devrites 3.2.28 → 4.0.0

package/scripts/check-reference-governance.mjs

@@ -1,83 +0,0 @@
-#!/usr/bin/env node
-// Ensure supporting skill references are reachable or explicitly time-bounded.
-import { existsSync, readFileSync, readdirSync } from 'node:fs';
-import { basename, dirname, join, normalize, relative, resolve, sep } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const defaultRoot = fileURLToPath(new URL('..', import.meta.url));
-const argv = process.argv.slice(2);
-function option(name, fallback) {
-  const i = argv.indexOf(name);
-  return i >= 0 ? argv[i + 1] : fallback;
-}
-const skillsDir = resolve(option('--skills-dir', join(defaultRoot, 'pack', '.claude', 'skills')));
-const allowlistPath = resolve(option('--allowlist', join(defaultRoot, 'tests', 'reference-orphan-allowlist.json')));
-
-function markdownFiles(dir) {
-  const files = [];
-  for (const entry of readdirSync(dir, { withFileTypes: true })) {
-    const file = join(dir, entry.name);
-    if (entry.isDirectory()) files.push(...markdownFiles(file));
-    else if (entry.isFile() && entry.name.endsWith('.md')) files.push(normalize(file));
-  }
-  return files;
-}
-
-const files = markdownFiles(skillsDir);
-const fileSet = new Set(files);
-const byBase = new Map();
-for (const file of files) byBase.set(basename(file), [...(byBase.get(basename(file)) || []), file]);
-const entries = files.filter((file) => basename(file) === 'SKILL.md');
-const reachable = new Set(entries);
-const queue = [...entries];
-const markdownLink = /\]\(([^)#]+\.md)(?:#[^)]*)?\)/g;
-const backtickPath = /`([A-Za-z0-9._/\-]+\.md)`/g;
-
-function candidates(from, token) {
-  if (/^(?:https?:|mailto:)/.test(token)) return [];
-  if (token.startsWith('.claude/skills/')) return [join(skillsDir, token.slice('.claude/skills/'.length))];
-  if (token.includes('/')) return [resolve(dirname(from), token)];
-  return byBase.get(token) || [];
-}
-
-while (queue.length) {
-  const from = queue.shift();
-  const text = readFileSync(from, 'utf8');
-  const tokens = [
-    ...[...text.matchAll(markdownLink)].map((match) => match[1]),
-    ...[...text.matchAll(backtickPath)].map((match) => match[1]),
-  ];
-  for (const token of tokens) {
-    for (const candidate of candidates(from, token)) {
-      const file = normalize(candidate);
-      if (fileSet.has(file) && !reachable.has(file)) {
-        reachable.add(file);
-        queue.push(file);
-      }
-    }
-  }
-}
-
-const allowlist = existsSync(allowlistPath) ? JSON.parse(readFileSync(allowlistPath, 'utf8')) : {};
-const today = new Date().toISOString().slice(0, 10);
-let failures = 0;
-function fail(message) { console.error(`FAIL: ${message}`); failures++; }
-for (const [file, exception] of Object.entries(allowlist)) {
-  if (!exception || !exception.owner || !exception.reason || !/^\d{4}-\d{2}-\d{2}$/.test(exception.expires || '')) {
-    fail(`${file}: orphan exception requires owner, reason, and YYYY-MM-DD expires`);
-  } else if (exception.expires < today) {
-    fail(`${file}: orphan exception expired ${exception.expires}`);
-  }
-}
-const orphans = files.filter((file) => basename(file) !== 'SKILL.md' && !reachable.has(file));
-for (const file of orphans) {
-  const rel = relative(skillsDir, file).split(sep).join('/');
-  if (!(rel in allowlist)) fail(`${rel}: unreachable reference`);
-}
-for (const file of Object.keys(allowlist)) {
-  if (!orphans.some((orphan) => relative(skillsDir, orphan).split(sep).join('/') === file)) {
-    fail(`${file}: orphan exception is stale; reference is reachable or gone`);
-  }
-}
-console.log(`reference-governance: ${files.length - entries.length} references, ${orphans.length} orphan(s)`);
-process.exit(failures ? 1 : 0);

package/scripts/check-reply-contract.sh

@@ -1,64 +0,0 @@
-#!/usr/bin/env bash
-# check-reply-contract.sh: keep user-facing rite-* completion replies normalized.
-
-set -u
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-SKILLS="${DEVRITES_SKILLS_DIR:-$ROOT/pack/.claude/skills}"
-CONTRACT="devrites-lib/reference/reply-contract.md"
-fail=0
-
-bad() {
-  printf 'FAIL: %s\n' "$*"
-  fail=1
-}
-
-for f in "$SKILLS"/rite*/SKILL.md; do
-  [ -f "$f" ] || continue
-  rel="${f#"$ROOT"/}"
-
-  if grep -qE '^## Output' "$f"; then
-    if ! grep -q "$CONTRACT" "$f" && ! grep -q 'Reply-contract exception:' "$f"; then
-      bad "$rel has ## Output but does not reference $CONTRACT or declare Reply-contract exception"
-    fi
-  fi
-
-  case "$rel" in
-    pack/.claude/skills/rite/SKILL.md)
-      continue
-      ;;
-  esac
-
-  # Obvious menu-style next actions make lifecycle replies hard to scan. The
-  # contract allows one command only; alternates belong in Open/Alternative.
-  if grep -nE '^Next:[^`]*(/rite-[^[:space:]]+)[^`]*([[:space:]]or[[:space:]]|[[:space:]]/[[:alnum:]_-]+| · |→)' "$f" >/tmp/dr_reply_next 2>/dev/null; then
-    bad "$rel has ambiguous Next: wording:"
-    sed "s|$ROOT/||" /tmp/dr_reply_next
-  fi
-
-  if grep -q 'Reply-contract exception:' "$f" || [ "$rel" = "pack/.claude/skills/rite-status/SKILL.md" ]; then
-    continue
-  fi
-  if awk '
-    /^```/ {
-      if (inside && done && bad) exit 0
-      inside = !inside
-      done = bad = 0
-      next
-    }
-    inside && /^Done:/ { done = 1 }
-    inside && tolower($0) ~ /(^|[^a-z])(fail|not run|blocker|blocked|unproven|awaiting|spec drift|re-prove needed)([^a-z]|$)/ { bad = 1 }
-    inside && /Critical <n>|principle violations <n>|boundary held <yes\|no>/ { bad = 1 }
-    END { exit !(inside && done && bad) }
-  ' "$f"; then
-    bad "$rel puts an unresolved state in a Done template; use Awaiting/Stopped/NO-GO"
-  fi
-done
-
-if [ "$fail" -eq 0 ]; then
-  printf 'reply-contract: PASS\n'
-else
-  printf 'reply-contract: FAIL\n'
-fi
-
-exit "$fail"

package/scripts/check-rule-uniqueness.sh

@@ -1,45 +0,0 @@
-#!/usr/bin/env bash
-# scripts/check-rule-uniqueness.sh: assert each canonical principle heading
-# appears in exactly one canonical file under pack/.claude/.
-#
-# Drift catcher: if someone re-duplicates a principle's full treatment, this
-# script fails and names the offenders. Cross-link summaries are fine: they
-# don't use the canonical heading.
-#
-# Usage:
-#   scripts/check-rule-uniqueness.sh
-# Exits non-zero if any principle is duplicated or missing from its canonical
-# home. Add new entries to PRINCIPLES below as principles get a canonical
-# home.
-
-set -u
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-PACK="$ROOT/pack/.claude"
-
-# Format: <grep-pattern>|<canonical-relative-path>
-PRINCIPLES=(
-  '^## Reuse before you write|pack/.claude/skills/devrites-lib/reference/standards/coding-style.md'
-  '^## Trust boundary (three tiers)|pack/.claude/skills/devrites-lib/reference/standards/security.md'
-  '^## Universal rationalizations|pack/.claude/skills/devrites-lib/reference/standards/anti-patterns.md'
-)
-
-fail=0
-
-for entry in "${PRINCIPLES[@]}"; do
-  pattern="${entry%%|*}"
-  canonical="${entry##*|}"
-  # Use literal-string grep (-F) to avoid regex meta-char surprises in headings.
-  # Match anchored to line start by adding the '## ' prefix ourselves.
-  needle="${pattern#^}"
-  matches="$(grep -rln -F -- "$needle" "$PACK"/skills "$PACK"/agents 2>/dev/null | sort -u)"
-  count="$(printf '%s\n' "$matches" | grep -c .)"
-  if [ "$count" -eq 1 ] && [ "$matches" = "$ROOT/$canonical" ]; then
-    printf 'ok: unique heading "%s" (canonical: %s)\n' "$needle" "$canonical"
-  else
-    printf 'FAIL: heading "%s" should appear only in %s; found in:\n' "$needle" "$canonical" >&2
-    printf '%s\n' "$matches" | sed 's|^|    |' >&2
-    fail=1
-  fi
-done
-
-exit "$fail"

package/scripts/devrites-detect.sh

@@ -1,176 +0,0 @@
-#!/usr/bin/env bash
-# scripts/devrites-detect.sh: deterministic anti-slop detector.
-#
-# Greps the current git diff (or a passed file list) for ~25 actionable
-# anti-slop patterns from rite-polish/reference/anti-ai-slop.md +
-# devrites-frontend-craft/reference/quality-standards.md. No LLM needed.
-#
-# Exits 0 if no findings, 1 if any (so a pre-push hook can block).
-# Use --advisory to always exit 0 (CI does this).
-#
-# Usage:
-#   scripts/devrites-detect.sh                # diff vs upstream / HEAD~
-#   scripts/devrites-detect.sh file1 file2    # check specific files
-#   scripts/devrites-detect.sh --advisory     # report-only, never fail
-
-set -euo pipefail
-
-ADVISORY=0
-FILES=()
-
-for arg in "$@"; do
-  case "$arg" in
-    --advisory) ADVISORY=1 ;;
-    *)          FILES+=("$arg") ;;
-  esac
-done
-
-# Resolve which files to scan: explicit args, else diff against the base.
-if [[ ${#FILES[@]} -eq 0 ]]; then
-  BASE=""
-  for candidate in origin/main origin/master main master HEAD~1; do
-    if git rev-parse --verify "$candidate" >/dev/null 2>&1; then
-      BASE="$candidate"
-      break
-    fi
-  done
-  if [[ -n "$BASE" ]]; then
-    mapfile -t FILES < <(git diff --name-only --diff-filter=ACMR "$BASE" 2>/dev/null || true)
-  fi
-fi
-
-# Filter into two scan lists: code/UI source (most rules) and markdown
-# (em-dash overuse only). Meta / reference docs are excluded from the markdown
-# scan because they discuss the patterns under audit.
-SCAN=()
-SCAN_MD=()
-for f in "${FILES[@]}"; do
-  [[ -z "$f" ]] && continue
-  [[ ! -f "$f" ]] && continue
-  case "$f" in
-    *.lock|*.png|*.jpg|*.jpeg|*.gif|*.svg|*.ico|*.woff*|*.ttf|*.zip|*.gz) continue ;;
-    *vendor/*|*node_modules/*|*dist/*|*build/*|*.min.*)                   continue ;;
-  esac
-  case "$f" in
-    *.md)
-      case "$f" in
-        REVIEW.md|CHANGELOG.md|res.md)                                 continue ;;
-        .review-notes/*|*/.review-notes/*)                             continue ;;
-        pack/.claude/skills/devrites-lib/reference/standards/*|*/pack/.claude/skills/devrites-lib/reference/standards/*)                   continue ;;
-        pack/.claude/skills/*|*/pack/.claude/skills/*)                 continue ;;
-      esac
-      SCAN_MD+=("$f")
-      ;;
-    *)
-      SCAN+=("$f")
-      ;;
-  esac
-done
-
-if [[ ${#SCAN[@]} -eq 0 && ${#SCAN_MD[@]} -eq 0 ]]; then
-  echo "devrites-detect: no files to scan."
-  exit 0
-fi
-
-# Each rule: pattern (ERE), severity, message.
-# Severity = critical (auth/safety), high (slop tell), low (style nit).
-RULES=(
-  # --- UI anti-slop (CSS-ish) ---
-  '#000([^0-9a-f]|$)|#fff([^0-9a-f]|$)|#000000|#ffffff'                            'high'  'Pure #000 / #fff: use near-black / near-white tokens.'
-  '#6366f1|#8b5cf6|#a855f7|#d946ef|#ec4899'                                        'high'  'Purple/blue gradient hex range: likely default AI palette.'
-  'background-clip:[[:space:]]*text|-webkit-background-clip:[[:space:]]*text'      'high'  'Gradient text decoration: likely AI slop.'
-  'backdrop-filter:[[:space:]]*blur'                                               'high'  'Glassmorphism `backdrop-filter: blur(...)`: banned default surface.'
-  'border-left:[[:space:]]*[1-6]px[[:space:]]+solid|border-l-[2-8]'                'low'   'Side-stripe accent border: common templating tell; confirm vs design system.'
-  'cubic-bezier\([^)]*0\.34[[:space:]]*,[[:space:]]*1\.56'                         'high'  'Bounce/elastic easing curve: banned unless design system uses it.'
-  'animation-duration:[[:space:]]*[5-9][0-9]{2}ms[[:space:]]*;[[:space:]]*animation-delay'  'low'   'Long animation durations stacked: verify motion budget.'
-  'z-index:[[:space:]]*[0-9]{4,}'                                                  'high'  'Raw z-index in the 1000s: use semantic z scale.'
-  'font-family:[[:space:]]*"?(DM Sans|Plus Jakarta|Fraunces|Newsreader)'           'high'  'Reflex font choice: use the project type system.'
-  'text-transform:[[:space:]]*uppercase[[:space:]]*;[^}]*letter-spacing'           'low'   'All-CAPS with letter-spacing: verify register; banned for body text.'
-  # --- Code anti-slop ---
-  '\bconsole\.log\('                                                               'high'  'console.log left in code: remove before polish.'
-  'if[[:space:]]*\([[:space:]]*[a-zA-Z_][a-zA-Z0-9_]*[[:space:]]*&&[[:space:]]*[a-zA-Z_][a-zA-Z0-9_]*\.length[[:space:]]*>[[:space:]]*0' 'high' 'Over-defensive `x && x.length > 0`: validate at boundaries.'
-  '\bcatch[[:space:]]*\([[:space:]]*\)[[:space:]]*\{[^}]*\}'                       'high'  'Blanket catch with no narrow handling: likely swallowing errors.'
-  '\bcatch[[:space:]]*\([[:space:]]*[A-Za-z][A-Za-z0-9_]*[[:space:]]*\)[[:space:]]*\{[[:space:]]*\}'  'high'  'Empty catch body: silently swallows errors. Catch narrow; recover or rethrow.'
-  '//[[:space:]]*helper function|//[[:space:]]*increment'                          'low'   'Tutorial-style comment: restates code; remove.'
-  '^[[:space:]]*(//|#)[[:space:]]*(Now (I('"'"'ll| will)|we('"'"'ll| will))|Updated|Added|Changed|Modified|As requested|Step [0-9]+:)'  'low'   'Diff-narrating comment: describe the current constraint or delete it.'
-  '\bfunction[[:space:]]+(process|handle|do)(Data|Item|Thing|It)?\b'               'high'  'Generic AI naming (`processData` / `handleItem` / `doIt`): name for intent.'
-  '\bfunction[[:space:]]+get[A-Z][a-zA-Z]*\([^)]*\)[[:space:]]*\{[[:space:]]*return[[:space:]]+[A-Z][a-zA-Z]+\.find'  'low'   'Useless wrapper around a single ORM call: inline.'
-  '//[[:space:]]*TODO:[[:space:]]*(improve|cleanup|refactor)[[:space:]]+(this|later)'  'low'   '"TODO: improve this later": without owner/issue, this rots.'
-  '\btemp\s*=|\bresult\s*=|\bdata\s*=[^=]'                                         'low'   'Generic local name (temp/result/data): name for intent.'
-  '\binterface[[:space:]]+I[A-Z][a-zA-Z]+\b'                                       'low'   '`IFoo` prefix on interfaces: most modern style guides prefer `Foo`.'
-  '/\*\s*eslint-disable\s*\*/'                                                     'high'  'Global eslint-disable: explain or remove.'
-  # --- Security ---
-  '\bnew Function\('                                                               'critical' '`new Function(...)`: dynamic code construction.'
-  '\beval\s*\('                                                                    'critical' '`eval(...)`: avoid.'
-  '\bdangerouslySetInnerHTML\b'                                                    'high'  'dangerouslySetInnerHTML: confirm XSS-safe.'
-  'process\.env\.[A-Z_]+(.{0,40}(?:console|res\.send|res\.json))'                  'high'  'env var possibly echoed to response/log: re-check for secret leakage.'
-  # --- Performance pitfalls ---
-  '\.forEach\([^)]+\)\s*\.\s*forEach\('                                            'low'   'Nested `forEach`: accidental quadratic loop?'
-)
-
-# Markdown-only rules. Run against SCAN_MD, not SCAN.
-# Em-dash overuse: 2+ em-dashes (U+2014) on the same line: the per-line proxy
-# for the "multiple em-dashes per paragraph" rule in anti-ai-slop.md.
-MD_RULES=(
-  $'.*\xe2\x80\x94.*\xe2\x80\x94'  'high'  'Em-dash overuse on one line (2+ em-dashes): a common AI tell; prefer comma, period, or parenthetical.'
-)
-
-FOUND=0
-
-# Code rules against code files.
-if [[ ${#SCAN[@]} -gt 0 ]]; then
-  N=${#RULES[@]}
-  i=0
-  while (( i < N )); do
-    pat="${RULES[$i]}"
-    sev="${RULES[$((i+1))]}"
-    msg="${RULES[$((i+2))]}"
-    i=$((i+3))
-
-    HITS="$(grep -HnIE --color=never "$pat" "${SCAN[@]}" 2>/dev/null || true)"
-    [[ -z "$HITS" ]] && continue
-
-    while IFS= read -r line; do
-      [[ -z "$line" ]] && continue
-      FOUND=$((FOUND + 1))
-      printf '[%s] %s: %s\n' "$sev" "$line" "$msg"
-    done <<<"$HITS"
-  done
-fi
-
-# Markdown rules against markdown files.
-if [[ ${#SCAN_MD[@]} -gt 0 ]]; then
-  N=${#MD_RULES[@]}
-  i=0
-  while (( i < N )); do
-    pat="${MD_RULES[$i]}"
-    sev="${MD_RULES[$((i+1))]}"
-    msg="${MD_RULES[$((i+2))]}"
-    i=$((i+3))
-
-    HITS="$(grep -HnIE --color=never "$pat" "${SCAN_MD[@]}" 2>/dev/null || true)"
-    [[ -z "$HITS" ]] && continue
-
-    while IFS= read -r line; do
-      [[ -z "$line" ]] && continue
-      FOUND=$((FOUND + 1))
-      printf '[%s] %s: %s\n' "$sev" "$line" "$msg"
-    done <<<"$HITS"
-  done
-fi
-
-TOTAL=$(( ${#SCAN[@]} + ${#SCAN_MD[@]} ))
-
-echo
-if [[ $FOUND -eq 0 ]]; then
-  echo "devrites-detect: clean: scanned $TOTAL files (${#SCAN[@]} code, ${#SCAN_MD[@]} md)."
-  exit 0
-fi
-
-echo "devrites-detect: $FOUND finding(s) across $TOTAL files (${#SCAN[@]} code, ${#SCAN_MD[@]} md)."
-
-if [[ $ADVISORY -eq 1 ]]; then
-  exit 0
-fi
-
-exit 1

package/scripts/grade-feature.sh

@@ -1,204 +0,0 @@
-#!/usr/bin/env bash
-# Deterministic outcome grader for a completed DevRites feature workspace.
-#
-# Trigger evals in evals/*.json check skill selection. This script checks
-# whether a completed run is shippable and has proof. It reads only committed
-# Markdown artifacts, so CI can grade a golden fixture without an API key or
-# model harness.
-#
-# Git fixtures do not preserve the mtimes needed to compare proof with code.
-# The `devrites-engine evidence-fresh` gate performs that check in a live
-# workspace.
-#
-# Usage: grade-feature.sh [--json] <workspace-dir>
-#   e.g. evals/golden/shippable-feature | .devrites/work/<slug> | .devrites/archive/<slug>
-#
-# Checks from rite-seal/reference/{seal-template,go-no-go,final-evidence}.md:
-#   1. seal.md present with "Verdict: GO" (not NO-GO)
-#   2. seal.md "## Acceptance Criteria" has no unchecked "- [ ]" item
-#   3. seal.md "## Blockers" is empty / "none"
-#   4. evidence.md present and non-empty
-#   5. review.md present
-#   6. questions.md has no open question (later lifecycle phases block them)
-#   7. state.md Phase in {seal, ship, done}; Status not awaiting_human / blocked
-#
-# Exit codes: 0 shippable; 1 one or more invariants failed; 2 bad usage.
-
-set -euo pipefail
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-json=0
-if [ "${1:-}" = "--json" ]; then
-  json=1
-  shift
-fi
-ws="${1:-}"
-if [ "$#" -ne 1 ] || [ ! -d "$ws" ]; then
-  printf 'usage: grade-feature.sh [--json] <workspace-dir>\n' >&2
-  exit 2
-fi
-
-seal="$ws/seal.md"; ev="$ws/evidence.md"; rev="$ws/review.md"
-q="$ws/questions.md"; st="$ws/state.md"
-problems=()
-rules=()
-unchecked=0
-acceptance_ready=0
-
-add_problem() {
-  rules+=("$1")
-  problems+=("$2")
-}
-
-# Checks 1 through 3: seal verdict, acceptance, and blockers.
-if [ ! -f "$seal" ]; then
-  add_problem "final.seal.missing" "seal.md missing: feature never sealed"
-else
-  grep -qiE '^[[:space:]]*Verdict:[[:space:]]*GO[[:space:]]*$' "$seal" \
-    || add_problem "final.verdict.not-go" "seal.md Verdict is not GO"
-  unchecked=$(awk '/^## /{insec=($0 ~ /^## Acceptance Criteria/)} insec && /^- \[ \]/{c++} END{print c+0}' "$seal")
-  if [ "${unchecked:-0}" -gt 0 ]; then
-    add_problem "final.acceptance.unchecked" "seal.md has ${unchecked} unchecked acceptance criterion(s)"
-  else
-    acceptance_ready=1
-  fi
-  if awk '
-      /^## /{ insec=($0 ~ /^## Blockers/); next }
-      insec { l=$0; gsub(/^[[:space:]]+|[[:space:]]+$/,"",l)
-              if (l=="") next
-              ll=tolower(l); if (ll ~ /^-?[[:space:]]*(none|n\/a)$/) next
-              nz=1 }
-      END { exit(nz?0:1) }' "$seal"; then
-    add_problem "final.blockers.unresolved" "seal.md lists unresolved blockers"
-  fi
-fi
-
-# Check 4: evidence.
-{ [ -f "$ev" ] && [ -s "$ev" ]; } \
-  || add_problem "final.evidence.missing-or-empty" "evidence.md missing or empty: acceptance unproven"
-
-# Check 5: review.
-[ -f "$rev" ] || add_problem "final.review.missing" "review.md missing: feature not reviewed"
-
-# Check 6: open questions block sealing.
-if [ -f "$q" ]; then
-  if python3 - "$q" <<'PY'
-from pathlib import Path
-import sys
-
-lines = Path(sys.argv[1]).read_text().splitlines()
-in_question = False
-status = ""
-for line in lines:
-    stripped = line.strip()
-    if stripped.startswith("## "):
-        if in_question and status.lower() == "open":
-            raise SystemExit(0)
-        in_question = stripped[3:].lower().startswith("q-")
-        status = ""
-    elif in_question and stripped.lower().startswith("status:"):
-        status = stripped.split(":", 1)[1].strip()
-if in_question and status.lower() == "open":
-    raise SystemExit(0)
-
-status_index = None
-for line in lines:
-    stripped = line.strip()
-    if not (stripped.startswith("|") and stripped.endswith("|")):
-        status_index = None
-        continue
-    cells = [cell.strip() for cell in stripped.strip("|").split("|")]
-    lowered = [cell.lower() for cell in cells]
-    if status_index is None:
-        status_index = lowered.index("status") if "status" in lowered else None
-        continue
-    if status_index < len(cells) and cells[status_index].lower() == "open":
-        raise SystemExit(0)
-raise SystemExit(1)
-PY
-  then
-    add_problem "final.questions.open" "questions.md contains an open question"
-  fi
-fi
-
-# Check 7: state phase and status.
-if [ -f "$st" ]; then
-  ph="$(python3 "$ROOT/scripts/workflow_schema.py" field "$st" phase 2>/dev/null || true)"
-  stt="$(python3 "$ROOT/scripts/workflow_schema.py" field "$st" status 2>/dev/null || true)"
-  if ! python3 "$ROOT/scripts/workflow_schema.py" phase-property "$ph" shippable >/dev/null; then
-    add_problem "final.state.phase" "state.md Phase='${ph}' (expected a shippable phase)"
-  fi
-  case "$stt" in
-    awaiting_human|blocked)
-      add_problem "final.state.status" "state.md Status='${stt}' (not shippable)"
-      ;;
-  esac
-else
-  add_problem "final.state.missing" "state.md missing"
-fi
-
-# Check 8: every spec [ACn] is proven and checked in the seal.
-run_acceptance_check() {
-  if [ -n "${DEVRITES_CLI:-}" ]; then
-    "$DEVRITES_CLI" check-acceptance "$ws"
-    return $?
-  fi
-  if command -v devrites-engine >/dev/null 2>&1; then
-    devrites-engine check-acceptance "$ws"
-    return $?
-  fi
-  if [ -x "$ROOT/engine/devrites" ]; then
-    "$ROOT/engine/devrites" check-acceptance "$ws"
-    return $?
-  fi
-  if [ -d "$ROOT/engine" ] && command -v go >/dev/null 2>&1; then
-    ( cd "$ROOT/engine" && go run . check-acceptance "$ws" )
-    return $?
-  fi
-  printf 'check-acceptance: devrites-engine unavailable (install devrites or run from a checkout with Go)\n' >&2
-  return 127
-}
-
-if [ "$acceptance_ready" -eq 1 ] && ! acout=$(run_acceptance_check 2>&1); then
-  add_problem "final.acceptance.ids" \
-    "acceptance: $(printf '%s' "$acout" | tail -1 | sed 's/^check-acceptance: //')"
-fi
-
-slug="$(basename "$ws")"
-if [ "$json" -eq 1 ]; then
-  status="GO"
-  [ "${#problems[@]}" -gt 0 ] && status="NO-GO"
-  pairs=()
-  for ((i = 0; i < ${#problems[@]}; i++)); do
-    pairs+=("${rules[$i]}" "${problems[$i]}")
-  done
-  python3 - "$slug" "$status" "${pairs[@]}" <<'PY'
-import json
-import sys
-
-slug, status, *pairs = sys.argv[1:]
-items = [
-    {"rule_id": pairs[i], "message": pairs[i + 1]}
-    for i in range(0, len(pairs), 2)
-]
-print(json.dumps({
-    "schema": "devrites-outcome-grade/v1",
-    "workspace": slug,
-    "status": status,
-    "rule_ids": [item["rule_id"] for item in items],
-    "problems": items,
-}, separators=(",", ":")))
-PY
-  if [ "${#problems[@]}" -eq 0 ]; then
-    exit 0
-  fi
-  exit 1
-fi
-
-if [ "${#problems[@]}" -eq 0 ]; then
-  printf 'GO    %s: shippable: sealed GO, acceptance proven, no blockers, no open question.\n' "$slug"
-  exit 0
-fi
-printf 'NO-GO %s: %d blocker(s):\n' "$slug" "${#problems[@]}"
-for p in "${problems[@]}"; do printf '  - %s\n' "$p"; done
-exit 1