devrites 3.2.27 → 4.0.0

package/docs/cli.md

@@ -1,94 +1,141 @@
-# Tool-agnostic state core: the `devrites-engine` CLI
-
-DevRites stores its workflow in `.devrites/` Markdown files and the
-`devrites-engine` binary rather than tying it to one chat harness. Claude Code,
-Codex, Cursor, Gemini CLI, CI, and human operators can all run the same
-deterministic gates from the project root.
-
-## The `devrites-engine` CLI
-
-Install DevRites normally, then run the engine from the project root. These
-examples cover the common commands; `devrites-engine help` lists every current
-command and hook.
-
-```bash
-devrites-engine preamble                 # workspace digest for the active feature
-devrites-engine snapshot [slug]          # machine-readable workspace/status snapshot
-devrites-engine build-readiness [slug]   # semantic clarify + vet gate (exit 0 ready)
-devrites-engine readiness-digest coverage|engineering [slug] # canonical input digest
-devrites-engine clarify-return enter|restore [slug] # durable later-phase clarify cursor
-devrites-engine recovery route <class>             # typed owner/action; JSON recovery-route/v1
-devrites-engine recovery check|record|clear ...    # durable three-failure budget; record/clear accept --class
-devrites-engine reconcile snapshot|check|restore-check|abort|close [slug] # retained writer baseline and rejected-window recovery
-devrites-engine test-integrity [slug]    # reject weakened tests against that baseline
-devrites-engine evidence-fresh [slug]    # proof freshness gate      (exit 0 fresh · 3 stale)
-devrites-engine check-acceptance <dir>   # acceptance gate           (exit 0 proven · 1 gap)
-devrites-engine ledger sync <dir>        # fold a feature's spec deltas into the living capability ledger
-devrites-engine ledger list|show <cap>   # read the ledger: what the system already does
-devrites-engine context show --json      # report root, active workspace, and host command forms
-devrites-engine timeline log|list|report|purge # local typed trace, bounded report, exact retention
-devrites-engine health run               # run known project checks + record a code-health dashboard
-devrites-engine health record|list       # append/list manual or dashboard health history
-devrites-engine review-fingerprints [slug] # stable IDs for review findings; --write saves JSONL
-devrites-engine reviewer-stats report --json # direct structured reviewer-dispatch verdicts
-devrites-engine progress [slug]          # compact phase/slice footer
-devrites-engine resolve <qid> "<answer>" # answer a HITL gate
-devrites-engine close-out <slug>         # archive a shipped feature and clear ACTIVE
-devrites-engine help
+# `devrites-engine`: deterministic workspace core
+
+DevRites keeps durable workflow truth in `.devrites/` Markdown. Claude Code and
+Codex interpret the workflow, run exact custom agents, reconcile their results,
+and make semantic judgments. The Go engine exposes only deterministic,
+cross-host primitives; it never dispatches an agent or grades reviewer prose.
+
+## Command surface
+
+`devrites-engine help` lists the exhaustive operational surface. Standard
+`help`, `-h`, `--help`, `version`, and `--version` forms also remain supported:
+
+```text
+devrites-engine install [flags]
+devrites-engine update [flags]
+devrites-engine uninstall [flags]
+
+devrites-engine check candidate <slug>
+devrites-engine check readiness <slug>
+devrites-engine check readiness --emit-binding <slug>
+devrites-engine check seal <slug>
+
+devrites-engine state resolve <qid> "<answer>"
+devrites-engine state close <slug>
+
+devrites-engine secret-scan [--staged] [--stdin] [slug]
+devrites-engine version
 ```
 
-The AFK-parsed read commands (`status`, `readiness`, `seal`, `spec-validate`,
-`evidence-fresh`, `preamble`, `coverage`, `analyze`, `doctor`, `ledger`) accept
-`--json`, which wraps the result in a stable envelope: see
-[`engine/agent-contract.md`](engine/agent-contract.md). `snapshot` is already a
-structured JSON contract and emits `schemaVersion: devrites.workspace.v1`
-directly rather than wrapping human text. Snapshot consumers should read
-`nextCommands.claude` or `nextCommands.codex` for the current host instead of
-hardcoding a `/rite-*` or `$rite-*` command form. `context show --json` and
-`reviewer-stats report --json` are also direct structured reports rather than
-envelopes. The snapshot wire identifier is separate from the workspace-map
-frontmatter `schemaVersion: 2`: schema v2 is additive, reads legacy layouts and
-aliases, and rejects only declarations newer than the engine supports.
-
-The npm `devrites` shim remains the installer/updater/uninstaller entry point and
-proxies these engine subcommands when `devrites-engine` is installed. Install and
-update DevRites through `npx devrites ...`; DevRites is not distributed through
-Claude or Codex plugin stores.
-
-Callers use the exit code as the gate result. `build-readiness` routes
-objective gaps to their owner:
-
-<!-- authority:readiness-reasons:start -->
-| exit | reason | condition | remediation |
-| --- | --- | --- | --- |
-| `0` | `ready` | Ready to build | *(none)* |
-| `2` | `plan-unapproved` | Plan is not approved | `/rite-define` |
-| `3` | `awaiting-human` | A human-owned question is open | `/rite-resolve` |
-| `4` | `plan-blocked` | Plan is blocked and needs repair | `/rite-plan` |
-| `5` | `workspace-missing` | Workspace or state.md is missing | `/rite-spec` |
-| `6` | `coverage-not-clear` | Decision coverage is not CLEAR and fresh | `/rite-clarify` |
-| `7` | `engineering-not-ready` | Plan is not vetted or implementation readiness is not READY | `/rite-vet` |
-| `8` | `upgrade-required` | Planning artifacts use an older or unknown DevRites contract | `/rite-upgrade` |
-<!-- authority:readiness-reasons:end -->
-
-A non-zero `build-readiness`,
-`evidence-fresh`, or `check-acceptance` result is a hard stop that can be used
-in an agent loop, a local script, or pre-merge CI.
-
-`build-readiness` does not trust `CLEAR` or `READY` text alone. It validates the
-required sections, tables, ownership and test mappings, requires the current
-`devrites.readiness-artifacts.v2` declaration, and compares each artifact's
-SHA-256 field with the digest of its canonical inputs.
-
-`devrites-engine update` refreshes the installed binary and pack.
-`devrites-engine migrate` may upgrade a workspace declaration to structural
-schema v2, but it never creates or blesses clarification, vet, or proof
-evidence. `/rite-upgrade [slug]` is the separate semantic reconciliation route
-for an active unfinished workspace.
-
-## Why this exists
-
-The CLI exposes DevRites workspace data and standards to agent loops, local
-scripts, CI, and human operators without requiring each caller to reimplement
-the workflow. CLI and `rite-*` verdicts match because both use the same engine
-gates.
+Commands outside this operational list and the standard help/version forms are
+unsupported. There are no legacy engine aliases, tombstones, agent-protocol
+versions, semantic-readiness digests, compatibility telemetry, or workspace
+migration command.
+`check candidate` is additive; no existing engine command or public `/rite-*`
+workflow was removed or renamed.
+
+## npm adapter
+
+The `npx devrites` adapter accepts `add` as an alias for `install`, `upgrade` for
+`update`, and `remove` for `uninstall`. These are adapter-only conveniences, not
+`devrites-engine` aliases; documentation and automation should prefer the
+canonical command names.
+
+Use `npx devrites update --check` to compare the installed manifest version with
+the exact release candidate selected by the adapter without changing the
+installation. Use `npx devrites uninstall --keep-binary` to remove managed host
+artifacts while retaining the shared `devrites-engine` binary.
+
+## Checks
+
+- `check candidate <slug>` validates the strict `touched-files.md` manifest and
+  hashes its exact path/state/type/mode/content identity. A pass prints:
+  ```text
+  candidate-sha256: <64 lowercase hex>
+  candidate-files: <manifest row count>
+  ```
+- `check readiness <slug>` verifies the files required to leave the workspace's
+  current phase and, once `eng-review.md` is required, its exact stable
+  Build-input binding.
+- `check readiness --emit-binding <slug>` renders the exact stable Build-input
+  binding for Vet to record after semantic review.
+- `check seal <slug>` checks final required files and open human gates. Once
+  those files are complete, it verifies the stable readiness binding; only
+  after that aggregate check passes does it verify that `evidence.md`,
+  `review.md`, `seal.md`, and optional `browser-evidence.md` contain exactly one
+  binding to the current candidate digest.
+
+Semantic readiness, traceability, acceptance interpretation, evidence quality,
+doubt, test quality, reviewer reconciliation, and capability interpretation
+belong to the active skill and exact native agents. Normative spec grammar is
+checked by the root's explicit native re-read checklist. Repository build,
+test, lint, typecheck, schema, and release commands belong to that repository
+or CI.
+
+## Atomic state operations
+
+`state resolve` also supports `--drop <qid> ["<reason>"]` and `--batch <file>`.
+`state close` transactionally archives a shipped workspace and clears matching
+`ACTIVE`.
+
+The mutating forms share the engine's root-safety, locking, and atomic-write
+boundary.
+
+The root scans and rechecks `questions.md` to allocate the next unused qid,
+manages Clarify return fields without rewriting unrelated Markdown, charges an
+AFK budget once per green built slice, and counts no more than three recovery
+failures per causal fingerprint from context plus Dead ends/evidence. `/rite-doctor`
+is a read-only native inspection. None has an engine command or replacement
+script.
+
+## Secret scanning
+
+Use `secret-scan --staged` for exact Git index blobs and `secret-scan --stdin`
+for review text supplied through a non-logging process-stdin channel. The flags
+may be combined. The scanner does not follow worktree symlinks or print matched
+secret bytes. It accepts at most 4,096 entries, 64 MiB total captured input, and
+4,096 findings; input, limit, and output failures close the scan.
+
+Findings include only severity, a redacted or escaped source label, category,
+and zero-based byte offset. HIGH findings exit `3`.
+
+## Output and exits
+
+Lifecycle checks print stable line-oriented fields. `reason: DRV-...` identifies
+the deterministic gate outcome without an agent protocol or versioned wrapper.
+Skills read workspace Markdown directly.
+
+`check candidate` uses the two exact fields shown above. Invalid usage or root
+selection exits `2`; a malformed/unsafe manifest or candidate mismatch prints
+`candidate: BLOCKED: <reason>` to stderr and exits `3`.
+
+- `0`: passed or completed.
+- `2`: common invalid request or unreadable-state result.
+- `3`: common deterministic lifecycle or safety block.
+- Atomic state operations retain their documented operation-specific nonzero
+  results.
+
+## Root safety
+
+`DEVRITES_ROOT` selects a project root or `.devrites/` directory.
+`DEVRITES_WORKSPACE` may select one explicit contained workspace. Mutating
+commands refuse ambiguous, escaped, symlinked, or otherwise unsafe roots.
+
+Install, update, and uninstall remain manifest-owned operations and perform no
+network acquisition. Shell and npm entrypoints acquire the local candidate
+bundle and optional checksummed binary before invoking them. Remote acquisition
+uses exact SemVer, HTTPS-only redirect hops, mandatory exact-filename SHA-256
+sidecars, private temporary directories, and byte/archive bounds; it has no
+unchecked raw/source/default-branch fallback. Update
+accepts `--check` to compare the installed manifest version with that local
+candidate; remote-selector flags such as `--to` and `--pre` are unsupported.
+`/rite-upgrade` is a native compatibility audit, not an engine migration. Its
+read-only planner must cite a current rule and exact workspace defect; admitted
+repairs run through the current Clarify, Plan, Converge, Vet, Prove, Polish,
+Review, or Seal owner. Candidate repairs rerun current proof and never infer a
+historical pass.
+
+Production Go and shell Git sites remove repository/config/object/ref/pathspec
+retargeting `GIT_*` variables before execution while preserving unrelated Git
+environment. This targeting isolation is a caller boundary, not another engine
+command.

package/docs/command-map.md

@@ -20,7 +20,7 @@ visibility. Public utilities use the `rite-*` prefix: `rite-quick`,
 `rite-frame`, `rite-adopt`, `rite-learn`, `rite-doctor`, `rite-customize`,
 `rite-zoom-out`, `rite-prototype`, `rite-handoff`, `rite-pressure-test`,
 `rite-autocomplete`, `rite-explain`, `rite-pov`, `rite-dogfood`, and
-`rite-pr-feedback`, plus the semantic workspace maintenance command
+`rite-pr-feedback`, plus the evidence-gated workspace compatibility command
 `rite-upgrade`. The host may invoke `devrites-*` specialists through the model.
 `devrites-lib` is the non-workflow library exception.
 
@@ -36,65 +36,90 @@ Only promoted surfaces are shipped by the npm package.
 
 ## Engine command ownership
 
-Not every engine command is a phase step. Assign each new command to one of
-these lanes so its owner is clear:
+The Go surface is intentionally closed and deterministic:
 
 | Lane | Commands | Owner |
 |---|---|---|
-| Workflow gates | `preamble`, `build-readiness`, `readiness-digest`, `spec-skeleton`, `spec-validate`, `check-acceptance`, `evidence-fresh`, `coverage`, `doubt-coverage`, `budget`, `test-integrity`, `mutation-gate`, `review-integrity`, `footprint`, `reconcile`, `conventions`, `learnings`, `review-fingerprints`, `timeline`, `health`, `progress` | Called by the relevant `rite-*` workflow or shared reply contract. |
-| Workspace utilities | `status`, `snapshot`, `analyze`, `archive-search`, `clarify-return`, `recovery`, `resolve`, `close-out`, `stuck`, `tick-afk`, `ledger`, `profile` | Called by a specific utility/phase when its condition is met. |
-| Low-level completeness API | `readiness`, `seal` | Available for scripts/CI and documented engine use. Feature rites use stricter phase-specific gates (`build-readiness`, `/rite-seal` phase contract) instead of auto-running these weaker aggregate checks. |
-| Install / operator / CI | `install`, `update`, `uninstall`, `doctor`, `migrate`, `validate-pack`, `harness-matrix`, `extensions`, `overrides`, `reviewers`, `hook`, `version` | Called by `npx devrites ...`, `/rite-doctor`, hooks, CI, or a human operator; do not auto-run during feature work just because the command exists. |
-
-Workflow-owned commands should have a concrete call site in a `rite-*` skill,
-phase contract, shared reply contract, or installed hook. Operator-owned commands
-must say who runs them.
-
-These similarly named operations have separate owners: `devrites-engine update`
-replaces the installed engine and pack, `devrites-engine migrate` normalizes
-workspace layout and structural state schema, and `/rite-upgrade` reconciles an
-active workspace with the current semantic planning contract.
+| Candidate and deterministic checks | `check candidate`, `check readiness [--emit-binding]`, `check seal` | Candidate validates/hashes the strict project manifest; readiness checks phase files or emits the vetted Build-input binding; seal checks final files/open gates, that binding, then exact candidate bindings. |
+| Atomic workspace state | `state resolve`, `state close` | Go owns answer/drop/batch resolution and transactional close. |
+| Security | `secret-scan` | `/rite-ship`, safe hooks, or an operator scans staged blobs, stdin, or touched files. |
+| Install/operator | `install`, `update`, `uninstall`, `version` | npm/bootstrap or a human operator supplies local candidates; the engine performs deterministic local changes. |
+| Native policy | no engine command | Skills/root own spec grammar re-read, qid allocation, Clarify cursor edits, AFK/recovery accounting, and read-only `/rite-doctor`. |
+
+`devrites-engine help` exhaustively lists the operational engine commands.
+Standard `help`, `-h`, `--help`, `version`, and `--version` forms remain
+available; there are no legacy operational aliases. `check candidate <slug>`
+prints exactly
+`candidate-sha256: <64 lowercase hex>` and `candidate-files: <row count>` on a
+pass; usage/root errors exit `2` and candidate blocks exit `3`. There are no
+semantic readiness commands, reviewer-prose parsers, capability-ledger engine,
+compatibility telemetry, or migration command.
+
+Claude Code and Codex own native dispatch. Installed skills and exact agents
+own semantic readiness, traceability, acceptance/evidence quality, doubt,
+review reconciliation, test-quality assessment, capability interpretation,
+workspace compatibility, and
+recovery routing. Repository tools and CI own test, build, lint, typecheck,
+schema, and release execution.
+
+`secret-scan --staged` reads exact NUL-enumerated Git index blobs with
+replacement objects disabled. `--stdin` accepts text through process stdin.
+Scans cap captured input at 64 MiB and entries/findings at 4,096; findings expose
+metadata only and source or limit errors fail closed.
+
+The shell/npm updater acquires the exact-release pack/binary, then invokes
+the offline local `devrites-engine update`. Its `--check` compares installed and
+local candidate versions; engine release selectors are unsupported.
+`/rite-upgrade` separately audits an older active workspace. Only a cited
+current-contract defect may route a repair through its existing Clarify, Plan
+repair, Converge, Vet, Prove, Polish, Review, or Seal owner.
+See [`cli.md`](cli.md).
 
 ## Public commands (`user-invocable: true`)
 
 | Command | Phase | Argument | What it does | Reads | Writes |
 |---|---|---|---|---|---|
-| [`/rite`](../pack/.claude/skills/rite/SKILL.md) | menu | `[subcommand]` | Compact menu + suggested next command. Pure router; does **not** read state because `/rite-status` owns that job. | none | none |
-| [`/rite-spec`](../pack/.claude/skills/rite-spec/SKILL.md) | spec | `<feature>` | **New feature.** Deep investigation → writes a product-focused `spec.md` (WHAT/WHY, requirements, ACs, boundaries, gaps closed with options, design references). Checks the shipped archive for prior art before speccing. Creates the workspace map. | codebase + codegraph/graphify + shipped archive (`devrites-engine archive-search`) | `README.md`/`feature.md`, `brief.md`, `spec.md`, `references/`, `references.md`, `questions.md`, `decisions.md`, `assumptions.md`, `state.md` |
-| [`/rite-clarify`](../pack/.claude/skills/rite-clarify/SKILL.md) | clarify | `[slug]` | **Required, adaptive.** Topology-first coverage scan of the written spec; searches facts, closes human-owned decisions, audits assumptions, and takes a zero-question fast path when already clear. Writes a semantic `CLEAR` verdict bound to all decision inputs; later-phase retrofits persist and restore their return cursor when the contract is unchanged. | spec workspace + code/docs/decisions | `decision-coverage.md`, `spec.md`, `decisions.md`, `assumptions.md`, `questions.md`, `state.md` |
+| [`/rite`](../pack/.claude/skills/rite/SKILL.md) | menu | `[verb [args...]]` | Compact menu + router. No-argument menu mode does **not** read state because `/rite-status` owns that job. | none | none |
+| [`/rite use <slug>`](../pack/.claude/skills/rite/SKILL.md) | menu | `<slug>` | Inline context switch: confirms the workspace exists and re-points the active feature without running a phase. | `.devrites/work/<slug>/` | `.devrites/ACTIVE` |
+| [`/rite guide`](../pack/.claude/skills/rite/SKILL.md) | guided lifecycle | none | Inline walkthrough of one real, small first feature; explains and pauses at every phase boundary. | chosen change + lifecycle context | lifecycle-owned artifacts |
+| [`/rite-spec`](../pack/.claude/skills/rite-spec/SKILL.md) | spec | `<feature>` | **New feature.** Deep investigation → writes a product-focused `spec.md` (WHAT/WHY, requirements, ACs, boundaries, gaps, design references, and one capability-impact declaration). MODIFIED deltas preserve prior scenarios/claims unless an accepted decision authorizes removal. | codebase + native file/code search + shipped archive Markdown | `README.md`, `brief.md`, `spec.md`, `references/`, `references.md`, `questions.md`, `decisions.md`, `assumptions.md`, `state.md` |
+| [`/rite-clarify`](../pack/.claude/skills/rite-clarify/SKILL.md) | clarify | `[slug]` | **Required, adaptive.** Topology-first coverage scan of the written spec; searches facts, closes human-owned decisions, audits assumptions, and takes a zero-question fast path when already clear. Writes a semantic `CLEAR` verdict reconciled against the spec, decisions, assumptions, and evidence; later-phase retrofits persist and restore their return cursor when the contract is unchanged. | spec workspace + code/docs/decisions | `decision-coverage.md`, `spec.md`, `decisions.md`, `assumptions.md`, `questions.md`, `state.md` |
 | [`/rite-temper`](../pack/.claude/skills/rite-temper/SKILL.md) | temper | `[slug] [--mode]` | **Optional, before define.** Strategic review of the readied spec: scope mode (expand / selective / hold-rigor / reduce-to-MVP) + pre-mortem + 9-dimension floor-gate; folds decisions into the spec via the Spec Drift Guard. Significance-gated; **mandatory in `/rite-autocomplete`**. Reviewer: `devrites-strategy-reviewer`. | `spec.md` + decisions/assumptions + design-brief | `strategy.md`, `spec.md`, `decisions.md`, `assumptions.md` |
-| [`/rite-define`](../pack/.claude/skills/rite-define/SKILL.md) | define → plan | `[slug]` | Authors and approves architecture, plan, vertical `SLICE-###` tasks, and traceability, then leaves the workspace at the `plan` checkpoint for `/rite-vet`. | `spec.md` + `decision-coverage.md` (+ `strategy.md`) + references | `architecture.md`, `plan.md`, `tasks.md`, `traceability.md`, `state.md`, `decisions.md` |
-| [`/rite-vet`](../pack/.claude/skills/rite-vet/SKILL.md) | vet | `[slug] [--cross-model] [--full]` | **Before build: every feature.** Engineering review of the defined plan: scope challenge (reuse / minimum-diff / complexity smell) + architecture / plan code-quality / test-coverage design / performance, confidence-banded with a quote-the-source verification gate; failure-mode + parallelization map. Hardens `plan.md` / `tasks.md` in place; writes the build-readable `test-plan.md` and semantic, input-digest-bound `READY` verdict; acceptance-changing deltas route via the Spec Drift Guard. Runs on every plan: depth scales to stakes (light pass on simple plans, full on big/risky), never skipped; **always in `/rite-autocomplete`**. Reviewer: `devrites-plan-reviewer` (+ optional `--cross-model`). | `plan.md` + `tasks.md` + `spec.md` (+ `strategy.md`) | `eng-review.md`, `test-plan.md`, `plan.md`, `tasks.md`, `decisions.md`, `state.md` |
+| [`/rite-define`](../pack/.claude/skills/rite-define/SKILL.md) | define → plan | `[slug]` | Authors architecture, plan, vertical `SLICE-###` tasks, and traceability. A changed provider/consumer boundary names one canonical shared contract plus consuming provider/consumer tests; no change uses a justified no-impact statement. | `spec.md` + `decision-coverage.md` (+ `strategy.md`) + references | `architecture.md`, `plan.md`, `tasks.md`, `traceability.md`, `state.md`, `decisions.md` |
+| [`/rite-vet`](../pack/.claude/skills/rite-vet/SKILL.md) | vet | `[slug] [--cross-model] [--full]` | **Before build: every feature.** Engineering review of the defined plan: scope challenge (reuse / minimum-diff / complexity smell) + architecture / plan code-quality / test-coverage design / performance, confidence-banded with a quote-the-source verification gate; failure-mode and dependency-safety review. Hardens `plan.md` / `tasks.md` in place; writes the build-readable `test-plan.md` and a semantic `READY` verdict reconciled by the exact native reviewer; acceptance-changing deltas route via the Spec Drift Guard. Runs on every plan: depth scales to stakes (light pass on simple plans, full on big/risky), never skipped; **always in `/rite-autocomplete`**. Reviewer: `devrites-plan-reviewer` (+ optional `--cross-model`). | `plan.md` + `tasks.md` + `spec.md` (+ `strategy.md`) | `eng-review.md`, `test-plan.md`, `plan.md`, `tasks.md`, `decisions.md`, `state.md` |
 | [`/rite-plan`](../pack/.claude/skills/rite-plan/SKILL.md) | repair → plan | `[mode]` | Reslice / repair / re-order / split / unblock an active plan and return to the `plan` checkpoint; `revise` is artifact-only and `/rite-vet` is the normal resume. | spec/plan/tasks/state/drift + diff | `plan.md`, `tasks.md`, `state.md`, `decisions.md` |
-| [`/rite-build`](../pack/.claude/skills/rite-build/SKILL.md) | build | `[slice]` | Orchestrate **exactly one** vertical slice through the sole wright. The root writes an exact `.wright-allowlist`, retains the original slice baseline through snapshot → reconcile check → test/package integrity → close, and aborts rejected windows back to that baseline with a receipt. Objective failures stay agent-owned; only product/scope/policy choices, irreversible risk, or human-only access/actions become questions. | workspace + diff + `.devrites/CHECKPOINT` | code + `.wright-allowlist`, `recovery-attempts.jsonl`, `state.md`, `evidence.md`, `traceability.md`, `touched-files.md` (+ local `WIP(<slug>)` commit in checkpoint mode) |
+| [`/rite-build`](../pack/.claude/skills/rite-build/SKILL.md) | build | `[slice]` | In HITL, orchestrates one vertical slice through the sole wright; an explicit `.devrites/AFK` sentinel may chain bounded low-risk slices. Every task states exact project-relative paths; after return, the root rejects extra paths or weakened tests, runs repository proof, and maintains the strict candidate manifest. | workspace + diff + `.devrites/CHECKPOINT` | code + `state.md`, `evidence.md`, `traceability.md`, `touched-files.md` (+ local `WIP(<slug>)` commit in checkpoint mode) |
 | [`/rite-converge`](../pack/.claude/skills/rite-converge/SKILL.md) | converge | `[slug]` | **Recovery.** Compare live code with clarified intent, append each unmet piece as a traceable `SLICE-###`, and invalidate the old vet verdict so changed work returns through `/rite-vet`. `tasks.md` stays byte-identical when already converged. | clarified spec + plan/tasks + principles + live code | `tasks.md` (appended), `traceability.md`, `state.md`, `eng-review.md` (invalidated), `decisions.md` |
-| [`/rite-upgrade`](../pack/.claude/skills/rite-upgrade/SKILL.md) | maintenance | `[slug]` | **Conditional recovery.** Bring an active unfinished workspace onto `devrites.readiness-artifacts.v2`. A fresh read-only planner identifies the smallest change; the rite preserves completed source, slices, decisions, and evidence, removes stale engine-proof recipes and machine-local wrappers from active plans, then reruns current readiness gates. Already-current workspaces that pass readiness, completed workspaces, and archives are no-ops. | active workspace + current readiness contract | active unfinished planning artifacts only |
-| [`/rite-prove`](../pack/.claude/skills/rite-prove/SKILL.md) | prove | `[scope]` | Tests + build + runtime + browser proof of the completed feature. | `traceability.md` + workspace + diff | `evidence.md`, `browser-evidence.md`, `traceability.md`, `state.md` |
-| [`/rite-polish`](../pack/.claude/skills/rite-polish/SKILL.md) | polish | `[target \| mode]` | Orchestrator. Reads `reference/code.md` always (Phase 1 + 2); reads `reference/ui.md` when UI is touched (Phase 3 + 4). Mode tokens: `bolder \| quieter \| distill \| harden \| normalize-only`. | workspace + design system + diff | `polish-report.md`, `browser-evidence.md` |
-| [`/rite-review`](../pack/.claude/skills/rite-review/SKILL.md) | review | `[scope]` | Feature-scoped multi-axis review. Parallel fresh-context Spec + Standards agents (`devrites-spec-reviewer`, `devrites-code-reviewer`). | workspace + diff | `review.md`, `evidence.md`, `state.md` |
-| [`/rite-seal`](../pack/.claude/skills/rite-seal/SKILL.md) | seal | none | GO / NO-GO **decision**, hands off to `/rite-ship`. Walks acceptance vs evidence, fans out reviewers, writes the verdict. Runs no git; on GO sets `state.md` `Next step: /rite-ship`. Triggers: "GO / NO-GO", "is it safe to merge", "decide if we can ship". | all artifacts + diff | `seal.md`, `state.md` |
-| [`/rite-ship`](../pack/.claude/skills/rite-ship/SKILL.md) | ship | `[slug]` | Final phase. Requires a GO in `seal.md` → collapses any `WIP(<slug>)` checkpoints → renders type-`GO` + runs the irreversible git ladder (commit → push → tag/PR) + closes the task (archive workspace → `.devrites/archive/<slug>/`, clear `ACTIVE`, phase `done`). Triggers: "ship it", "ship this", "push it out", "close the task". | `seal.md` + all artifacts + diff | `ship.md`, `state.md`, archive |
-| [`/rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | (orchestrator) | `[idea] [--ship\|--yolo] [--max-slices N]` | Full lifecycle (spec → clarify → … → seal → ship). Spec + clarify form the one interactive window; AFK/checkpoint mode arms only after decision coverage is CLEAR. Pauses for genuine human-owned decisions/actions, NO-GO, or budget exhaustion; objective red checks use bounded technical recovery. Default stops at final type-`GO`; `--ship` (`--yolo`) auto-confirms it. | idea + workspace | whole workspace (drives every phase) |
+| [`/rite-upgrade`](../pack/.claude/skills/rite-upgrade/SKILL.md) | compatibility | `[slug]` | **Conditional recovery.** Audit an older released workspace against current contracts. Only cited defects route through Clarify, Plan repair, Converge, Vet, Prove, Polish, Review, or Seal. Ambiguous candidate scope is a gap; age/cursor form alone is never a defect, and old passes are never synthesized. | active workspace + named current contracts | admitted unfinished artifacts via their owning rite |
+| [`/rite-prove`](../pack/.claude/skills/rite-prove/SKILL.md) | prove | `[feature-slug]` | Positive, discriminating tests + build/runtime/browser proof; checks the same candidate before/after commands and binds evidence to its digest. | `traceability.md` + workspace + candidate | `evidence.md`, `browser-evidence.md`, `traceability.md`, `state.md` |
+| [`/rite-polish`](../pack/.claude/skills/rite-polish/SKILL.md) | polish | `[target \| mode]` | Runs code/UI polish, then applicable capability-ledger, design-memory, and ADR rollups; updates the manifest and affected proof before closing the candidate. | workspace + design system + candidate | `polish-report.md`, `browser-evidence.md`, `touched-files.md`, durable rollups |
+| [`/rite-review`](../pack/.claude/skills/rite-review/SKILL.md) | review | `[scope: slice N \| feature] [--full]` | Feature-scoped parallel Spec + Standards review of the closed candidate; binds `review.md` to its digest. | workspace + candidate | `review.md`, `evidence.md`, `state.md` |
+| [`/rite-seal`](../pack/.claude/skills/rite-seal/SKILL.md) | seal | `[feature-slug] [--full]` | Candidate-bound GO / NO-GO **decision**. Rechecks exact proof/review bindings and runs no git; on GO sets `Next step: /rite-ship`. | all artifacts + candidate | `seal.md`, `state.md` |
+| [`/rite-ship`](../pack/.claude/skills/rite-ship/SKILL.md) | ship | `[slug]` | Starts with a read-only Seal/candidate check and exact plan disclosure, then requires fresh literal `GO`. Only then may it collapse checkpoints, stage exact candidate paths, validate staged scope/bytes/bindings/secrets, commit and reverify, perform optional separately approved push/tag/PR actions, and archive/close. | `seal.md` + candidate + Git index | `ship.md`, `state.md`, archive |
+| [`/rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | (orchestrator) | `[idea] [--ship\|--yolo] [--max-slices N] [--full] [--cross-model]` | Full lifecycle (spec → clarify → … → seal → ship). Spec + clarify form the one interactive window; AFK/checkpoint mode arms only after decision coverage is CLEAR. Pauses for genuine human-owned decisions/actions, NO-GO, or budget exhaustion; objective red checks use bounded technical recovery. Default stops at Seal GO; `--ship` (`--yolo`) reaches Ship preflight but still requires fresh literal `GO` and native approval; `--full` selects the Full profile and `--cross-model` arms Vet's second opinion. | idea + workspace | whole workspace (drives every phase) |
 | [`/rite-quick`](../pack/.claude/skills/rite-quick/SKILL.md) | (express) | `<change>` | Express lane for a **small, reversible, unambiguous** change: one-line contract → TDD build → scoped prove → review-lite → ship, no full artifact tree. **Significance gate first**: auth / migration / public-API / destructive / multi-slice / ambiguous → escalates to `/rite-spec`. Triggers: "quick fix", "small change", "tiny tweak", "just do X". | the change + codebase | code + commit (optional `brief.md` / `evidence.md`) |
 | [`/rite-frame`](../pack/.claude/skills/rite-frame/SKILL.md) | lens | `[ask \| diff]` | Pre-flight + self-audit lens for ad-hoc work the lifecycle gates never see: **FRAME** turns an imperative ask into a falsifiable success criterion + verify command before code; **AUDIT** checks a raw diff against the four LLM coding failure modes (silent assumption / overcomplication / out-of-scope edit / unverifiable goal). Top of `/rite-quick` or before a plain "just do X". | the ask / a raw diff | success criterion + verify command (inline) |
-| [`/rite-adopt`](../pack/.claude/skills/rite-adopt/SKILL.md) | onboard | `[path]` | Bring an EXISTING codebase under DevRites: reverse-derive a `spec.md` of current behavior + placement + architecture, seed the conventions ledger from observed idioms, then hand off to the lifecycle. Triggers: "adopt this project", "onboard this codebase", "we already have code". | the codebase | `spec.md`, `.devrites/conventions.md`, `decisions.md`, `state.md` |
-| [`/rite-status`](../pack/.claude/skills/rite-status/SKILL.md) | status | `[slug]` | Active feature: phase, run mode (AFK/HITL), status, next action, evidence, open questions by gate, risks, handoff readiness. Reads via the shared `devrites-lib` preamble (portable). | workspace + `.devrites/AFK` | none |
-| [`/rite-resolve`](../pack/.claude/skills/rite-resolve/SKILL.md) | resume | `<qid> "<answer>"` \| `--drop <qid>` \| `--batch <file>` | Answer / drop / batch-resolve open `questions.md` entries; clears `state.md` `Awaiting human` and sets `Status: running`. Canonical writer for `status: open → answered`. | `questions.md` + `state.md` | `questions.md`, `state.md` |
-| [`/rite-zoom-out`](../pack/.claude/skills/rite-zoom-out/SKILL.md) | utility | none | One-pass structural map of an unfamiliar area (modules, in-callers, out-calls, decisions) in project vocabulary. Prefers codegraph/graphify. | codebase + ADRs/CONTEXT.md | none |
+| [`/rite-adopt`](../pack/.claude/skills/rite-adopt/SKILL.md) | onboard | `[path or area to adopt] [+ what you want to build next]` | Reverse-derive the existing baseline and next objective; propose any durable project guidance in the nearest native instruction file. | codebase + project instructions | workspace spec/state artifacts + optional guidance proposal |
+| [`/rite-status`](../pack/.claude/skills/rite-status/SKILL.md) | status | `[slug]` | Active feature: phase, run mode, status, persisted next action, evidence, questions, drift, risks, and handoff readiness. | direct workspace ledger/artifacts | none |
+| [`/rite-resolve`](../pack/.claude/skills/rite-resolve/SKILL.md) | resume | `<qid> "<answer>" \| --drop <qid> ["<reason>"] \| --batch <path-to-yaml>` | Answer / drop / batch-resolve open `questions.md` entries; clears `state.md` `Awaiting human` and sets `Status: running`. Canonical writer for `status: open → answered`. | `questions.md` + `state.md` | `questions.md`, `state.md` |
+| [`/rite-zoom-out`](../pack/.claude/skills/rite-zoom-out/SKILL.md) | utility | `[symbol \| file \| area to map]` | One-pass structural map of an unfamiliar area (modules, in-callers, out-calls, decisions) in project vocabulary. Prefers codegraph/graphify. | codebase + ADRs/CONTEXT.md | none |
 | [`/rite-prototype`](../pack/.claude/skills/rite-prototype/SKILL.md) | utility | `[question]` | Throwaway code answering ONE design question. Logic harness OR 2 to 4 UI variations on one route. Captures verdict to `decisions.md`. | spec / surrounding code | prototype scratch + `decisions.md` |
 | [`/rite-handoff`](../pack/.claude/skills/rite-handoff/SKILL.md) | utility | `[next-session-focus]` | Compacts the chat into a handoff doc. Syncs chat-only context into workspace canonical files. References existing artifacts by path. | chat + workspace | `handoff.md` + sync into canonical files |
-| [`/rite-learn`](../pack/.claude/skills/rite-learn/SKILL.md) | utility | `[--mine \| "<lesson>"]` | Mine archived features for recurring mistakes / dismissed-finding classes; propose project-local lessons into `.devrites/learnings.md` (loaded by the review skills before a fan-out). | archive + workspace | `.devrites/learnings.md` |
-| [`/rite-customize`](../pack/.claude/skills/rite-customize/SKILL.md) | utility | `[override <agent> \| extension <name>]` | Guided authoring for project-local reviewer overrides and extensions; writes the smallest artifact, then runs the matching validator. Explicit-only. | `.devrites/overrides`, `.devrites/extensions`, pack agents | `.devrites/overrides/<agent>.md` or `.devrites/extensions/<name>/...` |
+| [`/rite-learn`](../pack/.claude/skills/rite-learn/SKILL.md) | utility | `["<lesson>"]` | Review native memory plus verified archive/ADR evidence; propose one durable instruction or ADR update for human approval. | native memory + reviewed Markdown | approved existing instruction/ADR only |
+| [`/rite-customize`](../pack/.claude/skills/rite-customize/SKILL.md) | utility | `[instruction \| skill <name> \| agent <name> \| plugin \| --import-legacy]` | Guided authoring for a native project instruction, skill, agent, or explicitly connected plugin/MCP surface. | native host/project config | approved native artifact |
 | [`/rite-explain`](../pack/.claude/skills/rite-explain/SKILL.md) | utility | `[concept \| diff: \| walkthrough: \| since: \| idea]` | The **human** half of the learning loop (complement of `/rite-learn`, which teaches the repo). Turns a concept, diff, idea, or window of the user's own recent work into a dense personal explainer; diff inputs can produce a concern-ordered human review walkthrough. Grounds off `seal.md` / `evidence.md` / the diff / the archive. Read-only against source. | workspace + archive + diff + code | `.devrites/explainers/<date>-<slug>/explainer.md` or `walkthrough.md` |
-| [`/rite-pov`](../pack/.claude/skills/rite-pov/SKILL.md) | utility | `[candidate/link/question]` | Project-grounded verdict on adopting, switching, rejecting, or ignoring a named external technology/library/platform/pattern. Clears a project floor and external floor before grading. | repo profile + code/docs + external sources | `decisions.md` or ADR only on request |
+| [`/rite-pov`](../pack/.claude/skills/rite-pov/SKILL.md) | utility | `[candidate/link/question]` | Project-grounded verdict on one outside option after live repository and primary-source evidence. | live code/docs + external sources | `decisions.md` or ADR only on request |
 | [`/rite-dogfood`](../pack/.claude/skills/rite-dogfood/SKILL.md) | utility | `[feature-slug\|branch] [--port N]` | Diff-scoped browser QA: map changed user journeys, run scenario matrix, fix small obvious breakages, write dogfood report. Explicit-only. | diff + app routes + browser | `.devrites/work/<slug>/dogfood.md` + safe fixes |
-| [`/rite-pr-feedback`](../pack/.claude/skills/rite-pr-feedback/SKILL.md) | utility | `[PR number\|thread URL]` | Resolve GitHub PR review feedback: fetch unresolved threads, judge centrally, fix valid items, reply, resolve. Explicit-only. | PR threads + code | code/tests + PR replies/resolutions |
+| [`/rite-pr-feedback`](../pack/.claude/skills/rite-pr-feedback/SKILL.md) | utility | `[PR number\|thread URL\|blank for current branch]` | Resolve GitHub PR review feedback: fetch unresolved threads, judge centrally, fix valid items, reply, resolve. Explicit-only. | PR threads + code | code/tests + PR replies/resolutions |
 | [`/rite-pressure-test`](../pack/.claude/skills/rite-pressure-test/SKILL.md) | utility | `[idea]` | Pressure-test a rough idea: 3 to 5 genuinely different options → converge on one with trade-off + hinge. | spec / surrounding code | `decisions.md` (optional) |
-| [`/rite-doctor`](../pack/.claude/skills/rite-doctor/SKILL.md) | diagnostic | `[--code \| --reindex]` | Diagnose DevRites install, workspace, and optional index health. `--reindex` explicitly runs the internal synchronous refresh. Triggers: "rite doctor", "is DevRites healthy", "reindex". | install + workspace + optional indexes | none |
+| [`/rite-doctor`](../pack/.claude/skills/rite-doctor/SKILL.md) | diagnostic | none | Diagnose the DevRites binary, pack, schema, and native host permission/profile configuration. | install + host config | none |
+
+`/rite use <slug>` and `/rite guide` are inline router operations owned by
+`/rite`, not separate skills. There is no `/rite-use` or `/rite-guide` shortcut.
 
 ## Internal specialist skills (`user-invocable: false`, model-invoked)
 
-The 11 specialist skills below are model-invoked. `devrites-lib` is the twelfth
+The 10 specialist skills below are model-invoked. `devrites-lib` is the eleventh
 internal skill, but it sets `disable-model-invocation: true` and serves only as
 the shared reference library.
 
@@ -107,8 +132,7 @@ the shared reference library.
 | [`devrites-frontend-craft`](../pack/.claude/skills/devrites-frontend-craft/SKILL.md) | UI detected in build/polish | Build **to** `design-brief.md`: register, refine-per-slice, states, anti-slop | refs: shape/craft/design-references |
 | [`devrites-prose-craft`](../pack/.claude/skills/devrites-prose-craft/SKILL.md) | a phase writes prose; `/rite-polish` Phase 1 catch | Human-voice writing: strip LLM tells, keep precise lists/terms | refs: banned-phrases, structures, examples |
 | [`devrites-browser-proof`](../pack/.claude/skills/devrites-browser-proof/SKILL.md) | UI in prove/polish | Browser proof ladder + evidence schema + the structured **Visual Verdict** table | harness preferred |
-| [`devrites-refresh-indexes`](../pack/.claude/skills/devrites-refresh-indexes/SKILL.md) | Stop hook or explicit `/rite-doctor --reindex` call | Keep codebase-memory-mcp / codegraph / graphify current after edits | internal synchronous force; no-ops when no index |
-| [`devrites-debug-recovery`](../pack/.claude/skills/devrites-debug-recovery/SKILL.md) | failing tests/build/runtime | 7-step: loop → reproduce → hypotheses → trace → instrument → fix → cleanup | durable three-failure budget per root-cause fingerprint |
+| [`devrites-debug-recovery`](../pack/.claude/skills/devrites-debug-recovery/SKILL.md) | failing tests/build/runtime | 7-step: loop → reproduce → hypotheses → trace → instrument → fix → cleanup | caller + recovery count three failed attempts per causal fingerprint from context and Dead ends/evidence |
 | [`devrites-api-interface`](../pack/.claude/skills/devrites-api-interface/SKILL.md) | cross-boundary slice | Stable API/contract design | FE/BE split |
 | [`devrites-audit simplify`](../pack/.claude/skills/devrites-audit/SKILL.md) | `/rite-polish` Phase 1 | Chesterton's Fence, behavior-preserving simplification | dispatches `devrites-simplifier-reviewer` |
 | [`devrites-audit security`](../pack/.claude/skills/devrites-audit/SKILL.md) | input/auth/data/integration in scope | OWASP Top 10, three-tier boundary | dispatches `devrites-security-auditor` |
@@ -117,37 +141,37 @@ the shared reference library.
 
 ## Agents (`.claude/agents/devrites-*`, fresh-context leaves)
 
-**Eighteen roles:** 17 read-only leaves plus one source/test writer,
-`devrites-slice-wright`.
+**Seventeen role profiles:** both hosts have 16 read-only leaves plus the
+write-capable `devrites-slice-wright`.
 
 | Agent | Spawned by | Purpose |
 |---|---|---|
 | [`devrites-evidence-scout`](../pack/.claude/agents/devrites-evidence-scout.md) | `/rite-spec`, `/rite-clarify`, `/rite-converge` | Read-only bounded evidence dossier from live code, project records, or cited external facts |
 | [`devrites-plan-drafter`](../pack/.claude/agents/devrites-plan-drafter.md) | `/rite-define`, `/rite-plan repair` | Read-only planning candidate; the root makes decisions and writes planning artifacts |
-| [`devrites-proof-runner`](../pack/.claude/agents/devrites-proof-runner.md) | `/rite-prove`, affected re-proof | Read-only tree plus non-destructive command execution; returns a proof report, never the verdict |
-| [`devrites-upgrade-planner`](../pack/.claude/agents/devrites-upgrade-planner.md) | `/rite-upgrade` | Fresh read-only assessment of semantic contract gaps; returns a bounded preservation-first upgrade plan |
-| [`devrites-slice-wright`](../pack/.claude/agents/devrites-slice-wright.md) | `/rite-build` (the build core) | **Sole source/test writer**: implement one exact allowlisted slice (orient → TDD → verify); returns a typed artifact and writes no bookkeeping |
-| [`devrites-strategy-reviewer`](../pack/.claude/agents/devrites-strategy-reviewer.md) | `/rite-temper` (pre-plan) | Spec-vs-rubric strategic review (ambition / scope / premise / pre-mortem / YAGNI / testability / irreversibility / cross-cutting / convention); read-only; **not** part of the seal fan-out |
+| [`devrites-proof-runner`](../pack/.claude/agents/devrites-proof-runner.md) | `/rite-prove`, affected re-proof, `/rite-seal` | Validates immutable artifacts produced by root-executed proof commands; returns a proof report, never executes a gate or decides the verdict |
+| [`devrites-upgrade-planner`](../pack/.claude/agents/devrites-upgrade-planner.md) | `/rite-upgrade` | Fresh read-only contract matrix with typed outcome, cited defects, protected identities, and canonical repair route |
+| [`devrites-slice-wright`](../pack/.claude/agents/devrites-slice-wright.md) | `/rite-build`; accepted `/rite-prove`, `/rite-polish`, `/rite-review` corrections | **Sole source/test writer role** on Claude and Codex: implement one exact path-bounded slice or accepted correction and return a typed artifact |
+| [`devrites-strategy-reviewer`](../pack/.claude/agents/devrites-strategy-reviewer.md) | `/rite-temper`; conditional `/rite-vet` recheck | Spec-vs-rubric strategic review (ambition / scope / premise / pre-mortem / YAGNI / testability / irreversibility / cross-cutting / convention); read-only; **not** part of the seal fan-out |
 | [`devrites-plan-reviewer`](../pack/.claude/agents/devrites-plan-reviewer.md) | `/rite-vet` (pre-build) | Plan-vs-rubric engineering review (architecture / scope-reuse / plan code-quality / test-coverage design / performance / reversibility / failure-mode coverage), confidence-banded with a quote-the-source verification gate; read-only; **not** part of the seal fan-out |
-| [`devrites-forge-judge`](../pack/.claude/agents/devrites-forge-judge.md) | `/rite-build` on a `Forge: yes` slice | Comparative judge of K=2 to 3 competing candidate builds (acceptance / test strength / principle fit / simplicity / reuse / anti-slop); picks the single winner to land, names grafts; read-only |
-| [`devrites-spec-reviewer`](../pack/.claude/agents/devrites-spec-reviewer.md) | `/rite-review` Spec axis; `/rite-seal` | Does the diff implement the spec? Missing/partial/wrong criteria; scope creep |
+| [`devrites-spec-reviewer`](../pack/.claude/agents/devrites-spec-reviewer.md) | `/rite-prove`; `/rite-review` Spec axis; `/rite-seal` | Does the diff implement the spec? Missing/partial/wrong criteria; scope creep |
 | [`devrites-code-reviewer`](../pack/.claude/agents/devrites-code-reviewer.md) | `/rite-review` Standards axis; `/rite-seal` | Correctness / readability / architecture / maintainability |
-| [`devrites-test-analyst`](../pack/.claude/agents/devrites-test-analyst.md) | `/rite-seal` | Do the tests prove the acceptance criteria? |
+| [`devrites-test-analyst`](../pack/.claude/agents/devrites-test-analyst.md) | `/rite-build`, `/rite-seal` | Do the tests prove the acceptance criteria? |
 | [`devrites-frontend-reviewer`](../pack/.claude/agents/devrites-frontend-reviewer.md) | `/rite-seal` on UI features | UX, a11y, responsive, design-system, anti-AI-slop; reads the **Visual Verdict** |
-| [`devrites-security-auditor`](../pack/.claude/agents/devrites-security-auditor.md) | `/rite-seal` when input/auth/data in scope | OWASP Top 10, trust boundary, secrets, deps |
-| [`devrites-performance-reviewer`](../pack/.claude/agents/devrites-performance-reviewer.md) | `/rite-seal` when perf relevant | N+1s, hot paths, payload size |
+| [`devrites-security-auditor`](../pack/.claude/agents/devrites-security-auditor.md) | `devrites-audit security`; conditional `/rite-seal` | OWASP Top 10, trust boundary, secrets, deps |
+| [`devrites-performance-reviewer`](../pack/.claude/agents/devrites-performance-reviewer.md) | `devrites-audit perf`; conditional `/rite-seal` | N+1s, hot paths, payload size |
 | [`devrites-devex-reviewer`](../pack/.claude/agents/devrites-devex-reviewer.md) | `/rite-vet` (predict) + `/rite-seal` (measure) when a developer-facing surface is in scope | Developer-experience scorecard + predict-vs-measure boomerang (TTHW, getting-started, error-message quality, ergonomics, docs) |
-| [`devrites-doubt-reviewer`](../pack/.claude/agents/devrites-doubt-reviewer.md) | `devrites-doubt` loop | Adversarial check of a single claim/decision |
+| [`devrites-doubt-reviewer`](../pack/.claude/agents/devrites-doubt-reviewer.md) | `devrites-doubt` loop; `/rite-build` and `/rite-seal` stood-decision checks | Adversarial check of a single claim/decision |
 | [`devrites-simplifier-reviewer`](../pack/.claude/agents/devrites-simplifier-reviewer.md) | `devrites-audit simplify` | Independent simplification judgment |
-| [`devrites-retrospector`](../pack/.claude/agents/devrites-retrospector.md) | `/rite-ship` close (cadence-gated) | Cross-feature retrospective: mines the shipped archive for recurring patterns + trends; **drafts** graduation candidates for `/rite-learn`; read-only |
+| [`devrites-retrospector`](../pack/.claude/agents/devrites-retrospector.md) | `/rite-learn` cross-feature review | Read-only native search over reviewed archive evidence; proposes specific instruction/ADR candidates |
 
-Only the root dispatches; leaves never dispatch other leaves. The first
-fallback is a generic `explorer` or `worker` that reads the same role contract,
-but only when the host preserves the required read-only or exact-write
-boundary. If no safe fresh-context option is available, the workflow stops for
-HITL. The root never executes a specialist role. Declared leaf identity and
-scope guards fail closed. A missing or crashed engine blocks the tool call
-instead of granting permission to continue.
+Only the root dispatches; leaves never dispatch other leaves. It dispatches the
+exact named project role; if that role is unavailable, the workflow stops for
+HITL. The root never executes a specialist role. Reviewer profiles are
+natively read-only. Claude keeps its root in plan mode; Codex uses a
+workspace-capable root so its child can write, while workflow policy forbids
+that root from editing source/tests. Both hosts expose only
+`devrites-slice-wright` as a writable specialist. See
+[`standards/agents.md`](../pack/.claude/skills/devrites-lib/reference/standards/agents.md#source-writing-boundary).
 
 ## Engineering rules (`pack/.claude/skills/devrites-lib/reference/standards/`)
 
@@ -164,7 +188,7 @@ index is in
 
 | Trigger | Routes to |
 |---|---|
-| Frontend/UI detected (TSX/JSX/Vue/Svelte/Astro/Angular/ERB, CSS/Tailwind/tokens, components/forms/states) | `devrites-ux-shape` in spec (writes `design-brief.md`: direction, **calibration** density/motion, states), `devrites-frontend-craft` in build (builds to it; extracts to a supplied Figma/image target), `devrites-browser-proof` in prove, `rite-polish` Phase 3 + 4 (`reference/ui.md`) in polish, UX/a11y axes at review/seal, optional **design-memory** rollup → project `DESIGN.md` at ship |
+| Frontend/UI detected (TSX/JSX/Vue/Svelte/Astro/Angular/ERB, CSS/Tailwind/tokens, components/forms/states) | `devrites-ux-shape` in spec (writes `design-brief.md`: direction, **calibration** density/motion, states), `devrites-frontend-craft` in build (builds to it; extracts to a supplied Figma/image target), `devrites-browser-proof` in prove, `rite-polish` Phase 3 + 4 (`reference/ui.md`) in polish, UX/a11y axes at review/seal, optional **design-memory** rollup → project `DESIGN.md` in Polish before Review |
 | Uncertain library / framework behavior | `devrites-source-driven` |
 | Non-trivial decision (boundary, data model, auth, public API, migration, "this scales/safe") | `devrites-doubt` (+ `devrites-doubt-reviewer`) |
 | User input / auth / storage / external integration / secrets / permissions | `devrites-audit security` (+ `devrites-security-auditor`) |
@@ -199,7 +223,8 @@ See [`flow.md`](flow.md) for the Mermaid diagrams. The text form is:
    │            │                └ devrites-frontend-craft / source-driven / doubt
    └ (no workspace) → summary    devrites-* internal skills fire on triggers above
 
-/rite-autocomplete drives the entire sequence above unattended (best option per soft gate; --ship auto-confirms ship).
+/rite-autocomplete drives the reversible sequence unattended; --ship reaches
+only the exact-plan Ship approval boundary and never authorizes Git.
 ```
 
 - Every phase **reads the active workspace first**; if none, it stops and tells