devrites 4.6.0 → 5.0.0

package/pack/generated/omp/skills/rite-temper/reference/strategy-template.md

@@ -0,0 +1,90 @@
+# `strategy.md` template + fold-back rules
+
+`/rite-temper` produces two kinds of output. The `strategy.md` artifact is the durable
+**record** of the review; the **fold-back edits** are what the build follows. The
+record without the fold-back is dead prose: the build reads `spec.md`, not `strategy.md`.
+
+## `strategy.md`: the record
+Write to `.devrites/work/<slug>/strategy.md`. If one exists for the slug, **update** it, don't
+clobber.
+
+```markdown
+# Strategy: <slug>
+Tempered: <iso>
+
+## 1. Significance
+full | skipped — low stakes (<trigger>)        # if skipped, stop here (see significance.md)
+
+## 2. Scope mode
+Mode: expand | selective | hold-rigor | reduce-to-MVP
+Rationale: <why this mode>
+Hinge: <what evidence/answer would change the call>
+
+## 3. Forward pass (ambition)
+10-star outcome (the deliberate overshoot): <one or two lines>
+Premises challenged: <load-bearing assumption(s) + verdict>
+Converged sweet spot: <where we landed and why — this, not the overshoot, is what folds in>
+
+## 4. Pre-mortem (inversion)
+| Failure mode (past tense) | Likelihood | Mitigation | Owning slice/criterion |
+|---|---|---|---|
+| It shipped and <…> | high/med/low | <mitigation> | <slice or FR it binds to> |
+
+## 5. YAGNI ledger
+| Candidate scope item | later-refactor cost | Verdict |
+|---|---|---|
+| <item> | trivial / large | build-now / defer (revisit: <trigger>) |
+
+## 6. Cross-cutting coverage
+| Concern | Addressed? |
+|---|---|
+| Security / trust boundary | <how | N/A — why> |
+| Data & migration | <… | N/A> |
+| Observability | <… | N/A> |
+| Modifiability | <… | N/A> |
+
+## 7. Dimension scores (floor-gate)
+| Dimension | Band | Evidence |
+|---|---|---|
+| Problem altitude & ambition | strong/adequate/thin/broken | <spec line / absence> |
+| … (all 9) | … | … |
+Floor verdict: <weakest band> on <dimension> → pass | blocked
+
+## 8. Deferred / Won't-have-this-time
+- <item> — <one-line reason> (revisit when: <trigger>)
+
+## 9. Reviewer loop
+- iter 1: <findings → resolution> · iter 2: … (≤3)
+- Final: floor = <band>; unresolved → <none | blocking qid>
+```
+
+## Fold-back: the part the build follows
+Apply through the **Spec Drift Guard** (these are spec changes, not free edits). If a plan
+already exists, record in `drift.md` and route via `/rite-plan repair` instead of editing
+`spec.md` blind.
+
+- **`spec.md`:** these are the spec template's actual section headings. Edit each named one;
+  don't collapse pairs.
+  - Add to *Success metrics* **and** *Acceptance criteria* (separate sections) for
+    every opt-in **expansion**; remove (via the Guard) from both for every **reduction**. Each
+    must stay measurable + technology-agnostic.
+  - *Non-goals*: append every deferred item (from the YAGNI ledger + the Deferred register), so
+    it is neither silently dropped nor silently re-injected mid-build.
+  - *Constraints and invariants*: tighten where the pre-mortem demands; top failure modes +
+    mitigations go to *Failure and recovery behavior* rows.
+  - *Open questions* table: one row per scope call (options offered → decision → owner).
+  - **Re-run the Readiness gate** at the bottom of the spec after edits; it must still pass, and
+    **every folded scope delta must trace to a recorded decision** (a `questions.md` qid or a
+    `decisions.md` ADR): an untraceable change is the batch-dump failure.
+- **`decisions.md`:** one ADR-style entry per scope call and accepted trade-off:
+  `context · decision · why-not-the-alternative · what-would-change-it`.
+- **`assumptions.md`:** every "we'll probably need X" demoted to an explicit
+  **assumption-to-verify**, never smuggled into scope as a fact.
+
+## Write discipline
+- **Single canonical writer.** The skill writes `strategy.md` and edits the canonical files; the
+  `devrites-strategy-reviewer` agent is **read-only** and only returns findings + bands.
+- **No silent scope.** An expansion that the human didn't opt into, or a reduction that drops an
+  acceptance criterion without a recorded decision, is a defect, not a convenience.
+- Add `strategy.md` to the workspace between `spec.md` and `plan.md`; `/rite-define` and
+  `/rite-ship` read it.

package/pack/generated/omp/skills/rite-upgrade/SKILL.md

@@ -0,0 +1,112 @@
+---
+name: rite-upgrade
+description: Audit and reconcile an older released DevRites workspace. Proves a current-contract defect, then routes its phase owner while preserving completed work and history.
+argument-hint: "[feature-slug]"
+user-invocable: true
+disable-model-invocation: true
+---
+
+# /rite-upgrade: reconcile a released workspace safely
+
+Use when an unfinished workspace from an older release cannot resume. This is an
+audit/orchestrator—not a pack update, cursor conversion, release replay,
+structural migration, or generic cleanup.
+
+## Rules consulted
+
+Read `devrites-lib/reference/standards/core.md`, its agent and workspace-schema
+references, and only current phase contracts needed for the observed gap.
+
+## Invariants
+
+- Upgrade writes no workspace artifact and never edits source, tests, dependencies,
+  or Git. It observes, admits, invokes current owners, and re-audits only.
+- Recognize only released workspace forms: `.devrites/work/<slug>/state.md` with v1/v2
+  bullet fields (`- Phase:`, `- Next step:`, optional `- qid:`) or the v3 cursor table.
+  Preserve its encoding; only its owning rite may change fields. Never create aliases,
+  journals, telemetry, version markers, or an engine migrator.
+- Older provenance, cursor form, or pack version alone is never a defect. A repair requires
+  a current rule, exact workspace evidence, affected gate, owning rite, exact paths, and
+  the smallest behavior-neutral delta.
+- Existing rites own semantic changes. Upgrade may sequence `/rite-clarify`,
+  `/rite-plan repair`, `/rite-converge`, `/rite-vet`, `/rite-prove`, `/rite-polish`,
+  `/rite-review`, and `/rite-seal`; it never reimplements them or starts Build or Ship.
+  `/rite-doctor` owns install/config diagnosis.
+- An admitted candidate route may name only the exact current gate artifacts its owner
+  must refresh: `touched-files.md`, `evidence.md`, optional `browser-evidence.md`,
+  `polish-report.md`, `review.md`, `seal.md`, and the owner's `state.md` fields as
+  applicable. Source, completed-slice identities, answers, decisions, and unrelated
+  history remain protected. Each owner preserves unrelated content and normal gates.
+- Archived/`done` workspaces are no-ops. Unknown or unverifiable inputs stop without
+  writes. There is no legacy fallback: never synthesize or guess scope, bytes, proof,
+  freshness, or a historical pass.
+- The explicit invocation authorizes only admitted, behavior-neutral workspace repairs.
+  Product/policy choices, acceptance changes, irreversible risk, and human-only actions
+  remain HITL.
+
+## Workflow
+
+0. **Orient read-only.** Apply `/rite-doctor`. Resolve the explicit or active slug.
+   Archive-only is `current`; otherwise require contained regular `state.md` and read its
+   cursor. A damaged/mismatched install stops at Doctor; missing live work routes
+   `/rite-spec`; `done` is `current`. An unknown cursor is `unsupported`.
+1. **Freeze preservation evidence.** Record `git status --short`, cursor form/fields, and
+   hashes of completed-slice fields, candidate gate artifacts, existing answers/decisions,
+   and protected history. Inventory every path that could change; absence is evidence,
+   never permission to synthesize history. For a post-Build workspace, also retain the
+   exact result of `devrites-engine check candidate <slug>`; at or after Seal retain the
+   exact result of `devrites-engine check seal <slug>`.
+2. **Assess from fresh context.** Dispatch exact `devrites-upgrade-planner` with the named
+   installed contracts, workspace paths, cursor form, current phase, and frozen baseline.
+   Require one read-only typed assessment. It writes and asks nothing.
+3. **Admit the assessment fail closed.** Accept `current` only when every applicable axis has
+   cited evidence and no finding. Accept `repairable` only when every finding names the
+   current rule, exact workspace evidence, affected gate, owning rite, exact writable paths,
+   minimal delta, and protected invariants. Missing fields become `gap`.
+   Unsupported shapes remain untouched. Reject version-only, speculative, alias-creating,
+   source-changing, history-changing, or acceptance-changing advice.
+4. **Route; do not duplicate.** For `repairable`, invoke only the admitted current owners,
+   one at a time:
+   - decision coverage or a material assumption → `/rite-clarify`;
+   - stale/inconsistent planning or traceability with settled intent → `/rite-plan repair`;
+   - live code and recorded intent disagreement → `/rite-converge`;
+   - any changed planning input or readiness defect → `/rite-vet`;
+   - a missing/malformed strict manifest, missing/malformed/mismatched evidence binding,
+     a browser-binding defect when that file exists, or current candidate-check failure
+     → `/rite-prove`;
+   - candidate-affecting capability-ledger, `DESIGN.md`, or ADR rollups still deferred by
+     an old Ship-era workspace → `/rite-polish`;
+   - a missing, stale, or mismatched review binding → `/rite-review`;
+   - a missing, stale, or mismatched seal binding or failed Seal gate → `/rite-seal`.
+
+   Sequence only applicable owners; candidate owners stay in the Prove → Polish → Review
+   → Seal order above. Each owner keeps normal gates/write limits. Stop on HITL/blocked.
+   Never infer `/rite-customize --import-legacy`; that mode requires the exact token in the
+   user's current invocation.
+5. **Re-audit and prove preservation.** Re-dispatch the planner once against the changed
+   candidate. `gap`, `unsupported`, or a remaining finding stops. Compare the frozen hashes
+   and Git status; only admitted paths may differ. Cursor changes must match the owning
+   rite while preserving form. Any unadmitted, protected, or source change is a gap and
+   stops; Upgrade never restores it itself.
+   For a post-Build workspace, run `devrites-engine check candidate <slug>` and require
+   the assessed bindings to match it. At or after Seal, also run
+   `devrites-engine check seal <slug>`. Run readiness where applicable:
+   ```bash
+   devrites-engine check readiness <slug>; echo "readiness rc=$?"
+   ```
+   Any nonzero result or mismatch remains a `gap` and stops.
+6. **STOP.** Do not advance to Build or Ship. A repeated `/rite-upgrade` is a no-op only
+   when the fresh assessment independently returns `current`; no marker may manufacture
+   that result.
+
+## Output
+
+```text
+Done: workspace <slug> compatibility <current | reconciled>.
+Changed: <admitted active-workspace paths | none>
+Evidence: assessment=current; candidate rc=<n|n/a>; seal rc=<n|n/a>; readiness rc=<n|n/a>; protected history/source unchanged
+Open: <none | exact unsupported shape, evidence gap, or human gate>
+Next: <state.md next action | one owning rite>
+Record: <owning rite's state.md — written by the owner, not Upgrade>
+↻ Hygiene: /clear before the next lifecycle step
+```

package/pack/generated/omp/skills/rite-vet/SKILL.md

@@ -0,0 +1,158 @@
+---
+name: rite-vet
+description: Review a defined engineering plan before code. Use for plan vetting or lock-in; not for implementation review or final readiness sealing.
+argument-hint: "[slug] [--cross-model] [--full]"
+user-invocable: true
+---
+
+# /rite-vet: review the plan before build
+
+Vet every plan before code for scope, architecture, quality, proof, performance,
+failure modes, and writer safety. Cite findings; fold accepted technical
+hardening into planning artifacts; design Build tests. Temper owns product
+scope, Vet owns implementation; current `$ARGUMENTS` (`--full`) feeds the depth triggers in
+`reference/depth.md`; profiles never remove the exact plan-reviewer gate
+([orchestration-profiles.md](../devrites-lib/reference/orchestration-profiles.md)).
+
+## Rules
+
+Read the active standard from: `principles.md`, `patterns.md`, `coding-style.md`,
+`testing.md`, `spec-grammar.md`, `performance.md`, `error-handling.md`,
+`development-workflow.md`, `afk-hitl.md`, `one-shot-actions.md`,
+`developer-experience.md`, `elicitation.md`, and `definition-of-done.md`. Load
+repository topology, data integrity, and integration reliability only when
+triggered. Before classifying any Reslice, read `.omp/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+When a
+plan declares a root-authored executable workflow file, read
+`workflow-artifacts.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+## Invariants
+
+- Review implementation, not ambition. Challenge creep, complexity, proof, and
+  risk without changing accepted product scope.
+- Root alone asks, decides, folds, writes, and sets readiness. Reviewers judge;
+  they add no route policy. Cite every finding and confidence; suppress
+  unverified or confidence ≤4 findings under `review-axes.md`.
+  Lens arrows in `eng-lenses.md` are heuristics; band findings only under the
+  four `review-axes.md` names.
+- Auth, migration, public API, and data-model changes use maximum caution and the
+  irreversible-risk stop. Project principles never become trade-offs.
+- **Governance-protected paths** (`.devrites/**`, pack skill/agent trees,
+  `NOTICE.md` generator regions, CI/hook config named in repo docs) require explicit
+  human approval before plan slices may edit them. A slice touching a protected path
+  without approval → Vet **NEEDS CLARIFICATION**.
+  **Failing case:** plan edits another feature's `state.md` without recorded approval →
+  fail closed.
+- Use the lowest axis band; never average or round thin to ready. Search before
+  asking and resolve reversible technical choices. Ask only human-owned choices.
+- Preserve a valid technical return cursor. Agent-owned `NEEDS REPLAN` returns
+  internally to its caller, not to the human.
+- **Recovery recheck is bounded.** A valid cursor plus open fingerprint enters
+  Recovery recheck; it does not start another Full Vet or repeat unaffected
+  axes/reviewers.
+<!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"plan declares root-authored executable workflow file","action":"emit exact admission; stale/missing authority uses PLAN_VET_REPAIR","return":"Vet READY cursor or exact technical replan"} -->
+## Workflow
+
+0. **Orient.** Read core. Resolve active slug, require state, and read plan,
+   tasks, spec, decision coverage, optional strategy/design brief, decisions,
+   assumptions, and state. Require approved Plan and `Decision coverage: CLEAR`;
+   otherwise stop for Define or Clarify. Use code intelligence for placement,
+   blast radius, and reuse.
+1. **Select depth.** Apply `reference/depth.md` exactly; never skip. Every initial
+   pass records an engineering verdict and test-plan coverage. A valid Recovery
+   recheck retains prior depth and enters 1b.
+1a. **Independent initial pass.** Freeze candidate and dispatch exact fresh
+   read-only plan reviewer. Add developer-experience reviewer for developer
+   surfaces and current strategy reviewer after significant Temper. Missing
+   required account blocks.
+1b. **Recovery recheck.** Require valid return cursor, accepted prior finding,
+   exact fingerprint/reproduction, repaired candidate identity, changed
+   paths/criteria, and affected drift/evidence. Freeze that packet and dispatch
+   each exact owning reviewer once, fresh/read-only, limited to it. Do not rerun
+   broad inventory or unaffected reviewers. Close the prior fingerprint only
+   with discriminating evidence. Otherwise record one no-progress outcome. A
+   different Critical/Important invariant needs exact evidence and a new
+   fingerprint; a Suggestion, Nit, or FYI cannot keep recovery open. Reconcile
+   shared artifact/readiness gates and return to caller or next repair.
+2. **Challenge scope.** Apply review-axes §0 and search accepted decisions.
+   Harden to the smallest contract-complete plan, using marked topology action.
+   Then verify bidirectional ID-and-meaning traceability across spec/plan/
+   tasks/test-plan/traceability, acceptance, terms, principles, anti-slop,
+   and conventions; every slice and test-plan row maps to a live requirement
+   and vice versa. Critical gaps and
+   unexcepted principle breaches block; record the challenge result in `eng-review.md`
+   §2 (Scope challenge) after recheck.
+3. **Preflight Build entry.** Under `reference/artifacts.md`, verify exact
+   command/cwd/tool/version/prerequisite; output filters must preserve upstream
+   failure. Verify dependencies from authoritative source plus nearest manifest.
+   Run parser-sensitive syntax only in isolated fixtures. Remeasure mutable facts;
+   live evidence wins, conflict marks stale, and unmeasurable conflict is a gap.
+   Record complete SHA-256 provenance. Every behavioral mapping names a positive
+   discriminating assertion and decisive signal, never only exit zero.
+
+   For each consumptive action, bind every `reference/artifacts.md` Consumptive
+   action gates column; every fingerprint identifies one actionable seam; aliasing multiple
+   emit sites is a gap. Preflight observes but need not make future behavior pass.
+4. **Audit readiness.** Goal-backward map every requirement, criterion, NFR,
+   interaction, edge/prohibition, and decision row to one slice and executable
+   proof. Verify UX/spec/architecture alignment, contracts, dependency order,
+   slice independence/wiring, prerequisites, failure/observability/rollback, and
+   ownership. The plan's `Shared contract proof` names one reused boundary
+   artifact plus two consuming tests for every changed API/event/schema/provider-
+   consumer seam, or an explicit no-impact statement. Missing, one-sided,
+   duplicated-contract, vague, or non-consuming proof fails closed.
+
+   Technical gaps are `NEEDS REPLAN` and Plan repair. Product/risk gaps are
+   `NEEDS CLARIFICATION` and Clarify. Neither becomes a Build qid.
+5. **Review axes.** Apply `review-axes.md` through `eng-lenses.md`. Fold verified
+   behavior-preserving technical findings; walk only human-owned decisions.
+   Profile gate ceiling and Reslice marked action remain authoritative.
+6. **Write outputs.** Produce every artifact in `reference/artifacts.md`. After
+   editing intent/decision/assumption/question owners, re-scan affected coverage,
+   assumptions, uncertainty, and gates. Keep state non-READY. Every scenario and
+   criterion needs positive, discriminating proof; every slice must be one-pass
+   implementable; developer plans need a predicted scorecard. Durable commands
+   are portable repository commands, not host wrappers.
+7. **Narrow recheck after edits.** Dispatch exact plan reviewer once per
+   correction/fingerprint (`per correction/fingerprint`) with accepted findings,
+   changed paths/criteria, and new
+   identity. Within one correction, no broad third loop. If it changes plan,
+   fold again. A closed input plus a distinct Critical/Important invariant returns
+   that new fingerprint as progress. Then close matrix and rerun ID/meaning audit.
+8. **Build readback and readiness.** Add a cited five-line readback to
+   `eng-review.md` (artifacts.md §7 rows 1–5): outcome/ACs; IN/OUT/must-NOT; UI direction and architecture/
+   critical flow; slice order/first slice; decisive proof/action-time gates. A
+   fresh implementer must need no product, architecture, or proof invention.
+   Contradiction, ownerlessness, or material ambiguity blocks via Clarify or Plan.
+
+   Write exactly one `Implementation readiness: READY`, `NEEDS CLARIFICATION`,
+   or `NEEDS REPLAN`. Root alone sets READY after every account, checklist,
+   preflight, and sweep is green. Write phase/next step and emit one
+   `Readiness inputs SHA-256` with
+   `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
+   must pass. Technical failure records reproduction, not qid. Human gap awaits
+   Clarify. Optional cross-model follows `reference/cross-model.md`.
+
+   With READY, no pending remediation, and a valid technical return cursor,
+   restore and consume the return cursor instead of defaulting to Build. Preserve
+   it through admitted remediation. Only a real stop reaches the human.
+9. **Stop at the Vet boundary.** Show Build readback, scope verdict, lowest axis,
+   closed gaps, preflight, action checkpoints, and critical failures. Recommend
+   Build only when READY.
+
+> Do not replace interactive review with artifacts, change acceptance through
+> hardening, score without source evidence, or ignore unexplained complexity.
+
+## Phase exit (observable)
+
+**Complete when:** `eng-review.md` records exactly one readiness verdict, readiness
+binding SHA-256 passes, and every required reviewer account is admitted.
+
+**Failing case:** READY written while a required reviewer returned `Outcome: gap` →
+not complete; restore NEEDS REPLAN or dispatch missing reviewer.

package/pack/generated/omp/skills/rite-vet/reference/anti-patterns.md

@@ -0,0 +1,41 @@
+# /rite-vet: anti-patterns
+
+Universal rationalizations + red flags live in
+[`../../devrites-lib/reference/standards/anti-patterns.md`](../../devrites-lib/reference/standards/anti-patterns.md): read it when the
+reluctance is broader than this phase. Below are the vet-specific ones.
+
+Authority: `.omp/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+## Phase rationalizations
+
+| Excuse | Rebuttal |
+|---|---|
+| "I'll write all the findings into `eng-review.md` and let the user read it." | The artifact is the *output* of an interactive review, not a substitute for it. A material finding's path to "done" goes **through `AskUserQuestion`**, one at a time, with a recommendation + why. Dumping findings into one write and moving on is the exact failure this skill exists to prevent. |
+| "The plan doesn't handle X: flag it." (without checking) | Quote the line first. If you can't quote where the plan handles X, you also can't be sure it doesn't: force confidence ≤4 and suppress. The "field/case doesn't exist" finding is the most common false positive; the verification gate exists to kill it. |
+| "It's an obvious fix. I'll just edit the plan." | Verified plan hardening is Vet's job; topology uses the marked action. |
+| "This dimension is thin but the others are strong: net it's fine." | The gate is the **floor**, not the average. A plan `broken` on test-coverage does not pass because it's `strong` on architecture. |
+| "I can see it's adequate. I'll note the band, the evidence is obvious." | Cite the quoted evidence **before** the band. Score-first-justify-later is how a reviewer waves through a plan it already likes. |
+| "8+ files but it all needs to change: proceed." | The complexity smell is a **STOP-and-ask**, not a note. Name the overbuilt part, propose the smaller version that still meets acceptance, and let the human decide before any axis runs. Maybe it's justified (record *why*) but the gate fires first. |
+| "There's no test for this, but the user can add one later." | Coverage is designed **now**, before the code, so the build writes tests alongside it. A deferred test is a test that misses the boundary cases writing-it-now would expose. Regressions are non-negotiable. Critical, no question. |
+| "Performance looks fine." | "Looks fine" is not a measurement. A perf finding is "measure X against budget Y" or it's nothing: don't recommend speculative tuning, and don't wave past an N+1 you can quote. |
+| "Cross-model agrees, so apply it." | Cross-model consensus is a strong *signal*, not an approval. Every cross-model finding is informational until the human approves it (or, in AFK, until the gate ceiling clears a hardening-only change). |
+
+## Reslice classifier rationalizations
+
+**RSLICE-VET-001** — Slice/topology growth alone does not stop; fewer slices do not prove scope reduction; remediation does not grow product.
+
+## Red flags
+- `eng-review.md` / `test-plan.md` written but `plan.md` / `tasks.md` **not** hardened: the build
+  follows the plan, so the review changed nothing.
+- A finding raised with confidence ≥7 but **no quoted source line**, that defeats the verification gate.
+- Acceptance/product-behavior growth auto-applied in AFK, or an orthogonal human-owned gate that did not pause.
+- A failure-mode table with rows but no verdict column filled: a "no test + no handling + silent" row not marked Critical.
+- The reviewer loop running past 3 iterations, or the reviewer / cross-model being handed the author's reasoning (defeats the fresh-context point).
+- The skill writing code, implementing a slice, or running the build. That's `/rite-build`. Vet reviews and hardens the plan; it never implements.
+- Re-litigating the **spec's** scope/ambition, that was `/rite-temper`. Vet challenges *implementation* scope only.

package/pack/generated/omp/skills/rite-vet/reference/artifacts.md

@@ -0,0 +1,202 @@
+# `eng-review.md` + `test-plan.md` templates + fold-back rules
+
+`eng-review.md` records review; `test-plan.md` drives Build. Fold accepted findings
+into `plan.md`/`tasks.md`; prose alone never changes Build.
+
+Authority: `.omp/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+## `eng-review.md`: the record
+
+Write/update `.devrites/work/<slug>/eng-review.md`; never clobber.
+
+```markdown
+# Eng review: <slug>
+Vetted: <iso>   Cross-model: ran (codex) | off
+Implementation readiness: <READY | NEEDS CLARIFICATION | NEEDS REPLAN>
+(`NEEDS REPLAN` is the eng-review field value; `NEEDS_REPLAN` with an underscore
+is the autocomplete/reply-contract routing token — do not conflate.)
+Readiness inputs SHA-256: <64 lowercase hex>
+
+## 1. Depth
+light | full (<trigger that escalated it>)     # every plan is vetted — light or full, never skipped (see depth.md)
+
+## 2. Scope challenge
+- Existing reuse: <findings adopted by the plan>
+- Minimum diff: <accepted | trimmed n; list in NOT-in-scope>
+- Complexity: ok | smell (<n files, m new services) → asked → <reduce|proceed, why>
+- Built-in / completeness / distribution: <flags, with source citations>
+
+## 2a. Build-entry preflight
+| Gate | Command + cwd | Tool/version | Prerequisite owner | Full provenance inputs | Fixture/smoke | Verdict |
+|---|---|---|---|---|---|---|
+| <test/browser/package> | <command · cwd> | <version> | <owner + item> | <tool/manifest/lockfile/config SHA-256> | <what ran> | pass/fail/blocked |
+
+## 2b. Implementation readiness
+| Surface | Requirement/decision | Boundary/wiring | Slice | Proof | Verdict |
+|---|---|---|---|---|---|
+| <journey/data/interface/ops> | <REQ/AC + coverage row> | <contract + key link> | <SLICE-###> | <test-plan row> | ready/gap |
+
+Inventory/currentness: <pass/gaps> · slice order/independence: <pass/gaps> ·
+UX/spec/architecture: <pass/n-a/gaps> · operations/rollout/rollback: <pass/n-a/gaps>
+
+Shared contract proof: <pass | gap: missing/one-sided/duplicated-contract/vague/non-consuming>
+One-shot evidence completeness: <n/a | pass: action + retained artifact + bounds/sanitization + injective boundary map + per-seam/collision/cleanup fixtures | gap: exact missing proof>
+
+## 3. Axis findings (floor-gated)
+| Axis | Floor band | Findings (sev · confidence) |
+|---|---|---|
+| Architecture | strong/adequate/thin/broken | Critical (9) … |
+| Plan code-quality | … | … |
+| Test-coverage design | … | see test-plan.md |
+| Performance | … | … |
+Suppressed (confidence ≤4, unverified): <count — one line each>
+
+## 4. Failure modes
+| New codepath/boundary | Realistic failure | Partial/unknown effect | Recovery owner/path | Proof? | Silent? | Verdict |
+|---|---|---|---|---|---|---|
+| <path> | timeout / duplicate / race / stale | <state/effect> | <owner/action> | y/n | y/n | ok / **CRITICAL gap** |
+
+## 5. Dependency safety
+<declared order is safe | exact dependency/order correction>
+
+## 6. Native reviewer accounts
+- `devrites-plan-reviewer`: <findings + resolution | evidence-based No-findings>
+- `devrites-strategy-reviewer`: <current Temper verdict | Not-applicable: low-stakes skip>
+- `devrites-devex-reviewer`: <findings + resolution | No-findings | Not-applicable: no developer surface>
+- Recheck: <not-needed | one narrow recheck and result>
+- Cross-model (if --cross-model): <overlap / unique findings — informational until approved>
+- Final: floor = <band>; unresolved → <none | blocking qid>
+
+## 7. Completion summary
+- Outcome: <one sentence; REQ/AC refs>
+- Boundaries: <IN/OUT/must-NOT refs>
+- Design/flow: <UI/n-a; chosen seams/why; happy/error refs>
+- Delivery: <slice order + first>
+- Proof/gates: <test-plan rows; justified action-time gates>
+- Review: scope <accepted/reduced>; architecture <n>; quality <n>; coverage <x/y>,
+  gaps <n>, Critical regressions <n>; failure modes <n>, Critical gaps <n>.
+- Entry/records: preflight <pass/fail/blocked>; checkpoints <none/list>;
+  NOT-in-scope + existing written; plan <hardened | n Guard deltas>.
+```
+
+## `test-plan.md`: the build-readable coverage target
+
+Write/update `.devrites/work/<slug>/test-plan.md`. `/rite-build`'s slice-wright
+writes tests from it; `/rite-prove` walks it against `evidence.md`. Specify
+*what/where* to test, not implementation.
+
+```markdown
+# Test plan: <slug>
+From /rite-vet on <iso>. Runner + conventions: <detected framework + command>.
+
+## Build-entry preflight
+| Gate | Command | Cwd | Expected | Prerequisites | Provenance to recapture |
+|---|---|---|---|---|---|
+| <test/browser/package> | <exact command> | <path> | <exit/output> | <service/browser/credential owner> | <tool version + full SHA-256s> |
+
+Link any disposable parser fixture. Preflight values are planning evidence, not post-build proof;
+Prove recaptures the observed command, candidate identity, and result.
+
+Commands in this durable artifact are portable repository commands: no RTK or local shell
+aliases, user-specific absolute paths, or temporary proof trees. Evidence records
+the command actually executed.
+
+## Consumptive action gates
+| Action | Why one-shot/consumptive | Retained artifact | Bounds + sanitization | Boundary map + collision proof | Terminal-path fixtures | Cleanup survival | Retry authority |
+|---|---|---|---|---|---|---|---|
+| <exact approved action or n/a> | <one attempt/quota/state/evidence deletion> | <durable operator-controlled path/schema> | <size/cardinality + known/unknown/malformed handling> | <every emit seam -> stable boundary ID; per-seam injection + alias mutant rejected> | <success/known/unknown/hostile> | <assertion> | <none/fresh human authorization> |
+
+Every behavioral row names a positive, discriminating assertion and the decisive output it
+produces. A command or expected exit zero alone is not a behavioral assertion; static gates
+prove only their named static criterion.
+
+## Coverage diagram
+<the ASCII code-paths + user-flows diagram from review-axes.md, with COVERAGE / GAPS / REGRESSIONS line>
+
+## Per-gap test requirements
+| ID | Path / flow | Test file (match conventions) | Asserts (input → expected) | Kind | Slice | Priority |
+|---|---|---|---|---|---|---|
+| T1 | <path> | <path/to.test> | <empty list → 200 + []> | unit / E2E / eval | <slice> | P1 / **Regression-Critical** |
+
+## Interaction inventory (UI slices — every element + flow gets an asserting test)
+Enumerate every interactive element and user flow the feature exposes; one row each, none
+skipped. Level per `testing.md` "Completeness": elements/fields → unit/component, critical
+journeys → one E2E (never one-per-field). `/rite-build` must cover every row; `/rite-prove`
+fails any row with no passing result — an unverified element is a NO-GO, like an unproven criterion.
+```markdown
+| Element / flow | Kind (field/checkbox/select/radio/toggle/button/link/flow) | Level | Test file | Asserts (action → expected) |
+|---|---|---|---|---|
+| email field | field | unit | <form.test> | invalid → error; valid → accepted |
+| login | flow ★★★ | E2E | <login.e2e> | submit → dashboard |
+```
+
+Omit the whole section only for a slice with **no** interactive surface (pure backend/logic).
+
+## Acceptance → test map
+
+- <spec acceptance criterion> → <T1, T3>   # every criterion maps to ≥1 test
+
+For every row in `plan.md`'s `Shared contract proof`, the per-gap requirements name both
+provider- and consumer-side asserting tests and state how each consumes the same canonical
+artifact. Reference the plan row; do not reproduce its contract table here.
+
+## Parallelization table (in `eng-review.md` §5 when there's an opportunity)
+
+```markdown
+| Step / workstream | Modules touched (dir-level) | Depends on |
+|---|---|---|
+| API endpoints | controllers/, serializers/ | — |
+| Worker | jobs/, lib/queue/ | API endpoints |
+
+Lanes:  A: API → Worker (sequential, shared lib/)   ·   B: migration (independent)
+Order:  launch A + B in parallel worktrees → merge → C
+Conflicts: Lanes A and B both touch models/ — sequential or coordinate.
+```
+
+## Fold-back: the part the build follows
+
+Vet hardens the plan. Use the marked action before fold-back.
+
+- **Write directly into `plan.md` / `tasks.md`** (single canonical writer: you, not the reviewer):
+  - `plan.md` §Scope boundaries ← "NOT in scope" items.
+  - `plan.md` §Architecture decisions ← reuse-over-rebuild calls + named failure scenarios.
+  - `plan.md` §Applicability and system ownership ← corrected topology/data/integration
+    routing and each triggered standard's feature-specific output.
+  - `plan.md` §Dependency graph / §Implementation order ← any dependency or ordering fix
+    (e.g. refactor-before-feature split).
+  - `plan.md` §Complexity & deviations gate ← any deviation the §0 challenge surfaced + its justification.
+  - `tasks.md` slices ← added test requirements (point at `test-plan.md`), added error-handling /
+    failure-mode coverage, tightened slice scope, a split of a refactor+behavior slice into two.
+    Adjust a slice's `Gate:` upward when vet reveals higher stakes (e.g. an unflagged migration).
+  - Re-run the `plan.md` Readiness gate after edits; it must still pass.
+- **Reslice:** marked action only; no local predicate.
+- **`decisions.md`:** one ADR per material call: `context · decision · why-not-the-alternative ·
+  what-would-change-it`.
+- **`assumptions.md`:** every "we'll probably need X" demoted to an explicit assumption-to-verify,
+  never smuggled into scope as a fact.
+
+## Write discipline
+
+- **Single canonical writer.** The skill writes review/test-plan and edits plan/tasks;
+  `devrites-plan-reviewer` is **read-only** and returns findings + bands.
+- **No silent scope.** Growing acceptance without a decision, or dropping a criterion
+  without the Guard, is a defect.
+- Put `eng-review.md` + `test-plan.md` between `tasks.md` and `state.md`. Build/Prove
+  read test-plan as coverage; Review/Seal may consult eng-review for scope/failures.
+- Finish `test-plan.md`, fold-back, and rechecks first. Changes to `brief.md`, `spec.md`,
+  `decisions.md`, `assumptions.md`, or `questions.md` require revalidating the
+  affected decision-coverage rows, assumption audit, residual uncertainty, and closed gates.
+  Partial/Missing, an unowned material assumption, or an open blocking/escalating question routes
+  `/rite-clarify`/HITL. Re-read affected rows with current evidence; repeat the exact
+  plan-reviewer and applicable strategy/DevEx after edits. Root writes READY only after
+  the checklist. Normal readiness rejects missing/stale bindings; empty tables,
+  placeholders, non-passing preflight rows, or an
+  acceptance criterion with no meaningful test mapping remain native review blockers.
+  After the final recheck, emit the binding with `devrites-engine check readiness
+  --emit-binding <slug>` and replace its one exact line. Never refresh it without Vet.

package/pack/generated/omp/skills/rite-vet/reference/cross-model.md

@@ -0,0 +1,19 @@
+# `--cross-model`: explicit outside integration
+
+This optional pass runs only when the user supplies `--cross-model` and a
+different-model plugin, MCP server, or other native integration is explicitly
+connected. DevRites does not discover aliases, invent a fallback model, or wrap
+availability.
+
+Give the integration the same immutable `spec.md`, `plan.md`, and `tasks.md`
+candidate, without author reasoning. Ask for evidence-backed findings on
+boundaries, scope/reuse, proof design, performance, reversibility, and failure
+modes. The integration must remain read-only.
+
+If no explicit integration is connected, record `requested but not configured`
+and continue with the native `devrites-plan-reviewer`; absence is neither a pass
+nor a blocker.
+
+Verify every returned finding against the project before accepting it. Record
+only the integration used and accepted evidence in `eng-review.md`; do not
+maintain availability aliases or outside-review telemetry.