devrites 3.2.28 → 4.0.0

package/pack/generated/codex/skills/rite-ship/reference/git-ship.md

@@ -1,64 +1,102 @@
 # The irreversible ship: type-GO + git ladder
 
-`$rite-ship` is the only DevRites phase that runs actions that cannot be undone
-silently. The seal verdict authorizes the *decision*; this prompt authorizes the
-*action*.
+`$rite-ship` alone runs irreversible actions. A seal GO is never authorization for Git.
+Require fresh approval for one disclosed attempt plus native permission.
 
 ## The type-GO prompt (render verbatim, wait)
 
 ```
-About to: <git commit + git push [+ git tag vX.Y.Z | open PR]>
 Feature:  <slug>
 Verdict:  GO  (seal.md)
 Acceptance criteria proven: <n / total>
 Branch:   <target branch>
+Candidate paths: <exact project-relative paths>
+Checkpoint collapse: <exact `git reset --soft '<merge-base>'` command | skip>
+Stage plan: <exact argv-safe `git add -- '<path>'` command for every manifest row>
+Commit:   <exact git commit command>
+Push:     <exact git push command | skip>
+Tag:      <exact git tag command | skip>
+PR:       <exact PR command, target, title, and body source | skip>
 
-Type "GO" exactly to proceed. Anything else cancels.
+Type "GO" exactly to approve this attempt once. Anything else cancels.
 ```
 
-Rules for the prompt:
-- Render it **every time**, even with auto-trigger enabled. This is the last net.
-- Only the literal string `GO` (no quotes) proceeds. `y`, `yes`, `go` (lowercase),
-  `ok`, `sure`, `do it`, or anything else → cancel, record the cancel in `ship.md`
-  as "user declined irreversible step at <ts>", and stop.
-- `$rite-autocomplete --ship` (or `--yolo`) is the *only* caller permitted to satisfy
-  this prompt automatically. Every other path requires the human's literal `GO`.
-
-## The git ladder
-
-Follow `.agents/skills/devrites-lib/reference/standards/git-workflow.md` and the project's own convention. Do not invent
-a release flow the project doesn't use.
-
-0. **Collapse checkpoints** (only if checkpoint mode ran: see
-   [rite-build/reference/checkpoint.md](../../rite-build/reference/checkpoint.md)). Local
-   `WIP(<slug>)` commits are scratch; fold them into the working tree so the ship is one
-   atomic feature commit. `reset --soft` moves only the branch pointer: index and worktree
-   are untouched, so no change is ever lost:
-   ```bash
-   base=$(git rev-parse --abbrev-ref '@{upstream}' 2>/dev/null) || base=main
-   mb=$(git merge-base HEAD "$base" 2>/dev/null)
-   if [ -n "$mb" ] && git log --format='%s' "$mb..HEAD" | grep -q '^WIP('; then
-     git log --format='%s' "$mb..HEAD" | grep -qv '^WIP(' \
-       && echo "history since $base mixes WIP + real commits — surface and confirm before collapsing" \
-       || git reset --soft "$mb"   # fold every WIP commit since the branch point → staged
-   fi
-   ```
-   No WIP commits (checkpoint mode was off) → this is a silent no-op.
-1. **Stage** only the files in `touched-files.md`. Never `git add -A`; never stage
-   secrets, `.env`, or out-of-scope files (see the never-commit list in `git-workflow.md`).
-2. **Commit** with a Conventional Commit message derived from the feature (`feat(scope):
-   …` / `fix(scope): …`). Atomic: one logical change. Put the *why* in the body.
-   For non-trivial features, append trailers from the workspace record:
-   `Constraint:` from binding principles/irreversible risks, `Rejected:` from material alternatives,
-   `Confidence:` from `seal.md`, `Scope-risk:` from the blast-radius scan, and `Not-tested:` for
-   known proof gaps. Skip trailers for typos and pure formatting.
-3. **Push** to the target branch (the feature branch, or per the project's trunk
-   convention).
-4. **Tag / PR** only if the project does it: cut a tag when the project tags releases,
-   or open a PR when the project reviews via PRs. Otherwise skip: pushing the branch
-   is the ship.
-
-Capture the resulting commit SHA(s), branch, and tag/PR URL for `ship.md`.
+Rules:
+- Render every attempt; autocomplete flags only reach this boundary.
+- Only literal `GO` proceeds. Anything else cancels, records
+  `user declined irreversible step at <ts>` in `ship.md`, and stops.
+- `GO` is one-use for the shown scope/commands; changed/retried plans re-prompt.
+- Prior answers, AFK, seal GO, and native approval do not replace type-GO;
+  type-GO never replaces/bypasses native permission or sandbox approval.
+
+## The candidate-safe Git ladder
+
+Follow `standards/git-workflow.md` and project convention; invent no release flow.
+Candidate identity always comes from `devrites-engine check candidate`; do not
+implement a Git-side hash.
+
+### Before type-GO
+
+Pre-GO is read-only. Do not run the disclosed collapse or staging commands.
+
+0. **Protect existing index work.** Read the NUL-delimited staged state/path set.
+   Refuse a pre-existing staged path outside the manifest; never unstage, stage,
+   reset, or discard user work.
+1. **Analyze checkpoint history without mutating it.** Read the upstream, merge
+   base, commit OIDs, and full subjects. If no checkpoint commit exists, disclose
+   `skip`. A collapse is eligible only when every commit in its range has the exact
+   `WIP(<active-slug>):` prefix for the validated active slug. A different slug,
+   missing colon, broad `WIP(` match, ordinary commit, or mixed history blocks;
+   never reinterpret the range.
+2. **Verify the candidate.** Rerun `devrites-engine check candidate <slug>` and
+   `devrites-engine check seal <slug>`, compare every binding, require the
+   candidate worktree paths to be unchanged, and inspect the existing staged
+   scope. These checks do not prepare the index.
+3. **Prepare the disclosure.** Build argv-safe commands from literal validated
+   paths, without `eval` or command-string interpolation. Run only read-only
+   secret scans of the existing staged state and proposed PR body. Render the
+   literal prompt with the exact optional collapse command or `skip`, exact stage
+   plan, commit, push, tag, and PR commands; then wait.
+
+### After type-GO
+
+1. **Optional checkpoint collapse.** If and only if the prompt disclosed it,
+   recheck that `HEAD`, merge base, and every subject are unchanged and that each
+   subject starts exactly `WIP(<slug>):` for the active slug, then run the exact
+   disclosed `git reset --soft "$mb"`. Otherwise skip. Any different or mixed
+   subject blocks without mutation.
+2. **Exact staging.** Run `git add -- "$path"` once for each disclosed manifest
+   row, passing each validated project-relative path as its own quoted argv
+   element. Use no glob, directory, `-A`, `.env`, secret, out-of-scope path,
+   `eval`, or interpolated command string.
+3. **Compare staged scope.** Compare the NUL-delimited output of
+   `git diff --cached --name-status --no-renames -z` to the manifest's exact
+   state/path set. `present` maps only to `A` or `M`; `deleted` maps only to `D`.
+   Reject missing, extra, renamed, duplicated, or differently classified paths.
+4. **Compare staged bytes.** Require no index-to-worktree difference for any
+   manifest path. A dirty manifest path stops; never stage or reinterpret it
+   after this comparison.
+5. **Revalidate immediately before commit.** With no intervening mutation,
+   rerun `devrites-engine check candidate <slug>` and
+   `devrites-engine check seal <slug>`, require the exact candidate digest and
+   every evidence/browser/review/Seal binding, then run the staged secret scan.
+   Any scope, byte, identity, binding, scan, history, or command drift invalidates
+   the one-use approval. Stop and render a fresh type-GO prompt; do not repair the
+   drift under the old approval.
+6. **Commit** one logical change using Conventional Commit and a why-body.
+   Non-trivial work adds applicable `Constraint:`, `Rejected:`, `Confidence:`,
+   `Scope-risk:`, and `Not-tested:` workspace trailers; trivial edits omit them.
+7. **Verify the commit.** Immediately after the authorized commit and before any
+   push or tag, compare
+   `git diff-tree --root --no-commit-id --name-status --no-renames -r -z HEAD`
+   to the manifest using the same exact state/path mapping. Require candidate
+   paths still match `HEAD`, then rerun `devrites-engine check candidate <slug>`
+   and `devrites-engine check seal <slug>` and compare the exact digest again.
+   Any mismatch stops; do not reinterpret it.
+8. **Push** to the project-conventional target branch.
+9. **Tag / PR** only when project convention requires it; otherwise skip.
+
+Record SHA(s), branch, and tag/PR URL in `ship.md`.
 
 ## Pull request body
 

package/pack/generated/codex/skills/rite-ship/reference/ship-template.md

@@ -1,33 +1,39 @@
 # `ship.md` template
 
-The durable record of what shipped and how. Written by `$rite-ship` into the
-workspace **before** close-out, so it travels into `.devrites/archive/<slug>/ship.md`.
+Write before close-out; it moves to `.devrites/archive/<slug>/ship.md`.
 
 ```markdown
 # Ship: <slug>
 
 - Shipped at: <iso>
-- Verdict: GO (see seal.md)
+- Verdict: GO (seal.md)
 - Branch: <branch>
 - Commit(s): <sha> [<sha> …]
-- Tag / PR: <vX.Y.Z | PR url | none>
+- Tag/PR: <value|none>
 
 ## What shipped
-<one-paragraph summary of the feature delivered, in the project's vocabulary>
+<project-vocabulary paragraph>
 
 ## Acceptance
-- Criteria proven: <n / total>   (full walk in evidence.md / seal.md)
-- Outstanding (shipped with known follow-ups): <list | none>
+- Proven: <n/total> (evidence.md/seal.md)
+- Outstanding: <rows below | none>
 
-## Evidence pointers
-- seal.md — final GO/NO-GO verdict + reviewer reconciliation
-- evidence.md — acceptance walk; browser-evidence.md (if UI)
-- review.md — multi-axis review findings
+## Evidence
+- seal.md — verdict/reconciliation
+- evidence.md — acceptance; browser-evidence.md if UI
+- review.md — review findings
 
-## Follow-ups (FYI, not blocking)
-- <recorded follow-up + where it's tracked> | none
+## Follow-up reconciliation
+Checked: strategy.md (if present), decisions.md, review.md, seal.md.
+
+| Source | Item | Disposition | Destination / rationale |
+|---|---|---|---|
+| <file + section> | <item> | tracked | <durable path/ID> |
+| <file + section> | <item> | no-action | <decision or explicit human no-action approval + reason/revisit> |
+
+<If empty: No residual items found.>
 ```
 
-Keep it short. It points at the existing audit files rather than restating them.
-The acceptance count must match `seal.md`; if they disagree, the seal is the source of
-truth and the ship should not have proceeded.
+Keep pointers short. Acceptance MUST match `seal.md`. Each source residual appears
+once; a missing target, unsupported `no-action`, vague disposition, or conflict blocks
+close-out.

package/pack/generated/codex/skills/rite-spec/SKILL.md

@@ -1,111 +1,72 @@
 ---
 name: rite-spec
-description: Spec new or high-risk behavior before code and write its `.devrites/work/<slug>/` workspace. Use for a feature/app, vague product idea, auth or migration work, or a public-API change. Not for approved-spec planning.
+description: Specify new, vague, or high-risk behavior before code. Use for features, auth, migrations, or public API changes; not for planning an approved spec.
 argument-hint: "<feature or idea>"
 user-invocable: true
-required-agent-roles: none
 ---
 
-## Codex compatibility
-
-This is the Codex mirror of a DevRites skill. In Codex:
-
-- Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
-- Installed `.agents/` mirrors may be Git-ignored. If a repository-aware file tool refuses an ignored path, read it with a native filesystem command instead; a tool refusal is not a completed task.
-- For automatic Engram calls, omit optional `project` and `session_id` unless an exact value came from Engram or repository configuration. Never derive either from `task_name`, a run ID, directory name, or normalized slug. Call `mem_session_summary` without them by default; on `unknown_session` or `unknown_project`, retry once with both optional fields omitted. If auto-detection is ambiguous, ask the user instead of guessing.
-- Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. A missing visible `agent_type` field is still V2—not capability loss, V1, or HITL—so send it anyway. If the named call rejects it, stop before any generic/default spawn. Codex loads the role TOML's `developer_instructions` natively; DevRites verifies the durable rollout, wait, completion, and delivered result.
-- Only after the runtime explicitly identifies MultiAgent V1, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
-- On explicitly identified MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`.
-- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
-- If the required dispatch for the explicitly identified runtime is unavailable or rejected, stop for HITL. Never switch runtime lanes. Never execute a DevRites specialist role in the root context.
-- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
-- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
-- When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
-
-
 # $rite-spec: investigate and write the spec
 
-Turn a request into a **fully covered, correctly placed `spec.md`** by investigating
-the existing system and resolving every material gap found during authoring.
-`$rite-clarify` audits the full topology before `$rite-define` plans it. **Do not write
-a plan, tasks, or code here.** Those belong to `$rite-define` and `$rite-build`.
+Investigate and resolve material gaps into a placed, covered `spec.md`.
+`$rite-clarify` audits topology next. Write no plan, task, or code here.
 
-> **Use `$rite-quick` for a small change.** A typo, copy edit, config bump, or
-> one-function fix does not need a full workspace and lifecycle. Run
-> `$rite-quick <change>`. It returns here if the work touches auth, data, a migration, a
-> public API, or more than one slice.
+> Use `$rite-quick` for a typo, copy/config edit, or one-function fix. It returns
+> here for auth, data, migration, public API, or multi-slice work.
 
 ## Rules consulted (read on demand from `.agents/skills/devrites-lib/reference/standards/`)
-Pull `documentation.md` via `Read`
-when capturing significant spec decisions (why-not-what, ADR-style notes in `decisions.md`);
-pull `principles.md` when the project has declared invariants (`.devrites/principles.md`): a
-new spec must respect them, and a requirement that can only be met by breaking one is a blocking gap.
-Pull `spec-grammar.md` and `devrites-lib/reference/workspace-artifact-schema.md` when writing
-acceptance for a behavioral / high-risk requirement (auth,
-data model, state machine, public API, money, migration): the structured `### Requirement:` /
-`#### Scenario:` (SHALL · WHEN/THEN) form, lint-checked by `devrites-engine spec-validate`. Simple criteria
-stay flat `AC-###` bullets; the grammar is opt-in by rigor, never forced. Use
-[`reference/acceptance-criteria.md`](reference/acceptance-criteria.md) to keep each
-criterion independently observable and binary.
+Pull `documentation.md` for significant decisions and `principles.md` for
+declared invariants; an unavoidable principle violation is blocking.
+For behavioral/high-risk acceptance, use `spec-grammar.md` plus workspace schema;
+simple criteria stay flat `AC-###`. Apply
+[`acceptance-criteria.md`](reference/acceptance-criteria.md) so each is binary and observable.
 
 ## Operating rules (DevRites core)
-- No silent assumptions · no guessing through confusion · prefer existing conventions ·
-  ask the human when an answer changes scope, placement, data model, UX, security,
-  migration risk, or acceptance.
-- **Root authority:** the controlling chat asks every human question, makes decisions, and
-  writes the workspace. Read-only evidence work follows the fresh-context contract in
-  [`agents.md`](../devrites-lib/reference/standards/agents.md).
-- **Author one section at a time.** Draft problem → goal → requirements → acceptance →
-  edge cases, pausing after each section. If a section contains a contested requirement,
-  boundary, or unstated assumption, apply a relevant technique from
+- No silent assumptions or guessing; prefer conventions; ask on scope,
+  placement, data, UX, security, migration, or acceptance changes.
+- **Root authority:** controlling chat asks humans, decides, and writes workspace;
+  evidence work follows [`agents.md`](../devrites-lib/reference/standards/agents.md).
+- **Author one section at a time:** problem → goal → requirements → acceptance →
+  edges. For contested requirements/boundaries/assumptions, apply
   [`elicitation.md`](../devrites-lib/reference/standards/elicitation.md) before continuing.
 
 ## Workflow
-0. **Read `.agents/skills/devrites-lib/reference/standards/core.md`:** the always-on operating rules and anti-rationalizations.
-   Then run `devrites-engine preamble` for deterministic workspace orientation.
-0a. **Check whether existing code needs adoption.** If this is an
-   **existing codebase** that has **never been adopted** (no
-   `.devrites/conventions.md`, no prior `.devrites/work`, `.devrites/features`, or `.devrites/archive`) the build has no
-   conventions ledger, route through `$rite-adopt` **first** and pass `$ARGUMENTS` as its
-   next objective. Adopt derives the baseline `spec.md`, seeds conventions, and proposes
-   principles; `$rite-spec` only detects and routes. In **HITL**, present a ranked option:
-   recommend adoption first and include a spec-only escape hatch. In **AFK**, when adoption
-   is allowed, run `$rite-adopt` automatically. **Skip this check silently for greenfield or
-   already-onboarded projects.** Never block a spec only because adoption is absent. Probe:
+0. Read core; if `.devrites/ACTIVE` exists, require its `state.md`.
+0a. **Adoption check.** For a never-adopted existing codebase, route first to
+   `$rite-adopt` with `$ARGUMENTS`; it derives baseline spec/principles. HITL
+   offers ranked adopt-first and spec-only choices; permitted AFK adopts.
+   Silently skip greenfield/onboarded projects, and never block solely on absence:
    ```bash
-   if [ ! -f .devrites/conventions.md ] && [ ! -d .devrites/archive ] \
-      && [ -z "$(ls .devrites/work .devrites/features 2>/dev/null)" ] \
+   if [ ! -d .devrites/archive ] \
+      && [ -z "$(ls .devrites/work 2>/dev/null)" ] \
       && [ -n "$(git ls-files 2>/dev/null | grep -vE '^\.(devrites|claude)/' | head -1)" ]; then
      echo "brownfield, not yet adopted → recommend $rite-adopt first (carry this idea as its next objective)"
    else echo "greenfield or already onboarded → continue spec"; fi
    ```
-1. **Understand the request** (`$ARGUMENTS`). State the requested outcome and the
-   underlying problem in one or two sentences.
-   **Completion:** one sentence includes both.
-1a. **Local dedupe.** Search local issues/PRDs and archived specs before creating a new workspace:
-   ```bash
-   devrites-engine spec-dedupe "$ARGUMENTS"
-   ```
-   If it finds a close match, ask the user: extend existing / adopt / new spec. Record the choice in
-   `decisions.md` once the workspace exists. No match → continue silently.
+1. **Understand the request** (`$ARGUMENTS`). State outcome and underlying
+   problem in one sentence. **Completion:** it includes both.
+1a. **Dedupe.** Search local issues/PRDs, work, and archive. On a close match ask
+   extend/adopt/new, then record the choice; otherwise continue silently.
 2. **Investigate:** follow [investigation](reference/investigation.md) through its
-   complete findings and done-when gate. Also discover the project's **test /
+   complete findings and done-when gate. Discover the project's **test /
    build/typecheck/lint** commands, frontend/backend systems, and declared project guidance
    (`PRODUCT.md`, `DESIGN.md`, `CLAUDE.md`, `AGENTS.md`, and `.devrites/principles.md` when
    present).
    **Consult the capability ledger**, which records current system behavior
-   ([`ledger.md`](../rite-ship/reference/ledger.md)): `devrites-engine ledger list` for the
-   capabilities on record, then `devrites-engine ledger show <capability>` for any this feature
-   touches. Also search prior decisions with `devrites-engine decisions search "<2-4 feature nouns>"`
-   before asking the human to revisit a settled architecture, API, or auth choice. The
-   ledger shows whether each requirement is new or changes existing behavior, which
-   determines the delta kind in step 5.
+   ([`ledger.md`](../rite-polish/reference/ledger.md)); Polish folds accepted deltas
+   before Review. List `.devrites/specs/*/spec.md` with the
+   host filesystem and read only capabilities this feature touches. Search accepted ADRs and
+   relevant `.devrites/**/decisions.md` files directly before asking the human to revisit a
+   settled architecture, API, or auth choice. Compare exact requirement headers and meanings
+   with the current ledger to choose ADDED/MODIFIED/REMOVED; never classify from memory. Use
+   `spec-grammar.md`'s singular `Capability impact:` declaration to name the affected
+   capabilities and change, or give its specific `none` justification.
+   Inventory affected observable behavior from current test/contract/runtime/source
+   evidence; map each outcome to preserving REQ/AC. Greenfield `none` needs the
+   template's specific justification.
    Identify proof constraints now: human-only credentials, unavailable environments, approval
    windows, or acceptance not observable through existing test/runtime/browser surfaces.
    Split independent placement, blast-radius, and external-fact questions into at most three
-   bounded `devrites-evidence-scout` packets on one frozen baseline. Await and reconcile every
+   bounded `devrites-evidence-scout` tasks on one frozen candidate. Wait for and reconcile every
    cited dossier before step 4. The scout supplies facts only; it never asks the human or writes
    the spec.
 3. **Gather design references when provided:** [references-intake](reference/references-intake.md).
@@ -135,28 +96,33 @@ criterion independently observable and binary.
    product/acceptance ambiguity, irreversible/external approval, or human-only access. Record
    owned prerequisites. Keep a build checkpoint only for unavailable pre-code evidence or a
    mandatory action-time approval. **Completion:** no foreseeable human choice is deferred.
-5. **Create the workspace** + set `.devrites/ACTIVE` from
-   [state-workspace](reference/state-workspace.md). Write every required artifact and
-   conditional annex exactly from [spec-template](reference/spec-template.md), including its
-   grammar/delta, coverage-seed, edge/prohibition, UI, and AI rules. Then refresh any managed
-   project context block so `AGENTS.md` / `CLAUDE.md` point at the new active workspace:
-   ```bash
-   devrites-engine context sync || true
-   ```
+5. **Create or update the workspace** + set `.devrites/ACTIVE` from
+   [state-workspace](reference/state-workspace.md). If the slug already exists,
+   update the existing workspace rather than overwrite it; preserve history and
+   unrelated settled content. Write every required artifact and conditional
+   annex exactly from [spec-template](reference/spec-template.md), including its
+   capability impact, existing-behavior preservation, grammar/delta,
+   coverage-seed, qualified backstops, edge/prohibition, UI, and AI rules. Native
+   hierarchical instructions remain stable; do not rewrite `AGENTS.md` or
+   `CLAUDE.md` for the active workspace.
 5a. **Check the spec prose** with [spec-checklists](reference/spec-checklists.md).
    Emit every applicable domain checklist and fix each CRITICAL by correcting the spec,
    never by softening the question.
 6. **Run the complete readiness gate** at the bottom of
-   [spec-template](reference/spec-template.md), then validate structure and ledger deltas:
-   ```bash
-   devrites-engine spec-skeleton ".devrites/work/<slug>"
-   devrites-engine spec-validate ".devrites/work/<slug>" --against .devrites/specs
-   ```
-   **Do not run `devrites-engine analyze` in this phase:** `tasks.md` deliberately does not
-   exist yet. `$rite-define` owns the first analyze pass after it writes the slices.
-   Any failure blocks. The interruption forecast must be resolved, owned, or a justified
+   [spec-template](reference/spec-template.md), then apply the
+   **Native grammar re-read checklist** in `spec-grammar.md` to the complete
+   saved `spec.md`. Re-open the file after corrections and verify every
+   applicable item; there is no parser or replacement script. Natively compare
+   deltas with the current ledger using exact header semantics and the ledger's
+   complete-block preservation rule.
+   `tasks.md` deliberately does not exist yet; cross-artifact traceability starts in
+   `$rite-define`. Any grammar or delta failure blocks. The interruption forecast must be resolved, owned, or a justified
    action-time gate. Then write `Spec gate: passed <iso>`.
-6a. **Review-before-code digest.** Before planning, render the compact human review:
+6a. **Existing-spec delta.** For a pre-existing slug/workspace, compare old/new
+   spec and questions, then show `Acceptance delta` (added/removed/reworded IDs)
+   and `Open-question delta` (opened/resolved/reworded IDs), using `none` for
+   empty categories. Show before proceeding; new workspaces skip.
+6b. **Review-before-code digest.** Before planning, render the compact human review:
    `Intent` (one sentence), `Done means` (top acceptance/scenario IDs), `Scope/risk` (what is in/out
    plus the hard gates), and `Build exactly this?` (yes → next phase; no → revise now). The digest
    is a view over `spec.md`, not a new artifact. **Stop** after the digest.
@@ -166,23 +132,5 @@ criterion independently observable and binary.
 
 ## Output
 
-**Progress first**: run `devrites-engine progress`, then use the shared completion reply contract
-([`devrites-lib/reference/reply-contract.md`](../devrites-lib/reference/reply-contract.md)).
-Default success shape:
-```
-Done: spec ready for <slug>; placement decided and gaps closed.
-Changed: spec.md, decisions.md, assumptions.md, questions.md, references/ <updated|n/a>
-Evidence: checklists passed; grammar <valid | n/a flat acceptance>; design brief <path | n/a>
-Open: <none | n non-blocking questions | Alternative: $rite-quick if express-lane eligible>; review digest: intent + done-means + scope/risk rendered
-Next: $rite-clarify
-Record: .devrites/work/<slug>/spec.md
-↻ Hygiene: /clear before $rite-clarify; $rite-handoff if away > a few hours
-```
-If a workspace with the slug already exists, update its spec rather than overwriting it,
-and **show the human a short diff of what changed** in `spec.md` (acceptance criteria added /
-removed / reworded) before proceeding. A spec edit reviewed as a diff catches silent scope
-drift that a full re-read buries; this is the spec-review view (`$rite-spec --review` renders
-just the diff + the open-question delta, no re-investigation).
-
 When the ask overlaps the ACTIVE feature (same intent, >50% scope), route to
 `$rite-plan revise` (its gate decides) rather than minting a parallel workspace.

package/pack/generated/codex/skills/rite-spec/reference/investigation.md

@@ -16,10 +16,7 @@ presented to the human.
 Before external research, check whether the project already shipped related work. Search
 the archive for the feature's key nouns. A hit may indicate an extension, conflict, or
 replacement and provides prior decisions:
-```bash
-devrites-engine archive-search "<key nouns>" 2>/dev/null \
-  || grep -rliE '<noun1>|<noun2>' .devrites/archive/*/spec.md 2>/dev/null
-```
+Use native file search over `.devrites/archive/*/{spec,decisions}.md`.
 - **Overlap found** → read the overlapping `spec.md` + its `decisions.md`, then put it to
   the human as a ranked option (*extend the shipped feature* · *this supersedes it* ·
   *genuinely distinct*) same option-set contract as a gap.

package/pack/generated/codex/skills/rite-spec/reference/question-protocol.md

@@ -1,35 +1,36 @@
 # Spec question protocol
 
-For vague or unknown intent, invoke `devrites-interview`; it owns question order,
-one-question turns, best guesses, option sets, blocking-question budget, reframing,
-and completion. The shared HITL/AFK rendering contract lives in
-[`afk-hitl.md` § Option set](../../devrites-lib/reference/standards/afk-hitl.md#option-set--how-every-gap-is-presented).
-
-This reference owns only the spec-specific coverage and recording rules below.
+For vague or unknown intent, invoke `devrites-interview` for ordered one-question turns,
+recommendations, option sets, pass limits, reframing, and closure.
+This file owns only Spec-specific coverage and recording. Render through
+[`Option set`](../../devrites-lib/reference/standards/afk-hitl.md#option-set-how-every-gap-is-presented).
 
 ## Coverage gate: am I done asking?
-Before declaring the interview complete, each dimension is **resolved** or **explicitly
-deferred** (logged and non-blocking), never silently skipped:
+Each dimension MUST be **resolved** or **explicitly deferred** (logged, non-blocking),
+never skipped:
 - [ ] **Objective:** one-sentence success + the real problem behind it.
 - [ ] **Scope**: what's in vs explicitly out for v1.
 - [ ] **Data model**: core entities + relationships (or "none").
-- [ ] **UX / flow**: happy path + empty / loading / error / permission states (or "no UI").
-- [ ] **Integration**: external systems / APIs / contracts (or "none").
-- [ ] **Non-functional**: auth, sensitive data, latency / scale (or "n/a").
-- [ ] **Acceptance**: how each requirement is *proven* (test / observation).
+- [ ] **UX / flow**: happy path + empty/loading/error/permission states (or "no UI").
+- [ ] **Integration**: external systems/APIs/contracts (or "none").
+- [ ] **Non-functional**: auth, sensitive data, latency/scale (or "n/a").
+- [ ] **Acceptance**: how each requirement is *proven* (test/observation).
 - [ ] **Human prerequisites**: credentials, approval windows, irreversible action-time gates
   (or "none").
 
-A blocking gap in any dimension keeps the interview open; a deferred one goes to
-`questions.md` and doesn't block. This feeds the `$rite-spec` readiness gate.
+An agent recommendation is not a user answer. A human-owned material product, scope, UX,
+compatibility, or acceptance choice closes only by the user's option selection, free-form
+answer, or explicit deferral. Packets MAY be bounded; readiness MUST NOT. Rescan and continue
+while blockers remain. If the user stops, keep them blocking and MUST NOT pass `$rite-spec`
+readiness.
 
 ## Spec question boundary
-- Things the codebase, prior decisions, or authoritative docs answer (search them first).
-- Reversible implementation and test details (decide and note as an assumption).
-- Objective tooling/environment failures (record the prerequisite or technical blocker; never
-  ask the human to authorize the agent's repair work).
-- Everything at once "to be thorough." Thoroughness is depth on the few that matter.
+- Search code, decisions, authoritative docs before asking discoverable facts.
+- Decide and log agent-owned reversible implementation/test details.
+- Record tooling failures as prerequisites or blockers; never ask the human to authorize repair.
+- Ask only material choices, not everything at once.
 
 ## Record
-Confirmed answers → `decisions.md` (with rationale). Standing assumptions →
+Confirmed answers → `decisions.md` (with rationale). Agent-owned reversible, low-impact
+technical assumptions →
 `assumptions.md`. Open non-blocking items → `questions.md`.

package/pack/generated/codex/skills/rite-spec/reference/spec-checklists.md

@@ -1,19 +1,14 @@
 # Spec-quality checklists
 
-Before `$rite-define`, check that each requirement is complete, unambiguous, and
-measurable. These checklists evaluate the prose, not the implementation. For example,
-"the banner is prominent" fails because "prominent" has no threshold. Fixing that in
-the spec avoids a later reslice.
-
-These are not implementation tests. Ask "is *export* defined for an empty dataset?", not
-"does `exportCsv()` handle `[]`?". Implementation checks belong to `$rite-vet` and
-`$rite-prove`. These files never name a function, file, or library.
+Before `$rite-define`, test requirement prose for completeness, clarity, and
+measurability—not implementation. “Banner is prominent” lacks a threshold; ask
+whether export defines empty data, never whether `exportCsv()` handles `[]`.
+Function/file/library checks belong to `$rite-vet` and `$rite-prove`.
 
 ## Output: one file per requirement domain
 
-Emit `.devrites/work/<slug>/checklists/<domain>.md`, one per domain the spec covers.
-Skip a domain marked "none". The domains match the interview taxonomy, so each gap maps
-to a `devrites-interview` dimension:
+Emit `.devrites/work/<slug>/checklists/<domain>.md` per covered domain; skip
+`none`. Each domain maps gaps to a `devrites-interview` dimension:
 
 | Domain file | Tests the prose of |
 |---|---|
@@ -32,15 +27,14 @@ Scored: <iso>   Verdict: pass | gaps (<n CRITICAL / n minor>)
 | # | Question (tests the requirement prose) | Verdict | Spec line | Severity |
 |---|---|---|---|---|
 | 1 | Is every quantitative qualifier ("prominent", "fast", "large") given a number or reference? | fail | "banner is prominent" | **CRITICAL** |
-| 2 | Does each requirement name an observable outcome a test could check? | pass | FR-001..004 | — |
+| 2 | Does each requirement name an observable outcome a test could check? | pass | REQ-001..004 | — |
 | 3 | Are all enumerations closed — no "etc." / "and so on" / open "…"? | pass | — | — |
 ```
 
-Verdict is `pass` / `fail` / `n/a`. A `fail` carries a severity:
-- **CRITICAL:** the ambiguity would change the build or its acceptance: an unquantified
-  acceptance/success criterion, an incomplete enumeration in a requirement, an ambiguous data
-  shape, an undefined edge case on a stated flow, a contradictory pair of requirements.
-- **minor:** vague but nonessential prose. Record it; it does not block.
+Verdict: `pass | fail | n/a`. A fail is **CRITICAL** when ambiguity changes build
+or acceptance: unquantified success, open enumeration, ambiguous data shape,
+undefined stated-flow edge, or contradictory requirements. Other vague prose is
+**minor**: record it; do not block.
 
 ## Question bank
 
@@ -55,6 +49,11 @@ Each question checks one requirement-prose failure mode:
 - **Testability:** each acceptance criterion is binary and names (or clearly implies) its evidence.
   A criterion only provable by reading code is a fail.
 - **Consistency:** no requirement contradicts another, the data model, or a non-goal.
+- **Preservation:** each material brownfield outcome appears in `Existing behavior
+  to preserve` with preserving REQ/AC and current evidence. Missing/vague “no
+  regressions” or unjustified `none` is CRITICAL.
+- **Backstops:** each row names an independent held-out, property/metamorphic, or
+  direct behavioral check and the failure it discriminates; confidence/presence/self-review fail.
 - **Non-functional:** each NFR names affected REQ/AC IDs or a bounded `global` scope;
   human-only proof prerequisites name their owner.