devrites 4.0.12 → 4.2.0

package/pack/generated/codex/skills/rite-prove/SKILL.md

@@ -7,168 +7,107 @@ user-invocable: true
 
 # $rite-prove: prove the completed feature
 
-Prove the **whole feature**. Read the active workspace; if absent, run
-`$rite-spec <feature>`.
+Read the active workspace and prove the whole assembled feature once. Without
+one, use `/verify` or `/run`; if any task is pending, stop for `$rite-build`.
+Never report an unobserved pass. After Polish/Review code edits, repeat affected
+criteria and bind evidence to the changed candidate digest.
 
-> **Scope:** `/verify` proves one change; `/run` launches the app. `$rite-prove`
-> walks feature acceptance, relevant suite/build/typecheck/lint, and browser
-> proof, writing evidence under the active workspace. Without one, use
-> `/verify` or `/run`.
+## Rules
 
-## Gate: all slices must be built first
-Read `tasks.md` + `state.md`. If any slice is pending, stop for `$rite-build`.
-This phase proves the assembled feature once, after per-slice tests.
-
-**Never report an unobserved pass.** If a command could not run, report that and give
-exact manual steps.
-
-After polish/review edits, rerun affected criteria/routes so evidence binds the
-changed candidate digest before Seal.
-
-## Rules consulted (read on demand from `.agents/skills/devrites-lib/reference/standards/`)
-Pull these via `Read` when relevant:
-- `testing.md`: pyramid, determinism, no-flake discipline.
-- `test-proof-checklist.md`: compact proof-quality gate for tests and recorded evidence.
-- `browser-proof-checklist.md`: required UI states and Visual Verdict evidence.
-- `spec-grammar.md`: when the spec uses structured `### Requirement:` / `#### Scenario:`
-  blocks, each scenario (WHEN/THEN) is one observable behavior to walk and prove.
-- `performance.md`: measure first when perf is in scope.
-- `observability.md`: runtime telemetry must be observed to emit.
-- `developer-experience.md`: when the change ships a developer-facing surface (API / CLI / SDK /
-  webhook / config / error messages / getting-started): **measure** the DX scorecard (run the flow,
-  measure time-to-hello-world, and capture verbatim error text), rather than asserting it.
-- `definition-of-done.md`: acceptance, proof, gates, scope, rollback/docs.
-- `one-shot-actions.md`: pre-attempt evidence completeness and no-rerun handling for
-  consumptive proof actions.
-- `workflow-artifacts.md`: exact root-owned executable proof/controller/harness
-  artifacts under the active feature workspace.
-
-
-## Operating rules
-- Evidence over confidence. Feature scope only: fix within the feature or record a
-  blocker; don't refactor unrelated code.
-- Apply `testing.md`'s positive, discriminating proof rule to every behavioral claim.
-  A green command without an executing assertion and decisive observed signal is unproven.
-- Follow the shared
-  [`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md).
-  Prove owns proof binding, not manifest grammar or candidate hashing.
-- Spec Drift Guard applies: if tests/evidence reveal the spec is wrong, stop and handle
-  drift (`rite-build/reference/spec-drift-guard.md`).
-- **Root executes; runner validates; root records; wright fixes.** Use the native
-  fresh-context contract in
-  [`agents.md`](../devrites-lib/reference/standards/agents.md). The root owns exact
-  vetted gate execution, browser capability, the evidence verdict, and canonical
-  writes. The proof runner is read-only and validates immutable logs/artifacts.
-  Every accepted product source/test correction is one bounded
-  `devrites-slice-wright` task, never an inline edit.
-  Exact Vet-ready executable workflow artifacts under the active `.devrites/**`
-  workspace follow `workflow-artifacts.md` and are materialized by the controlling
-  root; they are not product writer work.
-- **Prove remains the controlling caller during technical backtracking.** Save
-  its return cursor, invoke Plan/Vet or bounded remediation inline, consume each
-  nested phase boundary, then resume the failed Prove step. Never make the human
-  submit an agent-owned repair, re-vet, or proof-rerun command. Apply `afk-hitl.md`
-  progress accounting: only three no-progress attempts on the exact same fingerprint
-  exhaust recovery; a closed prior finding or a genuinely new
-  Critical/Important fingerprint continues inside this invocation.
+Read the applicable standards: `testing.md`, `test-proof-checklist.md`,
+`browser-proof-checklist.md` for UI, `spec-grammar.md`, `performance.md`,
+`observability.md`, topology/data/integration rules named by the plan,
+`developer-experience.md`, `definition-of-done.md`, `one-shot-actions.md`, and
+`workflow-artifacts.md`. Developer surfaces require an observed flow, measured
+TTHW, and exact signal-bearing errors; never assert DX.
 
+- Evidence over confidence. Apply positive, discriminating proof to every
+  behavioral claim; a green command without executing assertion and decisive
+  signal is unproven.
+- Follow `candidate-integrity.md`. Prove owns proof binding, not candidate
+  grammar/hashing. Spec Drift Guard owns revealed contract drift.
+- Root executes vetted gates/browser and records evidence. A read-only proof
+  runner validates immutable evidence. The sole bounded wright fixes product
+  source/tests; root never does.
+- **Prove remains the controlling caller** during technical backtracking. Save
+  its cursor; run Plan repair, Recovery Vet, remediation, and re-proof inline;
+  consume nested boundaries; resume the failed rung. Recovery exhausts after
+  three no-progress attempts on the exact same fingerprint. Closing one or exposing a distinct
+  Critical/Important invariant is progress, not a reason to hand work off.
+<!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"Prove consumes installed Workflow Artifact or CLEANED rerun","action":"VERIFY_EXISTING or admitted proof path ending PROVE_AND_RETURN","return":"saved Prove cursor; stop before real action"} -->
 ## Released-workspace refresh entry
 
-Only an admitted `$rite-upgrade` assessment that proves a released-format candidate
-defect may enter this branch. Normal Prove never reconstructs candidate scope.
-
-Before proof, require that the legacy touched-file scope, live diff, tasks, and traceability agree unambiguously on every candidate path and state. Missing, unknown, or
-ambiguous scope is a recorded gap and HITL stop; never guess from Git alone. When they
-agree, preserve unrelated `touched-files.md` content and refresh only its strict manifest
-from the currently observed project bytes under the workspace schema.
+Only an admitted `$rite-upgrade` assessment proving a released-format candidate
+defect enters. Require legacy touched-file scope, live diff, tasks, and traceability agree unambiguously
+on every candidate path/state. Missing or
+ambiguous scope stops; never guess from Git. Preserve unrelated manifest content
+and refresh only the strict manifest from observed bytes.
 
-Discard every old pass as proof. Run all current approved real proof from scratch under
-the positive, discriminating rules below, and establish the pre-proof and post-proof engine digest
-with `devrites-engine check candidate <slug>`. Require an identical digest,
-then write one fresh exact binding in `evidence.md` and in `browser-evidence.md` when it
-exists. Historical evidence cannot substitute for any current gate. A current proof
-failure is a blocker; this Upgrade admission never authorizes source or test changes.
+Discard old passes. Run all current approved real proof from scratch. Establish
+pre-proof and post-proof engine digest with `devrites-engine check candidate
+<slug>` and require equality, then write one fresh exact binding in evidence and
+browser evidence. Current failure blocks; Upgrade does not authorize source or
+test changes.
 
 ## Workflow
-0. Read core, load relevant rules above, then resolve the active slug,
-   require its `state.md`, and read the cursor directly. On a blocked Prove cold
-   resume, reconcile any retained consumptive-action artifact against recorded
-   no-progress corrections before accepting `next_action: none`; a distinct
-   fingerprint below its cap resumes offline triage without another real action.
-1. **Confirm all slices built.** Read `spec.md`, `tasks.md`, `state.md`,
-   `test-plan.md`, and the full diff.
-   A missing `test-plan.md` enters caller-owned Vet backtracking; invoke Vet
-   inline and resume this step. It never authorizes ad hoc proof.
-2. **Discover commands** if not recorded:
-   [test-command-discovery](reference/test-command-discovery.md): README, package
-   scripts, Makefile, CI configs, Gemfile/Rakefile, pyproject, go.mod, Cargo.toml.
-   Discovery only supplies evidence. `test-plan.md` is the sole approved runtime
-   command list. If a discovered command is absent from it, do not run or
-   silently approve the command: return to the current Vet contract to add and
-   vet it inline, refresh readiness, then return to Prove without a user handoff.
-   **Completion:** exact commands are approved in `test-plan.md` or unavailable.
-3. **Execute proof against a frozen candidate.** Run
-   `devrites-engine check candidate <slug>` before any approved proof and retain
-   its exact digest. The root runs only commands declared by `test-plan.md`,
-   byte-for-byte, with exact cwd and prerequisites, capturing exit code and
-   decisive output in secure external scratch. Run the full relevant test suite
-   plus **build / typecheck / lint**. Then rerun the candidate check: require the
-   identical digest and no candidate-source mutation. Reject synthesized or
-   substituted commands, malformed manifests, zero-test/skipped/filtered results used as
-   behavioral proof, success inferred only from exit status, and any source drift. Static
-   gates prove only their named static criterion.
-   Immediately before any consumptive action, apply `one-shot-actions.md` to the
-   live candidate: require the vetted retained-artifact identity, bounds,
-   sanitization, injective boundary map, per-seam fault fixtures, collision mutant,
-   terminal-path fixtures, and cleanup-survival proof. A missing,
-   stale, or disposable-only evidence surface returns to Vet inline and consumes
-   no attempt. Record the admitted artifact identity before execution. After a
-   failed consumptive action, triage from that artifact; never reproduce it by
-   rerunning the action. Consuming its authorization blocks only another real
-   execution. If the artifact identifies a new Critical/Important fingerprint,
-   continue offline recovery inside this Prove invocation; do not label the new
-   fingerprint exhausted because the action budget is zero.
-4. **UI feature?** The root applies the browser proof ladder with
-   `design-brief.md`, `references.md`, the requested routes, browser harness, and
-   allowed scratch path:
-   [proof-ladder](reference/proof-ladder.md) + [browser-proof](reference/browser-proof.md)
-   (`devrites-browser-proof`): routes, viewports, screenshots (opened + described),
-   console, network, interaction paths, and the brief's proof targets. Compare screenshots
-   with target references and record deltas. An unresolved material mismatch is a failed
-   result; the root handles any accepted correction at step 7 before re-rendering.
-5. **Validate proof in fresh context.** In parallel, dispatch the exact read-only
-   `devrites-proof-runner` on candidate identity, approved commands, immutable
-   root evidence, and acceptance map, and `devrites-spec-reviewer` on the same
-   candidate. Wait for both; reject missing/stale, invented-ID, label-only, or
-   self-attested evidence. Neither executes commands.
-6. **Map proof completely.** Reconcile both exact verdicts, then follow
-   [`reference/acceptance-proof.md`](reference/acceptance-proof.md) for acceptance/scenario
-   coverage and the conditional critical-path, observability, developer-surface, and wiring
-   branches. Completion: every criterion, planned interaction, and declared key link has a
-   proof class plus positive, discriminating passing evidence, or is recorded as a blocker.
-7. **On failure** → [failure-triage](reference/failure-triage.md) +
-   `devrites-debug-recovery`. The root reconciles the reproduction. Send an accepted,
-   in-scope correction to the sole writer, `devrites-slice-wright`; update the
-   manifest from its actual scoped diff, rerun affected real proof and both
-   candidate checks, then dispatch a fresh proof runner. If a fix would exceed
-   scope, record a blocker.
-   If triage shows an agent-owned durable-plan error, apply the Spec Drift
-   Guard's inline return contract: preserve Prove as the origin, run repair and
-   Vet inside this invocation, and resume the exact failed proof rung. Ask only
-   for a human-owned decision; causal-fingerprint exhaustion stops once with a
-   technical blocker rather than another phase command.
-   For a consumptive-action failure, use fixtures or another non-consumptive
-   reproduction to fix and re-vet the retained fingerprint. Once the failure
-   condition is demonstrably changed, stop at the fresh-authorization boundary;
-   only a new human GO may admit the next real attempt.
-   If the retained fingerprint is missing or ambiguous, the lost past evidence
-   does not prove that no safe future acquisition design exists. Treat an in-scope
-   discriminator as a diagnostic-amplification Plan gap: repair and narrow-Vet the
-   boundary map and collision proof inline, then stop for fresh GO before one
-   evidence-acquisition attempt. Do not guess the runtime fix or reuse the old GO.
-8. The root updates `evidence.md`, `browser-evidence.md` (when present),
-   `traceability.md`, and `state.md`. Record exactly one binding for the observed
-   digest in evidence and browser evidence. New proof goes to canonical
-   `evidence.md`.
 
-> **Mid-flight discipline.** When tempted to claim an un-observed pass, skip a rung of the browser-proof ladder, or proceed with slices pending: see [`anti-patterns`](reference/anti-patterns.md). Load it the moment you reach for the excuse.
+1. **Orient.** Read core, resolve active slug, require `state.md`, and read its
+   cursor. On blocked Prove cold resume, reconcile retained consumptive evidence
+   and no-progress corrections before accepting terminal none; a distinct
+   fingerprint below cap resumes offline triage without another real action.
+2. **Freeze scope.** Read spec, tasks, state, test plan, and full diff. Require
+   every slice built. Missing `test-plan.md` invokes caller-owned Vet and returns
+   here; it never authorizes ad hoc proof.
+3. **Approve commands.** If absent, use
+   [test-command-discovery](reference/test-command-discovery.md) over repository
+   manifests/CI. Discovery is evidence only: `test-plan.md` is the sole approved runtime
+   command list. A newly found command must return to the current Vet contract,
+   refresh readiness, then resume without user handoff.
+4. **Execute a frozen candidate.** Run candidate check and retain its digest.
+   The root runs only commands declared by `test-plan.md`, with exact approved
+   command, cwd, prerequisites, exit, and sanitized
+   decisive output. Run relevant suite plus build/typecheck/lint. Recheck the
+   candidate and require identical digest/no source mutation. Reject substituted
+   commands, malformed manifests, zero-test/skipped/filtered behavioral claims,
+   exit-status-only claims, and source drift. Static gates prove only their named
+   static criterion.
+5. **Gate consumptive actions.** Immediately before execution, apply
+   `one-shot-actions.md`: current retained identity, bounds/sanitization,
+   injective boundary map, per-seam fault fixtures, collision mutant, terminal
+   fixtures, and cleanup-survival proof must be green. Missing/stale/disposable-
+   only evidence returns to Vet without spending an attempt. Record the admitted artifact identity before execution.
+   After failure, retained evidence is the
+   reproduction; never rerun for diagnosis. Spent authorization blocks another
+   action, but when action budget is zero it does not exhaust a newly identified
+   offline fingerprint.
+6. **Prove UI when applicable.** Use design brief/references, browser harness,
+   allowed scratch path, [proof ladder](reference/proof-ladder.md), and
+   [browser proof](reference/browser-proof.md): routes, viewports, opened and
+   described screenshots, console/network, interaction, target comparisons, and
+   every required state. Material mismatch fails.
+7. **Independent validation.** Dispatch exact fresh read-only
+   `devrites-proof-runner` and `devrites-spec-reviewer` on the same candidate,
+   commands, immutable evidence, and acceptance map. Reject missing/stale,
+   invented-ID, label-only, or self-attested reports; neither executes commands.
+8. **Map proof.** Reconcile both verdicts and
+   [acceptance-proof.md](reference/acceptance-proof.md). Every criterion,
+   scenario, interaction, and planned key link gets positive discriminating
+   evidence or a blocker, including applicable critical-path, observability,
+   developer, and wiring branches.
+9. **Recover red.** Use [failure triage](reference/failure-triage.md) and Debug
+   Recovery. Reconcile reproduction; send accepted in-scope source/test correction
+   to the sole wright; update actual manifest; rerun affected proof, both candidate
+   checks, and fresh proof runner. Scope growth blocks.
+
+   Agent-owned durable-plan errors run Spec Drift Guard, Plan, and Vet inline,
+   preserving Prove as origin. Consumptive failures use retained fixtures, repair,
+   and Vet, then stop for fresh GO after changed conditions. Ambiguous retained
+   evidence does not prove that no safe future acquisition design exists: treat
+   an in-scope discriminator as diagnostic-amplification Plan gap, repair its
+   finite map/collision proof, narrow-Vet, then seek fresh GO before one evidence
+   attempt. Never guess the runtime fix or reuse old GO.
+10. **Record.** Root updates `evidence.md`, optional `browser-evidence.md`,
+    traceability, and state, with exactly one observed candidate binding.
+
+> Do not claim an unobserved pass, skip browser proof, or proceed with pending
+> slices. Load `reference/anti-patterns.md` when tempted to do so.

package/pack/generated/codex/skills/rite-prove/reference/acceptance-proof.md

@@ -25,6 +25,23 @@ Undefined/unavailable signal: `cannot_verify`, evidence
 `insufficient_spec: <missing fact or evidence surface>`, then Spec Drift; never
 judgment or pass.
 
+## Applicable system-risk proof
+
+Reconcile `spec.md`'s applicability map with the final diff. For each triggered owner:
+
+- `repository-topology.md`: prove commands ran at every affected root and both provider
+  and consumer used the same canonical contract; identify generated/vendor sources.
+- `data-integrity.md`: prove declared invariants plus relevant duplicate/retry,
+  concurrency, interruption/resume, old/new coexistence, tenant isolation, and
+  rollback/forward-recovery cases with recorded scale/counts.
+- `integration-reliability.md`: prove relevant invalid/partial response, auth failure,
+  timeout/unknown outcome, rate limit/outage, duplicate/order, poison/backlog, cache/partition,
+  degradation, and recovery behavior.
+
+An evidence-backed dismissal is valid for an irrelevant case. An applicable case with no
+executable proof surface is `cannot_verify`; do not infer it from an implementation review
+or a mock that cannot produce the risk.
+
 ## Critical-path assertion strength
 
 For regression-Critical, irreversible, and data-loss paths, inject a small break,
@@ -49,3 +66,14 @@ Browser-capture docs/quickstarts when applicable. Write the scorecard to
 
 Exercise/follow every key `plan.md` link in the assembled feature; record each as
 `EVID-###`, or record none declared. An unwired link blocks.
+
+For every critical link, perturb or break the load-bearing input/link and observe the
+promised surface fail. Existence/registration/spy-call evidence is insufficient when a
+different path can coincidentally produce the expected result.
+
+## Baseline and environment claims
+
+Classify a failure as pre-existing or environment-specific only with a dated
+before-candidate result for the same command, working directory, prerequisites, and
+material environment. Otherwise record it as an unresolved candidate result. For time/local
+behavior, bind the instant, time zone, locale, and relevant old/new configuration.

package/pack/generated/codex/skills/rite-review/SKILL.md

@@ -28,6 +28,8 @@ Pull these via `Read` when the diff demands them:
 - `agents.md`: when to fan out to which review subagent.
 - `security.md`: when input / auth / data / integrations / secrets are in scope.
 - `security-checklist.md`: for the same security-sensitive scope, the compact trust-boundary sweep.
+- `repository-topology.md`, `data-integrity.md`, `integration-reliability.md`: only
+  when the spec applicability map or final diff triggers their ownership/failure/proof checks.
 - `performance.md`: only when perf is relevant or a regression risk is visible.
 
 ## Operating rules
@@ -53,10 +55,9 @@ Pull these via `Read` when the diff demands them:
 1. Read `spec.md`, `tasks.md`, `state.md`, `decisions.md`, `evidence.md`,
    `touched-files.md`, `.devrites/principles.md` (if present: the binding invariants to score
    the diff against), and the `git diff`. For "what would this change break"
-   questions, prefer a code-intelligence index if available (codebase-memory-mcp first,
-   cross-checked with codegraph + graphify, else standard methods (LSP / Read/Grep/Glob); see
-   `.agents/skills/devrites-lib/reference/standards/tooling.md`) over file reads;
-   they answer impact/callers in one call. When a finding hinges on an external library's
+   questions, apply `.agents/skills/devrites-lib/reference/standards/tooling.md`: use
+   the primary available index and cross-check only one named unresolved predicate before
+   falling back to LSP/file search. When a finding hinges on an external library's
    current API, context7 if available can confirm the signature. Run
    `devrites-engine check candidate <slug>` and require its digest to match the
    single `evidence.md` binding and the `browser-evidence.md` binding when that

package/pack/generated/codex/skills/rite-review/reference/five-axis-review.md

@@ -11,11 +11,15 @@ is complete, and to scope anything the agent could not (e.g. UI-only lenses belo
 - Do tests exist for the changed behavior, and do they prove the acceptance criteria?
 - Would they fail if the code were wrong? (No assertion-free or tautological tests.)
 - Edge cases: empty, boundary, error, permission-denied, concurrency.
+- Applicable data/integration/topology cases use a risk-capable boundary; no
+  risk-erasing mock, one-tenant isolation claim, or one-root proof for another root.
 
 ## 1. Correctness
 - Does it do what the spec says? Off-by-one, null/undefined, error paths, race
   conditions, incorrect assumptions about inputs.
 - Does it handle the states the slice promised (loading/empty/error for UI)?
+- Does retry/interruption converge without duplicate effects; do partial/unknown external
+  outcomes, migrations, old/new versions, tenant scope, and rollback follow the accepted plan?
 
 ## 2. Readability
 - Can the next engineer understand it without the author? Naming, function length,
@@ -35,6 +39,8 @@ is complete, and to scope anything the agent could not (e.g. UI-only lenses belo
   dispatcher, separate orchestration from business logic, move feature logic to its owning
   package, delete a pass-through wrapper, split a large file. Prefer the move that removes
   moving pieces over one that re-centralizes the same complexity.
+- Are repository/deployable roots, canonical contract and mutable-state owners, shared
+  resources, and synchronous/asynchronous consistency boundaries preserved without a cycle?
 
 ## 4. Security
 - Trust boundaries, input validation, authz checks, secrets handling. Hand off to

package/pack/generated/codex/skills/rite-review/reference/security-review.md

@@ -12,7 +12,8 @@ This is the **single-sourced OWASP-web checklist** both `$rite-review` and the
 - **Injection:** parameterized queries; no string-built SQL/shell/HTML; validate &
   encode at boundaries.
 - **Broken access control:** every sensitive action checks authz server-side; no
-  trusting client-supplied IDs/roles; no IDOR.
+  trusting client-supplied IDs/roles/tenant; no IDOR, cross-tenant read/write/cache/search,
+  confused-deputy path, or privilege change without re-authorization.
 - **Auth / session:** secure session handling; no credentials in code/logs; correct
   password/token handling.
 - **Sensitive data:** PII/secrets not logged or returned; encryption where required;
@@ -21,8 +22,12 @@ This is the **single-sourced OWASP-web checklist** both `$rite-review` and the
   untrusted input into requests.
 - **Misconfiguration:** safe defaults; debug off; CORS scoped; security headers as the
   project uses them.
+- **Files / request integrity:** resolved paths remain below the allowed root across
+  traversal/encoding/symlink/archive cases; state-changing browser requests use the
+  framework's forgery protection; CORS is not treated as CSRF defense.
 - **Vulnerable dependencies:** new/updated deps audited; no known-vuln versions added.
-- **Integrity / deserialization:** don't deserialize untrusted data unsafely.
+- **Integrity / deserialization:** safe non-executable parsing with type/size/depth limits;
+  untrusted data cannot instantiate executable objects.
 
 ## Trust boundary
 Apply the three-tier discipline (untrusted → boundary → trusted) per the canonical rule

package/pack/generated/codex/skills/rite-seal/reference/final-evidence.md

@@ -18,6 +18,9 @@ discriminating shell/golden/text assertions remain valid for textual or CLI acce
 
 Require built slices, resolved or accepted findings, no drift/open validating
 question, required UI/boundary proof, and an exact doubt verdict per stood decision.
+Reconcile the final diff with the spec applicability map. Every triggered topology,
+data, integration, security, and delivery owner needs its relevant observed failure/
+recovery evidence or an evidence-backed dismissal; a generic green suite cannot close it.
 
 ## Candidate binding and test integrity
 

package/pack/generated/codex/skills/rite-seal/reference/risk-and-rollback.md

@@ -4,25 +4,40 @@ Before GO, know how to undo the change and what could go wrong in production.
 
 ## Risk scan
 Rank risks; for each, note likelihood × impact and any mitigation:
-- **Data**: schema changes, data migration, destructive operations, backfills.
+- **Topology/ownership**: affected roots/deployables, shared contracts/state/resources,
+  dependency cycles, and intermediate deployment combinations.
+- **Data**: schema changes, migration/backfill interruption, concurrent/duplicate writes,
+  tenant/retention boundaries, destructive operations, and invariant reconciliation.
 - **Security**: new trust boundaries, auth/authz changes, secret handling, new deps.
 - **Compatibility**: API contract changes, breaking changes for existing clients,
   feature interactions.
-- **Operational**: new external dependency, config/env requirements, rate limits.
+- **Integration/operational**: timeouts/unknown outcomes, retry/idempotency, duplicate/order,
+  partial/invalid responses, provider/queue/cache outage, config/env, and rate limits.
+- **Delivery**: schema/config/application/worker/flag order, environment mismatch,
+  monitoring gap, exposure stages, and time to detect/recover.
 - **UX**: changed flows users rely on; unverified UI.
 
 ## Rollback plan (required for risky changes)
 For each risky step, state how to back it out:
 - **Migrations**: is there a reversible `down` / a documented manual revert? Is data
-  loss possible on rollback?
+  loss possible on rollback? If rollback is unsafe, is bounded forward recovery rehearsed?
 - **Feature flag**: can it be disabled without a deploy?
 - **Revert boundary**: can the change be `git revert`-ed cleanly, or does it entangle
   with other work?
 - **Data**: is there a backup / a way to restore prior state?
+- **External/async effects**: can an unknown outcome be reconciled without duplicating it;
+  who drains/replays/quarantines work and repairs partial state?
+- **Configuration/deployables**: what order restores compatible versions and values at
+  every root/environment?
 
 ## Blocking rules
 - A **destructive or data-migration change with no rollback plan** is a **NO-GO**.
-- A new external dependency with no failure handling is at least **Important**.
+- A data change with unknown invariant/tenant impact, no interruption/retry proof, or no
+  rollback/forward-recovery rehearsal is **NO-GO**.
+- A new/changed external or asynchronous boundary with blind retry, silent partial success,
+  or no outage/backlog recovery and monitoring is **NO-GO**.
+- Unsafe intermediate deployment order, unvalidated required configuration, or no watched
+  rollout signal/owner is **NO-GO** for live exposure.
 - Record the chosen rollback path in `seal.md` → "Rollback / Recovery".
 
 ## Fresh-context availability

package/pack/generated/codex/skills/rite-ship/reference/rollout.md

@@ -1,43 +1,62 @@
-# Staged rollout & rollback: when the ship includes a live deploy
-
-Opt-in. `$rite-ship`'s job ends at the git ladder (commit → push → tag / PR) and archiving the
-workspace; most projects deploy from CI on merge, and their pipeline owns the rollout. Reach for
-this reference only when the ship *itself* drives a live, staged production rollout the agent is
-responsible for. When it doesn't apply, skip it: the same no-op discipline as the rest of the pack.
-
-The governing idea is the one already in [`git-workflow.md`](../../devrites-lib/reference/standards/git-workflow.md) and
-[`deprecation.md`](../../devrites-lib/reference/standards/deprecation.md): **a launch is only done when it's reversible,
-observable, and incremental.** Write the rollback plan *before* you deploy, not after it breaks.
-
-## The rollback plan is a pre-condition
-Before the first byte ships, the plan exists, with a measured **time-to-rollback** per mechanism:
-feature flag < 1 min, redeploy < 5 min, DB rollback < 15 min. If the fastest reversal is slow, that
-is a launch risk to fix (add a flag) before shipping, not after. A destructive/migration step ships
-only with its rollback proven (expand→contract, [`deprecation.md`](../../devrites-lib/reference/standards/deprecation.md)).
-
-## Advance on evidence: the rollout decision thresholds
-Stage the exposure and, at each stage, read the signals ([`observability.md`](../../devrites-lib/reference/standards/observability.md))
-against a fixed table: advance on green, hold on yellow, roll back on red. Don't eyeball it.
-
-| Signal | Green (advance) | Yellow (hold, investigate) | Red (roll back now) |
-|---|---|---|---|
-| Error rate | within ~10% of baseline | 10-100% over baseline | > 2× baseline |
-| p95 latency | within ~20% of baseline | 20-50% over | > 50% over |
-| Client JS errors | none new | < 0.1% of sessions | > 0.1% of sessions |
-| Business metric on the path | neutral or up | < 5% decline | > 5% decline |
-
-## Stage the exposure, with a monitoring window at each step
-Internal/team → canary ~5% (hold 24-48h) → 25% → 50% → 100%, advancing only when **all** thresholds
-are green and you can still roll back to the previous percentage at any point. Data integrity or a
-security regression is an **immediate** rollback regardless of the table.
-
-## Feature-flag hygiene
-Every flag has an owner and an expiry; test both states in CI; don't nest flags (state explodes);
-remove the flag and its dead branch within ~2 weeks of full rollout: a lingering flag is the
-deprecation debt [`deprecation.md`](../../devrites-lib/reference/standards/deprecation.md) exists to prevent.
-
-## Verify in the first hour (a runbook, not a vibe)
-Health endpoint returns 200 · the error dashboard is flat · latency within budget · one critical
-user flow driven by hand · logs/metrics/traces flowing ([`observability.md`](../../devrites-lib/reference/standards/observability.md)
-"verify the telemetry fires") · a rollback dry-run confirmed reversible. Record the observations in
-`ship.md` / `evidence.md`: an un-watched launch is an unproven one.
+# Staged rollout and recovery: live deploys only
+
+Load this only when `$rite-ship` itself is explicitly authorized to drive a live
+deployment. Git-only Ship stops before rollout; CI-owned deployment follows the pipeline's
+runbook. A Seal GO or AFK setting never authorizes production action.
+
+## Preconditions before exposure
+
+Record one rollout sheet in `ship.md`/`evidence.md`:
+
+| Item | Required decision/evidence |
+| --- | --- |
+| Units and order | Repository/deployable, schema, config, application, worker, contract, and flag order; safe old/new combinations. |
+| Exposure stages | Project-native internal/canary/cohort/percentage/region stages and hold window. |
+| Advance/hold/abort signals | Project baseline or SLO, measurement window, minimum sample, exact threshold, and owner. |
+| Recovery | Fastest safe mechanism, steps, owner, measured/rehearsed time, and data/external-effect reconciliation. |
+| Observability | Watched dashboard/query/alert, failure signal, and executable first action. |
+| Authorization | Exact target/action approved for this attempt; no inferred retry permission. |
+
+Do not import generic percentage, latency, error-rate, or time-to-rollback numbers. Use
+accepted product risk, current baseline/SLO, traffic volume, and platform capability. If the
+project has no defensible threshold or signal, the monitoring gap blocks live exposure.
+
+## Choose the smallest reversible mechanism
+
+- A feature flag is useful only when the off path preserves current behavior, both states
+  are tested, disabling it stops the risky effect, and it has an owner/removal trigger.
+  Do not add a flag to a change already reversible by a safe atomic deploy.
+- A flag cannot reverse destructive data/schema effects. Apply
+  [`data-integrity.md`](../../devrites-lib/reference/standards/data-integrity.md) and prove
+  restore or forward recovery separately.
+- External APIs, webhooks, queues, jobs, and caches apply
+  [`integration-reliability.md`](../../devrites-lib/reference/standards/integration-reliability.md):
+  reconcile unknown outcomes, drain/quarantine/replay safely, and protect downstream capacity.
+- Multi-root/service rollout follows
+  [`repository-topology.md`](../../devrites-lib/reference/standards/repository-topology.md);
+  references to another repository never grant write/deploy authority there.
+
+## Stage, observe, decide
+
+At each authorized stage:
+
+1. Verify the intended versions/config/schema and candidate identity on the exact target.
+2. Exercise one critical success path and the declared degradation/recovery signal.
+3. Observe for the recorded window and sample; bind results to the stage and baseline.
+4. **Advance** only when every advance condition holds. **Hold** on ambiguous or
+   insufficient evidence. **Abort/recover** immediately on an abort condition, security or
+   tenant breach, data-integrity violation, unreconciled duplicate/unknown effect, or loss of
+   observability.
+5. Re-verify after recovery; record partial effects and reconciliation. A rollback command
+   exiting zero is not proof the prior state or data was restored.
+
+Never compress stages because an early sample "looks fine," continue through a monitoring
+gap, or retry a failed live action without fresh authorization when the attempt/target changes.
+
+## Completion
+
+Rollout is complete only when full intended exposure meets the recorded window/signals,
+telemetry is still watched, migrations/backfills and queues/reconciliation are settled,
+documentation matches deployed behavior, and temporary flags/compatibility paths have a
+dated removal owner. Otherwise report the exact current stage and remaining risk; do not call
+the launch done.

package/pack/generated/codex/skills/rite-spec/SKILL.md

@@ -19,6 +19,10 @@ declared invariants; an unavoidable principle violation is blocking.
 For behavioral/high-risk acceptance, use `spec-grammar.md` plus workspace schema;
 simple criteria stay flat `AC-###`. Apply
 [`acceptance-criteria.md`](reference/acceptance-criteria.md) so each is binary and observable.
+Use [`edge-case-trace.md`](../devrites-lib/reference/standards/edge-case-trace.md)
+to populate only relevant edge/prohibition rows. The spec's applicability map routes
+topology, data, integration, security, and delivery concerns to their focused standard;
+load a routed standard to discover required behavior, not to prescribe implementation.
 
 ## Operating rules (DevRites core)
 - No silent assumptions or guessing; prefer conventions; ask on scope,
@@ -65,6 +69,8 @@ simple criteria stay flat `AC-###`. Apply
    template's specific justification.
    Identify proof constraints now: human-only credentials, unavailable environments, approval
    windows, or acceptance not observable through existing test/runtime/browser surfaces.
+   An unfamiliar framework/version routes to `devrites-source-driven`; missing or
+   contradictory documentation is evidence to reconcile, never a license to guess.
    Split independent placement, blast-radius, and external-fact questions into at most three
    bounded `devrites-evidence-scout` tasks on one frozen candidate. Wait for and reconcile every
    cited dossier before step 4. The scout supplies facts only; it never asks the human or writes
@@ -102,7 +108,8 @@ simple criteria stay flat `AC-###`. Apply
    unrelated settled content. Write every required artifact and conditional
    annex exactly from [spec-template](reference/spec-template.md), including its
    capability impact, existing-behavior preservation, grammar/delta,
-   coverage-seed, qualified backstops, edge/prohibition, UI, and AI rules. Native
+   stakeholder/constraint/invariant, failure/recovery, applicability, coverage-seed,
+   qualified backstop, edge/prohibition, UI, and AI rules. Native
    hierarchical instructions remain stable; do not rewrite `AGENTS.md` or
    `CLAUDE.md` for the active workspace.
 5a. **Check the spec prose** with [spec-checklists](reference/spec-checklists.md).

package/pack/generated/codex/skills/rite-spec/reference/ai-spec-template.md

@@ -17,17 +17,24 @@ or LLM output.
 - Fallback/degradation: <what users see when AI is unavailable>
 
 ## Domain evals
-| Eval ID | Scenario | Expected signal | Gate |
-| --- | --- | --- | --- |
-| EVAL-001 | <domain-specific case> | <pass condition> | build/seal |
+| Eval ID | Scenario / slice | Dataset provenance | Expected signal + threshold | Gate |
+| --- | --- | --- | --- | --- |
+| EVAL-001 | <representative/adversarial/empty-context case> | <held-out source/version> | <pass condition and baseline delta> | build/seal |
+
+For RAG, cover retrieval relevance/context recall, context precision, answer
+faithfulness, citation support, tenant/ACL isolation, poisoned or conflicting documents,
+and insufficient-context fallback as applicable. A single polished example is not an eval.
 
 ## Guardrails
 - Inputs: <validation, prompt-injection boundaries, tenant/data limits>
-- Outputs: <schema checks, refusals, human review, citations>
+- Retrieval: <source provenance, indexing validation, tenant/ACL filter, freshness/deletion>
+- Outputs: <schema checks, refusals, human review, citations only to supporting retrieved sources>
 - Privacy/security: <data sent to model, retention, secrets policy>
+- Unknown/insufficient context: <abstain, clarify, or bounded fallback; never fabricate>
 
 ## Monitoring
-- Runtime metrics/logs: <latency, cost, quality, refusal/error rates>
+- Runtime metrics/logs: <latency, cost, retrieval/quality, refusal/error/fallback rates>
 - Alerts or manual review: <trigger>
-- Rollback/kill switch: <mechanism>
+- Rollback/kill switch: <prompt/model/index version and reversible mechanism>
+- Drift evaluation: <reference set, schedule/trigger, regression threshold, owner>
 ```