role is not evidence that spawning is unavailable. Only when the project hooks are unavailable or untrusted, no spawn primitive exists, or higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, create `.reconcile-inline` only for that path, and apply every fallback risk gate.
+- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. Codex loads that role TOML's `developer_instructions` natively. Because V2 collaboration lifecycle calls bypass hooks, DevRites verifies the current durable parent/child rollout for the exact role, wait, completion, and non-empty delivered result.
+- On MultiAgent V1, when the named role is not exposed, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
+- On MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`; do not substitute `worker` for an exposed V2 named role.
+- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
+- If any required named or generic agent dispatch is unavailable or rejected, stop for HITL. Never execute a DevRites specialist role in the root context.
 - Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
 - Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.

package/pack/generated/codex/skills/devrites-debug-recovery/SKILL.md

@@ -2,6 +2,7 @@
 name: devrites-debug-recovery
 description: Internal DevRites skill; DevRites agents invoke it explicitly, not by prompt match.
 user-invocable: false
+required-agent-roles: none
 ---
 
 ## Codex compatibility
@@ -11,10 +12,11 @@ This is the Codex mirror of a DevRites skill. In Codex:
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
 - **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- Inspect the current `spawn_agent` role list. When the named `devrites-<role>` is exposed, dispatch it with `fork_turns="none"`; full-history forks inherit the parent type. The matching project contract is `.codex/agents/devrites-<role>.toml`.
-- If a named role is not exposed, use generic `explorer` for every read-only role with `fork_turns="none"`. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. Trusted `.codex/hooks.json` binds `agent_type=explorer` to the fail-closed reviewer read-only guard.
-- For `devrites-slice-wright`, trusted `.codex/hooks.json` binds generic `worker` (`agent_type=worker`) to the active reconcile window and exact `.wright-allowlist`. Dispatch that worker with `fork_turns="none"`, tell it to read `.codex/agents/devrites-slice-wright.toml`, and execute the unchanged packet. Never create `.reconcile-inline` when this safe rung is available.
-- A missing custom role is not evidence that spawning is unavailable. Only when the project hooks are unavailable or untrusted, no spawn primitive exists, or higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, create `.reconcile-inline` only for that path, and apply every fallback risk gate.
+- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. Codex loads that role TOML's `developer_instructions` natively. Because V2 collaboration lifecycle calls bypass hooks, DevRites verifies the current durable parent/child rollout for the exact role, wait, completion, and non-empty delivered result.
+- On MultiAgent V1, when the named role is not exposed, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
+- On MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`; do not substitute `worker` for an exposed V2 named role.
+- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
+- If any required named or generic agent dispatch is unavailable or rejected, stop for HITL. Never execute a DevRites specialist role in the root context.
 - Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
 - Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.

package/pack/generated/codex/skills/devrites-doubt/SKILL.md

@@ -2,6 +2,7 @@
 name: devrites-doubt
 description: Internal DevRites skill; DevRites agents invoke it explicitly, not by prompt match.
 user-invocable: false
+required-agent-roles: devrites-doubt-reviewer
 ---
 
 ## Codex compatibility
@@ -11,10 +12,11 @@ This is the Codex mirror of a DevRites skill. In Codex:
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
 - **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- Inspect the current `spawn_agent` role list. When the named `devrites-<role>` is exposed, dispatch it with `fork_turns="none"`; full-history forks inherit the parent type. The matching project contract is `.codex/agents/devrites-<role>.toml`.
-- If a named role is not exposed, use generic `explorer` for every read-only role with `fork_turns="none"`. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. Trusted `.codex/hooks.json` binds `agent_type=explorer` to the fail-closed reviewer read-only guard.
-- For `devrites-slice-wright`, trusted `.codex/hooks.json` binds generic `worker` (`agent_type=worker`) to the active reconcile window and exact `.wright-allowlist`. Dispatch that worker with `fork_turns="none"`, tell it to read `.codex/agents/devrites-slice-wright.toml`, and execute the unchanged packet. Never create `.reconcile-inline` when this safe rung is available.
-- A missing custom role is not evidence that spawning is unavailable. Only when the project hooks are unavailable or untrusted, no spawn primitive exists, or higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, create `.reconcile-inline` only for that path, and apply every fallback risk gate.
+- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. Codex loads that role TOML's `developer_instructions` natively. Because V2 collaboration lifecycle calls bypass hooks, DevRites verifies the current durable parent/child rollout for the exact role, wait, completion, and non-empty delivered result.
+- On MultiAgent V1, when the named role is not exposed, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
+- On MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`; do not substitute `worker` for an exposed V2 named role.
+- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
+- If any required named or generic agent dispatch is unavailable or rejected, stop for HITL. Never execute a DevRites specialist role in the root context.
 - Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
 - Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
@@ -38,7 +40,7 @@ code · claiming "this is safe", "this scales", or "this matches the spec".
   `agent-packet/v1` and the adversarial objective *"find what's wrong; do not
   validate."* Follow
   [`agents.md`](../devrites-lib/reference/standards/agents.md). Inline does not satisfy
-  independence; it is a labeled fallback only at the final capability-ladder rung.
+  independence; if no fresh-agent rung is available, stop for HITL.
 - [ ] **4. RECONCILE**: classify EVERY finding: contract misread | valid & actionable |
   valid trade-off | noise. **Doubt-theater check:** if two or more cycles find substantive
   issues but classify **zero** as actionable, the review is too agreeable. Sharpen the

package/pack/generated/codex/skills/devrites-frontend-craft/SKILL.md

@@ -2,6 +2,7 @@
 name: devrites-frontend-craft
 description: Internal DevRites skill; DevRites agents invoke it explicitly, not by prompt match.
 user-invocable: false
+required-agent-roles: none
 ---
 
 ## Codex compatibility
@@ -11,10 +12,11 @@ This is the Codex mirror of a DevRites skill. In Codex:
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
 - **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- Inspect the current `spawn_agent` role list. When the named `devrites-<role>` is exposed, dispatch it with `fork_turns="none"`; full-history forks inherit the parent type. The matching project contract is `.codex/agents/devrites-<role>.toml`.
-- If a named role is not exposed, use generic `explorer` for every read-only role with `fork_turns="none"`. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. Trusted `.codex/hooks.json` binds `agent_type=explorer` to the fail-closed reviewer read-only guard.
-- For `devrites-slice-wright`, trusted `.codex/hooks.json` binds generic `worker` (`agent_type=worker`) to the active reconcile window and exact `.wright-allowlist`. Dispatch that worker with `fork_turns="none"`, tell it to read `.codex/agents/devrites-slice-wright.toml`, and execute the unchanged packet. Never create `.reconcile-inline` when this safe rung is available.
-- A missing custom role is not evidence that spawning is unavailable. Only when the project hooks are unavailable or untrusted, no spawn primitive exists, or higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, create `.reconcile-inline` only for that path, and apply every fallback risk gate.
+- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. Codex loads that role TOML's `developer_instructions` natively. Because V2 collaboration lifecycle calls bypass hooks, DevRites verifies the current durable parent/child rollout for the exact role, wait, completion, and non-empty delivered result.
+- On MultiAgent V1, when the named role is not exposed, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
+- On MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`; do not substitute `worker` for an exposed V2 named role.
+- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
+- If any required named or generic agent dispatch is unavailable or rejected, stop for HITL. Never execute a DevRites specialist role in the root context.
 - Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
 - Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.

package/pack/generated/codex/skills/devrites-interview/SKILL.md

@@ -2,6 +2,7 @@
 name: devrites-interview
 description: Internal DevRites skill; DevRites agents invoke it explicitly, not by prompt match.
 user-invocable: false
+required-agent-roles: none
 ---
 
 ## Codex compatibility
@@ -11,10 +12,11 @@ This is the Codex mirror of a DevRites skill. In Codex:
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
 - **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- Inspect the current `spawn_agent` role list. When the named `devrites-<role>` is exposed, dispatch it with `fork_turns="none"`; full-history forks inherit the parent type. The matching project contract is `.codex/agents/devrites-<role>.toml`.
-- If a named role is not exposed, use generic `explorer` for every read-only role with `fork_turns="none"`. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. Trusted `.codex/hooks.json` binds `agent_type=explorer` to the fail-closed reviewer read-only guard.
-- For `devrites-slice-wright`, trusted `.codex/hooks.json` binds generic `worker` (`agent_type=worker`) to the active reconcile window and exact `.wright-allowlist`. Dispatch that worker with `fork_turns="none"`, tell it to read `.codex/agents/devrites-slice-wright.toml`, and execute the unchanged packet. Never create `.reconcile-inline` when this safe rung is available.
-- A missing custom role is not evidence that spawning is unavailable. Only when the project hooks are unavailable or untrusted, no spawn primitive exists, or higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, create `.reconcile-inline` only for that path, and apply every fallback risk gate.
+- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. Codex loads that role TOML's `developer_instructions` natively. Because V2 collaboration lifecycle calls bypass hooks, DevRites verifies the current durable parent/child rollout for the exact role, wait, completion, and non-empty delivered result.
+- On MultiAgent V1, when the named role is not exposed, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
+- On MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`; do not substitute `worker` for an exposed V2 named role.
+- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
+- If any required named or generic agent dispatch is unavailable or rejected, stop for HITL. Never execute a DevRites specialist role in the root context.
 - Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
 - Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.

package/pack/generated/codex/skills/devrites-lib/SKILL.md

@@ -3,6 +3,7 @@ name: devrites-lib
 description: Internal DevRites skill; DevRites agents invoke it explicitly, not by prompt match.
 user-invocable: false
 disable-model-invocation: true
+required-agent-roles: none
 ---
 
 ## Codex compatibility
@@ -12,10 +13,11 @@ This is the Codex mirror of a DevRites skill. In Codex:
 - Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
 - Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
 - **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- Inspect the current `spawn_agent` role list. When the named `devrites-<role>` is exposed, dispatch it with `fork_turns="none"`; full-history forks inherit the parent type. The matching project contract is `.codex/agents/devrites-<role>.toml`.
-- If a named role is not exposed, use generic `explorer` for every read-only role with `fork_turns="none"`. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. Trusted `.codex/hooks.json` binds `agent_type=explorer` to the fail-closed reviewer read-only guard.
-- For `devrites-slice-wright`, trusted `.codex/hooks.json` binds generic `worker` (`agent_type=worker`) to the active reconcile window and exact `.wright-allowlist`. Dispatch that worker with `fork_turns="none"`, tell it to read `.codex/agents/devrites-slice-wright.toml`, and execute the unchanged packet. Never create `.reconcile-inline` when this safe rung is available.
-- A missing custom role is not evidence that spawning is unavailable. Only when the project hooks are unavailable or untrusted, no spawn primitive exists, or higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, create `.reconcile-inline` only for that path, and apply every fallback risk gate.
+- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. Codex loads that role TOML's `developer_instructions` natively. Because V2 collaboration lifecycle calls bypass hooks, DevRites verifies the current durable parent/child rollout for the exact role, wait, completion, and non-empty delivered result.
+- On MultiAgent V1, when the named role is not exposed, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
+- On MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`; do not substitute `worker` for an exposed V2 named role.
+- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
+- If any required named or generic agent dispatch is unavailable or rejected, stop for HITL. Never execute a DevRites specialist role in the root context.
 - Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
 - Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
 - When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.

package/pack/generated/codex/skills/devrites-lib/reference/model-tiers.md

@@ -21,13 +21,14 @@ one to a reviewer to save cost. The tier a scout runs on is where savings are sa
 ## The degradation rule
 
 Tiers are an optimization, never a correctness dependency. A skill written against tiers must run
-correctly on a harness that cannot select models per agent, or has no subagent primitive at all:
+correctly on a harness that cannot select models per agent:
 
 1. **Per-agent model override unavailable** → dispatch the scout on the **inherited** model and
    keep its **read budget and output cap**. The cost control falls back to structure, not model
    choice. This is why every scout dispatch also carries an explicit read budget.
-2. **No subagent primitive at all** → run the scout work **inline** in the orchestrator, with the
-   same budgets. The tier still tells you how much to spend, even with nothing to dispatch to.
+2. **No safe fresh-agent rung** → stop for HITL when the scout is required, or record the
+   explicitly optional scout as skipped. Never relabel root-context work as independent
+   specialist dispatch.
 
 A skill that only works when it can pick a cheap model is broken. The tier names the *intent*; the
 budget enforces it regardless of what the harness can do.