devrites 4.4.2 → 4.6.0

package/pack/generated/codex/skills/rite-polish/reference/anti-ai-slop.md

@@ -52,13 +52,10 @@ match the neighbors.
   dots as set dressing.
 
 ### Copy & data realism
-Placeholder content is a tell even when the layout is clean:
-- **Fake-perfect numbers** — `99.99%`, `10,000+`, `$1M`. Real data is ragged: `47.2%`, `1,283`.
-- **Placeholder people/brands** — "John Doe", "Acme", "Nexus". Invent specific, plausible ones.
-- **Filler verbs** — Elevate / Seamless / Unleash / Supercharge / Next-Gen. Say what it does.
-- **Copy self-audit** — re-read every visible string before shipping; anything grammatically
-  broken, referent-unclear, or "an LLM trying to sound thoughtful" gets rewritten. AI-cute
-  copy is worse than boring copy.
+Placeholder content is a tell even when the layout is clean: fake-perfect numbers
+(`99.99%`, `10,000+` — real data is ragged), placeholder people/brands ("John Doe",
+"Acme"), filler verbs (Elevate / Seamless / Unleash). Re-read every visible string before
+shipping; AI-cute copy is worse than boring copy.
 
 ### Category-reflex check — run at two altitudes
 
@@ -90,6 +87,8 @@ Each is pass/fail by counting or grep, not judgment:
 - **Layout families** (hero, image+text split, card grid, bento, table…): no family more
   than twice per page; never 3 consecutive image+text zigzags.
 - **Icons**: 0 emoji-as-icon; exactly one icon set imported.
+- **State presence in code**: default+hover+focus-visible+active+disabled for every interactive element; loading/error/empty where data delays or fails — an unreachable state's screenshot proves nothing.
+- **Form inputs**: no border-width shifts between states; focus ring from outline/ring (not border swap); consistent control height; reserved helper slot; disabled beyond opacity alone.
 
 ## Code anti-slop (UI **and** backend)
 - **Over-defensive checks** — `if (x && x.length > 0)` repeated, layered null guards,
@@ -158,49 +157,11 @@ Each is pass/fail by counting or grep, not judgment:
   Reuse → extend → build new (`coding-style.md`, `patterns.md`); duplication beats the *wrong*
   abstraction, but pasted clones are slop, not a deliberate AHA call.
 
-### Comment density — before / after
-
-```js
-// Before (slop): a comment narrating almost every line
-function calculateTotal(items) {
-  // initialize the total to zero
-  let total = 0;
-  // loop through each item in the items array
-  for (const item of items) {
-    // add the item price to the total
-    total += item.price;
-  }
-  // return the final total
-  return total;
-}
-
-// After: the names carry it; no comment needed
-function sumPrices(items) {
-  return items.reduce((total, item) => total + item.price, 0);
-}
-
-// A comment that earns its place — it explains WHY, not what:
-// Prices are in minor units (cents); the gateway rejects fractional amounts.
-const total = sumPrices(items);
-```
-
-## Why these are banned
-They signal "a model generated this" rather than "this team designed/wrote this." They
-ignore the product's register and the project's idiom, add noise, hide bugs (defensive
-catches), bloat the diff (over-engineering, beyond-spec), and often fail accessibility
-or correctness review. They're cargo-cult, not craft.
-
-## What to do instead
-- **UI**: project tokens / shared components / consistent type & spacing
-  (`design-system-discovery.md`); content shapes layout; motion serves feedback;
-  reserve modals for focused interrupting tasks.
-- **Code**: validate at trust boundaries (don't sprinkle null checks); catch narrow,
-  recover or rethrow; one clear name per concept; one responsibility per function;
-  reuse before write (`coding-style.md`); implement exactly the spec; let inherent
-  complexity be — don't pad with ceremony.
-- If the project **does** use one of these intentionally, follow the project. Consistency
-  beats the rule.
-
-## When in doubt: ask
-A "robust" check or shiny abstraction you can't justify in one sentence is probably slop.
-Delete it; or ask the user if it should exist.
+## Why banned, what instead
+They signal model-generated rather than team-designed work: they ignore register and
+idiom, add noise, hide bugs (defensive catches), bloat diffs, and often fail a11y or
+correctness review. Instead: project tokens/components, validate at trust boundaries,
+catch narrow and rethrow, one clear name per concept, reuse first (`coding-style.md`),
+implement exactly the spec. If the project intentionally uses one of these, follow the
+project — consistency beats the rule. A check or abstraction you can't justify in one
+sentence is slop: delete it or ask.

package/pack/generated/codex/skills/rite-pr-feedback/SKILL.md

@@ -24,8 +24,13 @@ Step 0: Read `.agents/skills/devrites-lib/reference/standards/core.md`, plus `gi
 2. **Fetch.** Use GitHub GraphQL/CLI to collect unresolved review threads with file, line, author, body, and thread id. Completion: every unresolved thread is represented once, or the fetch error is reported.
 3. **Legitimacy gate.** For each item, read the surrounding code and classify: `fix`, `not-addressing`, `declined`, `reply-only`, or `needs-human`. Deduplicate overlapping items.
 4. **Fix approved items.** Apply contained fixes, add/update tests when behavior changes, and run targeted checks. Larger product/API/security calls become `needs-human`.
-5. **Commit/push.** Stage only touched files. Commit only if changes exist; push the branch.
-   **Completion:** changed files are committed/pushed with SHA evidence, or no commit is created because the diff is empty.
+5. **Commit/push.** Stage only touched files; commit only if changes exist; push the branch.
+   Push rejected (protected branch, non-fast-forward, hooks): stop and report the exact
+   rejection — never force-push or rewrite a shared branch. Post-push checks fail: record
+   the failing check, choose fix-forward or revert, put the choice + reason in the thread
+   reply — never a silent red push.
+   **Completion:** committed/pushed with SHA evidence and green checks, or no commit (empty
+   diff), or the push failure reported verbatim.
 6. **Reply and resolve.** Reply to every thread with outcome and evidence. Resolve only `fix`, `not-addressing`, `declined`, and `reply-only`; leave `needs-human` open.
    **Completion:** every thread has one recorded outcome and only permitted terminal outcomes are resolved.
 7. **Verify.** Fetch unresolved threads again and report remaining intentional opens.

package/pack/generated/codex/skills/rite-pressure-test/SKILL.md

@@ -12,6 +12,7 @@ Use when the idea—not only requirements—is rough. Compare directions before
 first and write only workspace/ticket artifacts.
 
 ## Diverge (widen)
+
 - Search `decisions.md`, accepted ADRs, and relevant archives for rejected directions;
   revive one only with evidence that answers its recorded reason, citing both.
 - Generate 3-5 different shapes, including obvious, smaller, and different-boundary/data/
@@ -20,6 +21,7 @@ first and write only workspace/ticket artifacts.
 - For each, name concrete entities/flows/surfaces, optimization, rough cost, and main risk.
 
 ## Converge (commit)
+
 - Weigh options against the goal, constraints, and existing codebase conventions.
 - Prefer felt pain over nice-to-have. Rank differentiation: new capability > 10× gain >
   new audience > new context > better UX > cheaper; do not dress a vitamin as a painkiller.
@@ -33,10 +35,13 @@ If the hinge is an uncertain material fact, freeze at most three questions for
 `unavailable`, never support. Record claim, support, strongest contrary evidence, and
 `supported | assumption | refuted`. Refutation changes the recommendation; an assumption
 advances only when non-decisive with bounded downside. Weak/conflicting decisive evidence
-returns **Hold** with the resolving evidence, never `$rite-spec`. Do not research preferences
+returns **Hold** with the resolving evidence, never `$rite-spec`. Tie-breaker:
+see [`intent-map.md`](../devrites-lib/reference/intent-map.md) (`rite-pressure-test`
+vs `rite-spec`). Do not research preferences
 or reversible implementation choices.
 
 ## Boundaries
+
 - This is exploration, not specification. Output a **direction**, not a finished spec:
   `$rite-spec` writes the spec.
 - Don't over-explore: 3-5 options, one pass of convergence. If the user already knows

package/pack/generated/codex/skills/rite-prove/SKILL.md

@@ -111,3 +111,12 @@ test changes.
 
 > Do not claim an unobserved pass, skip browser proof, or proceed with pending
 > slices. Load `reference/anti-patterns.md` when tempted to do so.
+
+## Phase exit (observable)
+
+**Complete when:** every criterion in `acceptance-proof.md` has discriminating
+evidence bound to the current candidate digest, both independent validators admit
+accounts, and `state.md` records Prove complete with no open `cannot_verify` rows.
+
+**Failing case:** narrative "all tests passed" without `evidence.md` binding and
+proof-runner admission → phase not complete; Seal blocks.

package/pack/generated/codex/skills/rite-prove/reference/acceptance-proof.md

@@ -14,6 +14,16 @@ filtered, pending, zero-test, assertion-free, tautological, or unexecuted result
 do not count. Build/compile/typecheck/lint prove only their static criterion;
 discriminating shell assertions and golden/text comparisons may prove text/CLI.
 
+## Silent-failure probe
+
+When tests pass but error paths, dropped results, or partial success could hide
+failure, require at least one **discriminating** check that would fail if the silent
+path regressed (assert the failure surface, not only the happy path).
+
+**Failing case:** handler returns success while logging or swallowing internally; the
+suite stays green → map `cannot_verify` unless a test asserts the user-visible or
+contract failure outcome.
+
 ## Backstop disposition
 
 A `backstop` passes only on its spec-named independent held-out,

package/pack/generated/codex/skills/rite-review/SKILL.md

@@ -20,7 +20,9 @@ tell the user to run `$rite-spec <feature>`.
 all workflow-named roles remain mandatory at every depth.
 
 ## Rules consulted (read on demand from `.agents/skills/devrites-lib/reference/standards/`)
+
 Pull these via `Read` when the diff demands them:
+
 - `code-review.md`: small PRs, severity labels, tests-first review focus.
 - `review-checklist.md`: compact pass/fail sweep before reporting the verdict.
 - `principles.md`: declared project invariants (`.devrites/principles.md`); a diff that violates one with no recorded exception is a Critical, blocking finding.
@@ -33,9 +35,13 @@ Pull these via `Read` when the diff demands them:
 - `performance.md`: only when perf is relevant or a regression risk is visible.
 
 ## Operating rules
+
 - **Feature scope only.** Review touched files + the diff. **NO whole-project refactors,
   NO drive-by cleanup.** DO NOT delete suspected dead code outside this feature without
   asking. Spec Drift Guard applies.
+- **Silent-failure hunt:** when the suite is green, require proof that error paths and
+  partial-success branches would fail tests if broken. **Failing case:** tests pass but
+  handler returns success on internal error → Critical until an asserting test exists.
 - **Review the finished product.** `$rite-polish` has already simplified code and
   normalized or polished UI. If review finds a remaining complexity issue, record it as
   a finding rather than rerunning a simplification pass.
@@ -49,6 +55,7 @@ Pull these via `Read` when the diff demands them:
   route to `devrites-slice-wright`.
 
 ## Workflow
+
 0. Read `.agents/skills/devrites-lib/reference/standards/core.md` first (the always-on operating rules); pull the
    on-demand rules above as the diff demands them.
    Then read the explicit or active workspace's `state.md` directly.
@@ -129,6 +136,7 @@ Pull these via `Read` when the diff demands them:
    correction has affected proof plus a fresh Review.
 
 ## Finding labels
+
 - **Critical:** must fix before seal (correctness/security/data loss).
 - **Important:** should fix before seal (likely bug, real maintainability risk).
 - **Suggestion:** worth doing, not blocking.
@@ -141,6 +149,7 @@ change is already small: a pure noise-economics lever). Only a **`blocking` Crit
 seal; a `non-blocking` / `if-minor` finding is recorded, not a stop.
 
 ## Confidence and signal-to-noise
+
 Apply [`agents.md` § Result admission](../devrites-lib/reference/standards/agents.md#result-admission).
 Suppress unverifiable ≤4 hypotheses, require 7+ plus exact proof for
 Critical/Important, and make every silent/unusable account a blocking gap. Roll

package/pack/generated/codex/skills/rite-spec/reference/spec-checklists.md

@@ -11,7 +11,7 @@ Emit `.devrites/work/<slug>/checklists/<domain>.md` per covered domain; skip
 `none`. Each domain maps gaps to a `devrites-interview` dimension:
 
 | Domain file | Tests the prose of |
-|---|---|
+| --- | --- |
 | `functional.md` | Functional requirements + scenarios: is each capability stated, bounded, testable? |
 | `data-model.md` | Key entities / data model: shapes, fields, lifecycle, relationships (skip if "none"). |
 | `interaction.md` | API / UI impact + UX states: every screen state and contract named (skip if no UI/API). |
@@ -39,6 +39,7 @@ undefined stated-flow edge, or contradictory requirements. Other vague prose is
 ## Question bank
 
 Each question checks one requirement-prose failure mode:
+
 - **Measurability:** every "good / fast / prominent / simple / secure" carries a number, a budget,
   or a named reference. No adjective stands in for a threshold.
 - **Completeness:** every enumeration is closed (no "etc."); every requirement with a precondition
@@ -64,6 +65,8 @@ Each question checks one requirement-prose failure mode:
 - **Preservation:** each material brownfield outcome appears in `Existing behavior
   to preserve` with preserving REQ/AC and current evidence. Missing/vague “no
   regressions” or unjustified `none` is CRITICAL.
+  **Failing case:** brownfield login still works but the table has no evidence column
+  → CRITICAL until a test path, command, or observed contract is named.
 - **Backstops:** each row names an independent held-out, property/metamorphic, or
   direct behavioral check and the failure it discriminates; confidence/presence/self-review fail.
 - **Non-functional:** each NFR names affected REQ/AC IDs or a bounded `global` scope;
@@ -80,6 +83,7 @@ unchecked**. A spec without checklists is not yet checked, so define stops and r
 back here.
 
 ## Discipline
+
 - Score honestly. Do not soften a checklist question to pass a weak spec.
 - Don't pad. Five real questions that find one CRITICAL beat thirty rubber-stamped rows.
 - If a question needs a function name, it belongs in `$rite-vet`'s `test-plan.md`.

package/pack/generated/codex/skills/rite-spec/reference/spec-template.md

@@ -3,9 +3,10 @@
 Contract WHAT users get, WHY, success, and scope. HOW belongs in `plan.md`,
 topology in `architecture.md`/`flows.md`, coverage in `traceability.md`.
 
-Use `[NEEDS CLARIFICATION: <question>]` (blocking stops `$rite-clarify`) and
-stable `REQ-001`/`AC-001` IDs. Link, never duplicate, source artifacts. Over
-schema budget requires `Budget override: <reason>`.
+Use `[NEEDS CLARIFICATION: <question>]` (blocking stops `$rite-clarify`); before readiness
+every surviving marker converts to a gated `Q-###` open question (`spec-grammar.md` §
+Unresolved-question markers — fail closed). Stable `REQ-001`/`AC-001` IDs; link, never
+duplicate, source artifacts; over-budget requires `Budget override: <reason>`.
 
 ```markdown
 # Spec: <Feature>
@@ -33,6 +34,12 @@ No implementation detail. True greenfield: `none — no existing behavior in the
 | --- | --- | --- |
 | <outcome that must not regress> | REQ-001 / AC-001 | <current evidence> |
 
+Each preservation row **must** cite current evidence (test, runtime, contract, or
+observed behavior). An empty or vague evidence cell blocks Spec readiness.
+
+**Failing case:** row lists REQ-001 with evidence "none" or "TBD" → readiness gate
+fails until evidence is named or the outcome is removed from scope.
+
 ## Stakeholders and priorities
 | Actor/stakeholder | Observable outcome | Conflict / priority rule |
 | --- | --- | --- |
@@ -104,7 +111,7 @@ status routes Define/Vet/Build/Prove to the named standard without copying it he
 - Model/RAG/agent/eval/LLM-output scope: `ai-spec.md` from `ai-spec-template.md`.
 - Otherwise: not applicable.
 
-## Measurable success
+## Success metrics
 - <Metric or observable proof.>
 
 ## Scope boundaries

package/pack/generated/codex/skills/rite-status/SKILL.md

@@ -18,6 +18,8 @@ artifacts only as needed. Never infer lifecycle state from `README.md` or chat.
 
 If no workspace exists, recommend `$rite-spec <feature>` and stop.
 
+If `state.md` is unreadable/malformed: report a gap with the defect and stop — never infer the phase from other files; `$rite-doctor`/`$rite-upgrade` own repair.
+
 ## Report
 
 1. feature and one-line objective;

package/pack/generated/codex/skills/rite-vet/SKILL.md

@@ -40,6 +40,12 @@ plan declares a root-authored executable workflow file, read
   unverified or confidence ≤4 findings under `review-axes.md`.
 - Auth, migration, public API, and data-model changes use maximum caution and the
   irreversible-risk stop. Project principles never become trade-offs.
+- **Governance-protected paths** (`.devrites/**`, pack skill/agent trees,
+  `NOTICE.md` generator regions, CI/hook config named in repo docs) require explicit
+  human approval before plan slices may edit them. A slice touching a protected path
+  without approval → Vet **NEEDS CLARIFICATION**.
+  **Failing case:** plan edits another feature's `state.md` without recorded approval →
+  fail closed.
 - Use the lowest axis band; never average or round thin to ready. Search before
   asking and resolve reversible technical choices. Ask only human-owned choices.
 - Preserve a valid technical return cursor. Agent-owned `NEEDS REPLAN` returns
@@ -138,3 +144,11 @@ plan declares a root-authored executable workflow file, read
 
 > Do not replace interactive review with artifacts, change acceptance through
 > hardening, score without source evidence, or ignore unexplained complexity.
+
+## Phase exit (observable)
+
+**Complete when:** `eng-review.md` records exactly one readiness verdict, readiness
+binding SHA-256 passes, and every required reviewer account is admitted.
+
+**Failing case:** READY written while a required reviewer returned `Outcome: gap` →
+not complete; restore NEEDS REPLAN or dispatch missing reviewer.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "4.4.2",
+  "version": "4.6.0",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",