devrites 4.0.12 → 4.2.0

package/pack/.claude/skills/rite-autocomplete/reference/stop-conditions.md

@@ -1,124 +1,92 @@
-# Stop conditions: when autocomplete must pause for a human
-
-On these conditions, write `state.md` (`awaiting_human` or `blocked`), report
-the reason and one resume command when an actual human/safety/access action can
-change the state, notify if configured, and stop. Exhausted agent-owned
-technical recovery is terminal for its unchanged causal fingerprint: record
-`Next step: none` and no runnable recovery command. `--ship` cannot bypass them.
-Closure of a prior fingerprint is progress, not exhaustion. A separately evidenced
-Critical/Important failed invariant starts its own bounded fingerprint; it never
-resets or extends the budget of the one just closed.
-
-An exhausted consumptive-action authorization is not technical-recovery
-exhaustion. It blocks another real action, but retained evidence of a new
-Critical/Important fingerprint must enter offline caller-owned recovery while its
-own no-progress budget remains. After affected Vet is READY, pause for fresh action
-authorization; never execute from the old GO.
-
-## Always stop (irreversible-risk list: from `afk-hitl.md`)
-
-Regardless of `allow_gates` or `--ship`:
-- Destructive data migration (drop column/table, irreversible backfill).
-- Auth / authz boundary change.
-- Public-API break (response shape, removed endpoint, changed status semantics).
-- External-service contract change.
-- Filesystem destruction outside the workspace.
-
-Red checks are hard non-advance gates. Run bounded `devrites-debug-recovery`;
-on exhaustion, stop as a technical blocker unless human-owned.
-
-## Not a stop: agent-owned backtracking
-
-`NEEDS_REPLAN` is not a stop condition under an active Autocomplete caller. It
-blocks forward advancement, persists the return cursor, and immediately routes
-Plan repair plus Recovery Vet. The same applies to any intermediate nested
-`STOP`/`Next step` whose underlying decision is agent-owned.
-
-Agent-owned backtracking is not a stop condition while its causal-fingerprint
-budget remains. The active caller invokes the earlier phase inline, follows Vet
-and any bounded remediation, then resumes the originating phase. Persist
-`Next step` for crash recovery, but do not surface it as a command the human must
-submit. Use the repaired finding's narrow Vet recheck to distinguish resolution,
-the same decisive failure, and a genuinely new Critical/Important invariant.
-Stop only after three no-progress attempts on the exact same fingerprint or when
-the remaining choice is a real human/safety/access gate.
-
-On technical exhaustion, preserve the fingerprint, reproduction, attempts, and
-dead ends, then stop without `/rite-plan unblock` or another phase command.
-Reinvocation with unchanged evidence remains blocked and does not reset the cap.
-Here `unchanged` means the same fingerprint already has three recorded
-no-progress corrections. A retained fingerprint with remaining offline budget is
-not terminal merely because `state.md` was written by the failed action or a prior
-session ended.
-
-A pre-ownership workflow-artifact writer stop is not unchanged evidence when the
-current contract supplies controlling-root materialization. Prior drafter/wright refusals do not count
-as root materialization attempts. Reopen only when exact paths and executable
-behavior passed Vet and there is **no controlling-root materialization attempt**;
-record the routing migration so it cannot reset again. Missing product slices,
-unresolved protocol choices, or a recorded root attempt remain under their normal
-gate/fingerprint rules. The first controlling-root failure is not exhaustion: it
-is the first no-progress result for the materializer fingerprint. If all targets
-still equal their recorded preimages, no real action ran, and only admitted bound
-temporaries remain, reopen an incorrectly persisted one-shot `1/1` terminal,
-preserve its evidence as attempt one, clean/repair/preflight offline, and continue
-within the shared three-attempt cap.
-
-Past evidence being irretrievable is not by itself terminal. When an in-scope
-trusted diagnostic seam can make the next retained fingerprint uniquely
-actionable, Autocomplete must run diagnostic-amplification Plan repair and narrow
-Vet inline, then pause for a fresh GO before the single evidence-acquisition
-attempt. Use `Next: none` only after proving no safe in-scope amplification seam
-exists, a real human/risk/scope gate owns it, or bounded recovery is exhausted.
-
-## Stop on gate severity
-
-- `blocking` gate fires → synchronous pause.
-- `escalating` gate fires → pause, route to the specialist tag.
-- Any `questions.md` entry with `gate: validating` and `status: open` → pause (it is a
-  seal NO-GO by definition; stop before reaching seal).
-
-## Stop on strategic-review scope expansion (`/rite-temper`)
-
-- Any `expand` or added acceptance criterion pauses regardless of
-  `allow_gates`/`--ship`. Only `hold-rigor` and `reduce-to-MVP` auto-apply;
-  skipped low-stakes specs and those two modes do not pause.
-
-## Stop on incomplete decision coverage (`/rite-clarify`)
-
-- Stop on any material Partial/Missing/unowned row or low-confidence, high-consequence
-  assumption. Continue the up-front window with the next genuine decision packet; never arm
-  AFK or carry it into build. Resolve facts and reversible choices automatically.
-
-## Stop on workflow state
-
-- **NO-GO at seal** → stop; surface every blocker with `file:line` and the fix
-  direction. Do not round NO-GO up to GO.
-- **Spec Drift Guard fires** (`/rite-build` finds the plan is wrong and the change
-  alters product behaviour) → stop; route through `/rite-plan repair`.
-- **Budget exhausted with slices still pending:** any validated root-owned remaining
-  value of zero stops before the next dispatch. Report which bound won (pre-existing
-  remaining value, explicit flag, sentinel cap, or post-vet pending count) and the
-  unbuilt slices. A malformed value also fails closed. Zero with no pending slices is
-  normal completion → continue to `/rite-prove` without pausing.
-- **Still low-confidence after the interview:** the idea can't be pinned to testable
-  acceptance criteria → stop and ask, rather than guessing the product.
-- **Repeated failure:** bounded recovery exhausts → stop with reproduction.
-
-## The final type-GO
-
-- `--ship` / `--yolo` never authorizes Git. Continue through ship preflight,
-  disclose the exact plan, then stop for literal `GO` and native approval.
-- Without either flag, stop at seal GO with `/rite-ship` as the resume command.
-  Seal GO, AFK, prior approval, and flags never satisfy ship approval.
-
-## How to stop well
-
-State must be enough for a fresh agent to resume cold:
-- `state.md`: `Status`, the blocking reason, and either a single actionable
-  `Next step` command or the terminal `none — technical recovery exhausted`
-  marker.
-- The relevant `questions.md` / `drift.md` / `seal.md` entry that explains the pause.
-- A one-line user-facing message: *what* stopped it and, only when one exists,
-  *what human-owned action* resumes. A terminal technical blocker names no
-  routine Plan/Vet/retry command.
+# Stop conditions: when autocomplete pauses
+
+On a real stop, write `state.md` as `awaiting_human` or `blocked`, persist the
+reason, and include one resume command only when an actual human/safety/access
+action can change it. Exhausted agent-owned recovery records terminal
+`Next step: none` and no runnable recovery command. `--ship` never bypasses a
+stop.
+
+Authority: `.claude/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → keep Plan repair/affected Vet internal; no stop solely for topology/count.
+- `GUARD_AND_REPAIR` → enter Spec Drift Guard/Clarify; pause only at an existing human-owned gate; resume Plan/Vet internally.
+- `BLOCKED_INPUT` → no planning writes; stop internal branch; exact diagnostic; recover authority; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+## Always stop
+
+Regardless of flags or AFK ceiling:
+
+- destructive data migration;
+- auth/authz boundary change;
+- public API break;
+- external-service contract change; or
+- filesystem destruction outside the workspace.
+
+Red proof cannot advance. Run bounded Debug Recovery; stop after proven
+exhaustion unless the remaining owner is human.
+
+## Not stops: internal technical routing
+
+`NEEDS_REPLAN` is not a stop condition under active Autocomplete. It blocks
+forward work, persists the return cursor, and invokes Plan repair plus Recovery
+Vet inline. The same applies to nested `STOP`/`Next step` when its decision is
+agent-owned.
+
+Agent-owned backtracking is not a stop condition while the exact causal
+fingerprint has budget. Invoke the earlier phase, affected Vet, remediation, and
+proof; then resume the origin. Stop only after three no-progress corrections of
+that exact fingerprint or a real human/safety/access gate. Preserve reproduction,
+attempts, and dead ends; never offer `/rite-plan unblock` or another routine
+phase command. Reinvocation with unchanged evidence does not reset the cap.
+`unchanged` means the same fingerprint already has three recorded no-progress
+corrections. Closure is progress; a separately evidenced Critical/Important
+invariant starts its own cap and cannot extend the closed one.
+
+Spent consumptive-action authorization is not technical-recovery exhaustion.
+It blocks another execution; retained new Critical/Important evidence still
+enters offline recovery. After affected Vet is READY, pause for fresh action
+authorization and never reuse old GO.
+
+Past evidence being irretrievable is not by itself terminal. If an in-scope
+trusted seam can uniquely discriminate the next failure, run diagnostic-
+amplification Plan repair and narrow Vet inline, then pause for fresh GO before
+one evidence-acquisition attempt. Use terminal none only when no safe in-scope
+seam exists, a real human/risk/scope gate owns it, or bounded recovery is
+exhausted.
+
+<!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"classifier returns owner-busy, exhausted, or existing hard gate","action":"stop on exact WAIT_ACTIVE_OWNER, BLOCKED_EXHAUSTED, or BLOCKED_GATE result","return":"unchanged cursor plus fixed route-owned output"} -->
+## Other stop classes
+
+- **Gate severity:** blocking or escalating gate; any open validating question.
+- **Temper:** any `expand` or added acceptance criterion. `hold-rigor`,
+  `reduce-to-MVP`, and a justified skip do not pause.
+- **Clarify:** material Partial/Missing/unowned decision coverage or a
+  low-confidence high-consequence assumption. Continue the initial interview;
+  never arm AFK early.
+- **Seal:** NO-GO, with every blocker and fix direction. Never round up to GO.
+- **Reslice:** execute its marked action before deciding continue/stop.
+- **Slice budget:** any validated root-owned remaining value of zero stops before the next dispatch
+  when slices remain; malformed state also stops. Report whether the winning
+  bound was the pre-existing remaining value, explicit flag, sentinel cap, or post-vet pending count.
+  Zero with no pending slices is normal completion and proceeds to Prove.
+- **Resource envelope:** missing/malformed/expired AFK, overlapping run,
+  exhausted/unobservable declared agent/token/cost/time headroom, or review queue
+  above cap. At cap, only queue-reducing reconciliation may run. Persist winning
+  bound and observed usage; a new activation does not reset durable budgets or
+  expiry.
+- **Confidence:** intent still cannot become testable acceptance after interview.
+- **Repeated failure:** the exact fingerprint's bounded recovery is exhausted.
+
+## Final GO and durable stop
+
+`--ship`/`--yolo` never authorizes Git. With a flag, complete Ship preflight,
+disclose the exact plan, and stop for literal `GO` plus native approval. Without
+one, stop at Seal GO with `/rite-ship`. Seal GO, AFK, prior approval, and flags
+never satisfy Ship approval.
+
+A cold-resumable stop records `state.md` status, exact reason, and either one
+human-owned resume action or `none — technical recovery exhausted`; the owning
+question/drift/seal entry explains it. The user-facing line says what stopped
+and, only when applicable, what human action resumes it.

package/pack/.claude/skills/rite-build/SKILL.md

@@ -8,86 +8,64 @@ user-invocable: true
 # /rite-build: one verified slice
 
 Build and prove one slice. HITL stops; a later user invocation starts the next.
-Explicit `.devrites/AFK` alone lets the controlling root chain pending slices,
-only under existing green-proof, cap, and pause rules. **Read the active workspace
-first**; if none, tell the user to run `/rite-spec <feature>`.
+Explicit `.devrites/AFK` alone lets the controlling root chain pending slices
+under green proof, caps, and pause rules. Every wright returns after it. Read the
+active workspace first; without one, route `/rite-spec <feature>`.
 
-The root owns gates/workspace; a
-fresh-context [`devrites-slice-wright`](../../agents/devrites-slice-wright.md)
-writes product source and tests. Exact Vet-ready executable workflow artifacts use
+Root owns gates/bookkeeping. Fresh
+[`devrites-slice-wright`](../../agents/devrites-slice-wright.md) writes product
+source/tests. Workflow Artifact paths use
 [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md).
-Apply the readiness, selection, host, HITL/AFK,
-dispatch, doubt, fail-on-red, record, and stop checks. See
+Execute [`reference/phase-contract.md`](reference/phase-contract.md); dispatch uses
 [`reference/wright-dispatch.md`](reference/wright-dispatch.md).
 
-## Rules consulted (read on demand from `.claude/skills/devrites-lib/reference/standards/`)
-Read `.claude/skills/devrites-lib/reference/standards/core.md` first. The wright
-reads named on-demand rules while writing; root reads them for doubt/record gates:
-- `coding-style.md`: naming, function shape, guard clauses, comments, reuse-first.
-- `error-handling.md`: fail fast, no silent catches, fail closed.
-- `testing.md`: pyramid, behaviour over implementation, see-it-fail-first.
-- [`reference/tdd.md`](reference/tdd.md): the slice-level Red → Green → Refactor
-  and Prove-It contract.
-- `patterns.md`: composition over inheritance, avoid premature abstraction.
-- `principles.md`: the project invariants (`.devrites/principles.md`) the slice must honor; the wright reads them as **binding**, not priors.
-- `security.md`: when the slice touches user input, auth, data, or external integrations.
-- `definition-of-done.md`: standing Done bar: acceptance mapped, fresh proof, no open hard gates, scoped edits, rollback/docs where needed.
+## Required rules
 
+Read `.claude/skills/devrites-lib/reference/standards/core.md` first. Load only
+rules triggered by the slice:
 
-## Operating rules
-- **One slice per wright dispatch.** Every wright returns after it. The controlling
-  root applies the mode rule above before another dispatch.
-- Evidence over confidence. Prefer existing conventions. Feature scope only: no
-  drive-by refactors.
-- **Record adjacent issues; do not edit them.** An issue outside the exact paths
-  stated in the dispatch task becomes an FYI follow-up in `decisions.md`. The slice summary states
-  what it deliberately left alone ([`git-workflow.md`](../devrites-lib/reference/standards/git-workflow.md)
-  "Things I didn't touch"). The root rejects a returned diff outside this boundary.
-- **Don't re-run an unchanged check.** The same build or test on unchanged code provides
-  no new evidence. Re-verify after an edit.
-- Surface material assumptions. Do not introduce an unplanned dependency or second design
-  system: route the objective plan gap to `/rite-vet` (or bounded recovery), not to a human.
-  Ask only if the newly exposed choice changes licensing/cost/security, product behavior,
-  or an explicit architecture policy. The
-  [Spec Drift Guard](reference/spec-drift-guard.md) is active throughout.
-- **Avoid AI slop while writing.** `devrites-slice-wright` applies the anti-slop charter
-  while writing. The canonical list is `rite-polish/reference/anti-ai-slop.md`; do not
-  duplicate it here. The wright follows project idioms and reuses existing code first.
-  **Verify the charter on return.** Do not correct source from the orchestrator.
-  The **prose you write yourself** (`evidence.md`, `decisions.md`, the slice report) follows
-  the human-voice charter (`.claude/skills/devrites-lib/reference/standards/prose-style.md`; depth in `devrites-prose-craft`): no
-  filler openers or marketing adjectives; preserve exact commands and identifiers.
-- **Honor declared project principles.** The wright reads `.devrites/principles.md` and treats
-  each invariant as **binding** (not a prior to weigh like a convention): a slice it cannot build
-  without breaking one is an **Escalation**, not a silent violation. On return **you verify no
-  principle was broken**; a fresh violation is handled like any irreversible-risk item: a
-  human-approved, scoped exception in the register or a stop, never folded into the slice. No
-  `.devrites/principles.md` → none declared → nothing to honor.
-- **You never edit product source/tests.** You write `.devrites/` bookkeeping and,
-  only through `workflow-artifacts.md`, an exact Vet-ready executable workflow-artifact set.
-  Follow the
-  host gate in `wright-dispatch.md` before every build or recovery dispatch. On a
-  supported host, the wright is the only writer of code and tests. Codex gives
-  the root workspace permission only so that native writer dispatch can execute;
-  never patch code from the root. Put the exact project-relative source/test path
-  list directly in the task, dispatch the exact `devrites-slice-wright`, then
-  compare `git diff --name-only` with those task paths. Any extra source file is
-  a hard STOP.
-- **Executable workflow-artifact branch.** If every implementation target is an
-  exact admitted path under the active `.devrites/work/<slug>/`, the controlling
-  root materializes and proves that atomic set itself. It does not dispatch the wright,
-  decrement/count a product slice, update the candidate manifest, or execute the
-  consumptive action. After narrow Vet, restore the caller cursor.
+- coding style, error handling, testing, [`reference/tdd.md`](reference/tdd.md),
+  patterns, and definition of done;
+- binding `.devrites/principles.md` invariants when present;
+- security for input/auth/data/integrations;
+- repository topology for multiple roots/languages or generated/vendor surfaces;
+- data integrity for durable state, migration, concurrency, tenancy, or retention;
+- integration reliability for API/webhook/queue/job/cache/service boundaries.
 
-## Workflow
+The wright also applies the canonical anti-slop list. Root verifies its return;
+it never patches source itself.
 
-Run the full execution contract in
-[`reference/phase-contract.md`](reference/phase-contract.md). It is not optional:
-it contains the gated one-slice workflow, including readiness, HITL/AFK handling,
-wright dispatch, doubt, fail-on-red, record gates, and stop behavior.
+## Invariants
 
-## Output
+- One slice per wright dispatch; writers are serial. Use the native-worktree pilot
+  only when `wright-dispatch.md`'s clean preflight and reconciliation both hold,
+  otherwise serial same-worktree writing.
+- Exact feature scope only. Record adjacent issues and Things I didn't touch;
+  reject any returned diff outside the task's explicit source/test paths.
+- Never rerun an unchanged check. Re-prove after edits.
+- Unplanned dependency, design system, objective technical gap, or repair stays
+  inside Vet/Spec Drift Guard. Ask only for licensing/cost/security/product or
+  explicit architecture-policy decisions.
+- Root never edits product source/tests. It writes canonical `.devrites/`
+  bookkeeping and applies the Workflow Artifact route only. The supported host's
+  wright is sole product writer. Put exact project-relative paths directly in the
+  task; compare returned file list and `git diff --name-only`; extras hard-stop.
+- Project principles are binding. An unavoidable conflict or irreversible risk
+  needs a human-approved scoped exception or stop, never silent balancing.
+- Evidence beats confidence. Never weaken a failing test, skip TDD, widen a
+  writer, or self-approve a wright return. Route drift through
+  [`reference/spec-drift-guard.md`](reference/spec-drift-guard.md); checkpoint
+  mode follows [`reference/checkpoint.md`](reference/checkpoint.md).
 
-Use [`reference/output.md`](reference/output.md) and the shared
-[`reply contract`](../devrites-lib/reference/reply-contract.md). They keep the
-HITL stop, bounded AFK chaining, and no-automatic-`/rite-prove` boundary explicit.
+## Workflow Artifact branch
+
+<!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"Vet-ready admitted bytes require root authorship outside product wright","action":"ROOT_TRANSACTION; root writes only admitted .devrites/** targets","return":"saved Build slice cursor; wright product allowlist unchanged"} -->
+## Execute and reply
+
+Run every step in `reference/phase-contract.md`: readiness, one target, dispatch
+or canonical transaction, return inspection, independent doubt/test analysis,
+approved fail-on-red proof, record, AFK accounting, and stop. Use
+[`reference/output.md`](reference/output.md) plus the shared
+[`reply contract`](../devrites-lib/reference/reply-contract.md). HITL never starts
+the next slice automatically; AFK chains only within its durable remaining
+budget; Prove starts only after all slices are built.

package/pack/.claude/skills/rite-build/reference/phase-contract.md

@@ -9,33 +9,21 @@ See [`one-slice-cycle.md`](one-slice-cycle.md); candidate lifecycle is
    ID-and-meaning traceability, and green proof preflight; run
    `devrites-engine check readiness <slug>`. Any miss/nonzero stops.
 2. **Select one target.** Restate goal, acceptance criteria, exclusions, and exact
-   source/test paths. Before dispatch, validate relevant `assumptions.md` rows
+   source/test paths. Reconcile the spec/plan applicability map and include only the
+   triggered topology/data/integration standards plus their named failure/recovery/proof
+   cases in the writer contract. Before dispatch, validate relevant `assumptions.md` rows
    against live evidence. If one is disproved and changes acceptance, architecture,
    scope, or proof, use the Spec Drift Guard/plan recovery; a human-owned unknown
    stops. Resolve HITL before source work. AFK answers only permitted gates;
    human-owned or irreversible risk persists a question and stops for `/rite-resolve`.
-   If the target is only an exact Vet-ready executable workflow-artifact set under
-   the active feature workspace, apply
+   If the target is an exact Vet-ready Workflow Artifact set, apply
    [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md)
    instead of treating it as a product slice.
-3. **Dispatch or materialize.** Product source/tests apply [`wright-dispatch.md`](wright-dispatch.md).
+3. **Dispatch or transact.** Product source/tests apply [`wright-dispatch.md`](wright-dispatch.md).
    Put the smallest exact project-relative source/test path list directly in the task;
    dispatch the exact `devrites-slice-wright` fresh. Root never writes those product
    paths, wright never widens, and a missing profile stops.
-   For the workflow-artifact branch, the controlling root writes only the admitted
-   `.devrites/work/<slug>/` paths. Before an active journal or target write, it
-   compiles the materializer and runs the exact transaction implementation in a
-   disposable same-layout fixture covering success, replacement failure, rollback,
-   retained-temporary cleanup, and rerun. It then proves the complete atomic set,
-   rechecks an
-   identical product candidate, records hashes/evidence, and runs narrow Vet. Do not
-   dispatch any agent as a substitute writer and do not charge a product slice.
-
-### Executable workflow-artifact branch
-
-The controlling root materializes the exact admitted workflow-artifact set and
-**does not dispatch the wright**. This branch never changes product slice state or
-the candidate manifest; it returns through narrow Vet before any consumptive action.
+<!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"Build gate enters or resumes transaction","action":"invoke canonical operation table; reconcile exact result","return":"same slice/checkpoint cursor or Plan/Vet route"} -->
 4. **Inspect the return.** Wait; compare its file list and `git diff --name-only`
    with the contract. Reject stale, partial, malformed, or out-of-scope work.
    Preserve user work; source restoration uses the same bounded wright.
@@ -50,6 +38,9 @@ the candidate manifest; it returns through narrow Vet before any consumptive act
    and recheck `git diff --name-only`. Missing, weakened, red, or source-mutating proof
    is not success.
 
+   A failure is `pre-existing` or environment-specific only with a same-command,
+   same-environment baseline predating the candidate; otherwise it remains unresolved.
+
    Technical failure uses bounded `devrites-debug-recovery`: reapply the host gate
    before an accepted in-slice correction, keep one exact fingerprint/three
    no-progress attempts, and never rerun an unchanged check. A closed reproduction

package/pack/.claude/skills/rite-build/reference/wright-dispatch.md

@@ -11,6 +11,32 @@ Claude grants only the exact wright `acceptEdits`; Codex uses its workspace root
 the exact `:workspace` wright, and read-only specialists. Never bypass/substitute
 the wright or recreate an engine bridge.
 
+## Isolated writer-worktree pilot
+
+Use native isolation only when the current host exposes an explicit named-writer
+worktree plus result reconciliation; separate agent threads or inherited sandboxes do
+not qualify. Codex CLI custom subagents therefore use `same-worktree` unless a future
+supported interface passes this capability gate—never create a manual worktree from the
+read-only root to imitate it. Also require `git rev-parse
+--show-superproject-working-tree` to be empty; resolved git/common dirs; committed,
+clean candidate/index; all inputs at `HEAD`; no other writer; and green cheap isolated
+baseline proof. Otherwise use serial same-worktree dispatch—never stash, commit, or
+discard user work to qualify. Ask host for an explicit current-`HEAD` base when
+supported. Regardless of host defaults, the wright's first command must prove actual `git rev-parse HEAD` equals supplied
+`worktree_base`. Mismatch returns a gap with no write before project reads or baseline proof.
+
+The isolated wright returns one local unpushed `transfer_commit`, its `worktree_base`,
+and exact files. Root proves descendant base, exact `git diff --name-only
+<base>..<transfer>`, no `.devrites/**`/submodule/symlink/unrelated delta, unchanged
+source base, and no user-work overwrite. Use only host-native explicit reconciliation;
+never ad hoc copy, cherry-pick, or merge from read-only root. Compare transferred bytes,
+run approved proof, record evidence, then let host remove worktree.
+
+Conflict, extra/missing commit, moved base, or cleanup failure is `gap`/STOP:
+preserve the worktree and commit. Without explicit reconciliation, use same-worktree serial.
+Parallel writer work remains forbidden until this serial pilot measures transfer,
+conflict, proof, and review outcomes on both hosts.
+
 ## Prepare
 
 1. Derive the smallest exact project-relative source/test path list; reject
@@ -20,15 +46,20 @@ the wright or recreate an engine bridge.
    [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
    its rejection here is not a blocker.
 2. Put it in the task with goal, verbatim acceptance, exclusions, context,
-   `test-plan.md` proof commands, and applicable standards.
+   `test-plan.md` proof commands, and applicable standards. For each triggered
+   topology/data/integration standard, include only the feature-specific owner/invariant,
+   failure or partial-state case, recovery rule, and required proof from the vetted plan.
+   Do not paste the whole standard or silently omit an applicable risk.
    A new path requires a new bounded contract; the wright cannot widen the task.
 3. Record `git diff --name-only` before dispatch so unrelated work remains
-   distinguishable.
+   distinguishable. For an isolated pilot, also record committed base SHA and exact
+   baseline status before asking the host for isolation.
 
 ## Run
 
-Ask the host for the exact writer in fresh context and wait. Never run two
-writers in one worktree or substitute a generic agent.
+Ask the host for the exact writer in fresh context and wait. Use at most one writer
+across all linked worktrees for this workspace. Never run two writers in one worktree,
+run isolated and same-worktree writers concurrently, or substitute a generic agent.
 
 ## Inspect and prove
 
@@ -38,6 +69,8 @@ writers in one worktree or substitute a generic agent.
    wright; root never widens scope or edits source.
 2. Inspect the test diff for deletion, skipping, focus markers, or loosened
    assertions. Dedicated test analysis treats weakening as Critical.
+   Confirm a test for a data/integration/topology risk can actually exhibit that risk;
+   mocks that erase it and one-root proof offered for another root are unproven.
 3. Run only repository proof already approved by `test-plan.md`, then inspect
    `git diff --name-only` again in case a proof tool changed source.
 4. Challenge decisions. Human choices return; native diagnosis routes failures.

package/pack/.claude/skills/rite-clarify/SKILL.md

@@ -39,8 +39,9 @@ dispatch uses
    `Spec gate: passed`; otherwise stop at `/rite-spec`. Apply the native cursor
    protocol below before changing workspace artifacts.
 2. **Enumerate the topology.** From the spec, live code, contracts, references,
-   and recorded decisions, list every material actor, journey/component, state,
-   data lifecycle, integration, operation, proof surface, and must-NOT boundary.
+   and recorded decisions, list every material stakeholder/priority, invariant, actor,
+   journey/component, state, data lifecycle, integration, failure/recovery path,
+   operation, proof surface, applicability row, and must-NOT boundary.
 3. **Scan coverage.** Apply `devrites-interview` in clarify mode and mark each
    material surface Clear, Partial, Missing, not-applicable, or justified
    deferred-nonblocking with evidence and an owner. Use native repository search

package/pack/.claude/skills/rite-converge/SKILL.md

@@ -27,9 +27,11 @@ Pull on demand:
 - `spec-grammar.md`: buildable acceptance criteria vs `## Success metrics` (outcome KPIs the
   code can't make true and this pass never enqueues); structured `### Requirement:` /
   `#### Scenario:` blocks, each scenario one behavior to check as built / partial / absent.
-- `tooling.md`: prefer a code-intelligence index (codebase-memory-mcp → codegraph → graphify,
-  else LSP / Read/Grep/Glob) to read the live code, not assumptions.
+- `tooling.md`: use the primary available code index; cross-check only a named unresolved
+  predicate, then fall back to LSP/file search. Read live code, not artifact claims.
 - `testing.md`: a criterion with code but no covering test is *partial*, not done.
+- `repository-topology.md`, `data-integrity.md`, `integration-reliability.md`: only for
+  triggered applicability rows; missing failure/recovery behavior is partial or absent.
 
 ## Operating rules
 - **APPEND-ONLY, never rewrite.** The only write to `tasks.md` is **appending** new

package/pack/.claude/skills/rite-converge/reference/convergence-assessment.md

@@ -25,10 +25,14 @@ slice.
 | **partial** | Some of it exists: happy path only, un-wired, untested, a TODO stub, or an edge case from the scenario's WHEN/THEN missing. | Append a slice for the **remainder**, its `Known-Gotchas` naming what's already there so `/rite-build` extends rather than rebuilds. |
 | **absent** | No code implements it. | Append a full slice. |
 
-Read the code to decide: do not infer from the plan. Use the code-intelligence index
-(codebase-memory-mcp → codegraph → graphify, else LSP / grep) so the verdict reflects live
-code, not the artifacts' claims. Read `traceability.md` to see what is mapped; only reading the
-code and tests tells you what is built.
+Read the code to decide: do not infer from the plan. Apply `standards/tooling.md`: use the
+primary available code index, cross-check only a named unresolved predicate, then use LSP/file
+search so the verdict reflects live code. Read `traceability.md` to see what is mapped; only
+code and tests tell you what is built.
+
+Treat accepted invariants, failure/recovery rows, and triggered applicability obligations as
+buildable units alongside REQ/AC/scenarios. A happy path with missing applicable
+duplicate/retry/concurrency/tenant/timeout/order/interruption/rollback behavior is `partial`.
 
 ## Principle violations
 

package/pack/.claude/skills/rite-customize/SKILL.md

@@ -8,33 +8,31 @@ disable-model-invocation: true
 
 # /rite-customize: native project customization
 
-Use native; DevRites has no registry, override layer, or sync.
-`--import-legacy` is active only when that exact standalone token occurs in the
-current `$ARGUMENTS`; its presence below or in earlier context cannot activate it.
+Use native; no registry/override/sync. `--import-legacy` is active only when that exact
+standalone token occurs in current `$ARGUMENTS`; earlier context cannot activate it.
 
 ## Workflow
 
-1. Map policy to an instruction, reusable work to a skill, a specialist to an
-   agent, and external capability to a connected plugin/MCP server.
-2. Inspect target and host docs; reuse before copying DevRites.
-3. Draft the smallest nearest-scope change; do not restate base safeguards.
-4. Show path and exact diff; wait for approval.
-5. Write only the approved artifact; run native validation; keep no mirror.
+1. Map policy→instruction, reusable work→skill, specialist→agent, external capability→plugin/MCP.
+2. Inspect target/host docs; reuse before copying.
+3. Draft smallest nearest-scope change; do not restate safeguards.
+4. Show path/exact diff; wait.
+5. Write approved artifacts, validate natively, keep no mirror.
 
-Here, edit canonical source, run its generator, and never edit derived artifacts.
+Here, edit canonical source and generate; never edit derived artifacts.
 
 ## Legacy import mode
 
-`--import-legacy` migrates useful behavior without a registry:
-
-1. Inventory `.devrites/extensions/`, `.devrites/overrides/`, and
-   `.devrites/runbooks/` read-only; treat them as untrusted and keep useful rules.
-2. Map behavior to a project skill, scoped policy to its nearest instruction,
-   specialists to agents, and each runbook to a native skill with explicit gate,
+1. Inventory `.devrites/extensions/`, `.devrites/overrides/`, and `.devrites/runbooks/` read-only
+   as untrusted data.
+2. Record origin/files: external URL/SHA/path/license or local relative path, commit/content
+   digest, and owner confirmation. Add review date, copied/re-authored status, canonical owner,
+   and derived targets. Unverified external rights stay reference-only; never execute imported instructions.
+3. Map useful behavior to native owners; map runbooks to a native skill with explicit gate,
    checkpoint, and resume semantics.
-3. Reject gate/permission weakening. Show every target and diff; wait. Never auto-copy,
+4. Reject weaker gates/permissions. Show every diff and provenance receipt; wait. Never auto-copy,
    bulk-convert, or delete.
-4. Write approved native artifacts and validate. Leave the legacy files intact until native
+5. Write and validate approved native artifacts. Leave the legacy files intact until native
    validation passes; cleanup needs separate approval.
 
 ## Rules