devrites 3.2.27 → 4.0.0

package/pack/generated/codex/skills/rite-adopt/SKILL.md

@@ -1,119 +1,45 @@
 ---
 name: rite-adopt
-description: Adopt an existing or legacy codebase into DevRites by reverse-engineering current behavior, seeding conventions, and establishing the workflow. Use for inherited or live applications.
+description: Adopt an existing codebase into DevRites by reverse-engineering current behavior and establishing a baseline workspace.
 argument-hint: "[path or area to adopt] [+ what you want to build next]"
 user-invocable: true
-required-agent-roles: none
 ---
 
-## Codex compatibility
-
-This is the Codex mirror of a DevRites skill. In Codex:
-
-- Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
-- Installed `.agents/` mirrors may be Git-ignored. If a repository-aware file tool refuses an ignored path, read it with a native filesystem command instead; a tool refusal is not a completed task.
-- For automatic Engram calls, omit optional `project` and `session_id` unless an exact value came from Engram or repository configuration. Never derive either from `task_name`, a run ID, directory name, or normalized slug. Call `mem_session_summary` without them by default; on `unknown_session` or `unknown_project`, retry once with both optional fields omitted. If auto-detection is ambiguous, ask the user instead of guessing.
-- Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. A missing visible `agent_type` field is still V2—not capability loss, V1, or HITL—so send it anyway. If the named call rejects it, stop before any generic/default spawn. Codex loads the role TOML's `developer_instructions` natively; DevRites verifies the durable rollout, wait, completion, and delivered result.
-- Only after the runtime explicitly identifies MultiAgent V1, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
-- On explicitly identified MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`.
-- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
-- If the required dispatch for the explicitly identified runtime is unavailable or rejected, stop for HITL. Never switch runtime lanes. Never execute a DevRites specialist role in the root context.
-- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
-- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
-- When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
-
-
 # $rite-adopt: onboard existing code
 
-`$rite-adopt` derives a spec and initial conventions from existing code. It produces the
-same `spec.md` used by the rest of the lifecycle and seeds the conventions ledger with
-observed project idioms.
-
-Use it once when onboarding a repository or one of its sub-areas. Continue with
-`$rite-clarify`, `$rite-temper`, `$rite-define`, and `$rite-build`.
-
-> **Need only a code map?** `$rite-zoom-out` maps unfamiliar code without creating a
-> workspace or ledger. Use `$rite-adopt` when the project should enter the lifecycle.
-
-## Rules consulted (read on demand from `.agents/skills/devrites-lib/reference/standards/`)
-Pull `documentation.md` when recording the adoption decisions (why-not-what) in
-`decisions.md`; pull `principles.md` when the code
-upholds invariants worth proposing as project principles (step 4a).
-
-## Operating rules (DevRites core)
-- No silent assumptions · prefer the project's existing conventions (you are *documenting*
-  them, not imposing new ones) · ask the human when the adoption scope or the next-build
-  objective is unclear.
+Reverse-engineer existing behavior into the same `spec.md` contract used by new
+features. Adoption documents the repository; it does not rewrite it or create a
+parallel convention system.
 
 ## Workflow
-0. **Read `.agents/skills/devrites-lib/reference/standards/core.md`**, then run
-   `devrites-engine preamble` for deterministic workspace orientation.
-1. **Scope the adoption** (`$ARGUMENTS`). Which repo or sub-area is being onboarded, and:
-   if stated: what the user wants to build *next* on top of it. If the next-build objective
-   is missing, ask once (it shapes the spec's acceptance); if the area is ambiguous, confirm
-   before investigating the whole tree.
-2. **Inspect the existing code** to establish the project's current structure. Use a
-   code-intelligence index if available (codebase-memory-mcp first (its `get_architecture`
-   gives a fast overview), cross-checked with codegraph + graphify, else standard methods
-   (LSP / Read/Grep/Glob); see `.agents/skills/devrites-lib/reference/standards/tooling.md`) for
-   structure, callers, and impact. Capture, per [adoption](reference/adoption.md): **current
-   behavior**, **architecture + placement** (layers, seams, where each kind of thing lives),
-   the **commands** (test / build / typecheck / lint), and the **idioms** (naming, layering,
-   error model, test style) + recurring **gotchas**. Read `PRODUCT.md` / `DESIGN.md` /
-   `CLAUDE.md` / `AGENTS.md` if present.
-3. **Write `spec.md`** via [rite-spec's spec template](../rite-spec/reference/spec-template.md)
-   and create the workspace + set `.devrites/ACTIVE`
-   ([state-workspace](../rite-spec/reference/state-workspace.md)). The spec records the
-   **current behavior as the baseline** and the **next objective** (what adoption is for) with
-   measurable acceptance. Also write `decisions.md`, `assumptions.md`, `questions.md`, and
-   `state.md` (phase: spec).
-3a. **Seed the capability ledger** from the baseline. If the derived `spec.md` carries
-   structured `### Requirement:` blocks, fold them into the living
-   `.devrites/specs/<capability>/spec.md` ledger so the project's current proven behavior is
-   recorded before the first new feature. The next `$rite-spec` writes deltas against this ledger
-   ([ledger.md](../rite-ship/reference/ledger.md)). A flat baseline folds as all-ADDED into the
-   feature slug's capability; tag capabilities in the spec first if you want finer granularity.
-   ```bash
-   devrites-engine ledger diff .devrites/work/<slug>   # preview
-   devrites-engine ledger sync .devrites/work/<slug>   # seed
-   ```
-   Skip when the baseline records no structured requirements (nothing to seed).
-4. **Seed the conventions ledger** from observed behavior:
-   [adoption § seeding](reference/adoption.md). This is the bootstrap exception to
-   evidence-gated promotion. Seeds start at the base band with onboarding provenance;
-   later sealed slices may confirm or contradict them, and fresh evidence wins.
-   **Completion:** every seed names observed evidence, provenance, and the base band.
-4a. **Propose candidate principles** (optional and human-ratified). When the code
-   consistently enforces an invariant, such as integer cents for money, redacted PII in
-   logs, or preserved v1 endpoints, propose it as a **candidate principle** rather than a
-   convention. Principles are prescriptive gates, so **never seed them automatically**.
-   Present each candidate through `AskUserQuestion` with evidence, and write human-ratified
-   candidates to `.devrites/principles.md` with a dated Governance entry
-   ([`principles.md`](../devrites-lib/reference/standards/principles.md)). An unratified
-   candidate remains a convention, not a gate. If no invariant qualifies, declare no
-   principles.
-5. **Hand off.** Continue with `$rite-clarify`. Its topology scan asks no questions when
-   the derived contract is already clear. Every plan then runs `$rite-vet` before build.
-   Do not plan or build here.
-   **Completion:** one next rite is reported and no plan or application code was written.
 
-> **Mid-flight discipline.** Do not invent conventions, seed an assumed idiom, or turn
-> adoption into a rewrite. Adoption records existing behavior; a later feature changes it.
-> See [`anti-patterns`](reference/anti-patterns.md).
+1. Read the core standards and resolve the repository/sub-area plus the next
+   objective. Ask once when either is materially ambiguous.
+2. Follow [`reference/adoption.md`](reference/adoption.md): inspect current
+   behavior, architecture and placement, callers, reusable seams, repository/CI
+   commands, visible code/test patterns, and non-obvious constraints. Read
+   existing `AGENTS.md`, `CLAUDE.md`, product, and design guidance.
+3. Create the workspace and write `spec.md`, `decisions.md`, `assumptions.md`,
+   `questions.md`, and `state.md`. The spec separates the current baseline from
+   the measurable next objective.
+4. For a structured baseline, follow the native ledger workflow in
+   [`ledger.md`](../rite-polish/reference/ledger.md): read current specs, preview
+   ADDED entries, confirm paths, refuse escape/symlink/clobber/ignored targets,
+   write, lint, and require an empty re-preview.
+5. If a repeatedly observed operating rule should govern future work, propose
+   one exact edit to the nearest existing `AGENTS.md`, `CLAUDE.md`, or scoped
+   document. Apply only after review. Do not create convention bands, scores, or
+   a command cache.
+6. A genuine non-negotiable invariant may be proposed for
+   `.devrites/principles.md`; the human must ratify it.
+7. Set the next step to `$rite-clarify` and stop. Do not plan or build.
 
 ## Output
 
-**Progress first**: run `devrites-engine progress`, then use the shared completion reply contract
-([`devrites-lib/reference/reply-contract.md`](../devrites-lib/reference/reply-contract.md)).
-Default success shape:
-```
-Done: adopted existing behavior into <slug>; baseline spec and placement recorded.
-Changed: spec.md, decisions.md, conventions ledger, principles proposals <updated|none>
-Evidence: not applicable; reverse-derived behavior is recorded for review
-Open: <none | adoption questions>
+```text
+Done: adopted <scope> into <slug>.
+Changed: <workspace artifacts>; project guidance <proposed | unchanged>
+Evidence: <source/CI paths inspected>
+Open: <questions | none>
 Next: $rite-clarify
-Record: .devrites/work/<slug>/spec.md
-↻ Hygiene: /clear before the next phase
 ```

package/pack/generated/codex/skills/rite-adopt/reference/adoption.md

@@ -1,55 +1,21 @@
-# Adoption: reverse-investigate + seed (the on-ramp contract)
+# Adoption: reverse-investigation
 
-Loaded on demand by `$rite-adopt`. Two jobs: document what the code already does (so the
-lifecycle has a spec), and seed the conventions ledger (so the first slice knows the idioms).
+Loaded on demand by `$rite-adopt`. Document what the code already does so the
+lifecycle starts from evidence rather than guesses.
 
-## Reverse-investigation: what to capture
+Capture the durable project shape:
 
-Document the **durable shape** of the project, not a line-by-line tour:
+- current user-visible behavior;
+- architecture, placement, callers, and important seams;
+- real test, build, typecheck, and lint commands from repository scripts or CI;
+- naming, layering, error, data-access, and test patterns visible in live code;
+- non-obvious ordering or framework constraints.
 
-- **Current behavior:** what the adopted area does today, from the user's perspective.
-- **Architecture + placement:** the layers and seams; where each kind of thing lives
-  (where endpoints / components / models / migrations / tests go). Prefer a code-intelligence
-  index if available (see `../../devrites-lib/reference/standards/tooling.md`) for
-  structure, callers, and impact.
-- **Commands:** the real test / build / typecheck / lint commands (run or read them; don't
-  guess). Verify uncertain framework facts at the source.
-- **Idioms:** naming + casing, layering, the error model, the result/exception style, the
-  http/data-access pattern, the test framework + file layout.
-- **Gotchas:** non-obvious constraints the code encodes (ordering requirements, "don't call
-  X before Y", a framework quirk).
+Use native code/file search and current repository documentation. Fresh source
+and CI configuration win over historical notes.
 
-This feeds `spec.md` (current behavior as the baseline + the next objective) and the ledger
-seeds below.
-
-## Seeding the conventions ledger
-
-The deliberate **bootstrap exception** to evidence-gated promotion. Normally a convention is
-promoted only when a *sealed slice proved it* (`$rite-seal`); adoption seeds from **observed
-existing code** so the first slice isn't blind. Keep the seeds honest:
-
-- Seed only what the code **and consistently** follows, not an aspiration, not a
-  one-off, not something you assumed.
-- Each seed starts at the base band (one corroboration) and is provenance-tagged as an
-  onboarding observation, **not** a sealed-slice proof. Real slices later corroborate it
-  (raising the band) or, per fresh-observation-wins, contradict it.
-
-```bash
-SLUG="$(cat .devrites/ACTIVE 2>/dev/null | tr -d '[:space:]')"
-if command -v devrites-engine >/dev/null 2>&1; then
-  devrites-engine conventions promote --slug "${SLUG}-adopt" \
-    --key test-runner --kind test \
-    --statement "tests run with <runner>, <file layout>" \
-    --evidence "observed during $rite-adopt onboarding (not yet slice-proven)"
-  # …one promote per durable convention the investigation actually observed
-  # (test-runner, build-cmd, error-model, http-client, endpoint-placement, …).
-else
-  echo "(conventions ledger unavailable — devrites-engine missing; skipping seed)"
-fi
-```
-
-The `-adopt` suffix on the slug marks the provenance as onboarding. Because the ledger is
-read at orient as a *prior* and the live code always overrides it
-([`.agents/skills/devrites-lib/reference/standards/security.md`](../../devrites-lib/reference/standards/security.md) § Prompt-injection resistance),
-an over-eager seed is self-correcting, but seed conservatively anyway; a wrong seed costs a
-needless contradiction later.
+Write the adopted baseline and next objective to `spec.md`; put uncertain facts
+in `assumptions.md` and durable decisions in `decisions.md`. If an observed rule
+should govern future work, propose one reviewed update to `AGENTS.md`,
+`CLAUDE.md`, or the nearest scoped project document. Do not create a convention
+ledger, confidence band, score, or duplicated command cache.

package/pack/generated/codex/skills/rite-autocomplete/SKILL.md

@@ -1,61 +1,40 @@
 ---
 name: rite-autocomplete
-description: Run the DevRites lifecycle end-to-end unattended; --ship confirms the final gate. Use when the user says "autocomplete", "one-shot this feature", or "ship it autonomously". Not for a single phase.
-argument-hint: "[idea] [--ship|--yolo] [--max-slices N]"
+description: Run the full DevRites lifecycle unattended; --ship continues to the final Git approval boundary. Use for one-shot autonomous work; not for a single phase.
+argument-hint: "[idea] [--ship|--yolo] [--max-slices N] [--full] [--cross-model]"
 user-invocable: true
-required-agent-roles: none
 ---
 
-## Codex compatibility
-
-This is the Codex mirror of a DevRites skill. In Codex:
-
-- Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
-- Installed `.agents/` mirrors may be Git-ignored. If a repository-aware file tool refuses an ignored path, read it with a native filesystem command instead; a tool refusal is not a completed task.
-- For automatic Engram calls, omit optional `project` and `session_id` unless an exact value came from Engram or repository configuration. Never derive either from `task_name`, a run ID, directory name, or normalized slug. Call `mem_session_summary` without them by default; on `unknown_session` or `unknown_project`, retry once with both optional fields omitted. If auto-detection is ambiguous, ask the user instead of guessing.
-- Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. A missing visible `agent_type` field is still V2—not capability loss, V1, or HITL—so send it anyway. If the named call rejects it, stop before any generic/default spawn. Codex loads the role TOML's `developer_instructions` natively; DevRites verifies the durable rollout, wait, completion, and delivered result.
-- Only after the runtime explicitly identifies MultiAgent V1, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
-- On explicitly identified MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`.
-- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
-- If the required dispatch for the explicitly identified runtime is unavailable or rejected, stop for HITL. Never switch runtime lanes. Never execute a DevRites specialist role in the root context.
-- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
-- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
-- When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
-
-
 # $rite-autocomplete: full lifecycle, unattended
 
-Runs every DevRites phase in order without pausing for discretionary input. It asks
-clarifying questions **before** unattended work begins. Safety gates remain active:
-hard irreversible-risk,<!-- pack-scan-ignore: negated statement: gates are NOT disabled -->
-blocking / escalating gates, and any NO-GO still pause.
+Runs every phase unattended after initial clarification. Irreversible-risk,
+blocking/escalating,<!-- pack-scan-ignore: negated statement: gates are NOT disabled -->
+and NO-GO gates still pause. Use the **Standard** native execution profile by
+default and **Full** for high-risk scope or explicit `--full`; profiles are defined in
+[`devrites-lib/reference/orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md).
 
 ## Rules consulted (read on demand from `.agents/skills/devrites-lib/reference/standards/`)
 **Step 0:** Read `.agents/skills/devrites-lib/reference/standards/core.md` and `.agents/skills/devrites-lib/reference/standards/afk-hitl.md` first.
 
 ## Operating rules
-- **Use one initial human window.** Run spec and topology-first clarify; arm AFK only after
-  `Decision coverage: CLEAR`. Later discretionary calls are recorded, not asked
+- **Use one initial human window.** Run spec and topology-first clarify; arm AFK
+  only after `Decision coverage: CLEAR`. Record later discretionary calls
   ([decision policy](reference/decision-policy.md)).
-- **Safety gates are not bypassable.** AFK never auto-passes destructive migration /
-  auth-authz change / public-API break / external-contract change; blocking
-  and escalating gates and any open `gate: validating` always pause. `--ship` auto-confirms
-  the **final** type-GO only: nothing else. A change that violates a declared project
-  principle (`.devrites/principles.md`) with no recorded exception pauses too: autocomplete
-  never grants a principle exception on its own (`principles.md`: that's a human decision).
-  Red checks never advance the loop: autocomplete runs the shared bounded debug recovery, then
-  stops as `blocked` if the objective failure remains; it asks only if recovery exposes a
-  human-owned decision.
-- **Set the loop budget from the plan's slice count.** After `$rite-vet`
-  (not `$rite-define`: vet may split or add slices, so the count isn't final until then),
-  set the AFK budget to however many slices the plan has, so the loop builds exactly the
-  planned slices and stops when they are done. `--max-slices N` is an optional lower
-  safety cap for a partial run; omit it to run the whole plan. The planned slice count
-  keeps the default run finite.
-- **Record each discretionary choice.** Pick the option recommended by the relevant
-  specialist or reviewer and record the rationale. Do not choose arbitrarily.
+- **Safety gates are not bypassable.** Irreversible risk, blocking/escalating,
+  open validating gates, and unexcepted principle violations pause. `--ship` /
+  `--yolo` never authorizes Git; it reaches only the exact-plan literal-GO and
+  native-approval boundary. Red checks run bounded recovery, then block unless
+  the remaining decision is human-owned.
+- **Budget from the post-vet slice count.** Vet may split/add slices.
+  `--max-slices N` may lower the cap for a partial run; otherwise build all.
+- **Parse flags only from this invocation.** `--ship`, `--yolo`, `--max-slices`,
+  `--full`, and `--cross-model` are active only when their exact standalone tokens
+  occur in `$ARGUMENTS`; their presence in this skill, examples, or earlier messages
+  can never arm them. `--max-slices` must occur once and be followed by a positive
+  base-10 integer; missing, repeated, malformed, or conflicting values stop before
+  any sentinel or workspace write.
+- **Record discretionary choices.** Use the specialist/reviewer recommendation
+  and rationale; never choose arbitrarily.
 - **Strategic review runs, but never auto-grows scope.** After `$rite-clarify`, run `$rite-temper`
   (significance-gated; it skips low-stakes specs in one line). Unattended it auto-applies only
   `hold-rigor` + `reduce-to-MVP` (these never grow acceptance); **any `expand` is a blocking
@@ -65,47 +44,58 @@ blocking / escalating gates, and any NO-GO still pause.
   run `$rite-vet` on **every** feature (depth scales: a light pass on simple plans, full rigor on
   big/risky; never skipped). Unattended it auto-applies only *hardening* findings: added test
   requirements, error-handling / failure-mode coverage, tightened scope, reuse-over-rebuild,
-  ordering / parallel-lane fixes (these never grow acceptance); **any finding that grows scope,
+  dependency-order fixes (these never grow acceptance); **any finding that grows scope,
   adds a slice, or changes acceptance is a blocking pause**, and irreversible-risk findings always
   pause. Cross-model is off unless `--cross-model` was armed.
 
 ## Workflow
-1. **Orient + parse args.** Run `devrites-engine preamble` for deterministic workspace orientation.
-   The idea + flags: `--ship` / `--yolo` (auto-confirm the final
-   type-GO), `--max-slices N` (optional lower safety cap for a partial run; default =
-   the plan's slice count, i.e. run all planned slices).
+1. **Orient + parse args.** Resolve the explicit or active slug, require its
+   `state.md`, and read the cursor directly.
+   The idea + flags: `--ship` / `--yolo` (continue through ship preflight, then stop
+   for literal-GO and native approval), `--max-slices N` (optional lower safety cap for a partial run; default =
+   the plan's slice count, i.e. run all planned slices). Parse only the current
+   `$ARGUMENTS`; normalize the result to the idea, `ship_preflight: yes|no`,
+   `max_slices: N|plan`, `profile: standard|full`, and `cross_model: yes|no`.
+   **Completion:** that normalized state is unambiguous and no sentinel or workspace
+   file has been written.
 2. **Specify and clarify up front.** Use `devrites-interview`, `$rite-spec`, and
    `$rite-clarify` as one interactive window. Clear specs ask zero questions; Partial/Missing
    coverage never arms AFK. **Completion:** `decision-coverage.md` records `CLEAR`.
-3. **Arm AFK after clarity.** Require `Decision coverage: CLEAR`, then write `.devrites/AFK`
-   with `allow_gates: [advisory]`; set the slice budget
-   from the plan's count after `$rite-vet` (the slice count is only final post-vet), or from
-   an explicit `--max-slices` ([reference/loop.md](reference/loop.md)). validating / blocking / escalating +
-   irreversible-risk still pause. Also `touch .devrites/CHECKPOINT`: unattended runs use
-   checkpoint mode so each proven slice is committed locally as a crash-survivable `WIP`
-   ([rite-build/reference/checkpoint.md](../rite-build/reference/checkpoint.md));
-   `$rite-ship` collapses them into the one feature commit.
+3. **Arm AFK after clarity.** Require `Decision coverage: CLEAR`, then apply the
+   loop's [one-write AFK contract](reference/loop.md#arm-afk-once): preserve a valid
+   existing sentinel byte-for-byte or create an advisory-only sentinel once; never
+   rewrite it after Vet. Also `touch .devrites/CHECKPOINT`: unattended runs use
+   checkpoint mode so each proven slice is committed locally as a crash-survivable
+   `WIP` ([rite-build/reference/checkpoint.md](../rite-build/reference/checkpoint.md));
+   `$rite-ship` collapses them into the one feature commit. **Completion:** AFK config is
+   valid and advisory-only, any pre-existing bytes are unchanged, and the checkpoint
+   sentinel exists.
 4. **Drive the phases** ([reference/loop.md](reference/loop.md)). The canonical arc is
    `$rite-spec` → **`$rite-clarify`** → **`$rite-temper`** → `$rite-define` →
    **`$rite-vet`** → `$rite-build` (repeat until all slices
-   built; `devrites-engine tick-afk` each) → `$rite-prove` → `$rite-polish` → `$rite-review` → `$rite-seal`.
-   Run each by Reading its `SKILL.md` and executing its workflow; state is carried by the
-   workspace files, not chat.
+   built; root charges the AFK budget once per green built slice) → `$rite-prove`
+   → `$rite-polish` → `$rite-review` → `$rite-seal`.
+   Read each `SKILL.md` and execute it; workspace files carry state, not chat.
+   Immediately after `$rite-vet` and before the first Build dispatch, apply the loop's
+   [mutable post-vet budget](reference/loop.md#derive-the-mutable-post-vet-budget)
+   contract. **Completion:** the loop reaches Seal GO, or a stop condition is persisted
+   before any later phase runs; the cursor names the last completed phase and the
+   effective remaining budget.
 5. **Apply stop conditions at every gate** ([reference/stop-conditions.md](reference/stop-conditions.md)):
    on hard-risk / blocking / escalating / NO-GO / budget-exhausted / still-low-confidence
    → write `state.md` (`Status`, `Next step`), surface *why*, and **STOP**.
-6. **Seal GO → ship.** With `--ship`, proceed to `$rite-ship` and auto-confirm the
-   type-GO. Without it, render the type-GO prompt and stop for the human.
+   **Completion:** either no stop condition is active, or the stopped cursor and reason
+   are durable and no later phase has been invoked.
+6. **Seal GO → ship boundary.** With `--ship` / `--yolo`, proceed through
+   `$rite-ship` preflight, disclose the exact Git plan, then stop for the human's
+   literal `GO` and any native host approval. Without the flag, stop at seal GO with
+   `$rite-ship` as the resume command. **Completion:** the no-flag path has performed no
+   Ship work; the flagged path has disclosed the exact plan and performed no Git action
+   before fresh literal `GO` plus native approval.
 
 > **Mid-flight discipline.** Stop rather than auto-passing a blocking gate, answering a
 > human-owned material question, or continuing past red tests.
 
-## Output
-A compact phase log followed by the final status. **Progress first for the final
-status**: run `devrites-engine progress`, then use the shared typed states from
-[`devrites-lib/reference/reply-contract.md`](../devrites-lib/reference/reply-contract.md):
-`Shipped`, `Stopped`, `Awaiting human`, `NO-GO`, or `GO`.
-
 Keep the log terse:
 ```
 Autocomplete: <slug>
@@ -117,7 +107,9 @@ Final state examples: `Shipped: <feature>`, `Stopped: <reason>`, `Awaiting human
 Do not write a narrative recap.
 
 ## Clean baseline and checkpoint mode
-- Before an autonomous run, require a clean or explicitly accepted baseline: refuse unrelated dirty work and record expected planning artifacts.
-- Arm `.devrites/CHECKPOINT` for the run so each proven slice can be checkpointed local-only; `$rite-ship` owns collapsing those checkpoints.
-- Stop on risky steps, red gates, NO-GO, stale evidence, or budget exhaustion.
-- Autocomplete gets one approved pass through the lifecycle; `$rite-build` still builds exactly one slice per invocation.
+- Before autonomy, require a clean or accepted baseline; refuse unrelated dirty work and record plan artifacts.
+- Arm `.devrites/CHECKPOINT`; `$rite-ship` collapses its local-only proven-slice checkpoints.
+- Stop on risky steps, red gates, NO-GO, stale evidence, or exhausted budget.
+- One autocomplete pass spans the lifecycle. Each wright returns after one slice;
+  explicit `.devrites/AFK` lets the Build root chain green slices under cap/pause rules;
+  otherwise HITL stops.

package/pack/generated/codex/skills/rite-autocomplete/reference/loop.md

@@ -1,30 +1,37 @@
 # The autocomplete loop: arm AFK, drive every phase
 
-Autocomplete runs the existing `/rite-*` skills in order without stopping between
-routine phases. Each phase keeps its own workflow; autocomplete only sequences phases
-and enforces stop conditions.
+Autocomplete sequences existing `/rite-*` workflows and enforces stop
+conditions without pausing between routine phases.
 
-## Arm AFK
+## Arm AFK once
 
-Arm the gate policy up front; set the slice budget once the plan's count is known:
+Arm the gate policy up front without mutating it later:
 
 ```yaml
 allow_gates: [advisory]        # only advisory auto-handles; validating+ pause
 # notify: "<cmd>"              # optional — fired on any awaiting_human pause
-# max_slices: <N>              # the slice BUDGET — set from the plan's count after
-# $rite-define (or an explicit --max-slices). NOT a target decomposition; it only
-# caps how many run unattended (default = all the plan's slices).
+# max_slices: <N>              # include only for an explicit/configured cap
 ```
 
-The budget is the plan's slice count, so the loop builds the planned slices and stops
-when they are done. `--max-slices N` only lowers that number for a
-partial run. Arm the gate policy at step 3; write `max_slices` / `AFK slices remaining`
-**after `$rite-vet`** (it runs before the build loop and may split or add a slice, so the
-count isn't final until then: vet runs on every plan here, so always set the budget after it).
+Read an existing sentinel first. Preserve it byte-for-byte when valid; stop if its gate
+ceiling exceeds `advisory` or its `max_slices` conflicts with the invocation. If absent,
+write it once after clarity with `allow_gates: [advisory]` and an explicit
+`--max-slices N` only when supplied. The sentinel is read-only: never rewrite it after
+`$rite-vet` to inject a discovered plan count.
+
+### Derive the mutable post-vet budget
+
+After `$rite-vet`, count remaining pending slices and derive the run budget as the
+minimum of that count, an explicit `--max-slices`, and a configured sentinel cap. Before
+the first build dispatch, pre-seed `state.md` `afk_slices_remaining` when absent. If a
+valid remaining counter already exists, retain the lower of it and the derived budget;
+never increase or reinitialize it. This keeps the crash-survivable budget in its mutable owner
+without changing AFK configuration mid-run.
 
 `allow_gates: [advisory]` prevents an open `gate: validating` from being queued until
 seal, where it would force NO-GO under `afk-hitl.md`. Autocomplete pauses on it instead. Widen
-`allow_gates` only when the caller explicitly asks.
+`allow_gates` only outside autocomplete through an explicit human configuration change;
+autocomplete itself never widens the ceiling.
 
 ## Drive the phases
 
@@ -37,13 +44,13 @@ Read each phase's `SKILL.md` and execute that workflow. Workspace files such as
 | 2 | `$rite-clarify` | same interactive window: topology-first scan; write `decision-coverage.md`; proceed only on `CLEAR`, then arm AFK |
 | 3 | `$rite-temper` | significance-gated strategic review; harden spec + write `strategy.md`. Skip low-stakes specs in one line. AFK: `hold-rigor` / `reduce-to-MVP` auto-apply; **any `expand` pauses (blocking)**; irreversible-risk pauses |
 | 4 | `$rite-define` | reads `decision-coverage.md` + `strategy.md`; writes `plan.md` + `tasks.md`; records `Plan approved` |
-| 5 | `$rite-vet` | engineering/readiness review on **every** plan (light pass on simple plans, full on big/risky; never skipped); harden `plan.md` / `tasks.md` + write `eng-review.md` (`Implementation readiness: READY`) + `test-plan.md`. AFK: hardening / coverage findings auto-apply; **any scope-growing / acceptance-changing finding pauses (blocking)**; irreversible-risk pauses. Set the slice budget after this (vet may split a slice) |
-| 6 | `$rite-build` ×N | **loop** while any slice is `pending`; build one (the slice-wright reads `test-plan.md` for coverage), then run `devrites-engine tick-afk state.md`: exit 3 (budget hit) ⇒ STOP |
+| 5 | `$rite-vet` | engineering/readiness review on **every** plan (light pass on simple plans, full on big/risky; never skipped); harden `plan.md` / `tasks.md` + write `eng-review.md` (`Implementation readiness: READY`) + `test-plan.md`. AFK: hardening / coverage findings auto-apply; **any scope-growing / acceptance-changing finding pauses (blocking)**; irreversible-risk pauses. Derive and pre-seed the state-owned slice budget after this (vet may split a slice); never rewrite the AFK sentinel |
+| 6 | `$rite-build` ×N | **loop** while any slice is `pending`; build one, then let the root charge exactly one budget unit with the built-state record. Zero ⇒ STOP before another dispatch. |
 | 7 | `$rite-prove` | once all slices `built`; walks `test-plan.md`; on failure → `devrites-debug-recovery` within scope |
 | 8 | `$rite-polish` | re-verify after code edits (evidence must stay fresh) |
 | 9 | `$rite-review` | apply in-scope fixes; re-prove if code changed |
 | 10 | `$rite-seal` | GO/NO-GO decision (no git here) |
-| 11 | `$rite-ship` | only if seal GO; `--ship` auto-confirms type-GO, else stop for human |
+| 11 | `$rite-ship` | only if seal GO; `--ship` / `--yolo` never authorizes Git and only continues to the exact-plan literal-GO/native-approval boundary |
 
 ## Between phases
 

package/pack/generated/codex/skills/rite-autocomplete/reference/stop-conditions.md

@@ -1,8 +1,8 @@
 # Stop conditions: when autocomplete must pause for a human
 
-In the cases below, autocomplete writes `state.md` (`Status: awaiting_human` or
-`blocked`), reports the reason and one resume command, fires `notify` if set, and
-**stops**. `--ship` cannot bypass them.
+On these conditions, write `state.md` (`awaiting_human` or `blocked`), report
+the reason and one resume command, notify if configured, and stop. `--ship`
+cannot bypass them.
 
 ## Always stop (irreversible-risk list: from `afk-hitl.md`)
 
@@ -13,9 +13,8 @@ Regardless of `allow_gates` or `--ship`:
 - External-service contract change.
 - Filesystem destruction outside the workspace.
 
-Red tests/types/lint/build/browser proof are hard non-advance gates, not automatically human
-gates. Run bounded `devrites-debug-recovery`; if it exhausts, stop as a technical blocker unless
-the remaining issue is human-owned.
+Red checks are hard non-advance gates. Run bounded `devrites-debug-recovery`;
+on exhaustion, stop as a technical blocker unless human-owned.
 
 ## Stop on gate severity
 
@@ -26,11 +25,9 @@ the remaining issue is human-owned.
 
 ## Stop on strategic-review scope expansion (`$rite-temper`)
 
-- `$rite-temper` choosing scope mode `expand`, or otherwise **adding** any acceptance
-  criterion to `spec.md`: → synchronous pause, regardless of `allow_gates` / `--ship`.
-  Autocomplete may auto-apply only `hold-rigor` and `reduce-to-MVP` (they harden / prune and
-  never grow the build's scope); **growing scope unattended is never automatic**. A low-stakes
-  spec that temper skips, or a `hold-rigor` / `reduce-to-MVP` run, does **not** pause.
+- Any `expand` or added acceptance criterion pauses regardless of
+  `allow_gates`/`--ship`. Only `hold-rigor` and `reduce-to-MVP` auto-apply;
+  skipped low-stakes specs and those two modes do not pause.
 
 ## Stop on incomplete decision coverage (`$rite-clarify`)
 
@@ -44,21 +41,21 @@ the remaining issue is human-owned.
   direction. Do not round NO-GO up to GO.
 - **Spec Drift Guard fires** (`$rite-build` finds the plan is wrong and the change
   alters product behaviour) → stop; route through `$rite-plan repair`.
-- **Budget exhausted with slices still pending:** `devrites-engine tick-afk` exit 3 while `tasks.md`
-  still has unbuilt slices (only when an explicit `--max-slices` capped the run below the
-  plan's count) → stop; report slices remaining. Exhausting the default budget = all
-  planned slices built = normal completion → continue to `$rite-prove` without pausing.
+- **Budget exhausted with slices still pending:** any validated root-owned remaining
+  value of zero stops before the next dispatch. Report which bound won (pre-existing
+  remaining value, explicit flag, sentinel cap, or post-vet pending count) and the
+  unbuilt slices. A malformed value also fails closed. Zero with no pending slices is
+  normal completion → continue to `$rite-prove` without pausing.
 - **Still low-confidence after the interview:** the idea can't be pinned to testable
   acceptance criteria → stop and ask, rather than guessing the product.
-- **Repeated failure:** a phase fails, `devrites-debug-recovery` can't fix it within
-  scope after a bounded number of attempts → stop with the reproduction.
+- **Repeated failure:** bounded recovery exhausts → stop with reproduction.
 
 ## The final type-GO
 
-- Default: render the type-GO prompt at `$rite-ship` and **stop** for the human's
-  literal `GO`.
-- With `--ship` / `--yolo`: auto-confirm the type-GO (the *only* thing the flag changes).
-  Everything above still pauses.
+- `--ship` / `--yolo` never authorizes Git. Continue through ship preflight,
+  disclose the exact plan, then stop for literal `GO` and native approval.
+- Without either flag, stop at seal GO with `$rite-ship` as the resume command.
+  Seal GO, AFK, prior approval, and flags never satisfy ship approval.
 
 ## How to stop well