devrites 3.2.28 → 4.0.0

package/pack/generated/claude/skills/rite-autocomplete/SKILL.md

@@ -1,42 +1,40 @@
 ---
 name: rite-autocomplete
-description: Run the DevRites lifecycle end-to-end unattended; --ship confirms the final gate. Use when the user says "autocomplete", "one-shot this feature", or "ship it autonomously". Not for a single phase.
-argument-hint: "[idea] [--ship|--yolo] [--max-slices N]"
+description: Run the full DevRites lifecycle unattended; --ship continues to the final Git approval boundary. Use for one-shot autonomous work; not for a single phase.
+argument-hint: "[idea] [--ship|--yolo] [--max-slices N] [--full] [--cross-model]"
 user-invocable: true
-required-agent-roles: none
 ---
 
 # /rite-autocomplete: full lifecycle, unattended
 
-Runs every DevRites phase in order without pausing for discretionary input. It asks
-clarifying questions **before** unattended work begins. Safety gates remain active:
-hard irreversible-risk,<!-- pack-scan-ignore: negated statement: gates are NOT disabled -->
-blocking / escalating gates, and any NO-GO still pause.
+Runs every phase unattended after initial clarification. Irreversible-risk,
+blocking/escalating,<!-- pack-scan-ignore: negated statement: gates are NOT disabled -->
+and NO-GO gates still pause. Use the **Standard** native execution profile by
+default and **Full** for high-risk scope or explicit `--full`; profiles are defined in
+[`devrites-lib/reference/orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md).
 
 ## Rules consulted (read on demand from `.claude/skills/devrites-lib/reference/standards/`)
 **Step 0:** Read `.claude/skills/devrites-lib/reference/standards/core.md` and `.claude/skills/devrites-lib/reference/standards/afk-hitl.md` first.
 
 ## Operating rules
-- **Use one initial human window.** Run spec and topology-first clarify; arm AFK only after
-  `Decision coverage: CLEAR`. Later discretionary calls are recorded, not asked
+- **Use one initial human window.** Run spec and topology-first clarify; arm AFK
+  only after `Decision coverage: CLEAR`. Record later discretionary calls
   ([decision policy](reference/decision-policy.md)).
-- **Safety gates are not bypassable.** AFK never auto-passes destructive migration /
-  auth-authz change / public-API break / external-contract change; blocking
-  and escalating gates and any open `gate: validating` always pause. `--ship` auto-confirms
-  the **final** type-GO only: nothing else. A change that violates a declared project
-  principle (`.devrites/principles.md`) with no recorded exception pauses too: autocomplete
-  never grants a principle exception on its own (`principles.md`: that's a human decision).
-  Red checks never advance the loop: autocomplete runs the shared bounded debug recovery, then
-  stops as `blocked` if the objective failure remains; it asks only if recovery exposes a
-  human-owned decision.
-- **Set the loop budget from the plan's slice count.** After `/rite-vet`
-  (not `/rite-define`: vet may split or add slices, so the count isn't final until then),
-  set the AFK budget to however many slices the plan has, so the loop builds exactly the
-  planned slices and stops when they are done. `--max-slices N` is an optional lower
-  safety cap for a partial run; omit it to run the whole plan. The planned slice count
-  keeps the default run finite.
-- **Record each discretionary choice.** Pick the option recommended by the relevant
-  specialist or reviewer and record the rationale. Do not choose arbitrarily.
+- **Safety gates are not bypassable.** Irreversible risk, blocking/escalating,
+  open validating gates, and unexcepted principle violations pause. `--ship` /
+  `--yolo` never authorizes Git; it reaches only the exact-plan literal-GO and
+  native-approval boundary. Red checks run bounded recovery, then block unless
+  the remaining decision is human-owned.
+- **Budget from the post-vet slice count.** Vet may split/add slices.
+  `--max-slices N` may lower the cap for a partial run; otherwise build all.
+- **Parse flags only from this invocation.** `--ship`, `--yolo`, `--max-slices`,
+  `--full`, and `--cross-model` are active only when their exact standalone tokens
+  occur in `$ARGUMENTS`; their presence in this skill, examples, or earlier messages
+  can never arm them. `--max-slices` must occur once and be followed by a positive
+  base-10 integer; missing, repeated, malformed, or conflicting values stop before
+  any sentinel or workspace write.
+- **Record discretionary choices.** Use the specialist/reviewer recommendation
+  and rationale; never choose arbitrarily.
 - **Strategic review runs, but never auto-grows scope.** After `/rite-clarify`, run `/rite-temper`
   (significance-gated; it skips low-stakes specs in one line). Unattended it auto-applies only
   `hold-rigor` + `reduce-to-MVP` (these never grow acceptance); **any `expand` is a blocking
@@ -46,47 +44,58 @@ blocking / escalating gates, and any NO-GO still pause.
   run `/rite-vet` on **every** feature (depth scales: a light pass on simple plans, full rigor on
   big/risky; never skipped). Unattended it auto-applies only *hardening* findings: added test
   requirements, error-handling / failure-mode coverage, tightened scope, reuse-over-rebuild,
-  ordering / parallel-lane fixes (these never grow acceptance); **any finding that grows scope,
+  dependency-order fixes (these never grow acceptance); **any finding that grows scope,
   adds a slice, or changes acceptance is a blocking pause**, and irreversible-risk findings always
   pause. Cross-model is off unless `--cross-model` was armed.
 
 ## Workflow
-1. **Orient + parse args.** Run `devrites-engine preamble` for deterministic workspace orientation.
-   The idea + flags: `--ship` / `--yolo` (auto-confirm the final
-   type-GO), `--max-slices N` (optional lower safety cap for a partial run; default =
-   the plan's slice count, i.e. run all planned slices).
+1. **Orient + parse args.** Resolve the explicit or active slug, require its
+   `state.md`, and read the cursor directly.
+   The idea + flags: `--ship` / `--yolo` (continue through ship preflight, then stop
+   for literal-GO and native approval), `--max-slices N` (optional lower safety cap for a partial run; default =
+   the plan's slice count, i.e. run all planned slices). Parse only the current
+   `$ARGUMENTS`; normalize the result to the idea, `ship_preflight: yes|no`,
+   `max_slices: N|plan`, `profile: standard|full`, and `cross_model: yes|no`.
+   **Completion:** that normalized state is unambiguous and no sentinel or workspace
+   file has been written.
 2. **Specify and clarify up front.** Use `devrites-interview`, `/rite-spec`, and
    `/rite-clarify` as one interactive window. Clear specs ask zero questions; Partial/Missing
    coverage never arms AFK. **Completion:** `decision-coverage.md` records `CLEAR`.
-3. **Arm AFK after clarity.** Require `Decision coverage: CLEAR`, then write `.devrites/AFK`
-   with `allow_gates: [advisory]`; set the slice budget
-   from the plan's count after `/rite-vet` (the slice count is only final post-vet), or from
-   an explicit `--max-slices` ([reference/loop.md](reference/loop.md)). validating / blocking / escalating +
-   irreversible-risk still pause. Also `touch .devrites/CHECKPOINT`: unattended runs use
-   checkpoint mode so each proven slice is committed locally as a crash-survivable `WIP`
-   ([rite-build/reference/checkpoint.md](../rite-build/reference/checkpoint.md));
-   `/rite-ship` collapses them into the one feature commit.
+3. **Arm AFK after clarity.** Require `Decision coverage: CLEAR`, then apply the
+   loop's [one-write AFK contract](reference/loop.md#arm-afk-once): preserve a valid
+   existing sentinel byte-for-byte or create an advisory-only sentinel once; never
+   rewrite it after Vet. Also `touch .devrites/CHECKPOINT`: unattended runs use
+   checkpoint mode so each proven slice is committed locally as a crash-survivable
+   `WIP` ([rite-build/reference/checkpoint.md](../rite-build/reference/checkpoint.md));
+   `/rite-ship` collapses them into the one feature commit. **Completion:** AFK config is
+   valid and advisory-only, any pre-existing bytes are unchanged, and the checkpoint
+   sentinel exists.
 4. **Drive the phases** ([reference/loop.md](reference/loop.md)). The canonical arc is
    `/rite-spec` → **`/rite-clarify`** → **`/rite-temper`** → `/rite-define` →
    **`/rite-vet`** → `/rite-build` (repeat until all slices
-   built; `devrites-engine tick-afk` each) → `/rite-prove` → `/rite-polish` → `/rite-review` → `/rite-seal`.
-   Run each by Reading its `SKILL.md` and executing its workflow; state is carried by the
-   workspace files, not chat.
+   built; root charges the AFK budget once per green built slice) → `/rite-prove`
+   → `/rite-polish` → `/rite-review` → `/rite-seal`.
+   Read each `SKILL.md` and execute it; workspace files carry state, not chat.
+   Immediately after `/rite-vet` and before the first Build dispatch, apply the loop's
+   [mutable post-vet budget](reference/loop.md#derive-the-mutable-post-vet-budget)
+   contract. **Completion:** the loop reaches Seal GO, or a stop condition is persisted
+   before any later phase runs; the cursor names the last completed phase and the
+   effective remaining budget.
 5. **Apply stop conditions at every gate** ([reference/stop-conditions.md](reference/stop-conditions.md)):
    on hard-risk / blocking / escalating / NO-GO / budget-exhausted / still-low-confidence
    → write `state.md` (`Status`, `Next step`), surface *why*, and **STOP**.
-6. **Seal GO → ship.** With `--ship`, proceed to `/rite-ship` and auto-confirm the
-   type-GO. Without it, render the type-GO prompt and stop for the human.
+   **Completion:** either no stop condition is active, or the stopped cursor and reason
+   are durable and no later phase has been invoked.
+6. **Seal GO → ship boundary.** With `--ship` / `--yolo`, proceed through
+   `/rite-ship` preflight, disclose the exact Git plan, then stop for the human's
+   literal `GO` and any native host approval. Without the flag, stop at seal GO with
+   `/rite-ship` as the resume command. **Completion:** the no-flag path has performed no
+   Ship work; the flagged path has disclosed the exact plan and performed no Git action
+   before fresh literal `GO` plus native approval.
 
 > **Mid-flight discipline.** Stop rather than auto-passing a blocking gate, answering a
 > human-owned material question, or continuing past red tests.
 
-## Output
-A compact phase log followed by the final status. **Progress first for the final
-status**: run `devrites-engine progress`, then use the shared typed states from
-[`devrites-lib/reference/reply-contract.md`](../devrites-lib/reference/reply-contract.md):
-`Shipped`, `Stopped`, `Awaiting human`, `NO-GO`, or `GO`.
-
 Keep the log terse:
 ```
 Autocomplete: <slug>
@@ -98,7 +107,9 @@ Final state examples: `Shipped: <feature>`, `Stopped: <reason>`, `Awaiting human
 Do not write a narrative recap.
 
 ## Clean baseline and checkpoint mode
-- Before an autonomous run, require a clean or explicitly accepted baseline: refuse unrelated dirty work and record expected planning artifacts.
-- Arm `.devrites/CHECKPOINT` for the run so each proven slice can be checkpointed local-only; `/rite-ship` owns collapsing those checkpoints.
-- Stop on risky steps, red gates, NO-GO, stale evidence, or budget exhaustion.
-- Autocomplete gets one approved pass through the lifecycle; `/rite-build` still builds exactly one slice per invocation.
+- Before autonomy, require a clean or accepted baseline; refuse unrelated dirty work and record plan artifacts.
+- Arm `.devrites/CHECKPOINT`; `/rite-ship` collapses its local-only proven-slice checkpoints.
+- Stop on risky steps, red gates, NO-GO, stale evidence, or exhausted budget.
+- One autocomplete pass spans the lifecycle. Each wright returns after one slice;
+  explicit `.devrites/AFK` lets the Build root chain green slices under cap/pause rules;
+  otherwise HITL stops.

package/pack/generated/claude/skills/rite-autocomplete/reference/loop.md

@@ -1,30 +1,37 @@
 # The autocomplete loop: arm AFK, drive every phase
 
-Autocomplete runs the existing `/rite-*` skills in order without stopping between
-routine phases. Each phase keeps its own workflow; autocomplete only sequences phases
-and enforces stop conditions.
+Autocomplete sequences existing `/rite-*` workflows and enforces stop
+conditions without pausing between routine phases.
 
-## Arm AFK
+## Arm AFK once
 
-Arm the gate policy up front; set the slice budget once the plan's count is known:
+Arm the gate policy up front without mutating it later:
 
 ```yaml
 allow_gates: [advisory]        # only advisory auto-handles; validating+ pause
 # notify: "<cmd>"              # optional — fired on any awaiting_human pause
-# max_slices: <N>              # the slice BUDGET — set from the plan's count after
-# /rite-define (or an explicit --max-slices). NOT a target decomposition; it only
-# caps how many run unattended (default = all the plan's slices).
+# max_slices: <N>              # include only for an explicit/configured cap
 ```
 
-The budget is the plan's slice count, so the loop builds the planned slices and stops
-when they are done. `--max-slices N` only lowers that number for a
-partial run. Arm the gate policy at step 3; write `max_slices` / `AFK slices remaining`
-**after `/rite-vet`** (it runs before the build loop and may split or add a slice, so the
-count isn't final until then: vet runs on every plan here, so always set the budget after it).
+Read an existing sentinel first. Preserve it byte-for-byte when valid; stop if its gate
+ceiling exceeds `advisory` or its `max_slices` conflicts with the invocation. If absent,
+write it once after clarity with `allow_gates: [advisory]` and an explicit
+`--max-slices N` only when supplied. The sentinel is read-only: never rewrite it after
+`/rite-vet` to inject a discovered plan count.
+
+### Derive the mutable post-vet budget
+
+After `/rite-vet`, count remaining pending slices and derive the run budget as the
+minimum of that count, an explicit `--max-slices`, and a configured sentinel cap. Before
+the first build dispatch, pre-seed `state.md` `afk_slices_remaining` when absent. If a
+valid remaining counter already exists, retain the lower of it and the derived budget;
+never increase or reinitialize it. This keeps the crash-survivable budget in its mutable owner
+without changing AFK configuration mid-run.
 
 `allow_gates: [advisory]` prevents an open `gate: validating` from being queued until
 seal, where it would force NO-GO under `afk-hitl.md`. Autocomplete pauses on it instead. Widen
-`allow_gates` only when the caller explicitly asks.
+`allow_gates` only outside autocomplete through an explicit human configuration change;
+autocomplete itself never widens the ceiling.
 
 ## Drive the phases
 
@@ -37,13 +44,13 @@ Read each phase's `SKILL.md` and execute that workflow. Workspace files such as
 | 2 | `/rite-clarify` | same interactive window: topology-first scan; write `decision-coverage.md`; proceed only on `CLEAR`, then arm AFK |
 | 3 | `/rite-temper` | significance-gated strategic review; harden spec + write `strategy.md`. Skip low-stakes specs in one line. AFK: `hold-rigor` / `reduce-to-MVP` auto-apply; **any `expand` pauses (blocking)**; irreversible-risk pauses |
 | 4 | `/rite-define` | reads `decision-coverage.md` + `strategy.md`; writes `plan.md` + `tasks.md`; records `Plan approved` |
-| 5 | `/rite-vet` | engineering/readiness review on **every** plan (light pass on simple plans, full on big/risky; never skipped); harden `plan.md` / `tasks.md` + write `eng-review.md` (`Implementation readiness: READY`) + `test-plan.md`. AFK: hardening / coverage findings auto-apply; **any scope-growing / acceptance-changing finding pauses (blocking)**; irreversible-risk pauses. Set the slice budget after this (vet may split a slice) |
-| 6 | `/rite-build` ×N | **loop** while any slice is `pending`; build one (the slice-wright reads `test-plan.md` for coverage), then run `devrites-engine tick-afk state.md`: exit 3 (budget hit) ⇒ STOP |
+| 5 | `/rite-vet` | engineering/readiness review on **every** plan (light pass on simple plans, full on big/risky; never skipped); harden `plan.md` / `tasks.md` + write `eng-review.md` (`Implementation readiness: READY`) + `test-plan.md`. AFK: hardening / coverage findings auto-apply; **any scope-growing / acceptance-changing finding pauses (blocking)**; irreversible-risk pauses. Derive and pre-seed the state-owned slice budget after this (vet may split a slice); never rewrite the AFK sentinel |
+| 6 | `/rite-build` ×N | **loop** while any slice is `pending`; build one, then let the root charge exactly one budget unit with the built-state record. Zero ⇒ STOP before another dispatch. |
 | 7 | `/rite-prove` | once all slices `built`; walks `test-plan.md`; on failure → `devrites-debug-recovery` within scope |
 | 8 | `/rite-polish` | re-verify after code edits (evidence must stay fresh) |
 | 9 | `/rite-review` | apply in-scope fixes; re-prove if code changed |
 | 10 | `/rite-seal` | GO/NO-GO decision (no git here) |
-| 11 | `/rite-ship` | only if seal GO; `--ship` auto-confirms type-GO, else stop for human |
+| 11 | `/rite-ship` | only if seal GO; `--ship` / `--yolo` never authorizes Git and only continues to the exact-plan literal-GO/native-approval boundary |
 
 ## Between phases
 

package/pack/generated/claude/skills/rite-autocomplete/reference/stop-conditions.md

@@ -1,8 +1,8 @@
 # Stop conditions: when autocomplete must pause for a human
 
-In the cases below, autocomplete writes `state.md` (`Status: awaiting_human` or
-`blocked`), reports the reason and one resume command, fires `notify` if set, and
-**stops**. `--ship` cannot bypass them.
+On these conditions, write `state.md` (`awaiting_human` or `blocked`), report
+the reason and one resume command, notify if configured, and stop. `--ship`
+cannot bypass them.
 
 ## Always stop (irreversible-risk list: from `afk-hitl.md`)
 
@@ -13,9 +13,8 @@ Regardless of `allow_gates` or `--ship`:
 - External-service contract change.
 - Filesystem destruction outside the workspace.
 
-Red tests/types/lint/build/browser proof are hard non-advance gates, not automatically human
-gates. Run bounded `devrites-debug-recovery`; if it exhausts, stop as a technical blocker unless
-the remaining issue is human-owned.
+Red checks are hard non-advance gates. Run bounded `devrites-debug-recovery`;
+on exhaustion, stop as a technical blocker unless human-owned.
 
 ## Stop on gate severity
 
@@ -26,11 +25,9 @@ the remaining issue is human-owned.
 
 ## Stop on strategic-review scope expansion (`/rite-temper`)
 
-- `/rite-temper` choosing scope mode `expand`, or otherwise **adding** any acceptance
-  criterion to `spec.md`: → synchronous pause, regardless of `allow_gates` / `--ship`.
-  Autocomplete may auto-apply only `hold-rigor` and `reduce-to-MVP` (they harden / prune and
-  never grow the build's scope); **growing scope unattended is never automatic**. A low-stakes
-  spec that temper skips, or a `hold-rigor` / `reduce-to-MVP` run, does **not** pause.
+- Any `expand` or added acceptance criterion pauses regardless of
+  `allow_gates`/`--ship`. Only `hold-rigor` and `reduce-to-MVP` auto-apply;
+  skipped low-stakes specs and those two modes do not pause.
 
 ## Stop on incomplete decision coverage (`/rite-clarify`)
 
@@ -44,21 +41,21 @@ the remaining issue is human-owned.
   direction. Do not round NO-GO up to GO.
 - **Spec Drift Guard fires** (`/rite-build` finds the plan is wrong and the change
   alters product behaviour) → stop; route through `/rite-plan repair`.
-- **Budget exhausted with slices still pending:** `devrites-engine tick-afk` exit 3 while `tasks.md`
-  still has unbuilt slices (only when an explicit `--max-slices` capped the run below the
-  plan's count) → stop; report slices remaining. Exhausting the default budget = all
-  planned slices built = normal completion → continue to `/rite-prove` without pausing.
+- **Budget exhausted with slices still pending:** any validated root-owned remaining
+  value of zero stops before the next dispatch. Report which bound won (pre-existing
+  remaining value, explicit flag, sentinel cap, or post-vet pending count) and the
+  unbuilt slices. A malformed value also fails closed. Zero with no pending slices is
+  normal completion → continue to `/rite-prove` without pausing.
 - **Still low-confidence after the interview:** the idea can't be pinned to testable
   acceptance criteria → stop and ask, rather than guessing the product.
-- **Repeated failure:** a phase fails, `devrites-debug-recovery` can't fix it within
-  scope after a bounded number of attempts → stop with the reproduction.
+- **Repeated failure:** bounded recovery exhausts → stop with reproduction.
 
 ## The final type-GO
 
-- Default: render the type-GO prompt at `/rite-ship` and **stop** for the human's
-  literal `GO`.
-- With `--ship` / `--yolo`: auto-confirm the type-GO (the *only* thing the flag changes).
-  Everything above still pauses.
+- `--ship` / `--yolo` never authorizes Git. Continue through ship preflight,
+  disclose the exact plan, then stop for literal `GO` and native approval.
+- Without either flag, stop at seal GO with `/rite-ship` as the resume command.
+  Seal GO, AFK, prior approval, and flags never satisfy ship approval.
 
 ## How to stop well
 

package/pack/generated/claude/skills/rite-build/SKILL.md

@@ -1,26 +1,26 @@
 ---
 name: rite-build
-description: Build one approved vertical slice, then stop with evidence. Use when the next planned slice should be implemented. Not for multiple slices.
+description: Build the next approved vertical slice with evidence. HITL stops after one; explicit AFK may chain bounded green slices.
 argument-hint: "[slice number or name]"
 user-invocable: true
-required-agent-roles: devrites-slice-wright
 ---
 
 # /rite-build: one verified slice
 
-Build and prove one slice, then **stop**. **Read the active workspace first**; if none,
-tell the user to run `/rite-spec <feature>`.
+Build and prove one slice. HITL stops; a later user invocation starts the next.
+Explicit `.devrites/AFK` alone lets the controlling root chain pending slices,
+only under existing green-proof, cap, and pause rules. **Read the active workspace
+first**; if none, tell the user to run `/rite-spec <feature>`.
 
-This skill owns the gates and workspace. A fresh-context
-[`devrites-slice-wright`](../../agents/devrites-slice-wright.md) writes source and tests.
-Run the readiness, slice-selection, and HITL checks; dispatch the wright; then run the
-doubt, fail-on-red, recording, and stop checks. See
+The root owns gates/workspace; a
+fresh-context [`devrites-slice-wright`](../../agents/devrites-slice-wright.md)
+writes source and tests. Apply the readiness, selection, host, HITL/AFK,
+dispatch, doubt, fail-on-red, record, and stop checks. See
 [`reference/wright-dispatch.md`](reference/wright-dispatch.md).
 
 ## Rules consulted (read on demand from `.claude/skills/devrites-lib/reference/standards/`)
-Read `.claude/skills/devrites-lib/reference/standards/core.md` first (workflow step 0). The
-following load on demand: **the wright reads them** (they are named in its contract) while it
-writes; read them yourself for the doubt/record gates:
+Read `.claude/skills/devrites-lib/reference/standards/core.md` first. The wright
+reads named on-demand rules while writing; root reads them for doubt/record gates:
 - `coding-style.md`: naming, function shape, guard clauses, comments, reuse-first.
 - `error-handling.md`: fail fast, no silent catches, fail closed.
 - `testing.md`: pyramid, behaviour over implementation, see-it-fail-first.
@@ -33,13 +33,14 @@ writes; read them yourself for the doubt/record gates:
 
 
 ## Operating rules
-- **One slice at a time. DO NOT** start the next slice without the user asking.
+- **One slice per wright dispatch.** Every wright returns after it. The controlling
+  root applies the mode rule above before another dispatch.
 - Evidence over confidence. Prefer existing conventions. Feature scope only: no
   drive-by refactors.
-- **Record adjacent issues; do not edit them.** An issue outside the captured
-  `.wright-allowlist` becomes an FYI follow-up in `decisions.md`. The slice summary states
+- **Record adjacent issues; do not edit them.** An issue outside the exact paths
+  stated in the dispatch task becomes an FYI follow-up in `decisions.md`. The slice summary states
   what it deliberately left alone ([`git-workflow.md`](../devrites-lib/reference/standards/git-workflow.md)
-  "Things I didn't touch"). The `devrites-engine reconcile` gate enforces this boundary.
+  "Things I didn't touch"). The root rejects a returned diff outside this boundary.
 - **Don't re-run an unchanged check.** The same build or test on unchanged code provides
   no new evidence. Re-verify after an edit.
 - Surface material assumptions. Do not introduce an unplanned dependency or second design
@@ -60,31 +61,24 @@ writes; read them yourself for the doubt/record gates:
   principle was broken**; a fresh violation is handled like any irreversible-risk item: a
   human-approved, scoped exception in the register or a stop, never folded into the slice. No
   `.devrites/principles.md` → none declared → nothing to honor.
-- **You never edit source: the wright is the only writer of code + tests.** You write only
-  `.devrites/` bookkeeping. On any red gate, doubt finding, or coverage gap your only remedies
-  are to continue the same wright under bounded `devrites-debug-recovery` (three total attempts
-  per root cause) or stop with the correctly classified blocker: never patch the code yourself
-  and never ask the human to authorize agent-owned repair work. The `devrites-engine reconcile`
-  gate enforces this against the root-owned pre-dispatch allowlist: any source file changed
-  outside that exact set is a hard STOP.
-- **Forge is manifest-owned, winner-takes-all.** For a fully typed `Forge: yes`
-  slice, follow [`reference/forge.md`](reference/forge.md): `forge plan` precedes
-  reconciliation; every candidate is bound to its isolated worktree and live worker;
-  the judge records one winner; normal reconciliation and proof pass before manifest-only
-  cleanup and the human report. Any stale/ineligible flag uses one serial wright before
-  Forge creates state.
+- **You never edit source.** You write only `.devrites/` bookkeeping. Follow the
+  host gate in `wright-dispatch.md` before every build or recovery dispatch. On a
+  supported host, the wright is the only writer of code and tests. Codex gives
+  the root workspace permission only so that native writer dispatch can execute;
+  never patch code from the root. Put the exact project-relative source/test path
+  list directly in the task, dispatch the exact `devrites-slice-wright`, then
+  compare `git diff --name-only` with those task paths. Any extra source file is
+  a hard STOP.
 
 ## Workflow
 
 Run the full execution contract in
 [`reference/phase-contract.md`](reference/phase-contract.md). It is not optional:
 it contains the gated one-slice workflow, including readiness, HITL/AFK handling,
-wright dispatch, forge, doubt, fail-on-red, record gates, and stop behavior.
+wright dispatch, doubt, fail-on-red, record gates, and stop behavior.
 
 ## Output
 
-Use the full output contract in [`reference/output.md`](reference/output.md).
-It preserves the progress-footer-first response shape, uses the shared completion
-reply contract
-([`devrites-lib/reference/reply-contract.md`](../devrites-lib/reference/reply-contract.md)),
-and keeps the explicit stop after one slice.
+Use [`reference/output.md`](reference/output.md) and the shared
+[`reply contract`](../devrites-lib/reference/reply-contract.md). They keep the
+HITL stop, bounded AFK chaining, and no-automatic-`/rite-prove` boundary explicit.

package/pack/generated/claude/skills/rite-build/reference/afk-discipline.md

@@ -3,6 +3,11 @@
 AFK mode is active when `.devrites/AFK` exists. It lets `/rite-build` chain slices
 without per-slice user input. The rules below limit that unattended work.
 
+Load the shared
+[`afk-hitl.md`](../../devrites-lib/reference/standards/afk-hitl.md#the-sentinel-devritesafk)
+contract for the sentinel schema, defaults, gate ceiling, and mutable-counter
+ownership. This file owns only Build's dispatch, charging, and red-path behavior.
+
 These rules follow established autonomous-coding loops, including Ralph Wiggum and
 Claude Code auto mode:
 
@@ -14,44 +19,41 @@ Claude Code auto mode:
 4. **Keep irreversible work manual.** Destructive work, auth boundaries, and public
    API breaks always pause regardless of the sentinel.
 
-## The sentinel file
-
-`.devrites/AFK` (presence = AFK). Optional YAML body:
-
-```yaml
-max_slices: 10                       # read-only INITIAL budget; seeds state.md on first AFK build
-notify: "ntfy.sh/my-topic"           # shell command run on awaiting_human transition
-allow_gates: [advisory, validating]  # gate severities AFK may auto-handle
-```
-
-`.devrites/AFK` is **read-only config**: never rewritten in place. `max_slices` is the
-initial budget; the mutable remaining count lives in `state.md` as `AFK slices remaining:
-<n>`, seeded from `max_slices` on the first AFK build and decremented by `devrites-engine tick-afk`
-(see "Iteration cap").
-
-Defaults when keys are omitted:
-- `max_slices`: unlimited (a missing cap is risky: see "Always cap iterations").
-- `notify`: none.
-- `allow_gates`: `[advisory]`.
-
-To disable AFK, delete the file. The next `/rite-build` runs in HITL.
-
 ## Iteration cap
 
-`/rite-build`'s **record step** (workflow step 6) decrements `state.md`'s `AFK slices
-remaining` by 1 each time a slice is marked `built`, by running
-`devrites-engine tick-afk <state.md path>`. The script reads the
-field, decrements, writes it back, prints the new value, and **exits `3` when it hits 0**.
-The cap is enforced by `devrites-engine tick-afk`, not by prose, when it exits 3:
+The controlling root owns the cap:
+
+1. **Before every dispatch**, re-read `.devrites/AFK`, `state.md`, and the
+   selected slice. A configured `max_slices` and any existing
+   `afk_slices_remaining` value, including its released bullet form, must each
+   be a decimal nonnegative integer. A missing
+   `state.md` or malformed configured value fails closed; an omitted cap is the
+   documented unlimited default only when no remaining counter exists. If the
+   effective remaining value is zero, stop before dispatching another slice.
+2. **After proof is green**, combine the pending → built record and budget
+   charge in one `state.md` rewrite. If the remaining field is absent, add
+   `afk_slices_remaining` to a cursor table or `AFK slices remaining` to a
+   legacy bullet cursor, seed it from `max_slices`, and write
+   `max_slices - 1`; otherwise preserve its spelling and write `remaining - 1`.
+   The counter is never below zero: a value that would go negative is an invariant failure and
+   stops. A missing `max_slices` means unlimited and no remaining field is
+   created.
+   A controlling orchestrator may pre-seed the remaining field from a validated
+   post-plan budget before the first dispatch; never increase or reinitialize an
+   existing value.
+3. **Charge exactly once after each green built slice.** A slice already marked
+   built is not charged again after retry, resume, or compaction. Re-read the
+   saved cursor; if it is zero, report the cap and stop before the next
+   dispatch.
+
+Use this stop message:
 
-- `/rite-build` treats exit 3 as a forced HITL stop:
-  ```
-  AFK cap reached. Raise `state.md` `AFK slices remaining` or remove the sentinel to continue.
-  ```
-- The workspace stays consistent: no half-built slice, no pending question.
+```
+AFK cap reached. Raise `state.md` `AFK slices remaining` or remove the sentinel to continue.
+```
 
-Step 0 re-derives the remaining budget from `state.md` (seeding it from `.devrites/AFK`
-`max_slices` on the first AFK build); `max_slices` itself is read-only and never rewritten.
+`max_slices` itself is read-only and never rewritten. No exit-code command
+enforces this policy.
 
 Choose a missing or large cap deliberately. Ralph's rule is 5-10 iterations for small
 tasks and 30-50 for larger ones. Do not use `unlimited` for work that has not completed

package/pack/generated/claude/skills/rite-build/reference/anti-patterns.md

@@ -1,37 +1,23 @@
 # rite-build: anti-patterns
 
-Load this when standing a non-trivial implementation decision, or when the
-agent feels reluctance toward stopping after one slice, applying TDD, or
-calling `devrites-doubt`.
+Load when a non-trivial decision stands or stopping, TDD, or doubt discipline
+feels inconvenient.
 
-Pack-wide rationalizations + red flags (incl. tests-later, defensive checks,
-generic AI naming, drive-by refactors): see
+Pack-wide rationalizations and red flags live in
 [standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-patterns.md).
 
 ## Phase-specific rationalizations
 
 | Excuse | Rebuttal |
 |---|---|
-| "Slices 1 and 2 are related; let me do both." | One slice, then stop. Full stop. The user asks for the next. |
+| "Slices 1 and 2 are related; let me do both." | HITL needs a later user invocation. Explicit `.devrites/AFK` may let the root chain only after green proof and cap/pause gates; each wright still returns after one. |
 | "It's faster to skip `devrites-doubt` for this small change." | Doubt is cheapest *before* the decision is standing. After is debugging. |
 
-## Forge ([forge.md](forge.md))
-
-| Excuse | Rebuttal |
-|---|---|
-| "This slice is hard. I'll forge it." | Hard ≠ forkable. Forge competes ≥2 *genuinely-different* approaches with no clear winner. One hard approach is single-path; building it K times wastes K× for one answer. |
-| "I'm not sure which approach is right, so let me compete them and decide." | Forge is for a real fork the plan couldn't settle, not for dodging a decision you can make now. Decide from the code/docs first; forge only when the alternatives are genuinely undecidable on paper. |
-| "Candidate A's data layer plus B's UI would be the best of both." | Don't hand-merge candidates: two authors in one tree is the incoherence the single-writer rule exists to prevent. Land one winner whole; graft a *specific* runner-up idea only by continuing the winning wright once. |
-| "The judge already scored these, so I can skip the post-return doubt." | The judge picks *between* candidates; it doesn't replace doubting the winner's standing decisions. Steps 4-7 run on the winner unchanged. |
-| "A fourth candidate might be even better." | K is capped at 3. A fourth rarely moves the winner and multiplies cost; if none of three is right, the plan is wrong: `/rite-plan repair`, don't add candidates. |
-
 ## Red Flags
 
-- About to start slice N+1 without the user asking.
+- About to start slice N+1 outside explicit AFK or before its green-proof/cap/pause gates.
 - Skipping `devrites-doubt` on a branching, boundary, data-model, auth, public-API, or migration decision.
 - Adding a dependency or a second design system without recording rationale in `decisions.md`.
 - Writing a `try/catch` block wider than what you handle.
 - A comment that restates what the next line does.
 - Touching files that aren't in `touched-files.md` for "tidiness".
-- Forging a slice with no acceptance / `test-plan.md` coverage for the judge to score against.
-- Landing more than one candidate's code, or keeping a losing worktree/branch around after F7.

package/pack/generated/claude/skills/rite-build/reference/checkpoint-protocol.md

@@ -44,7 +44,8 @@ and the resume line is `/rite-resolve <qid> "<answer>"` (or `--drop <qid> "<reas
 
 ### Workspace mutations
 
-In one atomic write (one `state.md` rewrite + one `questions.md` append):
+In one bounded root-owned update (one `questions.md` append and one `state.md`
+rewrite; do not claim cross-file atomicity):
 
 1. **`questions.md` append:**
 
@@ -99,11 +100,12 @@ In one atomic write (one `state.md` rewrite + one `questions.md` append):
 ## qid generation
 
 Format: `q-YYYY-MM-DD-NNN`, where `NNN` is the next sequential integer for that date in
-`questions.md`. For the write side, call
-`devrites-engine resolve next-qid <questions.md path>`. It
-counts existing `## q-YYYY-MM-DD-` headers for today, prints the next zero-padded id, and
-refuses to print an id whose header already exists. Use that id verbatim so each qid is
-unique within the date.
+`questions.md`. The controlling root must scan every question header matching
+today's prefix, collect its numeric suffixes, and select one above the highest
+observed suffix (or `001` when none exist), advancing until it is unused. Then
+re-read `questions.md` immediately before the append and repeat the scan. Append only if
+the same candidate is still the next unused id; otherwise recompute. There is no
+reservation or engine command for qids.
 
 ## When AFK is active
 
@@ -123,9 +125,8 @@ If `.devrites/AFK` exists and the slice's `Gate` is in `allow_gates`, `/rite-bui
 For gates in `allow_gates`, AFK **auto-picks the recommended option** (option 1 of the set)
 instead of pausing, recording it as above. For `blocking` and `escalating` (and every
 irreversible-risk item), AFK **always** invokes the checkpoint protocol: the sentinel does
-not unlock these gates: **unless `allow_irreversible: true`** is set, which makes AFK
-auto-pick the recommendation on *every* gate, irreversible included (maximal autonomy, opt-in;
-see `afk-hitl.md`). See `afk-discipline.md` for the irreversible-risk list.
+not unlock these gates and no AFK key can override them. See `afk-discipline.md`
+for the irreversible-risk list.
 
 ## Multi-question pauses