devrites 3.2.28 → 4.0.0

package/pack/generated/codex/skills/rite-upgrade/SKILL.md

@@ -1,146 +1,112 @@
 ---
 name: rite-upgrade
-description: User-invoked semantic upgrade for an active legacy DevRites workspace. Reconciles unfinished planning with the installed workflow contract while preserving completed work and history.
+description: Audit and reconcile an older released DevRites workspace. Proves a current-contract defect, then routes its phase owner while preserving completed work and history.
 argument-hint: "[feature-slug]"
 user-invocable: true
 disable-model-invocation: true
-required-agent-roles: none
 ---
 
-## Codex compatibility
+# $rite-upgrade: reconcile a released workspace safely
 
-This is the Codex mirror of a DevRites skill. In Codex:
-
-- Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
-- Installed `.agents/` mirrors may be Git-ignored. If a repository-aware file tool refuses an ignored path, read it with a native filesystem command instead; a tool refusal is not a completed task.
-- For automatic Engram calls, omit optional `project` and `session_id` unless an exact value came from Engram or repository configuration. Never derive either from `task_name`, a run ID, directory name, or normalized slug. Call `mem_session_summary` without them by default; on `unknown_session` or `unknown_project`, retry once with both optional fields omitted. If auto-detection is ambiguous, ask the user instead of guessing.
-- Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. A missing visible `agent_type` field is still V2—not capability loss, V1, or HITL—so send it anyway. If the named call rejects it, stop before any generic/default spawn. Codex loads the role TOML's `developer_instructions` natively; DevRites verifies the durable rollout, wait, completion, and delivered result.
-- Only after the runtime explicitly identifies MultiAgent V1, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
-- On explicitly identified MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`.
-- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
-- If the required dispatch for the explicitly identified runtime is unavailable or rejected, stop for HITL. Never switch runtime lanes. Never execute a DevRites specialist role in the root context.
-- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
-- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
-- When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
-
-
-# $rite-upgrade: bring an active workspace onto the current contract
-
-Use this when a workspace created under older DevRites rules cannot safely continue with
-the installed pack. It reconciles the workspace to the current desired state; it does not
-replay a chain of release-specific scripts. Structural `devrites-engine migrate` remains a
-separate first step.
-
-Current semantic contract: `devrites.readiness-artifacts.v2`.
+Use when an unfinished workspace from an older release cannot resume. This is a
+audit/orchestrator—not a pack update, cursor conversion, release replay,
+structural migration, or generic cleanup.
 
 ## Rules consulted
 
-Read `devrites-lib/reference/standards/core.md`,
-`devrites-lib/reference/standards/agents.md`,
-`devrites-lib/reference/workspace-artifact-schema.md`, and the current Clarify, Define,
-Plan, Vet, Converge, and Build phase contracts needed by the assessment.
+Read `devrites-lib/reference/standards/core.md`, its agent and workspace-schema
+references, and only current phase contracts needed for the observed gap.
 
 ## Invariants
 
-- Never edit application source, tests, dependencies, Git state, or historical evidence.
-- Preserve completed-slice identity, status, acceptance, dependencies, historical proof,
-  answered questions, and `touched-files.md`.
-- Reassess only unfinished planning. Archived or `done` workspaces are a no-op.
-- Never downgrade a workspace that names a future semantic contract.
-- This is a recovery command, not a lifecycle phase; never write `Phase: upgrade`.
-- Durable plans contain portable repository commands, not RTK/local aliases, user-specific
-  absolute paths, or temporary proof trees. Runtime packets may name an execution adapter;
-  evidence may record both logical and executed forms.
-- Ask at most one coherent question, and only for product, policy, irreversible risk, or
-  human-only access/action. Retry and repair authorization is agent-owned.
-- The explicit `$rite-upgrade` invocation authorizes the bounded workspace reconciliation.
-  The root remains the only canonical writer.
+- Upgrade writes no workspace artifact and never edits source, tests, dependencies,
+  or Git. It observes, admits, invokes current owners, and re-audits only.
+- Recognize only released workspace forms: `.devrites/work/<slug>/state.md` with v1/v2
+  bullet fields (`- Phase:`, `- Next step:`, optional `- qid:`) or the v3 cursor table.
+  Preserve its encoding; only its owning rite may change fields. Never create aliases,
+  journals, telemetry, version markers, or an engine migrator.
+- Older provenance, cursor form, or pack version alone is never a defect. A repair requires
+  a current rule, exact workspace evidence, affected gate, owning rite, exact paths, and
+  the smallest behavior-neutral delta.
+- Existing rites own semantic changes. Upgrade may sequence `$rite-clarify`,
+  `$rite-plan repair`, `$rite-converge`, `$rite-vet`, `$rite-prove`, `$rite-polish`,
+  `$rite-review`, and `$rite-seal`; it never reimplements them or starts Build or Ship.
+  `$rite-doctor` owns install/config diagnosis.
+- An admitted candidate route may name only the exact current gate artifacts its owner
+  must refresh: `touched-files.md`, `evidence.md`, optional `browser-evidence.md`,
+  `polish-report.md`, `review.md`, `seal.md`, and the owner's `state.md` fields as
+  applicable. Source, completed-slice identities, answers, decisions, and unrelated
+  history remain protected. Each owner preserves unrelated content and normal gates.
+- Archived/`done` workspaces are no-ops. Unknown or unverifiable inputs stop without
+  writes. There is no legacy fallback: never synthesize or guess scope, bytes, proof,
+  freshness, or a historical pass.
+- The explicit invocation authorizes only admitted, behavior-neutral workspace repairs.
+  Product/policy choices, acceptance changes, irreversible risk, and human-only actions
+  remain HITL.
 
 ## Workflow
 
-0. **Orient and normalize structure.** Read the active slug or `$ARGUMENTS`. Run:
-   ```bash
-   devrites-engine doctor; echo "doctor rc=$?"
-   ```
-   A binary/pack integrity mismatch stops at `$rite-doctor`; do not run migration or
-   mutate semantic artifacts. Once healthy, orient without writing:
+0. **Orient read-only.** Apply `$rite-doctor`. Resolve the explicit or active slug.
+   Archive-only is `current`; otherwise require contained regular `state.md` and read its
+   cursor. A damaged/mismatched install stops at Doctor; missing live work routes
+   `$rite-spec`; `done` is `current`. An unknown cursor is `unsupported`.
+1. **Freeze preservation evidence.** Record `git status --short`, cursor form/fields, and
+   hashes of completed-slice fields, candidate gate artifacts, existing answers/decisions,
+   and protected history. Inventory every path that could change; absence is evidence,
+   never permission to synthesize history. For a post-Build workspace, also retain the
+   exact result of `devrites-engine check candidate <slug>`; at or after Seal retain the
+   exact result of `devrites-engine check seal <slug>`.
+2. **Assess from fresh context.** Dispatch exact `devrites-upgrade-planner` with the named
+   installed contracts, workspace paths, cursor form, current phase, and frozen baseline.
+   Require one read-only typed assessment. It writes and asks nothing.
+3. **Admit the assessment fail closed.** Accept `current` only when every applicable axis has
+   cited evidence and no finding. Accept `repairable` only when every finding names the
+   current rule, exact workspace evidence, affected gate, owning rite, exact writable paths,
+   minimal delta, and protected invariants. Missing fields become `gap`.
+   Unsupported shapes remain untouched. Reject version-only, speculative, alias-creating,
+   source-changing, history-changing, or acceptance-changing advice.
+4. **Route; do not duplicate.** For `repairable`, invoke only the admitted current owners,
+   one at a time:
+   - decision coverage or a material assumption → `$rite-clarify`;
+   - stale/inconsistent planning or traceability with settled intent → `$rite-plan repair`;
+   - live code and recorded intent disagreement → `$rite-converge`;
+   - any changed planning input or readiness defect → `$rite-vet`;
+   - a missing/malformed strict manifest, missing/malformed/mismatched evidence binding,
+     a browser-binding defect when that file exists, or current candidate-check failure
+     → `$rite-prove`;
+   - candidate-affecting capability-ledger, `DESIGN.md`, or ADR rollups still deferred by
+     an old Ship-era workspace → `$rite-polish`;
+   - a missing, stale, or mismatched review binding → `$rite-review`;
+   - a missing, stale, or mismatched seal binding or failed Seal gate → `$rite-seal`.
+
+   Sequence only applicable owners; candidate owners stay in the Prove → Polish → Review
+   → Seal order above. Each owner keeps normal gates/write limits. Stop on HITL/blocked.
+   Never infer `$rite-customize --import-legacy`; that mode requires the exact token in the
+   user's current invocation.
+5. **Re-audit and prove preservation.** Re-dispatch the planner once against the changed
+   candidate. `gap`, `unsupported`, or a remaining finding stops. Compare the frozen hashes
+   and Git status; only admitted paths may differ. Cursor changes must match the owning
+   rite while preserving form. Any unadmitted, protected, or source change is a gap and
+   stops; Upgrade never restores it itself.
+   For a post-Build workspace, run `devrites-engine check candidate <slug>` and require
+   the assessed bindings to match it. At or after Seal, also run
+   `devrites-engine check seal <slug>`. Run readiness where applicable:
    ```bash
-   devrites-engine preamble [feature-slug]
-   devrites-engine snapshot [feature-slug]
+   devrites-engine check readiness <slug>; echo "readiness rc=$?"
    ```
-   A missing workspace stops at `$rite-spec`; an archived or `Status: done` workspace is
-   a no-op. For an active healthy workspace, run:
-   ```bash
-   devrites-engine migrate
-   devrites-engine preamble [feature-slug]
-   devrites-engine snapshot [feature-slug]
-   ```
-   If every semantic artifact names the current contract and `build-readiness` passes,
-   mark the candidate as a likely no-op; the fresh upgrade assessment in step 2 must
-   confirm that before reporting it.
-1. **Freeze the preservation baseline.** Create the standard orchestrator-controlled
-   `agent-packet/v1` baseline. Include exact paths for current phase/artifact contracts,
-   `state.md`, `spec.md`, `decision-coverage.md`, `architecture.md`, `plan.md`, `tasks.md`,
-   `traceability.md`, `test-plan.md`, `eng-review.md`, `questions.md`, `decisions.md`,
-   `assumptions.md`, `drift.md`, `evidence.md`, and `touched-files.md` when present. Record
-   the source diff identity plus the protected identity/status/acceptance/dependency
-   fields for every completed slice and each preserved artifact identity. Freeze the
-   workspace while it is assessed.
-2. **Classify from fresh context.** Dispatch `devrites-upgrade-planner` with objective
-   `reconcile this workspace with devrites.readiness-artifacts.v2`, the exact baseline,
-   and budgets `25 files / 2,000 loaded lines / 180 result lines`. Require one validated
-   `upgrade-assessment`. The agent writes nothing and asks nothing.
-3. **Reconcile ownership.** Reject stale, malformed, or preservation-breaking advice.
-   Dispatch `devrites-evidence-scout` only for a bounded missing fact. Drop an open
-   retry/tool-repair question with `devrites-engine resolve --drop <qid>
-   "superseded by explicit semantic upgrade; agent-owned recovery"` and continue. Keep a
-   genuine existing human gate intact; if a newly discovered human-owned choice is
-   unavoidable, persist one option packet and stop.
-4. **Apply current desired state in the root.**
-   - Remove obsolete old-engine reconstruction, old workflow hashes, temporary proof
-     recipes, and host-local wrappers from active `plan.md`, `tasks.md`, and
-     `test-plan.md`. Keep historical evidence unchanged.
-   - Re-run Clarify against unfinished intent until `Decision coverage: CLEAR`; it writes
-     exactly one `DevRites contract: devrites.readiness-artifacts.v2` field. Do not stamp a
-     marker over stale content.
-   - Re-run Temper only where unfinished scope still needs strategic review.
-   - For unstarted planning, use the current Define contract. When active planning needs
-     normalization, dispatch `devrites-plan-drafter` in repair mode and reconcile only
-     pending slices. Preserve all completed slices without changing their protected fields.
-     For all-built active work, normalize only gate-required planning fields. Use Converge
-     only when live code and recorded intent genuinely differ.
-   - Invalidate stale engineering readiness after any planning edit. Run the full current
-     Vet contract, including its fresh plan reviewer, portable proof commands, preflight,
-     and digest refresh. Vet writes exactly one current contract field to `test-plan.md`
-     and `eng-review.md`.
-5. **Verify preservation and readiness.** Recompute the frozen source diff, every protected
-   completed-slice field, `evidence.md`, answered-question records, and `touched-files.md`;
-   any mismatch is a hard stop and must be restored before proceeding. Then run:
-   ```bash
-   devrites-engine build-readiness [feature-slug]; echo "readiness rc=$?"
-   ```
-   Follow the gate's current route for `2` through `7`; `8` means the semantic
-   reconciliation is still incomplete. Finish only at `0`. Preserve the original active
-   build cursor when it still names the next pending slice; otherwise use the current
-   deterministic next action.
-6. **STOP.** Do not start Build. A second `$rite-upgrade` must take the current-contract
-   no-op path.
+   Any nonzero result or mismatch remains a `gap` and stops.
+6. **STOP.** Do not advance to Build or Ship. A repeated `$rite-upgrade` is a no-op only
+   when the fresh assessment independently returns `current`; no marker may manufacture
+   that result.
 
 ## Output
 
-Run `devrites-engine progress`, then use the shared completion reply contract in
-`devrites-lib/reference/reply-contract.md`:
-
 ```text
-Done: workspace <slug> upgraded to devrites.readiness-artifacts.v2.
-Changed: <active planning artifacts only | none; already current>
-Evidence: build-readiness rc=0; source/completed slices/history preserved
-Open: <none | one genuine human gate>
-Next: <snapshot next command>
+Done: workspace <slug> compatibility <current | reconciled>.
+Changed: <admitted active-workspace paths | none>
+Evidence: assessment=current; candidate rc=<n|n/a>; seal rc=<n|n/a>; readiness rc=<n|n/a>; protected history/source unchanged
+Open: <none | exact unsupported shape, evidence gap, or human gate>
+Next: <state.md next action | one owning rite>
 Record: .devrites/work/<slug>/state.md
 ↻ Hygiene: /clear before the next lifecycle step
 ```
-
-On a no-op, say so and keep the snapshot's current next command.

package/pack/generated/codex/skills/rite-vet/SKILL.md

@@ -1,42 +1,20 @@
 ---
 name: rite-vet
-description: Vet a defined plan before code with senior-engineer engineering review. Use when the user says "vet the plan", "engineering review", "lock in the plan", or before building. Not for code review or final seal.
+description: Review a defined engineering plan before code. Use for plan vetting or lock-in; not for implementation review or final readiness sealing.
 argument-hint: "[slug] [--cross-model] [--full]"
 user-invocable: true
-required-agent-roles: devrites-plan-reviewer
 ---
 
-## Codex compatibility
-
-This is the Codex mirror of a DevRites skill. In Codex:
-
-- Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
-- Installed `.agents/` mirrors may be Git-ignored. If a repository-aware file tool refuses an ignored path, read it with a native filesystem command instead; a tool refusal is not a completed task.
-- For automatic Engram calls, omit optional `project` and `session_id` unless an exact value came from Engram or repository configuration. Never derive either from `task_name`, a run ID, directory name, or normalized slug. Call `mem_session_summary` without them by default; on `unknown_session` or `unknown_project`, retry once with both optional fields omitted. If auto-detection is ambiguous, ask the user instead of guessing.
-- Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. A missing visible `agent_type` field is still V2—not capability loss, V1, or HITL—so send it anyway. If the named call rejects it, stop before any generic/default spawn. Codex loads the role TOML's `developer_instructions` natively; DevRites verifies the durable rollout, wait, completion, and delivered result.
-- Only after the runtime explicitly identifies MultiAgent V1, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
-- On explicitly identified MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`.
-- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
-- If the required dispatch for the explicitly identified runtime is unavailable or rejected, stop for HITL. Never switch runtime lanes. Never execute a DevRites specialist role in the root context.
-- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
-- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
-- When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
-
-
 # $rite-vet: review the plan before build
 
-Review a defined plan for implementation scope, architecture, code quality, test
-coverage, performance, failure modes, and parallel work. Cite the source for every
-finding and design the test coverage that `$rite-build` will use. Fold accepted
-engineering changes into the canonical plan before code is written. Run this step on
-**every** plan; depth varies with risk. `$rite-autocomplete` always includes it, and
-`--cross-model` adds a second opinion from another model. **Read the active workspace
-first**; if there is no `plan.md`, tell the user to run `$rite-define`.
+Vet every plan before code for scope, architecture, quality, proof, performance,
+failure modes, and parallel safety. Cite findings, fold accepted technical hardening
+into the plan, and design Build tests. Risk sets depth; `$rite-autocomplete` has
+Vet and `--cross-model` adds one opinion. Missing `plan.md` routes to `$rite-define`.
 
-`$rite-temper` reviews product scope and strategy in the spec. `$rite-vet` reviews how
-to implement that settled scope.
+`$rite-temper` owns product scope/strategy; Vet owns implementation. Quick/Standard/Full
+comes from [`orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md),
+but every profile keeps the exact plan-reviewer gate.
 
 ## Rules consulted (read on demand from `.agents/skills/devrites-lib/reference/standards/`)
 Pull the standard named by the active axis: `principles.md`, `patterns.md`,
@@ -46,39 +24,28 @@ Pull the standard named by the active axis: `principles.md`, `patterns.md`,
 
 
 ## Operating rules
-- **Review implementation, not product ambition.** Treat the scope established by
-  `$rite-temper` as settled. Check whether the plan is simple, well tested, and low risk,
-  and challenge only implementation scope creep.
-- **The root updates the plan; the reviewer judges.** Vet is the plan-hardening phase, so
-  behavior-preserving plan refinements (test requirements, tightened scope boundaries, ordering,
-  parallel lanes, error-handling + failure-mode coverage) are written straight into
-  `plan.md` / `tasks.md` / `test-plan.md`. You are the single canonical writer. A finding that
-  changes **acceptance criteria or product behavior** is *not* a plan refinement: it routes
-  through the **Spec Drift Guard** (record in `drift.md`, recorded decision, then `$rite-plan
-  repair` for any structural reslice). Nothing that grows the build's scope lands without a
-  recorded human decision.
-- **Support every finding.** Every finding carries a confidence band; a finding you cannot
-  back by quoting the plan/spec line (or the code it references) is forced to low confidence and
-  suppressed from the main report: see the verification gate in [`reference/review-axes.md`](reference/review-axes.md).
+- **Review implementation, not ambition.** Temper's product scope is settled; challenge
+  only implementation creep, complexity, proof, and risk.
+- **Root hardens; reviewers judge.** Root alone asks, decides, folds back, writes, and sets
+  readiness. Write behavior-preserving test, boundary, ordering, error, and failure-mode
+  refinements into `plan.md`/`tasks.md`/`test-plan.md`. Acceptance/product changes require
+  the Spec Drift Guard: `drift.md`, recorded decision, then `$rite-plan repair` for reslicing.
+  Build scope never grows without a recorded human decision.
+- **Support every finding.** Cite its plan/spec/code source and confidence. Unverified or
+  confidence ≤4 stays suppressed per [`review-axes.md`](reference/review-axes.md).
 - **Apply maximum caution to hard-to-reverse changes.** Auth, migration, public API, and
   data-model changes always pause under the irreversible-risk list.
 - **Use the lowest axis band.** Never round `thin` up to `ready`; do not average the
   axes. Record the reason for every decision.
-- **Search before asking.** Apply `afk-hitl.md` decision ownership: verify facts and fold
-  reversible technical hardening into the plan; ask only about human-owned choices.
-- **Root hardens; reviewer judges.** Dispatch follows the file-backed contract in
-  [`agents.md`](../devrites-lib/reference/standards/agents.md). The root owns every
-  question, decision, fold-back, readiness verdict, and workspace write.
+- **Search before asking.** Verify facts and fold reversible technical hardening into the
+  plan; ask only human-owned choices under `afk-hitl.md`. Dispatch uses the bounded
+  [`agents.md`](../devrites-lib/reference/standards/agents.md) contract.
 
 ## Workflow
 0. **Read `.agents/skills/devrites-lib/reference/standards/core.md`** first.
-   Then run the shared orientation preamble. It prints `state.md`, present artifacts,
-   run mode, and open-question totals:
-   ```bash
-   devrites-engine preamble
-   devrites-engine snapshot
-   ```
-   Then the workspace: `plan.md`, `tasks.md`, `spec.md`, `decision-coverage.md`
+   Then resolve the active slug from `.devrites/ACTIVE`, require its
+   `state.md`, and read the workspace: `plan.md`, `tasks.md`, `spec.md`,
+   `decision-coverage.md`
    (for intent + acceptance), `strategy.md` (if `$rite-temper` ran), `decisions.md`,
    `assumptions.md`, `design-brief.md` (if UI), `state.md`. Require a `plan.md` whose
    Readiness gate passes (or `Plan approved`): else STOP → `$rite-define`. Require
@@ -88,57 +55,56 @@ Pull the standard named by the active axis: `principles.md`, `patterns.md`,
 1. **Set review depth. Never skip this step.** Apply
    [`reference/depth.md`](reference/depth.md) exactly. Every plan leaves a recorded
    engineering verdict and `test-plan.md` coverage map.
-1a. **Required initial independent pass (light and full).** Before hardening or writing,
-   freeze the candidate and dispatch `devrites-plan-reviewer` with the plan/spec packet.
-   Await and validate its report. Light depth reduces the inline hardening, not this
-   independent gate. Dispatch the DevEx predictor alongside it when triggered (within the
-   maximum-three read-only budget).
+1a. **Independent pass at every depth.** Freeze the candidate; dispatch exact
+   `devrites-plan-reviewer` fresh/read-only and validate its report. Add exact
+   `devrites-devex-reviewer` for developer surfaces and require the current exact
+   `devrites-strategy-reviewer` verdict after significant Temper. Missing accounts
+   block; never substitute inline work.
 2. **Scope challenge (blocking gate):** apply §0 of
-   [`reference/review-axes.md`](reference/review-axes.md). Search prior decisions first:
-   `devrites-engine decisions search "<2-4 plan nouns>"`. Harden to the smallest
+   [`reference/review-axes.md`](reference/review-axes.md). Search accepted ADRs and
+   relevant workspace `decisions.md` files directly. Harden to the smallest
    behavior-preserving plan; ask only when that changes acceptance or explicit architecture policy.
-2a. **Cross-artifact analyze + project gates.** Run the deterministic gate, add the
-   semantic terminology/conflict pass, and score principles, the anti-slop charter, and
-   conventions using their named standards. Any Critical blocks `$rite-build`; a principle
-   exception is always human-owned, while an absent principles file passes. Re-check after
-   hardening and write the result to `analysis.md`.
-   ```bash
-   devrites-engine analyze; echo "analyze rc=$?"
-   ```
+2a. **Cross-artifact/project gates.** Apply explicit checklists to spec, tasks,
+   and traceability. Every AC/REQ maps by ID and meaning to a real slice/proof;
+   every slice maps back. Check terminology/conflicts, principles, anti-slop, and
+   conventions. Critical blocks; principle exceptions are human-owned. Recheck
+   after hardening and write `analysis.md`.
 2b. **Build-entry preflight.** Using [`reference/artifacts.md`](reference/artifacts.md), verify
-   each exact proof command/cwd/tool/version and prerequisite; package names against their
-   authoritative source plus nearest manifest/lockfile; parser-sensitive planned syntax in an
-   isolated fixture; and the existing UI/browser harness where applicable. Record complete
-   SHA-256 provenance inputs. This is non-mutating and need not make future behavior pass.
+   every exact proof command/cwd/tool/version/prerequisite; package names against authoritative
+   source and nearest manifest/lockfile; parser-sensitive syntax in an isolated fixture;
+   applicable UI/browser harnesses. Remeasure decision-bearing counts/versions/state
+   claims read-only: live facts win; conflicts mark stale artifacts;
+   unmeasurable conflict = gap. Record complete SHA-256 provenance inputs. Require
+   every behavioral mapping to name a positive,
+   discriminating assertion and decisive signal, not merely a command or expected exit zero.
+   Preflight observes; it need not make future behavior pass.
 2c. **Implementation-readiness audit.** Goal-backward map every REQ/AC/NFR, interaction,
    edge/prohibition, and decision-coverage row to a slice and executable proof. Verify
    UX/spec/architecture alignment, producer-consumer contracts, slice independence/order and
    wiring, exact prerequisites, failure paths, operations, observability, rollout, and rollback.
+   Check `plan.md`'s canonical `Shared contract proof`: every changed API/event/schema or other
+   provider/consumer boundary needs one reused artifact and two asserting tests that consume it;
+   no boundary change needs the specific no-impact statement. Missing, one-sided, duplicated-contract,
+   vague, or non-consuming proof fails closed.
    Fold technical fixes into the plan. Product/risk gaps are `NEEDS CLARIFICATION` →
    `$rite-clarify`; technical plan/preflight gaps are `NEEDS REPLAN` → `$rite-plan repair`.
    Neither becomes a build qid.
 3. **Review four axes:** apply [`reference/review-axes.md`](reference/review-axes.md)
    through [`reference/eng-lenses.md`](reference/eng-lenses.md). Fold verified,
    behavior-preserving technical findings into the plan. Walk only human-owned decisions with
-   the human, one coherent option packet at a time. The AFK ceiling remains owned by
+   the human, one coherent option set at a time. The AFK ceiling remains owned by
    [`reference/depth.md`](reference/depth.md): scope/acceptance changes and irreversible risk pause.
-4. **Required outputs:** write every shape and fold-back required by
+4. **Required outputs:** prepare every shape and fold-back in
    [`reference/artifacts.md`](reference/artifacts.md), using the review rules in
-   [`reference/review-axes.md`](reference/review-axes.md). Ground parallelization in:
-   ```bash
-   devrites-engine lanes plan "$(cat .devrites/ACTIVE 2>/dev/null)"
-   ```
-   Completion: every scenario and acceptance criterion maps to planned proof, every slice is
+   [`reference/review-axes.md`](reference/review-axes.md). Derive dependency order
+   from the plan; let the native host schedule independent read-only work while
+   keeping source writers serial.
+   Completion: every scenario and acceptance criterion maps to planned positive,
+   discriminating proof, every slice is
    one-pass implementable, the Build-entry preflight is green or names an owned prerequisite,
    and developer-facing plans have a predicted `devex.md` scorecard. Durable proof commands
-   are portable repository commands; host-local wrappers belong only in runtime packets and
+   are portable repository commands; host-local wrappers belong only in observed
    recorded execution evidence.
-4a. **Forge gate.** `$rite-define` leaves `no` / `none` / `none`; Vet alone promotes under
-   [`rite-build/reference/forge.md`](../rite-build/reference/forge.md). Require a costly
-   unresolved architecture fork, 2–3 distinct complete contiguous `A`–`C` strategies, every
-   slice AC plus exact `test-plan.md` rows/commands, and `manifest-env-v1` as an explicit
-   Build-entry prerequisite. After final fold-back the three fields must agree, else clear
-   Forge before READY.
 5. **Write and fold back every artifact required by
    [`reference/artifacts.md`](reference/artifacts.md).** Route every
    acceptance/behavior-changing delta through the **Spec Drift Guard** (`drift.md` +
@@ -147,58 +113,44 @@ Pull the standard named by the active axis: `principles.md`, `patterns.md`,
    affected coverage rows, assumption audit, residual uncertainty, and closed gates.
    Partial/Missing, an unowned material assumption, or an open blocking/escalating question is
    `NEEDS CLARIFICATION` → `$rite-clarify`/HITL; never refresh past it.
-   Re-run the gate after every fold-back so a task edit cannot invalidate the earlier pass:
-   ```bash
-   devrites-engine analyze; echo "final analyze rc=$?"
-   ```
-   Any non-zero result blocks the handoff. Keep `state.md` non-READY and do not
-   generate the engineering digest yet; this is the frozen candidate for step 6,
-   not the final handoff.
-6. **One narrow recheck after accepted edits.** If steps 2 through 5 changed the frozen candidate,
-   dispatch `devrites-plan-reviewer` once more with only the accepted initial findings,
-   changed planning paths, affected criteria, and the new immutable identity. Do not repeat
-   the full review or start a third loop. If nothing changed, the initial report is final.
-   If the recheck causes an accepted edit, repeat step 5. After the recheck is
-   complete and all accepted edits are folded back, re-close the matrix, rerun
-   `analyze`, run `devrites-engine readiness-digest coverage <slug>`, replace the
-   complete `Coverage inputs SHA-256` line, and only then run
-   `devrites-engine readiness-digest engineering <slug>`.
+   After each fold-back rerun step 2a; missing/meaning-changing mappings block.
+   Keep `state.md` non-READY for step 6.
+6. **One narrow recheck after edits.** If the candidate changed, dispatch exact
+   `devrites-plan-reviewer` once with accepted findings, changed paths/criteria,
+   and new identity. No full or third loop; if it changes the plan, repeat step 5.
+   Then close the matrix and rerun step 2a's ID-and-meaning audit.
 
-   Now write exactly one `DevRites contract: devrites.readiness-artifacts.v2`
-   field to both `test-plan.md` and `eng-review.md`, plus one typed field to
-   `eng-review.md`: `Implementation readiness: READY`, `NEEDS CLARIFICATION`, or
-   `NEEDS REPLAN`. Only READY sets `Phase: vet` and `Next step: $rite-build`,
-   after a final sweep leaves no foreseeable human choice except a justified
-   action-time checkpoint. Technical failure records its reproduction and
-   `$rite-plan repair` without a qid; a human-owned contract gap routes
-   `$rite-clarify` and uses the normal awaiting-human block.
-   [`reference/cross-model.md`](reference/cross-model.md) owns the optional outside voice.
+6a. **Build readback.** From the final owning artifacts, add a cited five-line
+   readback to `eng-review.md` §7: outcome/ACs; IN/OUT and must-NOT boundaries;
+   UI direction when applicable plus chosen architecture/rationale and
+   critical happy/error flow; slice order and first slice; decisive proof and
+   justified action-time gates. Ask whether a fresh implementer could explain and
+   build it without inventing a product, design, architecture, or proof decision.
+   Contradictory, ownerless, or materially ambiguous statements block READY:
+   human-owned behavior, policy, or acceptance returns to `$rite-clarify`;
+   technical architecture,
+   slicing, or proof returns to `$rite-plan repair`.
+   The readback is a derived view and MUST NOT override its cited owners.
+
+   Write one typed field to `eng-review.md`: `Implementation readiness: READY`,
+   `NEEDS CLARIFICATION`, or `NEEDS REPLAN`. Root alone sets READY after every
+   exact account, checklist, proof preflight, and final sweep passes with no
+   foreseeable human choice except a justified action-time checkpoint. Write
+   `Phase: vet`, `Next step: $rite-build`, then emit the one exact
+   `Readiness inputs SHA-256` line with `devrites-engine check readiness
+   --emit-binding <slug>` only after this recheck. Normal `devrites-engine check
+   readiness <slug>` must then pass; otherwise record the blocker. Technical failure
+   records repro and `$rite-plan repair`, no qid; a human-owned gap routes
+   `$rite-clarify` and awaiting-human.
+   [`reference/cross-model.md`](reference/cross-model.md) owns the optional explicit
+   cross-model integration.
    Completion: the final axis floor clears, an objective technical blocker is recorded, or a
    genuine human-owned gate is recorded.
-7. **STOP.** Report the scope verdict, lowest axis band, coverage gaps closed, the
-   Build-entry preflight, expected action-time checkpoints, and the failure-mode criticals;
-   recommend `$rite-build` only when the entry contract is ready.
+7. **STOP.** Show the Build readback, scope verdict, lowest axis band, closed coverage
+   gaps, preflight, action-time checkpoints, and failure-mode criticals; recommend
+   `$rite-build` only when the entry contract is ready.
 
 > **Mid-flight discipline.** Do not replace the interactive review with
 > `eng-review.md`, change acceptance through plan hardening, score without source
 > evidence, or ignore unexplained complexity. See
 > [`reference/anti-patterns.md`](reference/anti-patterns.md).
-
-## Output
-
-**Progress first**: run `devrites-engine progress`, then use the shared completion reply contract
-([`devrites-lib/reference/reply-contract.md`](../devrites-lib/reference/reply-contract.md)).
-Default success shape:
-```
-Done: plan vetted for <slug>; depth <light|full> with axis floor <band>.
-Changed: eng-review.md, test-plan.md, plan.md, decisions.md
-Evidence: Implementation readiness: READY; coverage <x/y> planned; build-entry preflight <pass>; open findings Critical 0 / Important 0 / Suggestion <n>; reviewer loop <n>; outside-voice <ran|skipped-unavailable|disabled>
-Open: none
-Next: $rite-build
-Record: .devrites/work/<slug>/eng-review.md
-↻ Hygiene: /clear before $rite-build
-```
-If a blocker or Spec Drift Guard delta remains, use the shared `Stopped / blocked`
-form and route `Fix:` to `$rite-clarify` for product/risk decisions or `$rite-plan`
-for technical replanning; do not recommend `$rite-build`.
-**DO NOT write code, slice, or run the build here**. That's `$rite-build`. Vet reviews and hardens the plan; it never implements.