devrites 3.2.28 → 4.0.0

package/pack/.claude/skills/rite/SKILL.md

@@ -4,14 +4,14 @@ description: User-invoked DevRites menu and router; no args renders the menu, a
 argument-hint: "[verb [args...]]"
 user-invocable: true
 disable-model-invocation: true
-required-agent-roles: none
 ---
 
 # /rite: DevRites menu + router
 
-You are the DevRites entry point. Two modes:
+Two modes:
 
-- **No args** → run `devrites-engine first-task`, render one recommended-start line above the menu, then stop. Do not execute a phase or read `state.md`: status is `/rite-status`.
+- **No args** → render the menu and stop. Do not execute a phase or infer
+  workspace status; `/rite-status` owns that.
 - **Verb arg** → pass-through dispatch to the matching `rite-<verb>` skill (`/rite spec foo` ≡ `/rite-spec foo`); the called skill owns the output.
 
 When the user asks which rite fits, load [`devrites-lib/reference/intent-map.md`](../devrites-lib/reference/intent-map.md).
@@ -47,14 +47,14 @@ What each verb does lives once, in the Menu below; this table is the dispatch ma
 | `seal` | `/rite-seal` |
 | `ship` | `/rite-ship` |
 | `status [slug]` | `/rite-status` |
-| `doctor [--code | --reindex]` | `/rite-doctor` |
+| `doctor` | `/rite-doctor` |
 | `upgrade [slug]` | `/rite-upgrade` |
-| `learn [--mine \| "<lesson>"]` | `/rite-learn` |
+| `learn ["<lesson>"]` | `/rite-learn` |
 | `explain [concept \| diff \| idea \| recap]` | `/rite-explain` |
 | `pov [candidate]` | `/rite-pov` |
 | `dogfood [--port N]` | `/rite-dogfood` |
 | `pr-feedback [PR\|thread]` | `/rite-pr-feedback` |
-| `customize [override <agent> \| extension <name>]` | `/rite-customize` |
+| `customize [instruction \| skill \| agent \| plugin]` | `/rite-customize` |
 | `use <slug>` | (inline) |
 | `guide` | (inline) |
 | `resolve <qid> "<answer>"` | `/rite-resolve` |
@@ -101,25 +101,24 @@ Called phase skills own the shared completion reply contract
 
 ```
 DevRites — disciplined senior-engineer workflow
-Recommended start: <greenfield: /rite spec <feature> | brownfield-unadopted: /rite adopt | active-feature: /rite status | dirty-worktree: /rite frame or /rite quick | branch-ahead: /rite ship/status | clean-default: /rite spec <feature>>
                               menu form           direct shortcut
 SPEC          /rite spec               ≡    /rite-spec        investigate deeply → write spec.md
-ADOPT         /rite adopt              ≡    /rite-adopt       onboard existing code → reverse-derive spec.md + seed conventions
+ADOPT         /rite adopt              ≡    /rite-adopt       onboard existing code → reverse-derive spec.md
 CLARIFY       /rite clarify            ≡    /rite-clarify     close the complete decision surface before planning
 TEMPER        /rite temper             ≡    /rite-temper      optional — strategic review: scope mode + pre-mortem, harden the spec
 PLAN          /rite define             ≡    /rite-define      turn the spec into plan + task slices + state
 VET           /rite vet                ≡    /rite-vet         mandatory every plan — light/full engineering review by stakes
 REPLAN        /rite plan               ≡    /rite-plan        decompose / reslice / repair an active plan
-BUILD         /rite build              ≡    /rite-build       implement exactly one verified vertical slice, then stop
+BUILD         /rite build              ≡    /rite-build       one slice/wright; HITL stops, `.devrites/AFK` may chain
 CONVERGE      /rite converge           ≡    /rite-converge    recovery — append work needed to meet intent
 PROVE         /rite prove              ≡    /rite-prove       tests + build + runtime + browser evidence
 POLISH        /rite polish             ≡    /rite-polish      code polish always; UI normalize + polish if UI
 REVIEW        /rite review             ≡    /rite-review      feature-scoped multi-axis review
 SEAL          /rite seal               ≡    /rite-seal        final GO / NO-GO decision (no git)
-SHIP          /rite ship               ≡    /rite-ship        type-GO + commit/push/tag, then archive + clear ACTIVE
+SHIP          /rite ship               ≡    /rite-ship        pre-GO read-only; fresh GO → commit; optional approved push/tag/PR → archive
 STATUS        /rite status             ≡    /rite-status      active feature, next action, evidence, risks
-DOCTOR        /rite doctor ...         ≡    /rite-doctor      health check; --reindex refreshes structural indexes
-UPGRADE       /rite upgrade ...        ≡    /rite-upgrade     reconcile an active legacy workspace with current contracts
+DOCTOR        /rite doctor             ≡    /rite-doctor      installation and native host diagnostics
+UPGRADE       /rite upgrade ...        ≡    /rite-upgrade     audit an older workspace; route only proven gaps
 LEARN         /rite learn ...          ≡    /rite-learn       review captured lessons → promote to project rules / principles
 EXPLAIN       /rite explain ...        ≡    /rite-explain     grounded concept/diff/idea/recap explainer
 POV           /rite pov ...            ≡    /rite-pov         decide adopt / trial / hold / reject for an external option
@@ -129,7 +128,7 @@ CUSTOMIZE     /rite customize ...      ≡    /rite-customize   author overrides
 SWITCH        /rite use <slug>                                re-point .devrites/ACTIVE to another feature (inline)
 GUIDE         /rite guide                                     first feature, guided — full lifecycle on one small real change (inline)
 RESUME        /rite resolve ...        ≡    /rite-resolve     answer a HITL checkpoint
-AUTO          /rite autocomplete ...   ≡    /rite-autocomplete  run the whole lifecycle unattended (--ship to push)
+AUTO          /rite autocomplete ...   ≡    /rite-autocomplete  unattended lifecycle; `--ship` stops at Ship preflight
 QUICK         /rite quick <change>     ≡    /rite-quick       express lane — one small reversible change (escalates if it grows)
 UTILITY       /rite frame | prototype | handoff | zoom-out | pressure-test  (or direct shortcuts)
 ```

package/pack/.claude/skills/rite/reference/menu.md

@@ -1,30 +1,29 @@
 # Menu reference
 
-Phase-ordered command reference for `/rite`. Load only if the user wants detail on
-what each command does or how phases connect.
+Phase-ordered `/rite` reference. Load only for command detail or phase connections.
 
 ## Phases and commands
 
 | Phase | Command | Use when |
 |---|---|---|
 | Spec | `/rite-spec <feature>` | **New feature.** Investigate → write spec.md. Asks with options; gathers attached design references (optional). |
-| Adopt | `/rite-adopt` | Onboard an existing codebase instead of starting fresh: reverse-derive spec.md + seed the conventions ledger. |
+| Adopt | `/rite-adopt` | Onboard an existing codebase instead of starting fresh: reverse-derive spec.md and propose project guidance. |
 | Clarify | `/rite-clarify` | _Required after spec._ Topology-first decision-coverage scan; zero-question fast path when already clear. |
 | Temper | `/rite-temper` | _Optional, before define._ Strategic review of the spec: scope mode (expand/selective/hold-rigor/reduce) + pre-mortem; hardens the spec. Best on big/risky features; mandatory in `/rite-autocomplete`. |
 | Plan | `/rite-define` | Turn the approved spec into plan + vertical task slices + state. |
 | Vet | `/rite-vet` | _Required before build._ Review every plan: scope · architecture · tests · perf; light for simple/reversible, full for high stakes. |
 | Re-plan | `/rite-plan` | The active plan is too big, wrong, stale, ambiguous, or blocked. |
-| Build | `/rite-build` | Implement the next single vertical slice. Stops after one slice. |
+| Build | `/rite-build` | One slice/wright; HITL stops; `.devrites/AFK` lets root bounded-chain slices. |
 | Converge | `/rite-converge` | _Recovery._ Code drifted from or falls short of intent after a resume, adoption, or stalled build: compare live code with spec/plan/tasks and append remaining work as new slices for `/rite-build`. |
 | Prove | `/rite-prove` | Prove the current scope: tests, build, runtime, browser evidence. |
 | Polish | `/rite-polish` | Code polish always; normalize and polish UI when in scope. Modes: `bolder/quieter/distill/harden/normalize-only`. |
 | Review | `/rite-review` | Feature-scoped review before sealing. |
 | Seal | `/rite-seal` | Final GO / NO-GO decision (no git). |
-| Ship | `/rite-ship` | Type-GO → commit/push/tag, then archive the task + clear ACTIVE. |
+| Ship | `/rite-ship` | Pre-GO read-only; fresh GO → commit → optional approved push/tag/PR → archive/close. |
 | Status | `/rite-status` | See where the active feature stands. |
-| Doctor | `/rite-doctor` | Health check: install integrity, stale ACTIVE, orphaned gates, hook wiring, merge/rebase state. |
-| Upgrade | `/rite-upgrade` | _Explicit recovery._ Reconcile an active legacy workspace with the installed semantic workflow contract; preserve completed work and history. |
-| Learn | `/rite-learn` | Review the captured learning ledger → promote recurring lessons to project rules / principles. |
+| Doctor | `/rite-doctor` | Diagnose install integrity and native host configuration. |
+| Upgrade | `/rite-upgrade` | _Explicit compatibility._ Audit an older released workspace; route cited defects through Clarify/Plan repair/Converge/Vet or current Prove/Polish/Review/Seal, preserve history, and never synthesize old proof. |
+| Learn | `/rite-learn` | Review native memory and archived evidence → propose durable project guidance. |
 
 ## Typical orderings
 
@@ -36,13 +35,14 @@ what each command does or how phases connect.
 - **Existing codebase**: `/rite-adopt` → `/rite-clarify` → `/rite-define` → `/rite-vet` → build.
 - **Drift mid-build**: classify → bounded recovery for objective defects, `/rite-plan`
   repair for a wrong durable plan, or one user decision for real product/risk drift.
-- **Workspace from older DevRites rules**: `/rite-upgrade` → current Clarify/Plan/Vet
-  gates → resume the snapshot's next command. Structural migration alone is not enough.
+- **Older workspace cannot resume**: `/rite-upgrade` audits first → only proven gaps use
+  Clarify/Plan repair/Converge/Vet or Prove/Polish/Review/Seal → resume. It never
+  migrates cursor format or invents a prior pass.
 - **Resumed / adopted / stalled**: `/rite-converge` (assess live code vs intent → append the
   remaining slices) → `/rite-vet` → `/rite-build` ×N → continue at `/rite-prove`.
 
 ## Rules this menu obeys
 
 - `/rite` never edits code or runs a phase workflow.
-- Menu mode runs `devrites-engine first-task`; `/rite-status` owns workspace status.
+- Menu mode is static; `/rite-status` owns workspace status.
 - It suggests; the user (or Claude, when appropriate) invokes the real skill.

package/pack/.claude/skills/rite-adopt/SKILL.md

@@ -1,100 +1,45 @@
 ---
 name: rite-adopt
-description: Adopt an existing or legacy codebase into DevRites by reverse-engineering current behavior, seeding conventions, and establishing the workflow. Use for inherited or live applications.
+description: Adopt an existing codebase into DevRites by reverse-engineering current behavior and establishing a baseline workspace.
 argument-hint: "[path or area to adopt] [+ what you want to build next]"
 user-invocable: true
-required-agent-roles: none
 ---
 
 # /rite-adopt: onboard existing code
 
-`/rite-adopt` derives a spec and initial conventions from existing code. It produces the
-same `spec.md` used by the rest of the lifecycle and seeds the conventions ledger with
-observed project idioms.
-
-Use it once when onboarding a repository or one of its sub-areas. Continue with
-`/rite-clarify`, `/rite-temper`, `/rite-define`, and `/rite-build`.
-
-> **Need only a code map?** `/rite-zoom-out` maps unfamiliar code without creating a
-> workspace or ledger. Use `/rite-adopt` when the project should enter the lifecycle.
-
-## Rules consulted (read on demand from `.claude/skills/devrites-lib/reference/standards/`)
-Pull `documentation.md` when recording the adoption decisions (why-not-what) in
-`decisions.md`; pull `principles.md` when the code
-upholds invariants worth proposing as project principles (step 4a).
-
-## Operating rules (DevRites core)
-- No silent assumptions · prefer the project's existing conventions (you are *documenting*
-  them, not imposing new ones) · ask the human when the adoption scope or the next-build
-  objective is unclear.
+Reverse-engineer existing behavior into the same `spec.md` contract used by new
+features. Adoption documents the repository; it does not rewrite it or create a
+parallel convention system.
 
 ## Workflow
-0. **Read `.claude/skills/devrites-lib/reference/standards/core.md`**, then run
-   `devrites-engine preamble` for deterministic workspace orientation.
-1. **Scope the adoption** (`$ARGUMENTS`). Which repo or sub-area is being onboarded, and:
-   if stated: what the user wants to build *next* on top of it. If the next-build objective
-   is missing, ask once (it shapes the spec's acceptance); if the area is ambiguous, confirm
-   before investigating the whole tree.
-2. **Inspect the existing code** to establish the project's current structure. Use a
-   code-intelligence index if available (codebase-memory-mcp first (its `get_architecture`
-   gives a fast overview), cross-checked with codegraph + graphify, else standard methods
-   (LSP / Read/Grep/Glob); see `.claude/skills/devrites-lib/reference/standards/tooling.md`) for
-   structure, callers, and impact. Capture, per [adoption](reference/adoption.md): **current
-   behavior**, **architecture + placement** (layers, seams, where each kind of thing lives),
-   the **commands** (test / build / typecheck / lint), and the **idioms** (naming, layering,
-   error model, test style) + recurring **gotchas**. Read `PRODUCT.md` / `DESIGN.md` /
-   `CLAUDE.md` / `AGENTS.md` if present.
-3. **Write `spec.md`** via [rite-spec's spec template](../rite-spec/reference/spec-template.md)
-   and create the workspace + set `.devrites/ACTIVE`
-   ([state-workspace](../rite-spec/reference/state-workspace.md)). The spec records the
-   **current behavior as the baseline** and the **next objective** (what adoption is for) with
-   measurable acceptance. Also write `decisions.md`, `assumptions.md`, `questions.md`, and
-   `state.md` (phase: spec).
-3a. **Seed the capability ledger** from the baseline. If the derived `spec.md` carries
-   structured `### Requirement:` blocks, fold them into the living
-   `.devrites/specs/<capability>/spec.md` ledger so the project's current proven behavior is
-   recorded before the first new feature. The next `/rite-spec` writes deltas against this ledger
-   ([ledger.md](../rite-ship/reference/ledger.md)). A flat baseline folds as all-ADDED into the
-   feature slug's capability; tag capabilities in the spec first if you want finer granularity.
-   ```bash
-   devrites-engine ledger diff .devrites/work/<slug>   # preview
-   devrites-engine ledger sync .devrites/work/<slug>   # seed
-   ```
-   Skip when the baseline records no structured requirements (nothing to seed).
-4. **Seed the conventions ledger** from observed behavior:
-   [adoption § seeding](reference/adoption.md). This is the bootstrap exception to
-   evidence-gated promotion. Seeds start at the base band with onboarding provenance;
-   later sealed slices may confirm or contradict them, and fresh evidence wins.
-   **Completion:** every seed names observed evidence, provenance, and the base band.
-4a. **Propose candidate principles** (optional and human-ratified). When the code
-   consistently enforces an invariant, such as integer cents for money, redacted PII in
-   logs, or preserved v1 endpoints, propose it as a **candidate principle** rather than a
-   convention. Principles are prescriptive gates, so **never seed them automatically**.
-   Present each candidate through `AskUserQuestion` with evidence, and write human-ratified
-   candidates to `.devrites/principles.md` with a dated Governance entry
-   ([`principles.md`](../devrites-lib/reference/standards/principles.md)). An unratified
-   candidate remains a convention, not a gate. If no invariant qualifies, declare no
-   principles.
-5. **Hand off.** Continue with `/rite-clarify`. Its topology scan asks no questions when
-   the derived contract is already clear. Every plan then runs `/rite-vet` before build.
-   Do not plan or build here.
-   **Completion:** one next rite is reported and no plan or application code was written.
 
-> **Mid-flight discipline.** Do not invent conventions, seed an assumed idiom, or turn
-> adoption into a rewrite. Adoption records existing behavior; a later feature changes it.
-> See [`anti-patterns`](reference/anti-patterns.md).
+1. Read the core standards and resolve the repository/sub-area plus the next
+   objective. Ask once when either is materially ambiguous.
+2. Follow [`reference/adoption.md`](reference/adoption.md): inspect current
+   behavior, architecture and placement, callers, reusable seams, repository/CI
+   commands, visible code/test patterns, and non-obvious constraints. Read
+   existing `AGENTS.md`, `CLAUDE.md`, product, and design guidance.
+3. Create the workspace and write `spec.md`, `decisions.md`, `assumptions.md`,
+   `questions.md`, and `state.md`. The spec separates the current baseline from
+   the measurable next objective.
+4. For a structured baseline, follow the native ledger workflow in
+   [`ledger.md`](../rite-polish/reference/ledger.md): read current specs, preview
+   ADDED entries, confirm paths, refuse escape/symlink/clobber/ignored targets,
+   write, lint, and require an empty re-preview.
+5. If a repeatedly observed operating rule should govern future work, propose
+   one exact edit to the nearest existing `AGENTS.md`, `CLAUDE.md`, or scoped
+   document. Apply only after review. Do not create convention bands, scores, or
+   a command cache.
+6. A genuine non-negotiable invariant may be proposed for
+   `.devrites/principles.md`; the human must ratify it.
+7. Set the next step to `/rite-clarify` and stop. Do not plan or build.
 
 ## Output
 
-**Progress first**: run `devrites-engine progress`, then use the shared completion reply contract
-([`devrites-lib/reference/reply-contract.md`](../devrites-lib/reference/reply-contract.md)).
-Default success shape:
-```
-Done: adopted existing behavior into <slug>; baseline spec and placement recorded.
-Changed: spec.md, decisions.md, conventions ledger, principles proposals <updated|none>
-Evidence: not applicable; reverse-derived behavior is recorded for review
-Open: <none | adoption questions>
+```text
+Done: adopted <scope> into <slug>.
+Changed: <workspace artifacts>; project guidance <proposed | unchanged>
+Evidence: <source/CI paths inspected>
+Open: <questions | none>
 Next: /rite-clarify
-Record: .devrites/work/<slug>/spec.md
-↻ Hygiene: /clear before the next phase
 ```

package/pack/.claude/skills/rite-adopt/reference/adoption.md

@@ -1,55 +1,21 @@
-# Adoption: reverse-investigate + seed (the on-ramp contract)
+# Adoption: reverse-investigation
 
-Loaded on demand by `/rite-adopt`. Two jobs: document what the code already does (so the
-lifecycle has a spec), and seed the conventions ledger (so the first slice knows the idioms).
+Loaded on demand by `/rite-adopt`. Document what the code already does so the
+lifecycle starts from evidence rather than guesses.
 
-## Reverse-investigation: what to capture
+Capture the durable project shape:
 
-Document the **durable shape** of the project, not a line-by-line tour:
+- current user-visible behavior;
+- architecture, placement, callers, and important seams;
+- real test, build, typecheck, and lint commands from repository scripts or CI;
+- naming, layering, error, data-access, and test patterns visible in live code;
+- non-obvious ordering or framework constraints.
 
-- **Current behavior:** what the adopted area does today, from the user's perspective.
-- **Architecture + placement:** the layers and seams; where each kind of thing lives
-  (where endpoints / components / models / migrations / tests go). Prefer a code-intelligence
-  index if available (see `../../devrites-lib/reference/standards/tooling.md`) for
-  structure, callers, and impact.
-- **Commands:** the real test / build / typecheck / lint commands (run or read them; don't
-  guess). Verify uncertain framework facts at the source.
-- **Idioms:** naming + casing, layering, the error model, the result/exception style, the
-  http/data-access pattern, the test framework + file layout.
-- **Gotchas:** non-obvious constraints the code encodes (ordering requirements, "don't call
-  X before Y", a framework quirk).
+Use native code/file search and current repository documentation. Fresh source
+and CI configuration win over historical notes.
 
-This feeds `spec.md` (current behavior as the baseline + the next objective) and the ledger
-seeds below.
-
-## Seeding the conventions ledger
-
-The deliberate **bootstrap exception** to evidence-gated promotion. Normally a convention is
-promoted only when a *sealed slice proved it* (`/rite-seal`); adoption seeds from **observed
-existing code** so the first slice isn't blind. Keep the seeds honest:
-
-- Seed only what the code **and consistently** follows, not an aspiration, not a
-  one-off, not something you assumed.
-- Each seed starts at the base band (one corroboration) and is provenance-tagged as an
-  onboarding observation, **not** a sealed-slice proof. Real slices later corroborate it
-  (raising the band) or, per fresh-observation-wins, contradict it.
-
-```bash
-SLUG="$(cat .devrites/ACTIVE 2>/dev/null | tr -d '[:space:]')"
-if command -v devrites-engine >/dev/null 2>&1; then
-  devrites-engine conventions promote --slug "${SLUG}-adopt" \
-    --key test-runner --kind test \
-    --statement "tests run with <runner>, <file layout>" \
-    --evidence "observed during /rite-adopt onboarding (not yet slice-proven)"
-  # …one promote per durable convention the investigation actually observed
-  # (test-runner, build-cmd, error-model, http-client, endpoint-placement, …).
-else
-  echo "(conventions ledger unavailable — devrites-engine missing; skipping seed)"
-fi
-```
-
-The `-adopt` suffix on the slug marks the provenance as onboarding. Because the ledger is
-read at orient as a *prior* and the live code always overrides it
-([`.claude/skills/devrites-lib/reference/standards/security.md`](../../devrites-lib/reference/standards/security.md) § Prompt-injection resistance),
-an over-eager seed is self-correcting, but seed conservatively anyway; a wrong seed costs a
-needless contradiction later.
+Write the adopted baseline and next objective to `spec.md`; put uncertain facts
+in `assumptions.md` and durable decisions in `decisions.md`. If an observed rule
+should govern future work, propose one reviewed update to `AGENTS.md`,
+`CLAUDE.md`, or the nearest scoped project document. Do not create a convention
+ledger, confidence band, score, or duplicated command cache.

package/pack/.claude/skills/rite-autocomplete/SKILL.md

@@ -1,42 +1,40 @@
 ---
 name: rite-autocomplete
-description: Run the DevRites lifecycle end-to-end unattended; --ship confirms the final gate. Use when the user says "autocomplete", "one-shot this feature", or "ship it autonomously". Not for a single phase.
-argument-hint: "[idea] [--ship|--yolo] [--max-slices N]"
+description: Run the full DevRites lifecycle unattended; --ship continues to the final Git approval boundary. Use for one-shot autonomous work; not for a single phase.
+argument-hint: "[idea] [--ship|--yolo] [--max-slices N] [--full] [--cross-model]"
 user-invocable: true
-required-agent-roles: none
 ---
 
 # /rite-autocomplete: full lifecycle, unattended
 
-Runs every DevRites phase in order without pausing for discretionary input. It asks
-clarifying questions **before** unattended work begins. Safety gates remain active:
-hard irreversible-risk,<!-- pack-scan-ignore: negated statement: gates are NOT disabled -->
-blocking / escalating gates, and any NO-GO still pause.
+Runs every phase unattended after initial clarification. Irreversible-risk,
+blocking/escalating,<!-- pack-scan-ignore: negated statement: gates are NOT disabled -->
+and NO-GO gates still pause. Use the **Standard** native execution profile by
+default and **Full** for high-risk scope or explicit `--full`; profiles are defined in
+[`devrites-lib/reference/orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md).
 
 ## Rules consulted (read on demand from `.claude/skills/devrites-lib/reference/standards/`)
 **Step 0:** Read `.claude/skills/devrites-lib/reference/standards/core.md` and `.claude/skills/devrites-lib/reference/standards/afk-hitl.md` first.
 
 ## Operating rules
-- **Use one initial human window.** Run spec and topology-first clarify; arm AFK only after
-  `Decision coverage: CLEAR`. Later discretionary calls are recorded, not asked
+- **Use one initial human window.** Run spec and topology-first clarify; arm AFK
+  only after `Decision coverage: CLEAR`. Record later discretionary calls
   ([decision policy](reference/decision-policy.md)).
-- **Safety gates are not bypassable.** AFK never auto-passes destructive migration /
-  auth-authz change / public-API break / external-contract change; blocking
-  and escalating gates and any open `gate: validating` always pause. `--ship` auto-confirms
-  the **final** type-GO only: nothing else. A change that violates a declared project
-  principle (`.devrites/principles.md`) with no recorded exception pauses too: autocomplete
-  never grants a principle exception on its own (`principles.md`: that's a human decision).
-  Red checks never advance the loop: autocomplete runs the shared bounded debug recovery, then
-  stops as `blocked` if the objective failure remains; it asks only if recovery exposes a
-  human-owned decision.
-- **Set the loop budget from the plan's slice count.** After `/rite-vet`
-  (not `/rite-define`: vet may split or add slices, so the count isn't final until then),
-  set the AFK budget to however many slices the plan has, so the loop builds exactly the
-  planned slices and stops when they are done. `--max-slices N` is an optional lower
-  safety cap for a partial run; omit it to run the whole plan. The planned slice count
-  keeps the default run finite.
-- **Record each discretionary choice.** Pick the option recommended by the relevant
-  specialist or reviewer and record the rationale. Do not choose arbitrarily.
+- **Safety gates are not bypassable.** Irreversible risk, blocking/escalating,
+  open validating gates, and unexcepted principle violations pause. `--ship` /
+  `--yolo` never authorizes Git; it reaches only the exact-plan literal-GO and
+  native-approval boundary. Red checks run bounded recovery, then block unless
+  the remaining decision is human-owned.
+- **Budget from the post-vet slice count.** Vet may split/add slices.
+  `--max-slices N` may lower the cap for a partial run; otherwise build all.
+- **Parse flags only from this invocation.** `--ship`, `--yolo`, `--max-slices`,
+  `--full`, and `--cross-model` are active only when their exact standalone tokens
+  occur in `$ARGUMENTS`; their presence in this skill, examples, or earlier messages
+  can never arm them. `--max-slices` must occur once and be followed by a positive
+  base-10 integer; missing, repeated, malformed, or conflicting values stop before
+  any sentinel or workspace write.
+- **Record discretionary choices.** Use the specialist/reviewer recommendation
+  and rationale; never choose arbitrarily.
 - **Strategic review runs, but never auto-grows scope.** After `/rite-clarify`, run `/rite-temper`
   (significance-gated; it skips low-stakes specs in one line). Unattended it auto-applies only
   `hold-rigor` + `reduce-to-MVP` (these never grow acceptance); **any `expand` is a blocking
@@ -46,47 +44,58 @@ blocking / escalating gates, and any NO-GO still pause.
   run `/rite-vet` on **every** feature (depth scales: a light pass on simple plans, full rigor on
   big/risky; never skipped). Unattended it auto-applies only *hardening* findings: added test
   requirements, error-handling / failure-mode coverage, tightened scope, reuse-over-rebuild,
-  ordering / parallel-lane fixes (these never grow acceptance); **any finding that grows scope,
+  dependency-order fixes (these never grow acceptance); **any finding that grows scope,
   adds a slice, or changes acceptance is a blocking pause**, and irreversible-risk findings always
   pause. Cross-model is off unless `--cross-model` was armed.
 
 ## Workflow
-1. **Orient + parse args.** Run `devrites-engine preamble` for deterministic workspace orientation.
-   The idea + flags: `--ship` / `--yolo` (auto-confirm the final
-   type-GO), `--max-slices N` (optional lower safety cap for a partial run; default =
-   the plan's slice count, i.e. run all planned slices).
+1. **Orient + parse args.** Resolve the explicit or active slug, require its
+   `state.md`, and read the cursor directly.
+   The idea + flags: `--ship` / `--yolo` (continue through ship preflight, then stop
+   for literal-GO and native approval), `--max-slices N` (optional lower safety cap for a partial run; default =
+   the plan's slice count, i.e. run all planned slices). Parse only the current
+   `$ARGUMENTS`; normalize the result to the idea, `ship_preflight: yes|no`,
+   `max_slices: N|plan`, `profile: standard|full`, and `cross_model: yes|no`.
+   **Completion:** that normalized state is unambiguous and no sentinel or workspace
+   file has been written.
 2. **Specify and clarify up front.** Use `devrites-interview`, `/rite-spec`, and
    `/rite-clarify` as one interactive window. Clear specs ask zero questions; Partial/Missing
    coverage never arms AFK. **Completion:** `decision-coverage.md` records `CLEAR`.
-3. **Arm AFK after clarity.** Require `Decision coverage: CLEAR`, then write `.devrites/AFK`
-   with `allow_gates: [advisory]`; set the slice budget
-   from the plan's count after `/rite-vet` (the slice count is only final post-vet), or from
-   an explicit `--max-slices` ([reference/loop.md](reference/loop.md)). validating / blocking / escalating +
-   irreversible-risk still pause. Also `touch .devrites/CHECKPOINT`: unattended runs use
-   checkpoint mode so each proven slice is committed locally as a crash-survivable `WIP`
-   ([rite-build/reference/checkpoint.md](../rite-build/reference/checkpoint.md));
-   `/rite-ship` collapses them into the one feature commit.
+3. **Arm AFK after clarity.** Require `Decision coverage: CLEAR`, then apply the
+   loop's [one-write AFK contract](reference/loop.md#arm-afk-once): preserve a valid
+   existing sentinel byte-for-byte or create an advisory-only sentinel once; never
+   rewrite it after Vet. Also `touch .devrites/CHECKPOINT`: unattended runs use
+   checkpoint mode so each proven slice is committed locally as a crash-survivable
+   `WIP` ([rite-build/reference/checkpoint.md](../rite-build/reference/checkpoint.md));
+   `/rite-ship` collapses them into the one feature commit. **Completion:** AFK config is
+   valid and advisory-only, any pre-existing bytes are unchanged, and the checkpoint
+   sentinel exists.
 4. **Drive the phases** ([reference/loop.md](reference/loop.md)). The canonical arc is
    `/rite-spec` → **`/rite-clarify`** → **`/rite-temper`** → `/rite-define` →
    **`/rite-vet`** → `/rite-build` (repeat until all slices
-   built; `devrites-engine tick-afk` each) → `/rite-prove` → `/rite-polish` → `/rite-review` → `/rite-seal`.
-   Run each by Reading its `SKILL.md` and executing its workflow; state is carried by the
-   workspace files, not chat.
+   built; root charges the AFK budget once per green built slice) → `/rite-prove`
+   → `/rite-polish` → `/rite-review` → `/rite-seal`.
+   Read each `SKILL.md` and execute it; workspace files carry state, not chat.
+   Immediately after `/rite-vet` and before the first Build dispatch, apply the loop's
+   [mutable post-vet budget](reference/loop.md#derive-the-mutable-post-vet-budget)
+   contract. **Completion:** the loop reaches Seal GO, or a stop condition is persisted
+   before any later phase runs; the cursor names the last completed phase and the
+   effective remaining budget.
 5. **Apply stop conditions at every gate** ([reference/stop-conditions.md](reference/stop-conditions.md)):
    on hard-risk / blocking / escalating / NO-GO / budget-exhausted / still-low-confidence
    → write `state.md` (`Status`, `Next step`), surface *why*, and **STOP**.
-6. **Seal GO → ship.** With `--ship`, proceed to `/rite-ship` and auto-confirm the
-   type-GO. Without it, render the type-GO prompt and stop for the human.
+   **Completion:** either no stop condition is active, or the stopped cursor and reason
+   are durable and no later phase has been invoked.
+6. **Seal GO → ship boundary.** With `--ship` / `--yolo`, proceed through
+   `/rite-ship` preflight, disclose the exact Git plan, then stop for the human's
+   literal `GO` and any native host approval. Without the flag, stop at seal GO with
+   `/rite-ship` as the resume command. **Completion:** the no-flag path has performed no
+   Ship work; the flagged path has disclosed the exact plan and performed no Git action
+   before fresh literal `GO` plus native approval.
 
 > **Mid-flight discipline.** Stop rather than auto-passing a blocking gate, answering a
 > human-owned material question, or continuing past red tests.
 
-## Output
-A compact phase log followed by the final status. **Progress first for the final
-status**: run `devrites-engine progress`, then use the shared typed states from
-[`devrites-lib/reference/reply-contract.md`](../devrites-lib/reference/reply-contract.md):
-`Shipped`, `Stopped`, `Awaiting human`, `NO-GO`, or `GO`.
-
 Keep the log terse:
 ```
 Autocomplete: <slug>
@@ -98,7 +107,9 @@ Final state examples: `Shipped: <feature>`, `Stopped: <reason>`, `Awaiting human
 Do not write a narrative recap.
 
 ## Clean baseline and checkpoint mode
-- Before an autonomous run, require a clean or explicitly accepted baseline: refuse unrelated dirty work and record expected planning artifacts.
-- Arm `.devrites/CHECKPOINT` for the run so each proven slice can be checkpointed local-only; `/rite-ship` owns collapsing those checkpoints.
-- Stop on risky steps, red gates, NO-GO, stale evidence, or budget exhaustion.
-- Autocomplete gets one approved pass through the lifecycle; `/rite-build` still builds exactly one slice per invocation.
+- Before autonomy, require a clean or accepted baseline; refuse unrelated dirty work and record plan artifacts.
+- Arm `.devrites/CHECKPOINT`; `/rite-ship` collapses its local-only proven-slice checkpoints.
+- Stop on risky steps, red gates, NO-GO, stale evidence, or exhausted budget.
+- One autocomplete pass spans the lifecycle. Each wright returns after one slice;
+  explicit `.devrites/AFK` lets the Build root chain green slices under cap/pause rules;
+  otherwise HITL stops.

package/pack/.claude/skills/rite-autocomplete/reference/loop.md

@@ -1,30 +1,37 @@
 # The autocomplete loop: arm AFK, drive every phase
 
-Autocomplete runs the existing `/rite-*` skills in order without stopping between
-routine phases. Each phase keeps its own workflow; autocomplete only sequences phases
-and enforces stop conditions.
+Autocomplete sequences existing `/rite-*` workflows and enforces stop
+conditions without pausing between routine phases.
 
-## Arm AFK
+## Arm AFK once
 
-Arm the gate policy up front; set the slice budget once the plan's count is known:
+Arm the gate policy up front without mutating it later:
 
 ```yaml
 allow_gates: [advisory]        # only advisory auto-handles; validating+ pause
 # notify: "<cmd>"              # optional — fired on any awaiting_human pause
-# max_slices: <N>              # the slice BUDGET — set from the plan's count after
-# /rite-define (or an explicit --max-slices). NOT a target decomposition; it only
-# caps how many run unattended (default = all the plan's slices).
+# max_slices: <N>              # include only for an explicit/configured cap
 ```
 
-The budget is the plan's slice count, so the loop builds the planned slices and stops
-when they are done. `--max-slices N` only lowers that number for a
-partial run. Arm the gate policy at step 3; write `max_slices` / `AFK slices remaining`
-**after `/rite-vet`** (it runs before the build loop and may split or add a slice, so the
-count isn't final until then: vet runs on every plan here, so always set the budget after it).
+Read an existing sentinel first. Preserve it byte-for-byte when valid; stop if its gate
+ceiling exceeds `advisory` or its `max_slices` conflicts with the invocation. If absent,
+write it once after clarity with `allow_gates: [advisory]` and an explicit
+`--max-slices N` only when supplied. The sentinel is read-only: never rewrite it after
+`/rite-vet` to inject a discovered plan count.
+
+### Derive the mutable post-vet budget
+
+After `/rite-vet`, count remaining pending slices and derive the run budget as the
+minimum of that count, an explicit `--max-slices`, and a configured sentinel cap. Before
+the first build dispatch, pre-seed `state.md` `afk_slices_remaining` when absent. If a
+valid remaining counter already exists, retain the lower of it and the derived budget;
+never increase or reinitialize it. This keeps the crash-survivable budget in its mutable owner
+without changing AFK configuration mid-run.
 
 `allow_gates: [advisory]` prevents an open `gate: validating` from being queued until
 seal, where it would force NO-GO under `afk-hitl.md`. Autocomplete pauses on it instead. Widen
-`allow_gates` only when the caller explicitly asks.
+`allow_gates` only outside autocomplete through an explicit human configuration change;
+autocomplete itself never widens the ceiling.
 
 ## Drive the phases
 
@@ -37,13 +44,13 @@ Read each phase's `SKILL.md` and execute that workflow. Workspace files such as
 | 2 | `/rite-clarify` | same interactive window: topology-first scan; write `decision-coverage.md`; proceed only on `CLEAR`, then arm AFK |
 | 3 | `/rite-temper` | significance-gated strategic review; harden spec + write `strategy.md`. Skip low-stakes specs in one line. AFK: `hold-rigor` / `reduce-to-MVP` auto-apply; **any `expand` pauses (blocking)**; irreversible-risk pauses |
 | 4 | `/rite-define` | reads `decision-coverage.md` + `strategy.md`; writes `plan.md` + `tasks.md`; records `Plan approved` |
-| 5 | `/rite-vet` | engineering/readiness review on **every** plan (light pass on simple plans, full on big/risky; never skipped); harden `plan.md` / `tasks.md` + write `eng-review.md` (`Implementation readiness: READY`) + `test-plan.md`. AFK: hardening / coverage findings auto-apply; **any scope-growing / acceptance-changing finding pauses (blocking)**; irreversible-risk pauses. Set the slice budget after this (vet may split a slice) |
-| 6 | `/rite-build` ×N | **loop** while any slice is `pending`; build one (the slice-wright reads `test-plan.md` for coverage), then run `devrites-engine tick-afk state.md`: exit 3 (budget hit) ⇒ STOP |
+| 5 | `/rite-vet` | engineering/readiness review on **every** plan (light pass on simple plans, full on big/risky; never skipped); harden `plan.md` / `tasks.md` + write `eng-review.md` (`Implementation readiness: READY`) + `test-plan.md`. AFK: hardening / coverage findings auto-apply; **any scope-growing / acceptance-changing finding pauses (blocking)**; irreversible-risk pauses. Derive and pre-seed the state-owned slice budget after this (vet may split a slice); never rewrite the AFK sentinel |
+| 6 | `/rite-build` ×N | **loop** while any slice is `pending`; build one, then let the root charge exactly one budget unit with the built-state record. Zero ⇒ STOP before another dispatch. |
 | 7 | `/rite-prove` | once all slices `built`; walks `test-plan.md`; on failure → `devrites-debug-recovery` within scope |
 | 8 | `/rite-polish` | re-verify after code edits (evidence must stay fresh) |
 | 9 | `/rite-review` | apply in-scope fixes; re-prove if code changed |
 | 10 | `/rite-seal` | GO/NO-GO decision (no git here) |
-| 11 | `/rite-ship` | only if seal GO; `--ship` auto-confirms type-GO, else stop for human |
+| 11 | `/rite-ship` | only if seal GO; `--ship` / `--yolo` never authorizes Git and only continues to the exact-plan literal-GO/native-approval boundary |
 
 ## Between phases