devrites 4.0.12 → 4.1.0

package/pack/.claude/skills/rite-plan/SKILL.md

@@ -7,34 +7,33 @@ user-invocable: true
 
 # /rite-plan: (re)plan an active feature
 
-Update an existing plan when implementation evidence, drift, or a user decision makes it
-wrong. **Read the active workspace first.** If `.devrites/ACTIVE` is empty or its workspace
-is missing, stop and tell the
-user to run `/rite-spec <feature>`. **Revise mode is artifact-only**: reconcile
+Update a plan invalidated by evidence, drift, or user decision. **Read the active workspace
+first.** Missing `.devrites/ACTIVE`/workspace stops to `/rite-spec <feature>`. **Revise is
+artifact-only**: reconcile
 `spec.md` / `architecture.md` / `plan.md` / `tasks.md` / `traceability.md` without
 editing source code.
 
 ## Rules consulted (read on demand from `.claude/skills/devrites-lib/reference/standards/`)
 Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD criteria.
+Load `repository-topology.md`, `data-integrity.md`, or `integration-reliability.md`
+when the spec applicability map or observed drift triggers them.
 
 ## Operating rules
 - Update the spec when needed, but never plan around a known-wrong assumption.
-- If a change alters product behavior, scope, architecture, data model, UX, security,
-  or migration risk → search facts first, then route the human-owned contract decision
-  through `/rite-clarify` (using the Spec Drift Guard). Reversible technical repair is
-  agent-owned and must not become a question.
+- For product behavior, scope, architecture, data, UX, security, or migration changes,
+  search facts then route human-owned contract decisions through `/rite-clarify`/Drift
+  Guard. Reversible technical repair is agent-owned, not a question.
 - Keep each slice small enough for one focused build → prove cycle.
-- **Slice count is derived, never dictated:** reslice when a slice fails the sizing rule
-  (multiple "and"s, can't build+prove in one cycle), not to hit a user-named tally. A
-  requested count is a hint at most; slice logically and explain if it differs. See
-  [`reference/slicing.md`](reference/slicing.md) ("How many slices?").
+- **Derive slice count:** reslice when work cannot build+prove in one cycle, not to hit a
+  requested tally. Treat counts as hints and explain honest differences; see
+  [`slicing.md`](reference/slicing.md).
 - **Size by complexity, order by dependency.** A slice carries a `Complexity: N/5` score (from
   `/rite-define`); a slice scoring **>3** is a reslice trigger unless its inline reason justifies
   the irreducible complexity. Honor each slice's `depends_on:`: the next *buildable* slice is the
   lowest pending one whose dependencies are all built. This preserves one-slice-at-a-time execution.
 - **Root writes; drafter proposes.** Follow
   [`agents.md`](../devrites-lib/reference/standards/agents.md). The controlling chat owns
-  human questions, decisions, reconciliation, and all planning-artifact writes.
+  human questions, decisions, reconciliation, and planning writes.
 - **Nested repair preserves its caller.** When `state.md` contains a valid
   technical-backtracking return cursor, preserve any valid return cursor
   byte-for-byte. `/rite-vet` is the next internal prerequisite, not a command to
@@ -47,12 +46,9 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
 1. Read `spec.md`, `decision-coverage.md`, `plan.md`, `tasks.md`, `state.md`, `drift.md`,
    `eng-review.md`, and the current `git diff` (if a repo). Read `decisions.md` and
    `assumptions.md`. Require `Decision coverage: CLEAR`; otherwise STOP → `/rite-clarify`.
-   If a code-intelligence
-   index is available: `codebase-memory-mcp` first, cross-checked with `codegraph`
-   (`.codegraph/` / `codegraph_*` tools) + `graphify` (`graphify-out/`), else standard methods
-   (LSP / `Read`/`Grep`/`Glob`); see `.claude/skills/devrites-lib/reference/standards/tooling.md`:
-   prefer it for structural questions (what calls X, what would
-   changing Y break) over reading whole files, to keep planning context lean. For an external
+   Apply `.claude/skills/devrites-lib/reference/standards/tooling.md`: use the
+   primary available structural index, and cross-check only for a named unresolved
+   predicate rather than reassurance. For an external
    dependency's current API surface, consult context7 if available.
 2. **Pick the mode** (`$ARGUMENTS` or infer):
    - **decompose:** first/again break the feature into vertical slices.
@@ -61,41 +57,40 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
    - **reorder:** fix the dependency order.
    - **split:** separate backend/frontend contracts (see `devrites-api-interface`).
    - **unblock:** a verification failed; re-route around the blocker.
-   - **course-correct:** a deliberate mid-build *pivot* (the user changed their mind), distinct
-     from accidental drift: classify the change, assess its impact across the remaining slices,
-     decide rollback vs forward-fix, and update `spec.md` + `plan.md` + `tasks.md` + `decisions.md`
-     atomically. An acceptance/behavior change still goes through the user first. When the plan
-     names an `MVP cut`, offer it as the retreat option: falling back to the cut is a pre-agreed
-     scope, not a new negotiation.
-   - **revise:** apply a requested planning-artifact revision and reconcile existing artifacts in
-     any direction; propose the file edit set first, confirm each file before writing, and **never
-     edit source code**. The sole confirmation exception is explicit `/rite-upgrade` with an
-     admitted `repairable` assessment naming current rule, evidence, gate, exact paths, and
-     delta; it authorizes only that neutral workspace edit, never source or history.
-     **Gate first: revise or new?** Same intent? More than 50% of existing scope
-     survives? original *not* completable without this? Two "no"s → new work: recommend
-     sealing/shipping the current workspace (MVP cut if named) then `/rite-spec` for the new
-     intent, and stop. Revise preserves context; a new workspace separates the work.
+   - **course-correct:** deliberate mid-build user pivot. Classify impact on remaining slices,
+     choose rollback/forward-fix, and update spec/plan/tasks/decisions atomically. Acceptance or
+     behavior still needs the user first; an `MVP cut` is the pre-agreed retreat.
+   - **revise:** reconcile a requested artifact revision; propose/confirm its file set and
+     **never edit source**. Only explicit `/rite-upgrade` with a `repairable` assessment naming
+     rule, evidence, gate, paths, and delta can authorize its neutral workspace edit—not source/history.
+     **Revise or new?** Same intent? >50% scope survives? Original not completable without it?
+     Two “no” answers mean new work: seal/ship current scope (`MVP cut` if named), then
+     `/rite-spec`, and stop.
    See [replan-and-repair](reference/replan-and-repair.md) for each mode's steps.
-2a. **Draft the repair from fresh context.** Freeze the inputs and dispatch
-   `devrites-plan-drafter` in `repair` mode with only the selected mode, affected artifact
-   paths, settled contract, and observed failure/drift. Await one atomic `plan-candidate`;
-   the drafter writes nothing and returns human-owned choices separately.
+2a. **Draft fresh.** Dispatch `devrites-plan-drafter` in `repair` mode with frozen mode,
+   affected artifacts, settled contract, and failure/drift. Await one atomic, read-only
+   `plan-candidate`; human choices return separately.
    When the observed failure is missing or ambiguous consumptive-action evidence,
    require the drafter to apply `one-shot-actions.md` and return the bounded
    diagnostic-amplification design, injective boundary map, per-seam fixtures, and
-   collision mutant. Past evidence loss alone is not a terminal conclusion.
-   The drafter never supplies implementation bodies. Bind the exact active
-   `.devrites/work/<slug>/` targets and complete executable contract; after Vet
-   READY, the controlling root materializes the exact vetted workflow-artifact paths
-   under
+   collision mutant. Past evidence loss is not terminal. The drafter supplies no bodies.
+   Bind exact active `.devrites/work/<slug>/` targets and executable contract; after Vet READY, root
+   materializes the exact vetted workflow-artifact paths under
    [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
    without dispatching the product wright.
 3. Reason about dependencies: [dependency-graph](reference/dependency-graph.md).
+   Reconcile the horizon register against `../rite-define/reference/plan-template.md`.
+   Preserve every `HZN-###` and unresolved item. Cite evidence when reclassifying the earliest
+   honest decision point; resolution or supersession also needs evidence. Never silently delete
+   an item. Planning choices resolve from source evidence or become bounded risk spikes with
+   discriminating criteria and fallback branches; local/checkpoint entries retain their owner,
+   trigger, bounds/fallback, and proof. A new human-owned blocker stops to `/rite-clarify`.
    Reconcile `plan.md`'s canonical `Shared contract proof`: changed provider/consumer
    boundaries keep one reused contract artifact ahead of both asserting tests, and unaffected
    plans retain the specific no-impact statement. Missing, one-sided, duplicated-contract, vague, or
    non-consuming proof routes to `/rite-vet` only after repair.
+   Reconcile the spec applicability map and retain every applicable standard's required
+   topology/data/integration owner, failure/recovery, deployment order, and proof output.
    **Completion:** the slice graph is cycle-free and every dependency names an existing slice.
 4. Re-slice using vertical-slice rules: [slicing](reference/slicing.md) and
    [task-breakdown](reference/task-breakdown.md). Prefer thin, shippable, verifiable.
@@ -106,7 +101,8 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
    the previous vet verdict: set `Phase: plan`, `Next step: /rite-vet`, and, when
    `eng-review.md` exists, set `Implementation readiness: NEEDS REPLAN`. Never retain READY
    across changed planning inputs. Preserve `Plan approved` only for behavior/acceptance-neutral
-   technical repair; clear and reconfirm it when the contract changed. If you stopped for drift,
+   technical repair; clear it for a contract-changing or newly blocking horizon item and
+   reconfirm only after Clarify and Vet close it. If you stopped for drift,
    mark the `drift.md` entry resolved. Never remove or overwrite a valid caller
    return cursor while writing the Plan checkpoint.
 6. If product behavior/acceptance criteria change, confirm through `/rite-clarify` before
@@ -122,7 +118,8 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
    left unjustified), the dependency order is acyclic, every `drift.md` entry you stopped for
    is marked resolved, revised artifacts agree with each other, no source files changed in
    `revise` mode, behavior-change-vs-not is confirmed (`no`, or clarified), and every changed
-   plan ends at `/rite-vet` rather than returning directly to build. The `Shared contract proof`
+   plan ends at `/rite-vet` rather than returning directly to build; horizon IDs stay stable,
+   reclassifications cite evidence, and no unresolved item vanished. The `Shared contract proof`
    table or justified no-impact statement must still match the revised boundary set.
    If any check fails, loop back: don't hand off a half-reshaped plan.
 

package/pack/.claude/skills/rite-plan/reference/dependency-graph.md

@@ -4,7 +4,8 @@ Order slices by what must exist before what. Keep it in `plan.md` as plain text.
 
 ## Build the graph
 1. For each slice, list its hard prerequisites (a model it queries, an endpoint it
-   calls, a component it composes).
+   calls, a component it composes, a contract/schema/config it consumes, or a deployable
+   version that must already tolerate the change).
 2. Draw edges prerequisite → dependent.
 3. Topologically sort. Independent slices can be built in any order (or noted as
    parallelizable for the user).
@@ -24,10 +25,18 @@ Finding drift early is cheap; finding it at seal time is not.
 - A slice with many prerequisites → probably too big; reslice for a thinner cut that
   stands alone.
 - A cycle (A needs B needs A) → the boundary is wrong; split the contract
-  (`devrites-api-interface`) so one side can land with a stub.
+  (`devrites-api-interface`) so one side can land against one canonical contract.
+  Do not hide the cycle with duplicated types, a service locator, or an unowned stub.
 - Everything depends on slice 1 → slice 1 is doing too much.
+- File-disjoint slices share a database migration chain, generated contract, lockfile,
+  queue/port, environment, or deployable → serialize that resource or isolate it explicitly.
 
 ## Cross-boundary edges
 Mark edges that cross a frontend/backend or service boundary. Those slices should
 define the contract first (so both sides can proceed) and trigger `devrites-doubt`
 before standing the interface.
+
+For monorepos/multiple repositories, annotate the proven root and deployable on each node.
+For data/integration changes, include recovery ordering: expand before new writers,
+backfill before contract, consumer compatibility before provider exposure, and monitoring
+before rollout. The graph is incomplete if code order is safe but deploy order is not.

package/pack/.claude/skills/rite-plan/reference/task-breakdown.md

@@ -19,6 +19,8 @@ This reference owns decomposition; the shared schema owns field names and meanin
    provider/consumer boundary, map the plan's `Shared contract proof` artifact before its
    provider- and consumer-side asserting tests; both tests consume that same artifact and
    their slice dependencies preserve the order. Do not duplicate the contract in each slice.
+   For each applicable topology/data/integration row, assign its owner, failure/recovery
+   case, and proof to a slice; preserve deployment/resource ordering from the plan.
 5. Write or update `traceability.md` so every `AC-###` maps to ≥1 `SLICE-###`, a
    planned proof, evidence status, and likely touched files.
 6. Sanity check: every acceptance criterion in `spec.md` maps to ≥1 slice; no slice has

package/pack/.claude/skills/rite-polish/reference/adr-promotion.md

@@ -1,11 +1,11 @@
 # ADR promotion
 
-Promote only durable architecture or interface decisions from `decisions.md`; slice-local
-calls remain in the archived workspace. Do this during Polish before Review. If the
-project has no `docs/adr/`, ask before creating that convention.
+During Polish, promote a `decisions.md` architecture/interface choice only when it is
+hard to reverse, surprising without context, and a real trade-off. Otherwise leave it in
+the archived workspace. If the project has no `docs/adr/`, ask before creating that
+convention.
 
 Write the next append-only `docs/adr/ADR-NNN.md` with Context, Decision, Status
-`accepted`, and Consequences. Never rewrite an accepted ADR; supersede it with a new ADR
-that links the old one. Add every promoted ADR to the authoritative candidate
-manifest, run affected real re-proof, and refresh evidence/browser bindings before
-Review. Ship performs no ADR promotion.
+`accepted`, and Consequences. Never rewrite an accepted ADR; supersede it with a linked
+new ADR. Add it to the candidate manifest, run affected real re-proof, and refresh evidence
+and browser bindings before Review. Ship performs no ADR promotion.

package/pack/.claude/skills/rite-pressure-test/SKILL.md

@@ -7,42 +7,35 @@ user-invocable: true
 
 # /rite-pressure-test: diverge then converge
 
-Use when the *idea* (not just the requirements) is rough. Generate options, then commit
-to one, so `/rite-spec` has a real direction to specify.
-
-A thinking stance, not a build phase: capturing thinking is not implementing. Write
-workspace/ticket artifacts freely; source edits wait for `/rite-build`, via `/rite-spec`.
-
-Read `.claude/skills/devrites-lib/reference/standards/core.md` first: its operating rules (no silent assumptions, prefer
-existing conventions) shape the divergence. The other rule files load on demand.
+Use when the idea—not only requirements—is rough. Compare directions before
+`/rite-spec`; never implement. Read [`core.md`](../devrites-lib/reference/standards/core.md)
+first and write only workspace/ticket artifacts.
 
 ## Diverge (widen)
-- Search the current `decisions.md`, accepted ADRs, and directly relevant archived
-  Markdown for prior rejected directions. Reconsider one only when new evidence answers
-  its recorded reason; cite both the rejection and the new evidence.
-- Generate 3-5 genuinely different approaches to the underlying goal, not variations of
-  one. Cover at least: the obvious approach, a simpler/smaller approach, and a
-  different-shape approach (different data model, flow, or boundary).
-- Generate from **named lenses** so each option exists for a reason, not to pad the count:
-  *inversion* (do the opposite), *constraint-removal* (what if the hard limit vanished),
-  *audience-shift* (build it for a different user), *10×* (what if it had to handle ten times
-  the scale or scope), *expert-lens* (how a specialist in the domain would do it). Borrow the
-  *structure* of an analogous product, not its surface. "Uber for X" copies the veneer, not
-  the mechanism that made it work.
-- For each: one-line description, what it optimizes for, rough cost, main risk.
-- Stay concrete: name real entities, flows, and surfaces, not abstractions.
+- Search `decisions.md`, accepted ADRs, and relevant archives for rejected directions;
+  revive one only with evidence that answers its recorded reason, citing both.
+- Generate 3-5 different shapes, including obvious, smaller, and different-boundary/data/
+  flow options. Use named lenses— inversion, constraint removal, audience shift, 10×, or
+  expert practice—without padding. Borrow analogous mechanisms, not branding.
+- For each, name concrete entities/flows/surfaces, optimization, rough cost, and main risk.
 
 ## Converge (commit)
 - Weigh options against the goal, constraints, and existing codebase conventions.
-- **Painkiller or vitamin?** Score each on whether it removes a real, felt pain (a painkiller
-  users seek out) or is merely nice-to-have (a vitamin they forget). Prefer the painkiller: a
-  vitamin dressed as a painkiller is the most common ideation trap.
-- **Rank the differentiation**, strongest to weakest: a new capability > a 10× improvement > a
-  new audience > a new context > better UX > cheaper. The higher an option sits, the more
-  defensible the direction.
+- Prefer felt pain over nice-to-have. Rank differentiation: new capability > 10× gain >
+  new audience > new context > better UX > cheaper; do not dress a vitamin as a painkiller.
 - Recommend one, with the reason and the key trade-off accepted.
 - Note what would change the recommendation (the decision's hinge).
 
+## Premise evidence floor
+
+If the hinge is an uncertain material fact, freeze at most three questions for
+`devrites-evidence-scout`. Validate every citation; missing/malformed/unverifiable output is
+`unavailable`, never support. Record claim, support, strongest contrary evidence, and
+`supported | assumption | refuted`. Refutation changes the recommendation; an assumption
+advances only when non-decisive with bounded downside. Weak/conflicting decisive evidence
+returns **Hold** with the resolving evidence, never `/rite-spec`. Do not research preferences
+or reversible implementation choices.
+
 ## Boundaries
 - This is exploration, not specification. Output a **direction**, not a finished spec:
   `/rite-spec` writes the spec.
@@ -60,9 +53,9 @@ existing conventions) shape the divergence. The other rule files load on demand.
 ```
 Done: pressure test complete for <goal>.
 Changed: workspace only
-Evidence: options compared <n>; recommendation <option>; hinge <condition>
-Open: <none | unresolved premise>
-Next: /rite-spec <feature>
+Evidence: options compared <n>; recommendation <option>; hinge <condition>; premises <supported/assumption/refuted + sources>
+Open: <none | unresolved premise and resolving evidence>
+Next: <when supported: /rite-spec <feature>; when Hold: none — requires <resolving evidence>>
 Record: not applicable
 ↻ Hygiene: /clear before starting the lifecycle
 ```

package/pack/.claude/skills/rite-prove/SKILL.md

@@ -34,9 +34,10 @@ Pull these via `Read` when relevant:
   blocks, each scenario (WHEN/THEN) is one observable behavior to walk and prove.
 - `performance.md`: measure first when perf is in scope.
 - `observability.md`: runtime telemetry must be observed to emit.
-- `developer-experience.md`: when the change ships a developer-facing surface (API / CLI / SDK /
-  webhook / config / error messages / getting-started): **measure** the DX scorecard (run the flow,
-  measure time-to-hello-world, and capture verbatim error text), rather than asserting it.
+- `repository-topology.md`, `data-integrity.md`, `integration-reliability.md`: only
+  for applicable spec/plan rows; their required proof cases cannot be replaced by a generic green suite.
+- `developer-experience.md`: for developer surfaces, run the flow and measure TTHW plus exact
+  signal-bearing error text with typed redactions; never assert DX.
 - `definition-of-done.md`: acceptance, proof, gates, scope, rollback/docs.
 - `one-shot-actions.md`: pre-attempt evidence completeness and no-rerun handling for
   consumptive proof actions.
@@ -54,16 +55,11 @@ Pull these via `Read` when relevant:
   Prove owns proof binding, not manifest grammar or candidate hashing.
 - Spec Drift Guard applies: if tests/evidence reveal the spec is wrong, stop and handle
   drift (`rite-build/reference/spec-drift-guard.md`).
-- **Root executes; runner validates; root records; wright fixes.** Use the native
-  fresh-context contract in
-  [`agents.md`](../devrites-lib/reference/standards/agents.md). The root owns exact
-  vetted gate execution, browser capability, the evidence verdict, and canonical
-  writes. The proof runner is read-only and validates immutable logs/artifacts.
-  Every accepted product source/test correction is one bounded
-  `devrites-slice-wright` task, never an inline edit.
-  Exact Vet-ready executable workflow artifacts under the active `.devrites/**`
-  workspace follow `workflow-artifacts.md` and are materialized by the controlling
-  root; they are not product writer work.
+- **Root executes/records; runner validates; wright fixes.** Under
+  [`agents.md`](../devrites-lib/reference/standards/agents.md), root owns vetted gates, browser,
+  verdict, and canonical writes; read-only proof runner checks immutable evidence; each source/
+  test fix is one bounded wright task. Root materializes exact Vet-ready `.devrites/**`
+  executables under `workflow-artifacts.md`; they are not product writer work.
 - **Prove remains the controlling caller during technical backtracking.** Save
   its return cursor, invoke Plan/Vet or bounded remediation inline, consume each
   nested phase boundary, then resume the failed Prove step. Never make the human
@@ -110,8 +106,9 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
 3. **Execute proof against a frozen candidate.** Run
    `devrites-engine check candidate <slug>` before any approved proof and retain
    its exact digest. The root runs only commands declared by `test-plan.md`,
-   byte-for-byte, with exact cwd and prerequisites, capturing exit code and
-   decisive output in secure external scratch. Run the full relevant test suite
+   byte-for-byte, with exact cwd/prerequisites, exit code, and sanitized decisive output per
+   [`security.md` § Secrets](../devrites-lib/reference/standards/security.md#secrets). Never retain
+   raw secrets; lost signal is `cannot_verify` plus a safe manual step. Run the full relevant suite
    plus **build / typecheck / lint**. Then rerun the candidate check: require the
    identical digest and no candidate-source mutation. Reject synthesized or
    substituted commands, malformed manifests, zero-test/skipped/filtered results used as

package/pack/.claude/skills/rite-prove/reference/acceptance-proof.md

@@ -25,6 +25,23 @@ Undefined/unavailable signal: `cannot_verify`, evidence
 `insufficient_spec: <missing fact or evidence surface>`, then Spec Drift; never
 judgment or pass.
 
+## Applicable system-risk proof
+
+Reconcile `spec.md`'s applicability map with the final diff. For each triggered owner:
+
+- `repository-topology.md`: prove commands ran at every affected root and both provider
+  and consumer used the same canonical contract; identify generated/vendor sources.
+- `data-integrity.md`: prove declared invariants plus relevant duplicate/retry,
+  concurrency, interruption/resume, old/new coexistence, tenant isolation, and
+  rollback/forward-recovery cases with recorded scale/counts.
+- `integration-reliability.md`: prove relevant invalid/partial response, auth failure,
+  timeout/unknown outcome, rate limit/outage, duplicate/order, poison/backlog, cache/partition,
+  degradation, and recovery behavior.
+
+An evidence-backed dismissal is valid for an irrelevant case. An applicable case with no
+executable proof surface is `cannot_verify`; do not infer it from an implementation review
+or a mock that cannot produce the risk.
+
 ## Critical-path assertion strength
 
 For regression-Critical, irreversible, and data-loss paths, inject a small break,
@@ -49,3 +66,14 @@ Browser-capture docs/quickstarts when applicable. Write the scorecard to
 
 Exercise/follow every key `plan.md` link in the assembled feature; record each as
 `EVID-###`, or record none declared. An unwired link blocks.
+
+For every critical link, perturb or break the load-bearing input/link and observe the
+promised surface fail. Existence/registration/spy-call evidence is insufficient when a
+different path can coincidentally produce the expected result.
+
+## Baseline and environment claims
+
+Classify a failure as pre-existing or environment-specific only with a dated
+before-candidate result for the same command, working directory, prerequisites, and
+material environment. Otherwise record it as an unresolved candidate result. For time/local
+behavior, bind the instant, time zone, locale, and relevant old/new configuration.

package/pack/.claude/skills/rite-review/SKILL.md

@@ -28,6 +28,8 @@ Pull these via `Read` when the diff demands them:
 - `agents.md`: when to fan out to which review subagent.
 - `security.md`: when input / auth / data / integrations / secrets are in scope.
 - `security-checklist.md`: for the same security-sensitive scope, the compact trust-boundary sweep.
+- `repository-topology.md`, `data-integrity.md`, `integration-reliability.md`: only
+  when the spec applicability map or final diff triggers their ownership/failure/proof checks.
 - `performance.md`: only when perf is relevant or a regression risk is visible.
 
 ## Operating rules
@@ -53,10 +55,9 @@ Pull these via `Read` when the diff demands them:
 1. Read `spec.md`, `tasks.md`, `state.md`, `decisions.md`, `evidence.md`,
    `touched-files.md`, `.devrites/principles.md` (if present: the binding invariants to score
    the diff against), and the `git diff`. For "what would this change break"
-   questions, prefer a code-intelligence index if available (codebase-memory-mcp first,
-   cross-checked with codegraph + graphify, else standard methods (LSP / Read/Grep/Glob); see
-   `.claude/skills/devrites-lib/reference/standards/tooling.md`) over file reads;
-   they answer impact/callers in one call. When a finding hinges on an external library's
+   questions, apply `.claude/skills/devrites-lib/reference/standards/tooling.md`: use
+   the primary available index and cross-check only one named unresolved predicate before
+   falling back to LSP/file search. When a finding hinges on an external library's
    current API, context7 if available can confirm the signature. Run
    `devrites-engine check candidate <slug>` and require its digest to match the
    single `evidence.md` binding and the `browser-evidence.md` binding when that

package/pack/.claude/skills/rite-review/reference/five-axis-review.md

@@ -11,11 +11,15 @@ is complete, and to scope anything the agent could not (e.g. UI-only lenses belo
 - Do tests exist for the changed behavior, and do they prove the acceptance criteria?
 - Would they fail if the code were wrong? (No assertion-free or tautological tests.)
 - Edge cases: empty, boundary, error, permission-denied, concurrency.
+- Applicable data/integration/topology cases use a risk-capable boundary; no
+  risk-erasing mock, one-tenant isolation claim, or one-root proof for another root.
 
 ## 1. Correctness
 - Does it do what the spec says? Off-by-one, null/undefined, error paths, race
   conditions, incorrect assumptions about inputs.
 - Does it handle the states the slice promised (loading/empty/error for UI)?
+- Does retry/interruption converge without duplicate effects; do partial/unknown external
+  outcomes, migrations, old/new versions, tenant scope, and rollback follow the accepted plan?
 
 ## 2. Readability
 - Can the next engineer understand it without the author? Naming, function length,
@@ -35,6 +39,8 @@ is complete, and to scope anything the agent could not (e.g. UI-only lenses belo
   dispatcher, separate orchestration from business logic, move feature logic to its owning
   package, delete a pass-through wrapper, split a large file. Prefer the move that removes
   moving pieces over one that re-centralizes the same complexity.
+- Are repository/deployable roots, canonical contract and mutable-state owners, shared
+  resources, and synchronous/asynchronous consistency boundaries preserved without a cycle?
 
 ## 4. Security
 - Trust boundaries, input validation, authz checks, secrets handling. Hand off to

package/pack/.claude/skills/rite-review/reference/security-review.md

@@ -12,7 +12,8 @@ This is the **single-sourced OWASP-web checklist** both `/rite-review` and the
 - **Injection:** parameterized queries; no string-built SQL/shell/HTML; validate &
   encode at boundaries.
 - **Broken access control:** every sensitive action checks authz server-side; no
-  trusting client-supplied IDs/roles; no IDOR.
+  trusting client-supplied IDs/roles/tenant; no IDOR, cross-tenant read/write/cache/search,
+  confused-deputy path, or privilege change without re-authorization.
 - **Auth / session:** secure session handling; no credentials in code/logs; correct
   password/token handling.
 - **Sensitive data:** PII/secrets not logged or returned; encryption where required;
@@ -21,8 +22,12 @@ This is the **single-sourced OWASP-web checklist** both `/rite-review` and the
   untrusted input into requests.
 - **Misconfiguration:** safe defaults; debug off; CORS scoped; security headers as the
   project uses them.
+- **Files / request integrity:** resolved paths remain below the allowed root across
+  traversal/encoding/symlink/archive cases; state-changing browser requests use the
+  framework's forgery protection; CORS is not treated as CSRF defense.
 - **Vulnerable dependencies:** new/updated deps audited; no known-vuln versions added.
-- **Integrity / deserialization:** don't deserialize untrusted data unsafely.
+- **Integrity / deserialization:** safe non-executable parsing with type/size/depth limits;
+  untrusted data cannot instantiate executable objects.
 
 ## Trust boundary
 Apply the three-tier discipline (untrusted → boundary → trusted) per the canonical rule

package/pack/.claude/skills/rite-seal/reference/final-evidence.md

@@ -18,6 +18,9 @@ discriminating shell/golden/text assertions remain valid for textual or CLI acce
 
 Require built slices, resolved or accepted findings, no drift/open validating
 question, required UI/boundary proof, and an exact doubt verdict per stood decision.
+Reconcile the final diff with the spec applicability map. Every triggered topology,
+data, integration, security, and delivery owner needs its relevant observed failure/
+recovery evidence or an evidence-backed dismissal; a generic green suite cannot close it.
 
 ## Candidate binding and test integrity
 

package/pack/.claude/skills/rite-seal/reference/risk-and-rollback.md

@@ -4,25 +4,40 @@ Before GO, know how to undo the change and what could go wrong in production.
 
 ## Risk scan
 Rank risks; for each, note likelihood × impact and any mitigation:
-- **Data**: schema changes, data migration, destructive operations, backfills.
+- **Topology/ownership**: affected roots/deployables, shared contracts/state/resources,
+  dependency cycles, and intermediate deployment combinations.
+- **Data**: schema changes, migration/backfill interruption, concurrent/duplicate writes,
+  tenant/retention boundaries, destructive operations, and invariant reconciliation.
 - **Security**: new trust boundaries, auth/authz changes, secret handling, new deps.
 - **Compatibility**: API contract changes, breaking changes for existing clients,
   feature interactions.
-- **Operational**: new external dependency, config/env requirements, rate limits.
+- **Integration/operational**: timeouts/unknown outcomes, retry/idempotency, duplicate/order,
+  partial/invalid responses, provider/queue/cache outage, config/env, and rate limits.
+- **Delivery**: schema/config/application/worker/flag order, environment mismatch,
+  monitoring gap, exposure stages, and time to detect/recover.
 - **UX**: changed flows users rely on; unverified UI.
 
 ## Rollback plan (required for risky changes)
 For each risky step, state how to back it out:
 - **Migrations**: is there a reversible `down` / a documented manual revert? Is data
-  loss possible on rollback?
+  loss possible on rollback? If rollback is unsafe, is bounded forward recovery rehearsed?
 - **Feature flag**: can it be disabled without a deploy?
 - **Revert boundary**: can the change be `git revert`-ed cleanly, or does it entangle
   with other work?
 - **Data**: is there a backup / a way to restore prior state?
+- **External/async effects**: can an unknown outcome be reconciled without duplicating it;
+  who drains/replays/quarantines work and repairs partial state?
+- **Configuration/deployables**: what order restores compatible versions and values at
+  every root/environment?
 
 ## Blocking rules
 - A **destructive or data-migration change with no rollback plan** is a **NO-GO**.
-- A new external dependency with no failure handling is at least **Important**.
+- A data change with unknown invariant/tenant impact, no interruption/retry proof, or no
+  rollback/forward-recovery rehearsal is **NO-GO**.
+- A new/changed external or asynchronous boundary with blind retry, silent partial success,
+  or no outage/backlog recovery and monitoring is **NO-GO**.
+- Unsafe intermediate deployment order, unvalidated required configuration, or no watched
+  rollout signal/owner is **NO-GO** for live exposure.
 - Record the chosen rollback path in `seal.md` → "Rollback / Recovery".
 
 ## Fresh-context availability