devrites 3.2.28 → 4.0.0

package/pack/generated/codex/skills/devrites-lib/reference/workspace-artifact-schema.md

@@ -1,28 +1,43 @@
 # Workspace artifact schema
 
-DevRites stores feature truth in `.devrites/work/<slug>/`. The older
-`.devrites/features/<slug>/` path remains readable during migration; do not delete
-existing workspaces or aliases. `feature.md` and `index.md` may stand in for the
-workspace map; `proof.md` may stand in for `evidence.md`.
+Feature truth lives in `.devrites/work/<slug>/`; discovery requires `state.md`.
+`README.md` is an optional map. Operational remnants and archive entries are not
+active workspaces. Current writers use canonical filenames. Both released cursor
+forms remain official; `$rite-upgrade` audits them in place and never performs
+path, alias, or format migration.
+
+## Slug identity
+
+New workspaces use a meaningful objective-derived slug that is lowercase ASCII
+kebab-case, matches `[a-z0-9]+(?:-[a-z0-9]+)*`, and is at most 64 characters.
+Prefer shortening at a word boundary. After the final shortening or suffix step,
+trim boundary hyphens and reject an empty result.
+
+Before creating a directory, compare any matching workspace's `brief.md`
+objective. Reuse it only for the same feature. Otherwise append the smallest
+unused numeric suffix (`-2`, `-3`, ...), shortening and trimming the base again
+to stay within 64 characters. Never overwrite a workspace by slug alone.
+Readers continue to accept safe legacy basenames; no ordinary phase renames one.
 
 ## Required by phase
 
 | Phase | Required artifacts |
 | --- | --- |
 | frame | `state.md` |
-| spec | `README.md`/`index.md`/`feature.md`, `brief.md`, `spec.md`, `state.md`, `decisions.md`, `assumptions.md`, `questions.md` |
+| spec | `README.md`, `brief.md`, `spec.md`, `state.md`, `decisions.md`, `assumptions.md`, `questions.md` |
 | clarify | spec artifacts plus `decision-coverage.md` |
 | temper | clarified spec artifacts |
 | define/plan | clarified spec artifacts plus `architecture.md`, `plan.md`, `tasks.md`, `traceability.md` |
-| vet/build/converge | plan artifacts plus `eng-review.md`, `test-plan.md` |
-| prove/polish/review/seal/ship/done | vetted plan artifacts plus `evidence.md`/`proof.md`, `touched-files.md` |
+| vet/build/converge | plan artifacts plus `eng-review.md`, `test-plan.md`; Build creates and maintains `touched-files.md` after its first green slice |
+| prove/polish/review | vetted plan artifacts plus `evidence.md`, `touched-files.md` |
+| seal/ship/done | proof artifacts plus `review.md`, `seal.md` |
 | conditional | `flows.md` when diagrams clarify; `design-brief.md` and `browser-evidence.md` for UI; `drift.md` for drift; `handoff.md` only when requested; `references.md` + `references/` when references exist |
 
 ## What each file owns
 
 | File | Job | Budget |
 | --- | --- | --- |
-| `README.md` / `index.md` / `feature.md` | compact workspace map: phase, status, next action, artifact map, read-next table, blocking gates, last updated | 120 lines |
+| `README.md` | compact workspace map: phase, status, next action, artifact map, read-next table, blocking gates, last updated | 120 lines |
 | `brief.md` | user request, objective, non-goals, success definition | 80 lines |
 | `spec.md` | product WHAT/WHY, requirements, acceptance criteria, edge cases, measurable success, scope boundaries | 260 lines |
 | `decision-coverage.md` | topology-first coverage matrix, assumption audit, residual uncertainty, and typed clarity verdict | 200 lines |
@@ -31,38 +46,83 @@ workspace map; `proof.md` may stand in for `evidence.md`.
 | `flows.md` | useful Mermaid sequence/state/data/lifecycle diagrams with why-it-matters text and related IDs | 160 lines |
 | `decisions.md` | ADR-style `DEC-###` log: status, context, options, decision, consequences, related IDs | 200 lines |
 | `assumptions.md` | assumptions with confidence, owner, validation status | 160 lines |
-| `questions.md` | `Q-###` open/resolved questions, gate, answer, impact | 180 lines |
-| `plan.md` | technical approach, slice strategy, validation strategy, rollback | 220 lines |
-| `tasks.md` | `SLICE-###` vertical slices with AC IDs, likely files, tests/proof, mode/gate, dependencies, Forge contract, done condition | 280 lines |
+| `questions.md` | current `q-YYYY-MM-DD-NNN` (or released `Q-###`) open/resolved questions, gate, answer, impact | 180 lines |
+| `plan.md` | technical approach, slice strategy, canonical shared-contract proof, validation strategy, rollback | 220 lines |
+| `tasks.md` | `SLICE-###` vertical slices with AC IDs, likely files, tests/proof, mode/gate, dependencies, done condition | 280 lines |
 | `traceability.md` | matrix: AC/REQ ID, slice IDs, test/proof, evidence ID, touched files, status | 220 lines |
-| `eng-review.md` | vetted scope/architecture/quality/performance findings, failure modes, build-entry preflight | 240 lines |
+| `eng-review.md` | vetted scope/architecture/quality/performance, failure modes, preflight, stable-input binding | 240 lines |
 | `test-plan.md` | executable proof commands, preflight/provenance contract, acceptance and interaction coverage | 260 lines |
 | `state.md` | compact cursor table/key-values; no narrative log | 120 lines |
-| `evidence.md` / `proof.md` | `EVID-###` command/action, result, timestamp if available, related AC/slice IDs, limitation | 280 lines |
+| `evidence.md` | `EVID-###` command/action, result, timestamp if available, related AC/slice IDs, limitation | 280 lines |
 | `browser-evidence.md` | UI route/viewports/screenshots/console/network/interactions and Visual Verdict | 220 lines |
 | `drift.md` | `DRIFT-###` spec/plan drift and resolution | 160 lines |
-| `touched-files.md` | implementation files, slice ownership, reason, and a concern-ordered `## Review trail` of `path:line` stops for human review | 160 lines |
+| `touched-files.md` | sole candidate manifest plus a concern-ordered `## Review trail` of `path:line` stops for human review | 160 lines |
 | `design-brief.md` | UI design direction, states, interaction model | 160 lines |
 | `handoff.md` | cold-resume guide: current objective, last completed slice, next action, blockers, read-next links | 120 lines |
 
-Files can exceed the budget only with `Budget override: <reason>`.
+## Candidate manifest and bindings
 
-## Semantic readiness contract
+`touched-files.md` contains exactly one `## Touched files` heading and exactly
+one authoritative `## Candidate manifest` heading. The first describes scope
+without repeating candidate paths; the manifest is the sole authority for candidate scope.
 
-`decision-coverage.md`, `test-plan.md`, and `eng-review.md` each contain exactly one:
+The manifest body is exactly either `No project files.` or this table with one
+or more rows:
+
+```markdown
+| State | File | Slice | Reason |
+| --- | --- | --- | --- |
+| present | `path/to/file` | SLICE-001 | Observable reason |
+```
+
+Rows are sorted by File: they must already be strictly sorted by normalized
+`File`, and readers reject rather than reorder them. `State` is exactly
+`present` or `deleted`; `File` is a unique
+project-relative UTF-8 path wrapped in one backtick pair; `Slice` and `Reason`
+are nonempty. Paths must also be unique under case folding. Every component
+rejects Windows-reserved characters and device names (including names with an
+extension) plus a trailing dot or space. `## Review trail` may cite
+concern-ordered `path:line` review stops, but it cannot define or expand
+candidate scope; only manifest rows do.
+
+The public candidate limits are a 1 MiB manifest, 4,096 rows, a 4,096-byte
+path, 64 MiB per present file, and 256 MiB across all present files.
+
+Workspace and audit artifacts are not candidate paths. Durable project files
+include `.devrites/specs/**`, `DESIGN.md`, and `docs/adr/**`, plus the exact
+`.devrites/principles.md` owner. Under `.devrites`, only those principles and
+spec owners may be candidates; `ACTIVE`, `AFK`, `CHECKPOINT`, `archive/**`,
+`work/**`, and every other sibling fail closed. Engine owns malformed path,
+type, and size rejection; phases do not reinterpret a rejected manifest.
+
+`evidence.md`, `review.md`, and `seal.md` each contain exactly one unindented standalone
+binding line; `browser-evidence.md` does too when that file exists:
 
 ```text
-DevRites contract: devrites.readiness-artifacts.v2
+Candidate SHA-256: <64 lowercase hex>
 ```
 
-Clarify writes the decision-coverage field after re-closing current intent. Vet writes
-the test-plan and engineering fields after current-contract hardening. A missing, older,
-unknown, duplicate, or future field is not current readiness; `$rite-build` routes it to
-`$rite-upgrade` rather than guessing or downgrading.
+Old unfinished workspaces refresh the manifest and rerun real proof. They never
+synthesize a historical pass or use a legacy fallback.
+
+The worktree digest is deterministic but is not an atomic filesystem snapshot
+against a malicious concurrent same-size rewrite. Ship's exact Git-index scope,
+byte, binding, and secret checks own the final freeze immediately before commit.
+
+Only a structural `Budget override: <reason>` line (not a fenced example)
+permits excess. Phase writers check these limits before returning; there is no
+repository-local script assumption in the installed workflow.
+
+## Native readiness ownership
+
+`decision-coverage.md` records the topology scan; `test-plan.md` records executable proof;
+`eng-review.md` records exact reviewer verdicts, `Implementation readiness`, and the emitted
+`Readiness inputs SHA-256`. Root re-reads them and applies the ID-and-meaning checklist.
+The digest binds reviewed bytes; it never substitutes for semantic review. Normal readiness
+checks structure plus that binding, and Seal rechecks it.
 
-Durable proof commands are portable from the repository and must not contain host-local
-wrappers, user-specific absolute paths, or temporary proof trees. Runtime agent packets may
-name an execution adapter; evidence may record the logical and actually executed commands.
+Proof commands must be repository-portable: no host wrappers, user-specific absolute paths,
+or temporary proof trees. Evidence records the executed command.
 
 ## Canonical slice grammar
 
@@ -76,9 +136,6 @@ Goal: <single observable capability>
 Satisfies: AC-001[, AC-002]
 Acceptance criteria: <binary criteria this slice closes>
 Complexity: <1..5> — <reason>
-Forge: <no | yes — reason>
-Forge strategies: <A=<complete approach> | B=<complete approach> [| C=<complete approach>] | none>
-Forge scorecard: <acceptance=AC-### list; test-plan=exact test-plan.md rows/commands | none>
 Mode: <AFK | HITL>
 Gate: <advisory | validating | blocking | escalating>
 SLA: <15m | 4h | 24h | none>
@@ -107,11 +164,7 @@ Done condition: <checkable, exhaustive completion criterion>
 `depends_on` is the machine-readable mirror of `Dependencies`; keep the sets
 identical and cycle-free. `Gate`, `SLA`, and `Checkpoint` are required for HITL
 slices; use `none` when they do not apply. Complexity above 3 triggers reslicing
-unless the stated reason makes the boundary irreducible. `$rite-define` writes
-`Forge: no` with both detail fields `none`; `$rite-vet` is the sole promoter.
-`Forge: yes` requires a reason, two or three distinct contiguous `A`–`C`
-strategies, and a scorecard that names every slice AC plus exact
-`test-plan.md` rows or commands.
+unless the stated reason makes the boundary irreducible.
 
 ## Read next by phase
 
@@ -122,7 +175,7 @@ strategies, and a scorecard that names every slice AC plus exact
 | temper | `spec.md`, `decision-coverage.md`, `decisions.md`, `assumptions.md`, `design-brief.md` |
 | define | `README.md`, `state.md`, `spec.md`, `decision-coverage.md`, `architecture.md`, `decisions.md`, `assumptions.md` |
 | vet | `README.md`, `traceability.md`, `plan.md`, `tasks.md`, `architecture.md`, `decisions.md` |
-| build | `state.md`, `decision-coverage.md`, `eng-review.md`, `test-plan.md`, `tasks.md`, `plan.md`, `architecture.md`, `traceability.md`, `questions.md` |
+| build | `state.md`, `decision-coverage.md`, `eng-review.md`, `test-plan.md`, `tasks.md`, `plan.md`, `architecture.md`, `traceability.md`, `questions.md`, and `touched-files.md` when present |
 | prove | `traceability.md`, `tasks.md`, `evidence.md`, `browser-evidence.md`, `touched-files.md` |
 | review/seal | `README.md`, `traceability.md`, `spec.md`, `evidence.md`, `decisions.md`, `drift.md`, `touched-files.md` |
 | handoff | `README.md`, `state.md`, `handoff.md`, then the linked source artifacts |
@@ -137,6 +190,22 @@ strategies, and a scorecard that names every slice AC plus exact
 
 ## ID contract
 
-Use stable IDs: `REQ-001`, `AC-001`, `SLICE-001`, `DEC-001`, `Q-001`,
-`DRIFT-001`, `EVID-001`. Old `AC1` and `Slice 1` forms are legacy and should
-not be generated for new workspaces.
+Use stable IDs: `REQ-001`, `AC-001`, `EDGE-001`, `PROH-001`, `SLICE-001`,
+`DEC-001`, `ASM-001`, `DRIFT-001`, `EVID-001`. Current queued questions use
+`q-YYYY-MM-DD-NNN`; released table registers may retain `Q-001`. IDs are
+append-only identities, not display positions:
+
+- Allocate the next unused numeric suffix for that prefix after scanning its
+  owning artifact. For a dated question ID, scan the current date's suffixes.
+  Never fill a gap; every deleted or retired ID remains consumed.
+- Never renumber an ID, reuse it, or transfer it to a different meaning. Reordering
+  sections or rows does not change IDs.
+- A wording edit that preserves the obligation keeps its ID. A materially different
+  meaning gets a new ID; record the relationship in `decisions.md` or `drift.md`
+  before updating downstream references.
+- Re-read the owning artifact immediately before an append when another writer may
+  have changed it; recompute rather than reserving an ID from stale state.
+
+Old `AC1` and `Slice 1` forms are legacy and should not be generated for new
+workspaces. Preserve released legacy forms unless an explicit upgrade owns the
+migration; never renumber them incidentally.

package/pack/generated/codex/skills/devrites-prose-craft/SKILL.md

@@ -1,29 +1,9 @@
 ---
 name: devrites-prose-craft
-description: Internal DevRites skill; DevRites agents invoke it explicitly, not by prompt match.
+description: Rewrite prose to remove AI tells while preserving meaning and voice. Use for artifacts, replies, commits, or PR copy; not code comments or UI craft.
 user-invocable: false
-required-agent-roles: none
 ---
 
-## Codex compatibility
-
-This is the Codex mirror of a DevRites skill. In Codex:
-
-- Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
-- Installed `.agents/` mirrors may be Git-ignored. If a repository-aware file tool refuses an ignored path, read it with a native filesystem command instead; a tool refusal is not a completed task.
-- For automatic Engram calls, omit optional `project` and `session_id` unless an exact value came from Engram or repository configuration. Never derive either from `task_name`, a run ID, directory name, or normalized slug. Call `mem_session_summary` without them by default; on `unknown_session` or `unknown_project`, retry once with both optional fields omitted. If auto-detection is ambiguous, ask the user instead of guessing.
-- Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. A missing visible `agent_type` field is still V2—not capability loss, V1, or HITL—so send it anyway. If the named call rejects it, stop before any generic/default spawn. Codex loads the role TOML's `developer_instructions` natively; DevRites verifies the durable rollout, wait, completion, and delivered result.
-- Only after the runtime explicitly identifies MultiAgent V1, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
-- On explicitly identified MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`.
-- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
-- If the required dispatch for the explicitly identified runtime is unavailable or rejected, stop for HITL. Never switch runtime lanes. Never execute a DevRites specialist role in the root context.
-- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
-- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
-- When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
-
-
 # devrites-prose-craft: prose that reads human
 
 Write for a teammate who will rely on the result. Remove model-shaped filler without sanding
@@ -34,8 +14,8 @@ off the author's voice or weakening technical content.
   `$rite-define` / `$rite-plan` (plan narrative), `$rite-temper` / `$rite-vet` (review prose),
   `$rite-review` / `$rite-seal` (findings + verdict prose), `$rite-ship` (commit/PR body),
   `devrites-doubt` / `rite-handoff` (notes).
-- Any phase composes a substantive **user-facing reply**. Deterministic progress footers are
-  script-rendered and exact by design.
+- Any phase composes substantive **user-facing prose** beyond the shared reply
+  labels.
 - `$rite-polish` Phase 1 as the **catch** pass on prose that slipped through at write time.
 
 ## Two modes

package/pack/generated/codex/skills/devrites-source-driven/SKILL.md

@@ -1,29 +1,9 @@
 ---
 name: devrites-source-driven
-description: Internal DevRites skill; DevRites agents invoke it explicitly, not by prompt match.
+description: Verify uncertain framework or library behavior in installed source or official docs. Use for unfamiliar APIs; not internal code.
 user-invocable: false
-required-agent-roles: none
 ---
 
-## Codex compatibility
-
-This is the Codex mirror of a DevRites skill. In Codex:
-
-- Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
-- Installed `.agents/` mirrors may be Git-ignored. If a repository-aware file tool refuses an ignored path, read it with a native filesystem command instead; a tool refusal is not a completed task.
-- For automatic Engram calls, omit optional `project` and `session_id` unless an exact value came from Engram or repository configuration. Never derive either from `task_name`, a run ID, directory name, or normalized slug. Call `mem_session_summary` without them by default; on `unknown_session` or `unknown_project`, retry once with both optional fields omitted. If auto-detection is ambiguous, ask the user instead of guessing.
-- Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. A missing visible `agent_type` field is still V2—not capability loss, V1, or HITL—so send it anyway. If the named call rejects it, stop before any generic/default spawn. Codex loads the role TOML's `developer_instructions` natively; DevRites verifies the durable rollout, wait, completion, and delivered result.
-- Only after the runtime explicitly identifies MultiAgent V1, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
-- On explicitly identified MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`.
-- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
-- If the required dispatch for the explicitly identified runtime is unavailable or rejected, stop for HITL. Never switch runtime lanes. Never execute a DevRites specialist role in the root context.
-- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
-- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
-- When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
-
-
 # devrites-source-driven: verify, don't guess
 
 When library behavior matters and is uncertain, verify it against installed source or
@@ -50,8 +30,8 @@ authoritative documentation before relying on it.
 ## Delegate broad research
 When the question is an *area* (a library surface, unfamiliar subsystem, or migration
 guide), the **root orchestrator** uses the fresh-context dispatch contract in
-[`agents.md`](../devrites-lib/reference/standards/agents.md) to send one bounded
-`agent-packet/v1` to `devrites-evidence-scout`. Await and validate its cited
+[`agents.md`](../devrites-lib/reference/standards/agents.md) to give one bounded
+question to `devrites-evidence-scout`. Wait for and validate its cited
 `evidence-dossier`; the orchestrator, not the scout, persists accepted facts under
 `references/` and links them from `references.md`.
 

package/pack/generated/codex/skills/devrites-ux-shape/SKILL.md

@@ -1,29 +1,9 @@
 ---
 name: devrites-ux-shape
-description: Internal DevRites skill; DevRites agents invoke it explicitly, not by prompt match.
+description: Shape UX/UI direction, states, and interactions before code. Use for screens, forms, dashboards, or settings; not for implementation or polish.
 user-invocable: false
-required-agent-roles: none
 ---
 
-## Codex compatibility
-
-This is the Codex mirror of a DevRites skill. In Codex:
-
-- Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
-- Installed `.agents/` mirrors may be Git-ignored. If a repository-aware file tool refuses an ignored path, read it with a native filesystem command instead; a tool refusal is not a completed task.
-- For automatic Engram calls, omit optional `project` and `session_id` unless an exact value came from Engram or repository configuration. Never derive either from `task_name`, a run ID, directory name, or normalized slug. Call `mem_session_summary` without them by default; on `unknown_session` or `unknown_project`, retry once with both optional fields omitted. If auto-detection is ambiguous, ask the user instead of guessing.
-- Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. A missing visible `agent_type` field is still V2—not capability loss, V1, or HITL—so send it anyway. If the named call rejects it, stop before any generic/default spawn. Codex loads the role TOML's `developer_instructions` natively; DevRites verifies the durable rollout, wait, completion, and delivered result.
-- Only after the runtime explicitly identifies MultiAgent V1, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
-- On explicitly identified MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`.
-- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
-- If the required dispatch for the explicitly identified runtime is unavailable or rejected, stop for HITL. Never switch runtime lanes. Never execute a DevRites specialist role in the root context.
-- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
-- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
-- When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
-
-
 # devrites-ux-shape: plan the UX/UI before code
 
 Decide what the UI *is* and how it should look and behave **before** code, and write it to
@@ -48,7 +28,8 @@ gathered:
   → `../devrites-frontend-craft/reference/design-references.md`.
 - `PRODUCT.md` / `DESIGN.md` / `CLAUDE.md` if present: anchors that reduce questions.
   `DESIGN.md` is the project's **rolled-up design memory** (tokens, calibration baseline,
-  proven component behaviors) earlier features sealed via `../rite-ship/reference/design-memory.md`;
+  proven component behaviors) earlier features closed during Polish via
+  `../rite-polish/reference/design-memory.md`;
   treat it as the inherited system: read it before re-discovering, depart only on signal.
 - `references.md` + `references/`: the screenshots / Figma / video / links the human
   supplied. Honor each recorded role: **target** = fidelity contract, **constraint** =

package/pack/generated/codex/skills/rite/SKILL.md

@@ -4,33 +4,14 @@ description: User-invoked DevRites menu and router; no args renders the menu, a
 argument-hint: "[verb [args...]]"
 user-invocable: true
 disable-model-invocation: true
-required-agent-roles: none
 ---
 
-## Codex compatibility
-
-This is the Codex mirror of a DevRites skill. In Codex:
-
-- Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
-- Installed `.agents/` mirrors may be Git-ignored. If a repository-aware file tool refuses an ignored path, read it with a native filesystem command instead; a tool refusal is not a completed task.
-- For automatic Engram calls, omit optional `project` and `session_id` unless an exact value came from Engram or repository configuration. Never derive either from `task_name`, a run ID, directory name, or normalized slug. Call `mem_session_summary` without them by default; on `unknown_session` or `unknown_project`, retry once with both optional fields omitted. If auto-detection is ambiguous, ask the user instead of guessing.
-- Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. A missing visible `agent_type` field is still V2—not capability loss, V1, or HITL—so send it anyway. If the named call rejects it, stop before any generic/default spawn. Codex loads the role TOML's `developer_instructions` natively; DevRites verifies the durable rollout, wait, completion, and delivered result.
-- Only after the runtime explicitly identifies MultiAgent V1, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
-- On explicitly identified MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`.
-- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
-- If the required dispatch for the explicitly identified runtime is unavailable or rejected, stop for HITL. Never switch runtime lanes. Never execute a DevRites specialist role in the root context.
-- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
-- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
-- When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
-
-
 # $rite: DevRites menu + router
 
-You are the DevRites entry point. Two modes:
+Two modes:
 
-- **No args** → run `devrites-engine first-task`, render one recommended-start line above the menu, then stop. Do not execute a phase or read `state.md`: status is `$rite-status`.
+- **No args** → render the menu and stop. Do not execute a phase or infer
+  workspace status; `$rite-status` owns that.
 - **Verb arg** → pass-through invocation of the matching `rite-<verb>` skill (`$rite spec foo` ≡ `$rite-spec foo`); the called skill owns the output.
 
 When the user asks which rite fits, load [`devrites-lib/reference/intent-map.md`](../devrites-lib/reference/intent-map.md).
@@ -66,14 +47,14 @@ What each verb does lives once, in the Menu below; this table is the invocation
 | `seal` | `$rite-seal` |
 | `ship` | `$rite-ship` |
 | `status [slug]` | `$rite-status` |
-| `doctor [--code | --reindex]` | `$rite-doctor` |
+| `doctor` | `$rite-doctor` |
 | `upgrade [slug]` | `$rite-upgrade` |
-| `learn [--mine \| "<lesson>"]` | `$rite-learn` |
+| `learn ["<lesson>"]` | `$rite-learn` |
 | `explain [concept \| diff \| idea \| recap]` | `$rite-explain` |
 | `pov [candidate]` | `$rite-pov` |
 | `dogfood [--port N]` | `$rite-dogfood` |
 | `pr-feedback [PR\|thread]` | `$rite-pr-feedback` |
-| `customize [override <agent> \| extension <name>]` | `$rite-customize` |
+| `customize [instruction \| skill \| agent \| plugin]` | `$rite-customize` |
 | `use <slug>` | (inline) |
 | `guide` | (inline) |
 | `resolve <qid> "<answer>"` | `$rite-resolve` |
@@ -120,25 +101,24 @@ Called phase skills own the shared completion reply contract
 
 ```
 DevRites — disciplined senior-engineer workflow
-Recommended start: <greenfield: $rite spec <feature> | brownfield-unadopted: $rite adopt | active-feature: $rite status | dirty-worktree: $rite frame or $rite quick | branch-ahead: $rite ship/status | clean-default: $rite spec <feature>>
                               menu form           direct shortcut
 SPEC          $rite spec               ≡    $rite-spec        investigate deeply → write spec.md
-ADOPT         $rite adopt              ≡    $rite-adopt       onboard existing code → reverse-derive spec.md + seed conventions
+ADOPT         $rite adopt              ≡    $rite-adopt       onboard existing code → reverse-derive spec.md
 CLARIFY       $rite clarify            ≡    $rite-clarify     close the complete decision surface before planning
 TEMPER        $rite temper             ≡    $rite-temper      optional — strategic review: scope mode + pre-mortem, harden the spec
 PLAN          $rite define             ≡    $rite-define      turn the spec into plan + task slices + state
 VET           $rite vet                ≡    $rite-vet         mandatory every plan — light/full engineering review by stakes
 REPLAN        $rite plan               ≡    $rite-plan        decompose / reslice / repair an active plan
-BUILD         $rite build              ≡    $rite-build       implement exactly one verified vertical slice, then stop
+BUILD         $rite build              ≡    $rite-build       one slice/wright; HITL stops, `.devrites/AFK` may chain
 CONVERGE      $rite converge           ≡    $rite-converge    recovery — append work needed to meet intent
 PROVE         $rite prove              ≡    $rite-prove       tests + build + runtime + browser evidence
 POLISH        $rite polish             ≡    $rite-polish      code polish always; UI normalize + polish if UI
 REVIEW        $rite review             ≡    $rite-review      feature-scoped multi-axis review
 SEAL          $rite seal               ≡    $rite-seal        final GO / NO-GO decision (no git)
-SHIP          $rite ship               ≡    $rite-ship        type-GO + commit/push/tag, then archive + clear ACTIVE
+SHIP          $rite ship               ≡    $rite-ship        pre-GO read-only; fresh GO → commit; optional approved push/tag/PR → archive
 STATUS        $rite status             ≡    $rite-status      active feature, next action, evidence, risks
-DOCTOR        $rite doctor ...         ≡    $rite-doctor      health check; --reindex refreshes structural indexes
-UPGRADE       $rite upgrade ...        ≡    $rite-upgrade     reconcile an active legacy workspace with current contracts
+DOCTOR        $rite doctor             ≡    $rite-doctor      installation and native host diagnostics
+UPGRADE       $rite upgrade ...        ≡    $rite-upgrade     audit an older workspace; route only proven gaps
 LEARN         $rite learn ...          ≡    $rite-learn       review captured lessons → promote to project rules / principles
 EXPLAIN       $rite explain ...        ≡    $rite-explain     grounded concept/diff/idea/recap explainer
 POV           $rite pov ...            ≡    $rite-pov         decide adopt / trial / hold / reject for an external option
@@ -148,7 +128,7 @@ CUSTOMIZE     $rite customize ...      ≡    $rite-customize   author overrides
 SWITCH        $rite use <slug>                                re-point .devrites/ACTIVE to another feature (inline)
 GUIDE         $rite guide                                     first feature, guided — full lifecycle on one small real change (inline)
 RESUME        $rite resolve ...        ≡    $rite-resolve     answer a HITL checkpoint
-AUTO          $rite autocomplete ...   ≡    $rite-autocomplete  run the whole lifecycle unattended (--ship to push)
+AUTO          $rite autocomplete ...   ≡    $rite-autocomplete  unattended lifecycle; `--ship` stops at Ship preflight
 QUICK         $rite quick <change>     ≡    $rite-quick       express lane — one small reversible change (escalates if it grows)
 UTILITY       $rite frame | prototype | handoff | zoom-out | pressure-test  (or direct shortcuts)
 ```

package/pack/generated/codex/skills/rite/reference/menu.md

@@ -1,30 +1,29 @@
 # Menu reference
 
-Phase-ordered command reference for `$rite`. Load only if the user wants detail on
-what each command does or how phases connect.
+Phase-ordered `$rite` reference. Load only for command detail or phase connections.
 
 ## Phases and commands
 
 | Phase | Command | Use when |
 |---|---|---|
 | Spec | `$rite-spec <feature>` | **New feature.** Investigate → write spec.md. Asks with options; gathers attached design references (optional). |
-| Adopt | `$rite-adopt` | Onboard an existing codebase instead of starting fresh: reverse-derive spec.md + seed the conventions ledger. |
+| Adopt | `$rite-adopt` | Onboard an existing codebase instead of starting fresh: reverse-derive spec.md and propose project guidance. |
 | Clarify | `$rite-clarify` | _Required after spec._ Topology-first decision-coverage scan; zero-question fast path when already clear. |
 | Temper | `$rite-temper` | _Optional, before define._ Strategic review of the spec: scope mode (expand/selective/hold-rigor/reduce) + pre-mortem; hardens the spec. Best on big/risky features; mandatory in `$rite-autocomplete`. |
 | Plan | `$rite-define` | Turn the approved spec into plan + vertical task slices + state. |
 | Vet | `$rite-vet` | _Required before build._ Review every plan: scope · architecture · tests · perf; light for simple/reversible, full for high stakes. |
 | Re-plan | `$rite-plan` | The active plan is too big, wrong, stale, ambiguous, or blocked. |
-| Build | `$rite-build` | Implement the next single vertical slice. Stops after one slice. |
+| Build | `$rite-build` | One slice/wright; HITL stops; `.devrites/AFK` lets root bounded-chain slices. |
 | Converge | `$rite-converge` | _Recovery._ Code drifted from or falls short of intent after a resume, adoption, or stalled build: compare live code with spec/plan/tasks and append remaining work as new slices for `$rite-build`. |
 | Prove | `$rite-prove` | Prove the current scope: tests, build, runtime, browser evidence. |
 | Polish | `$rite-polish` | Code polish always; normalize and polish UI when in scope. Modes: `bolder/quieter/distill/harden/normalize-only`. |
 | Review | `$rite-review` | Feature-scoped review before sealing. |
 | Seal | `$rite-seal` | Final GO / NO-GO decision (no git). |
-| Ship | `$rite-ship` | Type-GO → commit/push/tag, then archive the task + clear ACTIVE. |
+| Ship | `$rite-ship` | Pre-GO read-only; fresh GO → commit → optional approved push/tag/PR → archive/close. |
 | Status | `$rite-status` | See where the active feature stands. |
-| Doctor | `$rite-doctor` | Health check: install integrity, stale ACTIVE, orphaned gates, hook wiring, merge/rebase state. |
-| Upgrade | `$rite-upgrade` | _Explicit recovery._ Reconcile an active legacy workspace with the installed semantic workflow contract; preserve completed work and history. |
-| Learn | `$rite-learn` | Review the captured learning ledger → promote recurring lessons to project rules / principles. |
+| Doctor | `$rite-doctor` | Diagnose install integrity and native host configuration. |
+| Upgrade | `$rite-upgrade` | _Explicit compatibility._ Audit an older released workspace; route cited defects through Clarify/Plan repair/Converge/Vet or current Prove/Polish/Review/Seal, preserve history, and never synthesize old proof. |
+| Learn | `$rite-learn` | Review native memory and archived evidence → propose durable project guidance. |
 
 ## Typical orderings
 
@@ -36,13 +35,14 @@ what each command does or how phases connect.
 - **Existing codebase**: `$rite-adopt` → `$rite-clarify` → `$rite-define` → `$rite-vet` → build.
 - **Drift mid-build**: classify → bounded recovery for objective defects, `$rite-plan`
   repair for a wrong durable plan, or one user decision for real product/risk drift.
-- **Workspace from older DevRites rules**: `$rite-upgrade` → current Clarify/Plan/Vet
-  gates → resume the snapshot's next command. Structural migration alone is not enough.
+- **Older workspace cannot resume**: `$rite-upgrade` audits first → only proven gaps use
+  Clarify/Plan repair/Converge/Vet or Prove/Polish/Review/Seal → resume. It never
+  migrates cursor format or invents a prior pass.
 - **Resumed / adopted / stalled**: `$rite-converge` (assess live code vs intent → append the
   remaining slices) → `$rite-vet` → `$rite-build` ×N → continue at `$rite-prove`.
 
 ## Rules this menu obeys
 
 - `$rite` never edits code or runs a phase workflow.
-- Menu mode runs `devrites-engine first-task`; `$rite-status` owns workspace status.
+- Menu mode is static; `$rite-status` owns workspace status.
 - It suggests; the user (or Claude, when appropriate) invokes the real skill.