devrites 3.2.27 → 4.0.0

package/pack/generated/codex/skills/rite-review/SKILL.md

@@ -3,28 +3,8 @@ name: rite-review
 description: Review polished feature diff for correctness, readability, architecture, security, tests proving acceptance, Critical/Important findings, and quality dimensions before seal.
 argument-hint: "[scope: slice N | feature] [--full]"
 user-invocable: true
-required-agent-roles: devrites-spec-reviewer, devrites-code-reviewer
 ---
 
-## Codex compatibility
-
-This is the Codex mirror of a DevRites skill. In Codex:
-
-- Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
-- Installed `.agents/` mirrors may be Git-ignored. If a repository-aware file tool refuses an ignored path, read it with a native filesystem command instead; a tool refusal is not a completed task.
-- For automatic Engram calls, omit optional `project` and `session_id` unless an exact value came from Engram or repository configuration. Never derive either from `task_name`, a run ID, directory name, or normalized slug. Call `mem_session_summary` without them by default; on `unknown_session` or `unknown_project`, retry once with both optional fields omitted. If auto-detection is ambiguous, ask the user instead of guessing.
-- Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. A missing visible `agent_type` field is still V2—not capability loss, V1, or HITL—so send it anyway. If the named call rejects it, stop before any generic/default spawn. Codex loads the role TOML's `developer_instructions` natively; DevRites verifies the durable rollout, wait, completion, and delivered result.
-- Only after the runtime explicitly identifies MultiAgent V1, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
-- On explicitly identified MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`.
-- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
-- If the required dispatch for the explicitly identified runtime is unavailable or rejected, stop for HITL. Never switch runtime lanes. Never execute a DevRites specialist role in the root context.
-- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
-- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
-- When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
-
-
 # $rite-review: feature-scoped review
 
 Review the **active feature scope only**. **Read the active workspace first**; if none,
@@ -35,7 +15,9 @@ tell the user to run `$rite-spec <feature>`.
 > `.devrites/work/<slug>/spec.md` first, runs Spec ↔ Code-review axes as
 > parallel fresh-context reviewers (see [`parallel-dispatch.md`](../devrites-lib/reference/parallel-dispatch.md)), and gates feeding
 > into `$rite-seal`. Use `/code-review` for a one-off diff; use
-> `$rite-review` for a DevRites feature where the spec is the contract.
+> `$rite-review` for a DevRites feature where the spec is the contract. Use the shared depth rules in
+[`devrites-lib/reference/orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md);
+all workflow-named roles remain mandatory at every depth.
 
 ## Rules consulted (read on demand from `.agents/skills/devrites-lib/reference/standards/`)
 Pull these via `Read` when the diff demands them:
@@ -55,16 +37,19 @@ Pull these via `Read` when the diff demands them:
 - **Review the finished product.** `$rite-polish` has already simplified code and
   normalized or polished UI. If review finds a remaining complexity issue, record it as
   a finding rather than rerunning a simplification pass.
+- Follow the shared
+  [`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md).
+  Review starts only from the digest Polish closed.
 - Findings are labeled (below). Re-prove after any accepted correction.
-- **Reviewers judge; root reconciles; wright fixes.** Follow
-  [`agents.md`](../devrites-lib/reference/standards/agents.md). The root owns the verdict and
-  canonical writes; every accepted source/test correction routes to
-  `devrites-slice-wright`.
+- **Reviewers judge; root reconciles; wright fixes.** Per
+  [`agents.md`](../devrites-lib/reference/standards/agents.md), root directly
+  reconciles verdicts/writes artifacts; engines do not. Accepted corrections
+  route to `devrites-slice-wright`.
 
 ## Workflow
 0. Read `.agents/skills/devrites-lib/reference/standards/core.md` first (the always-on operating rules); pull the
    on-demand rules above as the diff demands them.
-   Then run `devrites-engine preamble` for deterministic workspace orientation.
+   Then read the explicit or active workspace's `state.md` directly.
 1. Read `spec.md`, `tasks.md`, `state.md`, `decisions.md`, `evidence.md`,
    `touched-files.md`, `.devrites/principles.md` (if present: the binding invariants to score
    the diff against), and the `git diff`. For "what would this change break"
@@ -72,7 +57,10 @@ Pull these via `Read` when the diff demands them:
    cross-checked with codegraph + graphify, else standard methods (LSP / Read/Grep/Glob); see
    `.agents/skills/devrites-lib/reference/standards/tooling.md`) over file reads;
    they answer impact/callers in one call. When a finding hinges on an external library's
-   current API, context7 if available can confirm the signature.
+   current API, context7 if available can confirm the signature. Run
+   `devrites-engine check candidate <slug>` and require its digest to match the
+   single `evidence.md` binding and the `browser-evidence.md` binding when that
+   file exists. A missing, malformed, or open candidate returns to Polish/Prove.
 2. **Review tests first:** do they prove the acceptance criteria? Missing,
    weak, or wrong tests are the first findings.
    **Completion:** every acceptance criterion maps to a proven test or a labeled finding.
@@ -81,8 +69,8 @@ Pull these via `Read` when the diff demands them:
    implements the wrong thing (Code-review pass, Spec fail), or code that does exactly
    what the spec asked but breaks project conventions (Spec pass, Code-review fail).
    Separate contexts prevent one axis from masking the other:
-   - Freeze the candidate and fresh-context dispatch **two** read-only reviewers in
-     parallel, each with its own `agent-packet/v1`, narrow brief, and no
+   - Freeze that closed digest and give the same digest to **two** read-only reviewers in
+     parallel, each with its own narrow brief and no
      cross-pollination:
      - **Spec axis** → `devrites-spec-reviewer`: "Apply your documented discipline on
        the active feature workspace + diff. Report (a) criteria the spec asked for that
@@ -106,7 +94,11 @@ Pull these via `Read` when the diff demands them:
    - **Do NOT merge or re-rank** their findings. Present them under separate
      `## Spec` and `## Code review` sub-sections in `review.md`. Surface contradictions
      between the axes explicitly (e.g. "Spec axis says complete, Code-review axis says
-     untestable"): `$rite-seal` decides what blocks.
+     untestable"): `$rite-seal` decides what blocks. Preserve each reviewer's
+     `Outcome:` and admit its account through
+     [`agents.md` § Result admission](../devrites-lib/reference/standards/agents.md#result-admission).
+     Either `Outcome: gap` stops Review; silence, failure, or malformed output never
+     becomes an empty findings list.
 4. **Reconcile, don't re-review.** With the two parallel reports in hand, the inline
    lead reconciles. It does **not** re-run the code-review axes over correctness /
    readability / architecture / maintainability that `devrites-code-reviewer` already
@@ -126,21 +118,14 @@ Pull these via `Read` when the diff demands them:
 6. **Performance:** apply `devrites-audit perf`
    ([performance-review](reference/performance-review.md)) only when performance is
    relevant or a regression risk is visible (measure first).
-7. Reconcile and accept only in-scope fixes. Consolidate them into one bounded wright
-   correction packet; never edit source in the reviewing context. Freeze the new candidate
-   and **run affected verification after changes** (`$rite-prove` logic), then perform at
-   most one narrow recheck of affected findings.
-8. The root updates `review.md`, `evidence.md`, and `state.md`.
+7. Reconcile and accept only in-scope fixes. Consolidate them into one bounded
+   wright correction; never edit source in the reviewing context. Any correction
+   updates the candidate manifest, returns through affected Prove, and then starts
+   a fresh Review on the new digest. Do not carry a prior reviewer account across it.
+8. The root updates `review.md` and `state.md`, writing exactly one candidate
+   binding in `review.md` for the digest given to every reviewer.
    **Completion:** the records name the reviewed candidate identity and every accepted
-   correction has affected proof plus its narrow recheck.
-9. **Require an account from every reviewer.** After `review.md` is written, run:
-   ```bash
-   devrites-engine review-integrity
-   devrites-engine review-fingerprints --write
-   ```
-   Exit 1 means an adversarial axis reported neither findings nor a justification. Re-run
-   that axis or add its `No-findings:` justification; do not carry a silent
-   axis into `$rite-seal` (where it surfaces as an Important).
+   correction has affected proof plus a fresh Review.
 
 ## Finding labels
 - **Critical:** must fix before seal (correctness/security/data loss).
@@ -155,22 +140,10 @@ change is already small: a pure noise-economics lever). Only a **`blocking` Crit
 seal; a `non-blocking` / `if-minor` finding is recorded, not a stop.
 
 ## Confidence and signal-to-noise
-Apply `$rite-vet`'s confidence rules. A reviewer that posts
-18 comments per PR teaches the team to ignore every one (below ~10% false-positive rate devs
-investigate each finding; past ~30% they label the tool noisy and skip it):
-- **Confidence-band each finding** (1-10) and state the band. A low-confidence finding (≤4)
-  you can't verify against the code is **suppressed**: roll it into one `Suppressed
-  (low-confidence): n` line, never raised as Critical/Important.
-- **Verify before you escalate.** Every Critical/Important quotes the spec line or cites the
-  `file:line` that proves it: no unverified blockers.
-- **Limit low-value comments.** Roll up trivia ("N style nits") into a single line; tooling already
-  catches style. Review's job is correctness + spec fidelity, not a lint dump.
-- **A silent axis is suspicious, not clean.** An adversarial axis that raises nothing must earn
-  it: end its `## Spec` / `## Code review` section with a **`No-findings:`** line naming the
-  passes it ran (missing/partial/incorrect for spec; edge cases, error paths, the riskiest
-  decision, a changed behavior whose test may not cover it for code) and why each came back
-  empty. Confidence bands suppress false positives; this requirement catches silent false
-  negatives ([`code-review.md` § Zero findings is suspicious](../devrites-lib/reference/standards/code-review.md)).
+Apply [`agents.md` § Result admission](../devrites-lib/reference/standards/agents.md#result-admission).
+Suppress unverifiable ≤4 hypotheses, require 7+ plus exact proof for
+Critical/Important, and make every silent/unusable account a blocking gap. Roll
+trivia into one line; review finds defects, not a quota.
 
 ## Severity orientation (labels, not score)
 
@@ -182,19 +155,4 @@ FYI` counts. There is no composite number. `$rite-seal` gates on
 
 ## Output → `review.md`
 
-Write the detailed review to `review.md`. In chat, run `devrites-engine progress` first, then use
-the shared completion reply contract
-([`devrites-lib/reference/reply-contract.md`](../devrites-lib/reference/reply-contract.md)).
-Default success shape:
-```
-Done: review complete for <slice N | feature>.
-Changed: review.md, review-fingerprints.jsonl, evidence.md <updated|n/a>, state.md
-Evidence: open findings Critical 0 / Important <non-blocking n> / Suggestion <n> / Nit <n> / FYI <n>; re-verification <cmd -> pass|n/a>
-Open: <none | non-blocking Important/Suggestion follow-ups>
-Next: $rite-seal
-Record: .devrites/work/<slug>/review.md
-↻ Hygiene: /compact (review findings) if fixing now; /clear if clean
-```
-If a blocking Critical or required re-proof remains, use the shared `Stopped /
-blocked` form and route `Fix:` to the single repair or `$rite-prove`; do not
-recommend `$rite-seal`.
+Write the detailed review to `review.md`.

package/pack/generated/codex/skills/rite-seal/SKILL.md

@@ -1,121 +1,69 @@
 ---
 name: rite-seal
-description: Decide GO / NO-GO readiness on the active feature. Use when the user asks "seal this", "GO / NO-GO", "decide if we can ship", "can we ship", or "safe to merge". Not for commit/push/tag/close; use $rite-ship.
+description: Decide GO/NO-GO for an active feature; $rite-ship owns commit, push, tag, and close.
 argument-hint: "[feature-slug] [--full]"
 user-invocable: true
-required-agent-roles: devrites-test-analyst
 ---
 
-## Codex compatibility
+# $rite-seal: GO / NO-GO
 
-This is the Codex mirror of a DevRites skill. In Codex:
+Verify the final candidate and write `seal.md`; `$rite-ship` alone performs
+authorized irreversible actions and close-out.
 
-- Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
-- Installed `.agents/` mirrors may be Git-ignored. If a repository-aware file tool refuses an ignored path, read it with a native filesystem command instead; a tool refusal is not a completed task.
-- For automatic Engram calls, omit optional `project` and `session_id` unless an exact value came from Engram or repository configuration. Never derive either from `task_name`, a run ID, directory name, or normalized slug. Call `mem_session_summary` without them by default; on `unknown_session` or `unknown_project`, retry once with both optional fields omitted. If auto-detection is ambiguous, ask the user instead of guessing.
-- Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. A missing visible `agent_type` field is still V2—not capability loss, V1, or HITL—so send it anyway. If the named call rejects it, stop before any generic/default spawn. Codex loads the role TOML's `developer_instructions` natively; DevRites verifies the durable rollout, wait, completion, and delivered result.
-- Only after the runtime explicitly identifies MultiAgent V1, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
-- On explicitly identified MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`.
-- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
-- If the required dispatch for the explicitly identified runtime is unavailable or rejected, stop for HITL. Never switch runtime lanes. Never execute a DevRites specialist role in the root context.
-- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
-- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
-- When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
+## Authority
 
+Read [`core.md`](../devrites-lib/reference/standards/core.md) plus only
+final-diff-relevant standards: agents, review, proof,
+browser, security, principles, docs, observability, deprecation, and Done.
+Load [`final-evidence.md`](reference/final-evidence.md) and
+[`go-no-go.md`](reference/go-no-go.md) for proof and verdict safety.
+Follow the shared
+[`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md) for
+the reviewed digest and artifact bindings.
 
-# $rite-seal: GO / NO-GO
+The host runs/reconciles named read-only reviewers; engine checks invariants.
+**Standard** is default; **Full** broadens conditional axes per
+[`devrites-lib/reference/orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md).
 
-The decision gate before shipping. **Read the active workspace first**; if none, tell
-the user to run `$rite-spec <feature>`. Produces `seal.md` with a clear verdict.
-`$rite-seal` **decides**; the irreversible git commit/push/tag and the task close-out
-live in `$rite-ship`, which refuses to run without a GO recorded here.
-
-## Rules consulted (read on demand from `.agents/skills/devrites-lib/reference/standards/`)
-**Step 0:** Read `.agents/skills/devrites-lib/reference/standards/core.md` first. The other rule files load on demand:
-pull these via `Read` before sealing:
-- `agents.md`: review-subagent fan-out at seal.
-- `code-review.md`: severity labels (Critical / Important / Suggestion / Nit / FYI).
-- `review-checklist.md`: compact final review pass/fail sweep.
-- `test-proof-checklist.md`: compact proof-quality gate for tests and evidence.
-- `browser-proof-checklist.md`: for UI scope, the browser-state and Visual Verdict gate.
-- `security-checklist.md`: when input / auth / data / integrations / secrets are in scope.
-- `principles.md`: declared project invariants (`.devrites/principles.md`) are a pass/fail gate; a diff that violates one with no recorded, human-approved exception is a NO-GO.
-- `documentation.md`: record decisions in `decisions.md` before sealing.
-- `observability.md`: a runtime surface that ships blind is an Important finding.
-- `deprecation.md`: when the diff removes / migrates code, API, or data (read with the
-  risk-and-rollback step below).
-- `definition-of-done.md`: standing Done bar: acceptance mapped, fresh proof, no open hard gates, scoped edits, rollback/docs where needed.
-
-
-## Operating rules
-- Evidence over confidence: a criterion is met only if evidence proves it.
-- Spec Drift Guard applies: unresolved drift is a NO-GO.
-- **Honest verdict.** DO NOT round a NO-GO up to GO to be agreeable.
-
-## Severity gate (the ship/no-ship rule)
-
-Read `review.md` and the latest reviewer outputs.
-
-| State | Gate result |
+## Gate
+
+| State | Verdict |
 |---|---|
-| `Critical == 0` and `Important == 0` and acceptance proven and drift resolved | **GO** (proceed) |
-| `Critical == 0` and `Important > 0` and acceptance proven and drift resolved | Render interactive prompt: *"`Important > 0` open. Proceed to seal? [y/N]"*. Default **N**. If the user types `y`, GO; otherwise NO-GO with the open Important findings listed as blockers-by-policy. |
-| `Critical > 0` | **NO-GO**, no exceptions. List every Critical with `file:line` and fix direction. |
-| Any acceptance criterion unproven, any bespoke `Prohibitions (must-NOT)` `resolved/test` row lacking linked proof, or any `plan.md` Key links row with no covering `EVID-###` wiring check (built-but-not-wired; `none declared` → n/a) | **NO-GO**, list the unproven criteria/prohibitions/links. |
-| Any criterion tagged `proof: judgment` in `evidence.md` (untagged reads `judgment`) | Judgment proof needs a human eye. HITL: enumerate them in the verdict digest: the human's GO covers them. AFK: **no auto-GO**: append a `gate: validating` question listing them and stop. |
-| Fan-out roster incomplete: `devrites-engine footprint roster` rc=3 (a reviewer neither dispatched nor skip-recorded) | **NO-GO** on the review's *completeness*, not a verdict on the diff: dispatch the missing reviewer or record a justified skip, then re-seal. Same standing as an unproven criterion. |
-| Silent review axis (`devrites-engine review-integrity` rc=1 (an adversarial axis in `review.md` reported nothing and justified nothing) | **Important**) a suspected rubber-stamp, on the review's *completeness* not the diff. Re-run that axis or record its `No-findings:` justification (`code-review.md` § Zero findings is suspicious), then re-seal. |
-| A declared extension check unaddressed (a valid `.devrites/extensions/*/component.yaml` declares `checks: at: seal` and `seal.md` records neither the check's outcome nor a skip justification | **Important**) same standing as a silent axis, on the review's *completeness*. Address the check's instruction or record why it doesn't apply, then re-seal. Checks are additive-only (an extension raises the bar, never lowers it); an extension that fails `extensions validate` has inactive checks, not a blocker. |
-| Visual Verdict `FAIL` on an acceptance-mapped UI criterion (`browser-evidence.md`) | **NO-GO**: an unmet acceptance criterion. A declared-state `FAIL` is Important (the `Important > 0` row). UI build with a `design-brief.md` but no Visual Verdict → Important evidence gap. No brief → not applicable. |
-| Diff violates a declared project principle (`.devrites/principles.md`) with no recorded, human-approved exception | **NO-GO**, list each violated principle with `file:line`. Same standing as an unproven criterion (absent / empty file → none declared → not a blocker). |
-| Unresolved drift in `drift.md` | **NO-GO**, route through `$rite-plan` first. |
-| Any `questions.md` entry with `gate: validating` and `status: open` | **NO-GO** regardless of behavior impact: an open validating gate is merge-blocking by definition. A slice marked `built (pending review)` is not done. |
-| A stood decision (boundary / data-model / auth / public-API / migration / branching) in the `decisions.md` `## Decisions stood` ledger with no recorded `devrites-doubt` verdict: `doubt: MISSING` / `doubt-coverage` rc=3 | **Important**. **NO-GO** when the undoubted decision is irreversible-risk (auth / public-API / migration), the same standing as an unproven acceptance criterion. Severity rides the unverified **decision**, not the exit code: `doubt-coverage` rc=1 (zero doubt dispatched) is a **prompt to verify**, not itself a finding: confirm against the ledger, where every-slice-trivial (`- none`) passes and a skipped triggering decision is the finding. |
-| `devrites-engine docs-stale` warns that user-facing CLI/API/install/docs-referenced code changed without README/docs updates | **FYI** unless the spec promised docs or users need docs to satisfy acceptance; then escalate to Important. |
-| Outside voice (`devrites-engine outside-voice`) is unavailable in `auto` mode | Advisory only; record `outside-voice: skipped-unavailable`. Disabled mode records `outside-voice: disabled`. |
+| Acceptance proven, deterministic checks pass, no unresolved drift or human gate, `Critical == 0`, `Important == 0` | **GO** |
+| Same, but `Important > 0` | Ask `Important findings remain. Proceed to seal? [y/N]`; default **N** |
+| `Critical > 0` | **NO-GO** |
+| Any acceptance criterion, resolved prohibition, or declared key link lacks proof | **NO-GO** |
+| Evidence is stale, or native diff review plus the exact test analyst finds weakened tests | **NO-GO: Critical** |
+| Any exact required reviewer account is missing or silent | **NO-GO** |
+| Any `gate: validating` question remains open | **NO-GO** |
+| Material UI acceptance lacks or fails required browser proof | **NO-GO** |
+| Unresolved drift, unsafe migration/removal, or unapproved principle violation remains | **NO-GO** |
+
+A judgment-only criterion needs the human eye; AFK records a validating question
+and stops.
 
 ## Workflow
 
-Before the verdict, run the deterministic advisory checks and record their outcomes in `seal.md`:
-```bash
-devrites-engine docs-stale; echo "docs-stale rc=$?"
-devrites-engine outside-voice; echo "outside-voice rc=$?"
-```
-If outside voice is `available`, ask the same artifacts/diff second opinion;
-findings stay advisory until verified with line quotes or accepted into the normal review pipeline.
-If `.devrites/extensions/` exists, read each valid extension's `component.yaml` for `checks:
-at: seal` entries and record every declared check's outcome (or skip justification) in `seal.md`.
-The severity gate treats an unaddressed one as Important.
-For developer-facing surfaces, compare `devex.md` predicted TTHW against the measured proof path and
-record the boomerang result.
-
-Run the full execution contract in
-[`reference/phase-contract.md`](reference/phase-contract.md). It is not optional:
-it contains the orientation, evidence, risk, reviewer fan-out, roster,
-review-integrity, verdict, convention, and learning steps for this gate.
-
-## On GO → hand off to $rite-ship
-
-`$rite-seal` makes the **decision** and stops. It does **not** run `git commit`,
-`git push`, `git tag`, publish, or deploy. Those moved to `$rite-ship`, which renders
-the type-GO prompt and refuses to run without a GO recorded here. Keeping the decision
-and the irreversible action as two separately-auditable steps is the point: a GO seal
-is a verdict, not an authorization to push.
-
-On **GO**: write `seal.md`, set `state.md` `Next step: $rite-ship`, and tell the user
-the feature is cleared to ship. Do **not** set phase `done`: `$rite-ship` marks done
-after the task is shipped and archived. The `Important > 0` interactive y/N earlier in
-the gate is the one off-ramp seal still owns; the type-GO off-ramp now lives in ship.
-For a **UI feature**, note in the hand-off that `$rite-ship` offers an optional
-**design-memory** rollup: persist this feature's proven design language into a project
-`DESIGN.md` so later features inherit it (`../rite-ship/reference/design-memory.md`).
+Follow [`reference/phase-contract.md`](reference/phase-contract.md):
+
+1. read workspace and final diff;
+2. recheck the canonical candidate/bindings and approved repository/CI proof;
+3. dispatch exact proof, spec, test, doubt, and applicable review agents;
+4. reconcile their read-only verdicts against source and immutable evidence;
+5. draft GO/NO-GO `seal.md` with acceptance, tests, decisions, and seven accounts;
+6. write exactly one candidate binding, then run
+   `devrites-engine check seal <slug>` for structure and identity, never semantics.
+
+Any candidate correction returns through affected Prove and a fresh Review before
+Seal starts again.
+
+Only repository scripts/CI authorize commands; never guess them.
+
+## On GO
+
+Set `state.md` `Next step: $rite-ship` and stop. A GO is a verdict, not
+authorization to perform an irreversible action.
 
 ## Output
 
-Use the full output contract in [`reference/output.md`](reference/output.md).
-It preserves the progress-first GO / NO-GO shape, uses the shared completion
-reply contract
-([`devrites-lib/reference/reply-contract.md`](../devrites-lib/reference/reply-contract.md)),
-and keeps the boundary that `$rite-seal` decides only; `$rite-ship` executes.
+Use [`reference/output.md`](reference/output.md).

package/pack/generated/codex/skills/rite-seal/reference/anti-patterns.md

@@ -16,7 +16,7 @@ see [standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-pat
 | "Drift is small; resolve it inline and seal." | Unresolved drift = NO-GO, no exceptions. Route through `$rite-plan` to repair, then seal. |
 | "Reviewer findings overlap; average them away." | Surface disagreements explicitly. Averaging hides where the reviewers disagree. |
 | "Carry the old reviewer verdicts though the diff changed." | If the diff changed since `$rite-review`, re-run the Spec + Code axes: don't carry stale verdicts forward. |
-| "Build never doubted a decision, but the wright seemed confident. GO without checking." | Doubt is a gate, not a vibe. `doubt-coverage` rc=1 (or a stood boundary / data-model / auth / public-API / migration decision in `decisions.md` with no recorded `devrites-doubt` verdict) is an Important finding, escalating to NO-GO when the undoubted decision is irreversible-risk (auth / public-API / migration). An empty `Decisions stood` on every slice passes only when confirmed against `decisions.md`, never assumed. |
+| "The wright was confident in a material decision. GO without independent review." | Confidence is not independent evidence. Ask the exact `devrites-doubt-reviewer` to test a boundary / data-model / auth / public-API / migration claim, reconcile its result against source, and record the verdict in `decisions.md`; unresolved irreversible risk is NO-GO. |
 
 ## Red Flags
 
@@ -26,4 +26,4 @@ see [standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-pat
 - `seal.md` written before walking *every* acceptance criterion one by one.
 - A NO-GO rounded up to GO "to be agreeable".
 - Unresolved drift, unresolved questions, or pending tasks, and you're sealing anyway.
-- `doubt-coverage` rc=1 left unexamined, or a stood irreversible-risk decision (auth / public-API / migration) carrying no recorded `devrites-doubt` verdict, and you're sealing GO anyway.
+- A stood irreversible-risk decision (auth / public-API / migration) has no recorded independent `devrites-doubt` verdict, and you are sealing GO anyway.

package/pack/generated/codex/skills/rite-seal/reference/final-evidence.md

@@ -1,63 +1,38 @@
 # Final evidence check
 
-The seal verifies that every promise in `spec.md` is backed by evidence in the workspace.
-
-## Acceptance-criteria pass
-Walk `spec.md` → "Acceptance criteria" one by one. For each:
-- Find the proving evidence in `evidence.md` / `browser-evidence.md` (command output,
-  observation, screenshot described).
-- Mark `[x]` + the evidence, or `[ ] unproven` + why.
-- A criterion "proven" only by reading the code is **not proven**: require a runtime/
-  test artifact, or downgrade it.
-- Hold the claim→evidence line: **"tests pass" is not "the feature works"** (the acceptance
-  walk is); **"bug fixed"** requires the original-symptom test now passing, not "code changed,
-  assumed fixed"; **"the agent reported success"** is never evidence: the command output is.
-
-Tag each new-workspace criterion `AC-###` in `spec.md` and carry the same id onto its checked line in
-`seal.md`, then grade coverage deterministically: every spec criterion id must be checked:
-```bash
-devrites-engine check-acceptance .devrites/work/<slug>   # exit 1 = a criterion is uncovered/unproven → NO-GO
-```
+Map every `spec.md` promise to fresh observed proof.
 
-## Cross-check the artifacts
-- `tasks.md`: are all slices in scope `built` AND is feature acceptance proven
-  (`evidence.md`)? Acceptance proof lives at the feature level, not per slice: a slice
-  is `built`, the feature is proven. Any pending slice that's part of this feature's
-  definition of done is a gap.
-- `review.md`: are all **Critical** and **Important** findings resolved (or accepted)?
-- `drift.md`: every entry marked resolved? Open drift blocks.
-- `questions.md`: any open question that changes behavior? Blocks. **Any entry with
-  `gate: validating` and `status: open` is a NO-GO regardless of behavior impact**: an
-  open validating gate is merge-blocking by definition; a slice marked
-  `built (pending review)` is not done.
-- `polish-report.md` (if UI): normalize+polish done, browser evidence present.
-- `references/` (if the spec gathered design references): does the built UI **match the
-  agreed references**? A mismatch on a referenced screen is a finding.
-
-## Evidence freshness: a GATE, not a courtesy
-Evidence must post-date the code it proves. **If `evidence.md` or `browser-evidence.md`
-predates the latest edit to any file in `touched-files.md`** (e.g. a polish- or
-review-phase edit landed after `$rite-prove`), a fresh `$rite-prove` run is **REQUIRED
-before GO**: stale evidence is not proof. Compare the evidence timestamps against the
-touched-files mtimes; if any code edit is newer, the proof is stale and this is a NO-GO
-until re-proven. Record the fresh result.
-
-Run the deterministic check rather than eyeballing mtimes:
-```bash
-devrites-engine evidence-fresh   # exit 3 = STALE proof → NO-GO until $rite-prove re-runs
-```
+## Acceptance
+
+For each AC/REQ/scenario/key link, exact `devrites-proof-runner` maps immutable
+results and exact `devrites-spec-reviewer` checks implementation and proof
+against its meaning. Bug fixes require original-symptom proof; self-report,
+inspection alone, and generic "tests pass" do not count.
+
+Behavioral claims require positive, discriminating evidence under `testing.md`.
+Skipped/focused/filtered/pending, zero-test, assertion-free, tautological, unexecuted, or
+exit-only results are unproven. Static gates prove only their named static criterion;
+discriminating shell/golden/text assertions remain valid for textual or CLI acceptance.
+
+## Cross-check
+
+Require built slices, resolved or accepted findings, no drift/open validating
+question, required UI/boundary proof, and an exact doubt verdict per stood decision.
+
+## Candidate binding and test integrity
+
+Run `devrites-engine check candidate <slug>` and require its digest to match the
+single evidence/review bindings and browser binding when present. Diff tests,
+dispatch exact `devrites-test-analyst`, run approved repository commands, then
+require the same candidate digest and no source mutation. Deleted/skipped/focused/
+weakened/tautological tests are Critical.
+
+After the native semantic verdicts are recorded in `seal.md`, run:
 
-## Test integrity & mutation: the suite must be real
-Stale proof isn't the only path to a false GO; a *weakened* test suite is. Run the deterministic
-gates:
 ```bash
-devrites-engine test-integrity; echo "test-integrity rc=$?"   # exit 3 = a test deleted/skipped/loosened → Critical NO-GO
-devrites-engine mutation-gate   # changed-files mutation score — band the verdict; survivors are unproven behaviours
+devrites-engine check seal "<slug>"
 ```
-A test weakened since the slice base is a **Critical NO-GO**: the suite went green by lowering the
-bar, not by the code being right. Record the mutation score in `seal.md`; under
-`DEVRITES_MUTATION=enforce` a sub-threshold score blocks GO.
 
-## Output into seal.md
-The "Acceptance Criteria" and "Verification Evidence" sections of `seal.md` come
-straight from this check. Unproven critical criteria → list them as **blockers**.
+This checks structure and exact candidate bindings, never acceptance, test
+quality, doubt, or review. Mutation stays optional unless project policy or
+`test-plan.md` requires it.

package/pack/generated/codex/skills/rite-seal/reference/go-no-go.md

@@ -1,53 +1,29 @@
 # GO / NO-GO
 
-The seal verdict is binary and evidence-based. When in doubt, NO-GO with a clear blocker
-list beats a hopeful GO. The **authoritative gate is the severity table in
-[`../SKILL.md`](../SKILL.md) ("Severity gate")**; this file is the rationale behind it: keep
-the two in sync.
-
-## NO-GO if any of these hold
-- A **critical acceptance criterion is unproven** (no evidence, or evidence shows fail).
-- **Tests or build fail** without an explicit, user-accepted risk.
-- The UI **cannot be verified** and the UI risk is material (visible/important surface), or a
-  Visual Verdict `FAIL` lands on an acceptance-mapped UI criterion (`browser-evidence.md`).
-- **Unresolved spec drift** remains (a known-wrong plan or an open behavior question).
-- A **security-critical issue** remains (auth bypass, data exposure, injection).
-- A **data migration or destructive change lacks a rollback plan**.
-- A **declared project principle is violated** (`.devrites/principles.md`) with no recorded,
-  human-approved exception: same standing as an unproven criterion (absent / empty file →
-  none declared → not a blocker).
-- A **stood decision was never independently doubted**. This means a `## Decisions stood` entry in
-  `decisions.md` carries `doubt: MISSING`, or `devrites-engine doubt-coverage` returns rc=3, when that decision
-  is irreversible-risk (auth / public-API / migration). Severity rides the undoubted decision,
-  not the exit code.
-- Any `questions.md` entry with `gate: validating` and `status: open`. **NO-GO
-  regardless of behavior impact** (an open validating gate is merge-blocking by
-  definition). A slice marked `built (pending review)` is not done.
-- A **test was weakened to go green** (`devrites-engine test-integrity` exit 3: a test deleted, skipped,
-  `xfail`-ed, or de-asserted since the slice base). A suite that passes on a lowered bar is not
-  proof; this is a Critical NO-GO.
-- Under `DEVRITES_MUTATION=enforce`, a **mutation score below threshold** (`devrites-engine mutation-gate`
-  exit 3: survived mutants are behaviours no test checks).
-
-## GO requires
-- Every critical acceptance criterion checked with evidence attached.
-- Tests + build green for the scope (or documented, user-accepted exceptions).
-- Browser proof present for material UI (or an explicit, accepted manual-only note).
-- No open questions/drift that change product behavior.
-- Security/data/migration risks either resolved or explicitly accepted by the user with
-  a rollback path.
-
-## Important findings (`Critical == 0`, `Important > 0`)
-Open `Important` findings do not auto-pass. With acceptance proven and drift resolved, render
-the interactive prompt *"`Important > 0` open. Proceed to seal? [y/N]"*: default **N**. `y`
-→ GO; otherwise NO-GO with the open Important findings listed as blockers-by-policy. Don't
-silently fold Important findings into a GO.
-
-## Conditional GO
-If only **non-blocking follow-ups** remain, it's a GO with a recorded follow-up list:
-not a NO-GO. Distinguish "must fix to ship" (blocker) from "should do next" (follow-up).
-
-## Honesty
-- Don't upgrade a NO-GO to GO to please the user. State blockers plainly.
-- Don't claim evidence you don't have. "Unproven" is a valid, important status.
-- If subagent reviewers disagree, surface the disagreement and decide explicitly.
+[`../SKILL.md`](../SKILL.md) owns gates. Draft native acceptance, test, doubt,
+and seven reviewer accounts in `seal.md`; then run
+`devrites-engine check seal <slug>` for structure/freshness.
+
+## NO-GO
+
+NO-GO on unproven acceptance/prohibitions/key links, red repository checks,
+stale proof, drift/open validating questions, Critical code/security, unsafe
+rollback, or an unapproved principle violation. Also block:
+- missing/adverse exact proof, spec, or test verdict;
+- deleted/skipped/focused/tautological/weakened tests;
+- missing/silent required review or invalid conditional account;
+- a stood decision without reconciled exact doubt verdict;
+- opted-in mutation missing/below threshold (otherwise optional).
+
+## GO
+
+GO needs fresh acceptance, green proof, resolved drift/human gates, acceptable
+security/data/rollback risk, every account, and no Critical.
+
+When only Important findings remain, ask:
+
+```text
+Important findings remain. Proceed to seal? [y/N]
+```
+
+Default NO-GO. `y` accepts named Important risks only, never Critical/missing proof.

package/pack/generated/codex/skills/rite-seal/reference/output.md

@@ -1,7 +1,5 @@
 # rite-seal output
 
-Run `devrites-engine progress` first, then render the canonical
-[`GO`](../../devrites-lib/reference/reply-contract.md#go) or
-[`NO-GO`](../../devrites-lib/reference/reply-contract.md#no-go) typed template.
+Use the shared [GO or NO-GO reply contract](../../devrites-lib/reference/reply-contract.md).
 
-Do not imply anything shipped. `$rite-seal` decides only; `$rite-ship` executes.
+Do not imply anything shipped. `$rite-seal` decides; `$rite-ship` executes.