devrites 3.2.27 → 4.0.0

package/pack/.claude/skills/rite-seal/reference/phase-contract.md

@@ -1,145 +1,47 @@
 # rite-seal phase contract
 
-1. **Run the shared orientation preamble:** it prints `state.md`, the artifacts present,
-   the run mode (HITL/AFK), and the open-question tally by gate, so you orient deterministically
-   instead of re-deriving state from raw Markdown:
-   ```bash
-   devrites-engine preamble
-   ```
-   Then read all artifacts: `brief.md`, `spec.md`, `plan.md`, `tasks.md`, `state.md`,
-   `decisions.md`, `assumptions.md`, `questions.md`, `drift.md`, `evidence.md`,
-   `browser-evidence.md`, `polish-report.md`, `review.md`, `design-brief.md` (if UI),
-   `devex.md` (if a developer-facing surface), `strategy.md` (if present), and the **final diff**. If a code-intelligence index is available
-   (see `.claude/skills/devrites-lib/reference/standards/tooling.md`), use it for
-   blast-radius checks on the final diff in step 5; context7 if available can confirm a current
-   external-API signature a reviewer flags.
-2. Check **acceptance criteria one by one**: first run `devrites-engine spec-validate .devrites/work/<slug>`;
-   unresolved or unproven `resolved/test` prohibitions are a NO-GO until the linked evidence exists.
-   Then use [final-evidence](final-evidence.md).
-   Each gets a checkbox + the evidence that proves it (or "unproven"). Verify each criterion
-   **independently against the evidence artifact**: the slice report or the build narrative is not
-   proof; the `devrites-spec-reviewer` + `devrites-test-analyst` fan-out in step 7 is the
-   independent cross-check (a verifier that never saw the optimistic narrative).
-3. Verify tests, build/typecheck/lint, and browser proof are present and green for the
-   scope. Re-run if cheap and in doubt. **For a UI feature with a `design-brief.md`**, read the
-   `## Visual Verdict` table in `browser-evidence.md`: a `FAIL` on an **acceptance-mapped**
-   criterion is an unmet acceptance criterion (NO-GO, per the severity gate), a declared-state
-   `FAIL` is **Important**, and a UI build whose brief exists but whose verdict is **absent** is an
-   Important evidence gap (the scorecard should have been emitted at browser-proof).
-4. Check unresolved **questions** and **drift**: any open item that changes product
-   behavior blocks. **Any `questions.md` entry with `gate: validating` and `status: open`
-   is a NO-GO regardless of behavior impact** (an open validating gate is merge-blocking by
-   definition); a slice marked `built (pending review)` is not done.
-4a. **Doubt coverage: every stood decision was independently doubted.** Run the deterministic
-   check, then judge it against `decisions.md`:
-   ```bash
-   devrites-engine doubt-coverage <slug>; echo "doubt-coverage rc=$?"
-   ```
-   The script reads two records `/rite-build` writes: the `## Decisions stood` ledger in
-   `decisions.md` (each entry ends `— doubt: <accept | reject-resolved | MISSING>`) and the `doubt`
-   footprint. Read the exit code:
-   - **rc=3:** the ledger records a stood decision with `doubt: MISSING`: doubt was definitively
-     skipped for a decision on record. **Important**; **NO-GO** when that decision is irreversible-risk
-     (auth / public-API / migration). This is the per-slice skip the footprint count alone can't catch.
-   - **rc=1:** zero doubt dispatched across the build. A **prompt to verify, not a finding**: confirm
-     against the ledger: an every-slice-trivial feature (`- none`) is a valid pass; a stood triggering
-     decision (boundary / data-model / auth / public-API / migration / branching) with no verdict is
-     the finding, same severity as rc=3.
-   - **rc=0:** covered, or not assessable because no wright was logged.
-   Either way, walk the `## Decisions stood` ledger yourself: severity rides the unverified
-   **decision**, never the exit code alone.
-5. Check **security, data, migration, rollback**, strategy scope, principles,
-   observability, developer experience, and removal using
-   [risk-and-rollback](risk-and-rollback.md) and the named standards. Unmitigated top risks,
-   scope creep, missing runtime diagnostics, broken developer contracts, or unsafe removals
-   are findings. An unexcepted declared-principle violation is Critical and NO-GO.
-6. Check **frontend polish** if UI is involved (states, a11y, responsive, design-system,
-   browser evidence).
-7. **Independent review:** apply the complete roster, triggers, dispatch shape, and
-   reconciliation from
-   [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md). Await
-   fresh-context batches of at most three and give reviewers only the workspace path plus
-   immutable diff, without author reasoning. Use named role → safely enforced generic fresh
-   agent; if neither is available, seal remains NO-GO. Carry Spec/Code verdicts only
-   for an unchanged post-review diff; rerun the other applicable axes.
-   **Footprint: account for the whole roster.** For each reviewer you dispatch, append
-   `devrites-engine footprint log <slug> reviewer devrites-<x>-reviewer` (the reviewer's **exact agent name**:
-   the roster gate matches on it, so a freehand label like `spec` will read as unaccounted); for
-   each roster reviewer you consciously do **not** dispatch, append
-   `devrites-engine footprint log <slug> skip devrites-<x>-reviewer` and note the one-line reason in `seal.md`.
-   A conditional reviewer that does not apply is a *recorded skip*, never a silent omission: step 7b
-   proves the roster complete before the verdict.
-7a. **Reconcile findings by confidence.** Band each reviewer finding by confidence
-   (1-10); a low-confidence (≤4) finding that can't be verified against the diff is **suppressed**
-   to a `Suppressed (low-confidence): n` line, not a blocker. Every Critical/Important must cite
-   the `file:line` (or spec line) that proves it. Surface genuine cross-reviewer disagreement
-   **explicitly** rather than averaging it away, and don't let a pile of low-confidence nits
-   inflate the verdict. The gate is `Critical == 0` + acceptance + drift, not "few findings".
-7b. **Account for the roster: no reviewer silently skipped.** Before the verdict, prove every
-   roster reviewer carries a decision (dispatched or skip-recorded in step 7's footprint):
-   ```bash
-   devrites-engine footprint roster <slug>; echo "roster rc=$?"
-   ```
-   - **rc=3:** a roster reviewer was neither dispatched nor skip-recorded: the silent omission
-     this gate exists to catch. **NO-GO** on the review's *completeness* (not the diff): dispatch
-     the missing reviewer or record a justified skip, then re-run. Same standing as an unproven
-     criterion (severity gate).
-   - **rc=1:** an always-on axis (Spec / Code-review) was skip-recorded: legitimate **only** as a
-     carry-forward of `/rite-review`'s verdict on an **unchanged** diff (step 7). Confirm that;
-     otherwise dispatch it.
-   - **rc=0:** every reviewer accounted for; proceed.
-7c. **No silent reviewer: a zero-findings axis is justified, not assumed.** Confirm no adversarial
-   axis rubber-stamped: an axis that reported nothing must carry a `No-findings:` justification.
-   ```bash
-   devrites-engine review-integrity <slug>; echo "review-integrity rc=$?"
-   ```
-   - **rc=1:** an axis in `review.md` is silent (no finding, no justification): **Important** on the
-     review's completeness. Re-run that axis or record its `No-findings:` account, then re-seal.
-   - **rc=0:** every axis has findings or a justified no-findings result; proceed. (No `review.md`, or a
-     freeform one, is a clean pass: the gate keys on per-axis sections.)
-   Then write stable finding IDs for learning and recurring-dismissal correlation:
-   ```bash
-   devrites-engine review-fingerprints --write <slug>
-   ```
-8. Decide GO / NO-GO: [go-no-go](go-no-go.md), and write `seal.md`. Then render the
-   **fan-out footprint** into `seal.md` and the output: deterministic run-weight (subagents
-   dispatched · slices · wall-clock), **never a token or dollar figure** (DevRites can't
-   truthfully source one):
-   ```bash
-   devrites-engine footprint render <slug>
-   ```
-   Also emit a machine-readable verdict block into `seal.md` (so `/rite-autocomplete` can gate
-   without parsing prose):
-   ```json
-   { "feature": "<slug>", "verdict": "GO | NO-GO | CONDITIONAL-GO", "criticals": 0, "important": 0,
-     "acceptance": "<proven>/<total>", "test_integrity": "ok | weakened", "mutation": "<score | n/a>",
-     "blockers": ["<one line each, empty on GO>"] }
-   ```
-9. **On GO only:** record evidence-proven conventions through
-   [conventions-ledger](conventions-ledger.md).
-9a. **On GO only:** append durable dismissed-finding or dead-end learnings as untrusted
-   priors. Promotion to a project rule remains human-owned.
+Seal's candidate action follows
+[`candidate-integrity.md`](../../devrites-lib/reference/candidate-integrity.md).
+
+1. **Read.** Resolve the explicit slug or `.devrites/ACTIVE`, require its
+   `state.md`, then read required workspace artifacts, conditional
+   browser/design/devex evidence, and final diff.
+2. **Recheck identity and real proof.** Run
+   `devrites-engine check candidate <slug>` and require its exact digest to match
+   the single evidence/review bindings and the browser binding when present.
+   Apply `spec-grammar.md`'s Native grammar re-read checklist, then run only
+   `test-plan.md`'s repository/CI commands against that frozen digest. Rerun the
+   candidate check afterward and require the identical digest and no source
+   mutation. Capture command, cwd, exit, decisive output, and identity.
+   Missing/red/mismatched blocks; unavailable is `cannot_verify`, never pass.
+3. **Judge acceptance.** Dispatch exact `devrites-proof-runner` on immutable
+   proof and exact `devrites-spec-reviewer` on the same candidate. Reconcile every
+   AC/REQ/scenario/key link by ID and meaning; missing/stale/self-attested/mismatched is NO-GO.
+4. **Judge tests.** Diff baseline/candidate tests for deletion, skip/focus,
+   tautology, or weakening; dispatch exact `devrites-test-analyst`. Missing or
+   adverse account, or green tests not asserting mapped behavior, is Critical.
+5. **Resolve gates.** Open blocking/escalating/validating questions and drift
+   block. Each stood decision needs a reconciled exact `devrites-doubt-reviewer` verdict.
+6. **Risk and native review.** Apply [`risk-and-rollback.md`](risk-and-rollback.md)
+   and the [`review roster`](../../devrites-lib/reference/parallel-dispatch.md) on
+   the candidate. Admit each result through
+   [`result admission`](../../devrites-lib/reference/standards/agents.md#result-admission).
+   `## Reviewer Accounts` preserves all seven; gap/missing/malformed blocks;
+   conditional `Not-applicable` names why.
+7. **Route corrections.** Reconcile cited findings/disagreements, but do not
+   edit the candidate or manifest in Seal. Route an accepted correction through
+   one bounded wright, update the manifest, run affected Prove, complete a fresh
+   Review, then restart Seal on the new digest.
+8. **Draft, then check deterministic invariants.** Write `seal.md` from
+   [`seal-template.md`](seal-template.md) with the GO/NO-GO rationale, acceptance map,
+   test-analysis account, stood-decision verdicts, all seven reviewer accounts,
+   and exactly one `Candidate SHA-256: <64 lowercase hex>` line. Then run:
    ```bash
-   devrites-engine learnings add "<slug>" "<dismissed-as-intentional class or dead-end>" dismiss
+   devrites-engine check seal "<slug>"
    ```
-10. **Record the durable phase traces.** Before the final output, record the health signal and
-    verdict event. The score is evidence-backed, not decorative: high for GO with green proof,
-    lower for NO-GO or unresolved blockers.
-    ```bash
-    devrites-engine health record <0..10> "<GO|NO-GO evidence summary>" --note "<top blocker or green proof>"
-    devrites-engine timeline log run-finished \
-      --slug <slug> \
-      --outcome "<passed|blocked>" \
-      --execution-mode named \
-      --guard-strength n/a \
-      --reason-id "<DRV-GATE-SEAL-PASSED on GO; otherwise the blocking DRV-* reason>" \
-      --host "<claude|codex>" \
-      --evidence .devrites/work/<slug>/seal.md
-    ```
-
-## `seal.md` template
-
-Loaded on demand from [`seal-template.md`](seal-template.md). Fill in
-each section + write to `.devrites/work/<slug>/seal.md` as the durable record.
+   This checks structure and exact candidate bindings, not prose or semantics. Blocks exit `3`;
+   invalid state exits `2`. GO sets `Next step: /rite-ship`; NO-GO names the
+   smallest fix. Never commit, push, tag, publish, deploy, or close here.
 
-> **Mid-flight discipline.** When tempted to round NO-GO up to GO, bypass the y/N prompt, average reviewer disagreements, or seal with unresolved drift: see [`anti-patterns`](anti-patterns.md). Load it the moment you reach for the excuse.
+> When tempted to round NO-GO up to GO or average away reviewer disagreement,
+> load [`anti-patterns.md`](anti-patterns.md).

package/pack/.claude/skills/rite-seal/reference/risk-and-rollback.md

@@ -29,8 +29,8 @@ For each risky step, state how to back it out:
 
 A required review must run in a fresh spawned agent:
 
-- If neither a named role nor a guarded generic agent is available, record the roster
-  skip reason and keep seal **NO-GO**.
+- If the named role is unavailable, record the roster skip reason and keep seal
+  **NO-GO**.
 - Never run the reviewer in the root context or log root work as a dispatched review.
 - AFK never auto-accepts a missing reviewer.
 - Security or irreversible-risk scope remains NO-GO while independent review is

package/pack/.claude/skills/rite-seal/reference/seal-template.md

@@ -1,36 +1,25 @@
 # `seal.md` template
 
-Loaded on demand by `/rite-seal`. The seal writes this template (filled in) to `.devrites/work/<slug>/seal.md` as the durable record of the GO / NO-GO verdict.
-
-```markdown
+```md
 # Seal: <Feature>
-
 Verdict: GO / NO-GO
-
+Candidate SHA-256: <64 lowercase hex>
 ## Acceptance Criteria
-- [ ] <criterion> — evidence: <...>
-
+- <AC>: <evidence>
 ## Verification Evidence
-<tests / build / lint summary>
-
-## Browser Evidence
-<summary | n/a>
-
-## Risks
-<ranked>
-
-## Blockers
-<must-fix before ship>
-
-## Non-blocking Follow-ups
-<deferred items>
-
-## Rollback / Recovery
-<how to back this out>
-
+<proof>
+## Reviewer Accounts
+- devrites-spec-reviewer: <outcome>
+- devrites-code-reviewer: <outcome>
+- devrites-test-analyst: <outcome>
+- devrites-frontend-reviewer: <outcome>
+- devrites-security-auditor: <outcome>
+- devrites-performance-reviewer: <outcome>
+- devrites-devex-reviewer: <outcome>
+## Risks / Rollback
+<risks/recovery>
+## Blockers / Follow-ups
+<blockers/follow-ups>
 ## Final Decision
-<one paragraph: verdict + why>
-
-## Footprint
-<deterministic fan-out from devrites-engine footprint — subagents · slices · wall-clock; never tokens/cost>
+<verdict/reason>
 ```

package/pack/.claude/skills/rite-ship/SKILL.md

@@ -1,112 +1,84 @@
 ---
 name: rite-ship
-description: Ship the sealed feature: commit, push, tag, archive, close. Use when the user says "ship it", "push the branch", "tag the release", or "close the task" after /rite-seal GO. Not for GO/NO-GO readiness.
+description: Commit, push, tag, archive, or close a sealed feature after /rite-seal GO. Use for repository mutation; not for GO/NO-GO readiness.
 argument-hint: "[feature-slug]"
 user-invocable: true
-required-agent-roles: none
 ---
 
 # /rite-ship: ship + close the task
 
-The final phase. `/rite-seal` **decides** GO/NO-GO; `/rite-ship` **executes** the
-irreversible git actions and **closes** the feature. **Read the active workspace
-first**; if none, tell the user to run `/rite-spec <feature>`.
-
-Refuses to ship unless `seal.md` records a **GO** verdict.
+`/rite-seal` decides; `/rite-ship` mutates Git and closes. Read the active workspace;
+if absent, route to `/rite-spec <feature>`. Ship only with current **GO** in `seal.md`.
 
 ## Rules consulted (read on demand from `.claude/skills/devrites-lib/reference/standards/`)
-**Step 0:** Read `.claude/skills/devrites-lib/reference/standards/core.md` first. Then pull on demand:
-- `git-workflow.md`: Conventional Commits, atomic commits, the never-commit list.
-- `afk-hitl.md`: type-GO is the irreversible-action gate.
-- `definition-of-done.md`: final acceptance, evidence, drift, rollback, and documentation bar.
-- [`release/ship-checklist.md`](../devrites-lib/reference/standards/release/ship-checklist.md): compact final ship and archive pass/fail sweep.
+**Step 0:** Read `core.md`, then pull as needed:
+- `git-workflow.md`: Conventional Commits, atomicity, never-commit list.
+- `afk-hitl.md`: type-GO irreversible-action gate.
+- `definition-of-done.md`: acceptance, evidence, drift, rollback, docs.
+- [`release/ship-checklist.md`](../devrites-lib/reference/standards/release/ship-checklist.md): final pass/fail sweep.
 
 ## Operating rules
-- **Seal GO is a precondition.** No GO in `seal.md` → stop, point at `/rite-seal`.
-- **Evidence must be fresh.** If any file in `touched-files.md` changed after
-  `evidence.md` was written, the proof is stale → stop, point at `/rite-prove`. Enforced
-  deterministically by `devrites-engine evidence-fresh` in step 1 (exit 3 = STALE), not by eyeballing
-  mtimes (see `.claude/skills/devrites-lib/reference/standards/development-workflow.md`).
-- **type-GO before anything irreversible.** Render the prompt verbatim and wait for
-  the literal `GO`. Last safety net: render it every time, even under auto-trigger.
-- **Never delete the audit trail.** Closing *archives* the workspace; it never erases
-  the `.md` files.
+- **GO is prerequisite.** No current `seal.md` GO → stop at `/rite-seal`.
+- **Ship is candidate-read-only.** Follow
+  [`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md).
+  Ship must not change any candidate path or `touched-files.md`; it may write only
+  workspace `ship.md`, `state.md`, and archive bookkeeping. Project/manifest mutation
+  returns through Prove → Review → Seal.
+- **Bindings stay exact.** Rerun candidate/Seal checks; require the digest bound in
+  evidence, optional browser evidence, review, and seal. Any mismatch stops.
+- **Fresh approval.** Disclose the exact Git attempt; literal `GO` authorizes it once.
+  Change/retry means re-prompt. Native approval remains separate/authoritative.
+- **Archive, never delete,** every audit `.md`.
 
 ## Workflow
-1. **Orient.** Run `devrites-engine preamble` for deterministic workspace orientation.
-   Then read `seal.md`, `state.md`, `spec.md`, `touched-files.md`, `evidence.md`, and
-   `design-brief.md` (if the feature is UI: the design-memory rollup in step 2a reads it).
-   Confirm the verdict is **GO**, then run the deterministic evidence-freshness gate rather than
-   eyeballing mtimes (mirrors `/rite-seal`):
-   ```bash
-   devrites-engine evidence-fresh; echo "evidence-fresh rc=$?"
-   ```
-   **Exit 3 → STALE proof: STOP**, point at `/rite-prove` (a polish/review edit made after
-   `/rite-prove` invalidates the proof). Not GO → stop with the single resume command.
-1a. **Health re-check (advisory).** Run the DevRites doctor before the irreversible ladder:
-   a stale `ACTIVE` or corrupt workspace here risks shipping or closing the wrong feature.
-   Advisory: surface issues, don't block.
+1. **Orient.** Snapshot; read seal, state, spec, touched files, evidence, and any UI
+   brief. Confirm GO/closed digest, then run:
    ```bash
-   devrites-engine doctor; echo "doctor rc=$?"
+   devrites-engine check candidate <slug>
+   devrites-engine check seal <slug>
    ```
-   If it flags the active feature, confirm you're shipping the intended slug before proceeding.
-2. Build the git plan from `git-workflow.md` + the project's own convention: the
-   Conventional-Commit message(s), commit trailers for non-trivial work, the target branch, and
-   whether a tag / PR applies. Derive trailers from `decisions.md`, `assumptions.md`, `seal.md`,
-   and `evidence.md`: `Constraint`, `Rejected`, `Confidence`, `Scope-risk`, `Not-tested` when
-   present; skip trailers for trivial typo/formatting commits. Scope the commit to
-   `touched-files.md`; never stage secrets or out-of-scope files.
-   **Completion:** message, trailers, target branch, tag/PR choice, and exact staged scope are explicit.
-2a. **Design memory (UI only).** Follow
-   [`reference/design-memory.md`](reference/design-memory.md). Completion: the confirmed
-   outcome is recorded, and any `DESIGN.md` edit is in `touched-files.md`; non-UI skips.
-2b. **Capability ledger sync.** Follow [`reference/ledger.md`](reference/ledger.md).
-   Completion: proven capability deltas are previewed, the confirmed outcome is recorded,
-   and every synced ledger file is in `touched-files.md`.
-2c. **Credential guard (blocking for HIGH).** Before the irreversible type-GO prompt, scan staged
-   and touched files plus any PR body draft. HIGH blocks ship and tells the user to rotate/redact;
-   MEDIUM asks for confirmation and records the exception in `ship.md`; LOW is FYI.
+   Nonzero/mismatch stops; never reinterpret it.
+1a. **Health (advisory).** Apply `/rite-doctor` read-only; surface WARN/FAIL without
+   repair. If ACTIVE is flagged, confirm the slug.
+2. **Prepare the exact Git candidate.** Follow
+   [`git-ship.md`](reference/git-ship.md): refuse out-of-manifest staged work; stage
+   exact manifest paths only after Seal GO; compare NUL-delimited staged state/path
+   sets, require identical index/worktree bytes, and rerun candidate/Seal checks.
+   From the verified index, build the exact project-conformant message/trailers,
+   branch, tag/PR, commands, and skips.
+2a. **Credential guard (HIGH blocks).** Scan staged blobs and any PR body. HIGH stops
+   and requires rotation/redaction; MEDIUM needs confirmation recorded in `ship.md`;
+   LOW is FYI.
    ```bash
-   devrites-engine secret-scan --staged; echo "secret-scan rc=$?"
+   devrites-engine secret-scan --staged
    ```
-   **rc=3 → STOP**: do not type-GO, commit, push, or archive.
-3. **Render the type-GO prompt** ([reference/git-ship.md](reference/git-ship.md)) and
-   wait. Only the literal `GO` proceeds; anything else cancels: record the cancel in
-   `ship.md` and stop (do not retry without the user asking).
-4. On `GO`: run the git ladder: commit → push → tag / PR as applicable
-   ([reference/git-ship.md](reference/git-ship.md)). Capture the commit SHA(s),
-   branch, and tag/PR URL.
-4a. **PR branch only.** Render the structured body from
-   [`reference/git-ship.md`](reference/git-ship.md#pull-request-body); omit empty sections.
-4b. **Durable architecture decisions only.** Apply
-   [`reference/adr-promotion.md`](reference/adr-promotion.md); slice-local decisions stay in
-   the archived workspace.
-5. Write `ship.md` ([reference/ship-template.md](reference/ship-template.md)): what
-   shipped, SHA(s), branch, tag/PR, acceptance summary (n/total), link to `seal.md`,
-   follow-ups.
-6. **Close the task** ([reference/close-out.md](reference/close-out.md)): set
-   `state.md` phase `done`, then run
-   `devrites-engine close-out <slug>` to archive
-   `.devrites/work/<slug>/` → `.devrites/archive/<slug>/` and clear `.devrites/ACTIVE`.
-   Every `.md` is preserved in the archive. Then refresh any managed project context block so
-   `AGENTS.md` / `CLAUDE.md` no longer advertise a closed active workspace:
-   ```bash
-   devrites-engine context sync || true
-   ```
-6a. **Cross-feature retro.** Run the cadence-gated advisory branch in
-   [`reference/close-out.md`](reference/close-out.md#cross-feature-retro). Completion: a
-   silent nudge does nothing; a real recurrence is appended to `.devrites/retro.md` and
-   surfaced to `/rite-learn`, never auto-promoted.
-
-> **Mid-flight discipline.** When tempted to ship without a GO seal, skip the type-GO,
-> stage files outside `touched-files.md`, or delete the workspace instead of archiving
-> it: stop. See [`anti-patterns`](reference/anti-patterns.md); the gate exists for the
-> failure mode the ask misses.
-
-## Output
+   Scan a PR body with `devrites-engine secret-scan --stdin` only through non-logging
+   process stdin, then close it—never command/argv/env/heredoc/log/temp file. If that
+   channel is unavailable, stop. **rc=3 → STOP:** no type-GO/commit/push/archive.
+2b. **Reconcile residuals before type-GO.** Scan `strategy.md` deferrals,
+   `decisions.md` FYIs/revisit triggers, unresolved `review.md` non-blocking/if-minor/
+   FYI findings, and `seal.md` follow-ups. Deduplicate only rows with identical
+   obligation + disposition, preserving every source pointer. Each residual appears
+   once in the pending `ship.md` table as `tracked` (durable path/ID) or `no-action`
+   (prior decision or explicit human acceptance + reason/revisit). Type-GO never
+   implies `no-action`. Missing/vague/conflicting disposition blocks; `none` requires
+   empty sources.
+3. **Type-GO.** Render [`git-ship.md`](reference/git-ship.md)'s prompt and wait.
+   Literal `GO` proceeds once; anything else records cancellation in `ship.md` and
+   stops. Any command/scope/branch/message/tag/PR change or retry needs a fresh prompt;
+   native approval is still required.
+4. On GO, commit; verify committed state/path set and exact candidate digest; then push →
+   tag/PR as applicable via `git-ship.md`. Capture SHA(s), branch, tag/PR URL. Mismatch
+   stops before push/tag; retry needs fresh approval.
+4a. **PR only:** render [`git-ship.md`](reference/git-ship.md#pull-request-body)'s
+   structured body; omit empty sections.
+5. Re-scan the four residual sources; any new/missing/changed item blocks archive.
+   Write [the template](reference/ship-template.md) with shipment metadata and the
+   unchanged pre-GO reconciliation.
+6. **Close.** Set `state.md` phase `done`; follow
+   [`close-out.md`](reference/close-out.md) and run `devrites-engine state close <slug>`
+   to move `.devrites/work/<slug>` → `.devrites/archive/<slug>` and clear `ACTIVE`.
+   Preserve every `.md`; stable hierarchical instructions need no active-workspace sync.
 
-**Progress first**: run `devrites-engine progress`, then use the Shipped typed template from
-the shared completion reply contract
-([`reply-contract.md` § Shipped](../devrites-lib/reference/reply-contract.md#shipped)).
-If the user declined type-GO: state that nothing shipped, the seal still reads GO, and
-the resume command (`/rite-ship`).
+> **Mid-flight discipline.** No seal GO, skipped type-GO, out-of-manifest stage, or
+> deleted workspace. Stop and use [`anti-patterns`](reference/anti-patterns.md).

package/pack/.claude/skills/rite-ship/reference/anti-patterns.md

@@ -13,7 +13,8 @@ Pack-wide rationalizations + red flags: see
 | "Seal said GO, so I can just push." | A GO verdict is a decision, not authorization. **Render the type-GO prompt every time** and wait for the literal `GO`. |
 | "I'll push the tag now; type-GO is a formality." | Type-GO is the last safety net before an irreversible action. Always render it: even under auto-trigger. |
 | "`git add -A` is faster than listing touched files." | Stage only what's in `touched-files.md`. `-A` sweeps secrets, scratch files, and out-of-scope edits into the ship. |
-| "The evidence is probably still good." | If any touched file changed after `evidence.md`, the proof is stale: stop and re-prove. Ship on fresh evidence only. |
+| "The evidence is probably still good." | Recheck the canonical candidate digest and every artifact binding. Any mismatch stops. |
+| "The ledger/DESIGN/ADR update is just ship bookkeeping." | Those are candidate paths. Route the change through Polish, affected Prove, Review, and Seal; Ship is read-only. |
 | "Delete the workspace, the feature's done." | Closing **archives** the workspace (`.devrites/archive/<slug>/`); it never deletes the audit trail. |
 
 ## Red Flags
@@ -21,5 +22,7 @@ Pack-wide rationalizations + red flags: see
 - About to run `git push` / `git tag` without rendering the type-GO prompt.
 - Shipping without a `GO` verdict recorded in `seal.md`.
 - Staging files not listed in `touched-files.md`, or any secret / `.env`.
+- Changing a candidate path or the manifest after Seal.
+- Pushing or tagging before the committed NUL-delimited state/path and digest checks pass.
 - `rm`-ing `.devrites/work/<slug>/` instead of archiving it.
 - Marking the feature `done` but leaving `.devrites/ACTIVE` pointing at it.

package/pack/.claude/skills/rite-ship/reference/close-out.md

@@ -1,7 +1,7 @@
 # Close-out: archive the workspace, free the active slot
 
 Closing a feature means it stops being the *active* work, not that its record is
-deleted. DevRites keeps the full audit trail; it just moves out of the live path.
+deleted. DevRites keeps the audit trail; it just moves out of the live path.
 
 ## What close-out does
 
@@ -9,7 +9,7 @@ deleted. DevRites keeps the full audit trail; it just moves out of the live path
    of `/rite-spec <next feature>`.
 2. **Archive.** Run the deterministic script:
    ```bash
-   devrites-engine close-out <slug>
+   devrites-engine state close <slug>
    ```
    It moves `.devrites/work/<slug>/` → `.devrites/archive/<slug>/` (every `.md`
    intact) and clears `.devrites/ACTIVE` **only if** ACTIVE still points at `<slug>`.
@@ -30,13 +30,5 @@ To resume archived work, move it back:
 `mv .devrites/archive/<slug> .devrites/work/<slug>` and write `<slug>` into
 `.devrites/ACTIVE`. Nothing is lost: close-out is reversible by design.
 
-## Cross-feature retro
-
-After archive, run `devrites-engine learnings nudge`. It stays silent until a
-finding/drift class recurs across at least two shipped features with new signal.
-
-When it emits, dispatch the read-only `devrites-retrospector` over
-`.devrites/archive/`, append its dated digest to `.devrites/retro.md`, and surface
-graduation candidates to `/rite-learn`. The retro proposes; only `/rite-learn` may
-promote a rule, principle, or convention. Mark `.devrites/.learnings-reviewed` only
-after the human acts there.
+Cross-feature review is user-invoked through `/rite-learn`; close-out does not
+mine, score, nudge, or write a retrospective ledger.