devrites 4.7.0 → 5.0.0

package/pack/generated/codex/skills/rite-quick/SKILL.md

@@ -19,7 +19,7 @@ executable, not advisory. This lane uses the **Quick** depth profile from
 **Run this first. If ANY of these holds, STOP and route to `$rite-spec`. Do NOT use the
 express lane:**
 - Touches **auth / authz**, a **data migration**, a **public API contract**, or any
-  **destructive / data-loss** path in the irreversible-risk list. See `standards/afk-hitl.md`.
+  **destructive / data-loss** path in the irreversible-risk list. See `../devrites-lib/reference/standards/afk-hitl.md`.
 - Spans **more than one vertical slice**, or more than a couple of files of real logic.
 - **Ambiguous scope:** you'd have to guess what "done" means, or the ask hides a design
   decision (data model, new dependency, second design system).
@@ -32,7 +32,7 @@ If none hold, the change is small + reversible + unambiguous → proceed. **When
 escalate**: the cost of the full lifecycle on a small change is minutes; the cost of the
 express lane on a risky one is the failure mode the lifecycle exists to prevent.
 
-## Rules consulted
+## Rules consulted (read on demand from `.agents/skills/devrites-lib/reference/standards/`)
 Load this lane's conditional standards when needed:
 - `coding-style.md`: naming, guard clauses, reuse-first.
 - `testing.md`: TDD, **completeness** (every touched behavior/element asserted) +
@@ -50,7 +50,8 @@ Load this lane's conditional standards when needed:
 2. **One-line contract.** Restate in 1-3 lines: the change, its **acceptance** (how you'll
    know it works), and the **scope boundary** (what you will NOT touch). This is the entire
    "spec + plan" for a quick change: keep it in the chat; optionally drop a `brief.md` +
-   `evidence.md` under `.devrites/work/<slug>/` if the user wants a record. This is the
+   `evidence.md` under an unused `.devrites/work/<slug>/` (no `state.md`; not a workspace
+   cursor) if the user wants a record. This is the
    `$rite-frame` FRAME move: if the acceptance won't reduce to a check that could be *false*,
    the ask is ambiguous → escalate per the significance gate. Its AUDIT pass is the diff
    self-review in step 5.
@@ -64,7 +65,8 @@ Load this lane's conditional standards when needed:
 5. **Review-lite + ship.** Self-review the diff for correctness, scope, and idiom. If
    `.devrites/principles.md` exists, confirm that no declared invariant is broken. This is
    `$rite-frame`'s AUDIT pass: one pass, no subagent fan-out. Show the diff, then on the user's confirm commit it
-   (Conventional Commits, atomic), or hand to `$rite-ship` if a workspace is active. **Never push
+   (Conventional Commits, atomic), or hand to `$rite-ship` only when the change belongs to the active
+   feature's candidate; otherwise commit standalone. **Never push
    without the user asking.**
 
 ## Escalation (mid-flight): the Spec Drift Guard still applies

package/pack/generated/codex/skills/rite-resolve/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: rite-resolve
 description: User-invoked resume verb for answering, dropping, or batch-resolving open `questions.md` gates.
-argument-hint: "<qid> \"<answer>\"  |  --drop <qid> [\"<reason>\"]  |  --batch <path-to-yaml>"
+argument-hint: "<qid> \"<answer>\"  |  --drop <qid> [\"<reason>\"]  |  --batch <path-to-file>"
 user-invocable: true
 disable-model-invocation: true
 ---
@@ -29,8 +29,9 @@ Pull these via `Read` when shaping the resolve:
 
 ## Operating rules
 
-- **Requires an active workspace.** Read `.devrites/ACTIVE` first; if empty or the slug
-  has no `questions.md`, **STOP** and tell the user to run `$rite-spec <feature>` first.
+- **Requires an active workspace.** Read `.devrites/ACTIVE` first; if empty, **STOP** and
+  tell the user to run `$rite-spec <feature>` first. If the slug has no `questions.md`,
+  report the missing required artifact and stop.
 - **One mutation per call.** A single qid (or `--batch` file) per invocation; never
   silently coalesce multiple human decisions into one log entry.
 - **Never overwrite an answered question.** If the qid's `status` is `answered` or
@@ -60,7 +61,7 @@ Pull these via `Read` when shaping the resolve:
    - `<qid> "<answer>"`: answer the single open question.
    - `--drop <qid>` (optional `"<reason>"`): mark the question `dropped`; record
      the reason inline.
-   - `--batch <path-to-yaml>`: bulk resolve, one entry per qid (see
+   - `--batch <path-to-file>`: bulk resolve, one entry per qid (see
      [`reference/answer-protocol.md`](reference/answer-protocol.md) for the batch
      format).
 2. **Load context.** Read `state.md`, `questions.md`, and the relevant slice from

package/pack/generated/codex/skills/rite-resolve/reference/answer-protocol.md

@@ -84,7 +84,7 @@ writes one block at a time and pauses. When `$rite-resolve` matches the block's
 
 - the entire `Awaiting human` block is removed (header + fields);
 - `- Status: running` is set;
-- a `Log` line is appended: `- <iso> build: resolved <qid>`.
+- a `Log` line is appended: `- <iso> <resuming phase>: resolved <qid>`.
 
 If `state.md`'s `Status` is `awaiting_human` but no `Awaiting human` block matches the
 qid (drift between the two files), `$rite-resolve` flags the inconsistency and refuses

package/pack/generated/codex/skills/rite-review/SKILL.md

@@ -36,9 +36,8 @@ Pull these via `Read` when the diff demands them:
 
 ## Operating rules
 
-- **Feature scope only.** Review touched files + the diff. **NO whole-project refactors,
-  NO drive-by cleanup.** DO NOT delete suspected dead code outside this feature without
-  asking. Spec Drift Guard applies.
+- **Feature scope only** — see
+  [feature-scoped-review](reference/feature-scoped-review.md). Spec Drift Guard applies.
 - **Silent-failure hunt:** when the suite is green, require proof that error paths and
   partial-success branches would fail tests if broken. **Failing case:** tests pass but
   handler returns success on internal error → Critical until an asserting test exists.
@@ -58,7 +57,6 @@ Pull these via `Read` when the diff demands them:
 
 0. Read `.agents/skills/devrites-lib/reference/standards/core.md` first (the always-on operating rules); pull the
    on-demand rules above as the diff demands them.
-   Then read the explicit or active workspace's `state.md` directly.
 1. Read `spec.md`, `tasks.md`, `state.md`, `decisions.md`, `evidence.md`,
    `touched-files.md`, `.devrites/principles.md` (if present: the binding invariants to score
    the diff against), and the `git diff`. For "what would this change break"
@@ -114,18 +112,18 @@ Pull these via `Read` when the diff demands them:
    Add only what the dispatched agents could not, then resolve overlaps and
    contradictions before labeling. ([five-axis-review.md](reference/five-axis-review.md)
    documents the axes the code-review agent applies.)
-   - **UI feature?** Apply the **UX rubric**
+   - **UI feature?** Dispatch `devrites-frontend-reviewer` and apply the **UX rubric**
      ([nielsen-heuristics](reference/nielsen-heuristics.md)) and the
-     **cognitive-load lens** ([cognitive-load](reference/cognitive-load.md)) on the
-     UX axis: surface heuristics scoring ≤ 2 and any cognitive-load findings
-     (extraneous noise, missing progressive disclosure, vocabulary drift) at the
-     appropriate severity.
-5. **Security:** apply `devrites-audit security`
-   ([security-review](reference/security-review.md)) when user input, auth, data
-   storage, external integrations, secrets, or permissions are involved.
-6. **Performance:** apply `devrites-audit perf`
-   ([performance-review](reference/performance-review.md)) only when performance is
-   relevant or a regression risk is visible (measure first).
+     **cognitive-load lens** ([cognitive-load](reference/cognitive-load.md),
+     [performance-checklist](reference/performance-checklist.md)). No UI/route/style
+     paths: record `Not-applicable: no relevant paths in diff`.
+5. **Security:** dispatch `devrites-security-auditor`
+   ([security-review](reference/security-review.md)) when input, auth, data,
+   secrets, or permissions are in the diff; else `Not-applicable: no relevant paths in diff`.
+6. **Performance:** dispatch `devrites-performance-reviewer`
+   ([performance-review](reference/performance-review.md),
+   [performance-checklist](reference/performance-checklist.md)) only on a budget or
+   hot path; else `Not-applicable: no relevant paths in diff`.
 7. Reconcile and accept only in-scope fixes. Consolidate them into one bounded
    wright correction; never edit source in the reviewing context. Any correction
    updates the candidate manifest, returns through affected Prove, and then starts
@@ -145,21 +143,14 @@ Pull these via `Read` when the diff demands them:
 
 **Action tag (separate from severity).** Tag each finding with how to act on it:
 `blocking` (fix before seal), `non-blocking` (fix when convenient), or `if-minor` (fix only if the
-change is already small: a pure noise-economics lever). Only a **`blocking` Critical** gates the
-seal; a `non-blocking` / `if-minor` finding is recorded, not a stop.
+change is already small: a pure noise-economics lever). Every Critical is `blocking` and gates the
+seal; `non-blocking` / `if-minor` findings are recorded, not a stop.
 
-## Confidence and signal-to-noise
+## Confidence and severity
 
 Apply [`agents.md` § Result admission](../devrites-lib/reference/standards/agents.md#result-admission).
-Suppress unverifiable ≤4 hypotheses, require 7+ plus exact proof for
-Critical/Important, and make every silent/unusable account a blocking gap. Roll
-trivia into one line; review finds defects, not a quota.
-
-## Severity orientation (labels, not score)
-
-After labeling, summarize findings as `Critical / Important / Suggestion / Nit /
-FYI` counts. There is no composite number. `$rite-seal` gates on
-`Critical == 0` and on acceptance plus drift. Do not invent a composite score.
+Roll trivia into one line. `$rite-seal` gates on `Critical == 0`,
+`Important == 0` (y/N override), acceptance, and drift. No composite score.
 
 > **Mid-flight discipline.** When tempted to demote a Critical, hide a finding, fix without re-verification, or wander out of scope: see [`anti-patterns`](reference/anti-patterns.md). Load it the moment you reach for the excuse.
 

package/pack/generated/codex/skills/rite-review/reference/cognitive-load.md

@@ -88,5 +88,3 @@ doesn't decide the rewrite strategy.
 - **Code quality:** covered by the simplification audit
   (`devrites-audit simplify`).
 - **Security:** covered by the security audit (`devrites-audit security`).
-
-Cognitive-load findings live on the **UX axis** of the multi-axis review.

package/pack/generated/codex/skills/rite-review/reference/five-axis-review.md

@@ -1,7 +1,7 @@
-# Code-review axes
+# Five-axis review: tests first, then six axes
 
-The dispatched `devrites-code-reviewer` always checks tests first, then applies the remaining
-axes under one severity scale (Critical / Important / Suggestion / Nit / FYI).
+The dispatched `devrites-code-reviewer` checks tests first, then correctness, readability,
+architecture, maintainability, and standards under one severity scale (Critical / Important / Suggestion / Nit / FYI).
 The `$rite-review` inline lead **reconciles** the returned report against the Spec
 axis. It does not re-run these axes itself. This file is the shared definition of
 what "full code-review discipline" covers; use it to judge whether the agent's report

package/pack/generated/codex/skills/rite-review/reference/nielsen-heuristics.md

@@ -8,9 +8,6 @@ multi-axis review and shape the severity labels on UX findings.
 findings". 3 is "good with minor gaps". 2 is "partial: significant gaps". 0-1 is a
 Critical / Important.
 
-Heuristics are Jakob Nielsen's 10 (1994, refreshed 2020): public usability canon,
-referenced by every serious design discipline.
-
 ## 1. Visibility of system status
 Users know what's happening, when, and where.
 - Loading indicators on async operations.
@@ -120,10 +117,9 @@ Users can find what they need without leaving the surface.
 
 ## Reporting
 
-In `$rite-review` output, surface only the heuristics scoring **≤2** as findings,
-plus any 3 with a specific noted gap. Heuristics at 4 are not reported individually.
-They roll up into the UX axis. Heuristics at 3 with no specific gap are not
-reported. Each surfaced finding gets a severity label per `rite-review/SKILL.md`.
+In `$rite-review` output, surface heuristics scoring **≤2**, plus any 3 with a specific
+noted gap, as findings; every score feeds the UX axis. Each surfaced finding gets a
+severity label per `rite-review/SKILL.md`.
 
 The rubric is descriptive, not gating. A score of 2 on aesthetic-minimalist isn't
 an automatic NO-GO; the `rite-seal` gate is `Critical == 0`, not "every heuristic

package/pack/generated/codex/skills/rite-seal/SKILL.md

@@ -13,8 +13,9 @@ authorized irreversible actions and close-out.
 ## Authority
 
 Read [`core.md`](../devrites-lib/reference/standards/core.md) plus only
-final-diff-relevant standards: agents, review, proof,
-browser, security, principles, docs, observability, deprecation, and Done.
+final-diff-relevant standards: agents, code-review, testing, browser-proof-checklist,
+security, principles, documentation, observability, deprecation, and
+definition-of-done.
 Load [`final-evidence.md`](reference/final-evidence.md) and
 [`go-no-go.md`](reference/go-no-go.md) for proof and verdict safety.
 Follow the shared
@@ -44,7 +45,10 @@ and stops.
 
 ## Workflow
 
-Follow [`reference/phase-contract.md`](reference/phase-contract.md):
+Follow [`reference/phase-contract.md`](reference/phase-contract.md)
+([`risk-and-rollback.md`](reference/risk-and-rollback.md),
+[`seal-template.md`](reference/seal-template.md),
+[`anti-patterns.md`](reference/anti-patterns.md)):
 
 1. read workspace and final diff;
 2. recheck the canonical candidate/bindings and approved repository/CI proof;

package/pack/generated/codex/skills/rite-seal/reference/final-evidence.md

@@ -9,10 +9,9 @@ results and exact `devrites-spec-reviewer` checks implementation and proof
 against its meaning. Bug fixes require original-symptom proof; self-report,
 inspection alone, and generic "tests pass" do not count.
 
-Behavioral claims require positive, discriminating evidence under `testing.md`.
-Skipped/focused/filtered/pending, zero-test, assertion-free, tautological, unexecuted, or
-exit-only results are unproven. Static gates prove only their named static criterion;
-discriminating shell/golden/text assertions remain valid for textual or CLI acceptance.
+Apply [`testing.md`'s positive, discriminating proof](../../devrites-lib/reference/standards/testing.md#positive-discriminating-proof),
+including invalid-result exclusions and static/textual criterion boundaries.
+Unsupported behavioral claims remain unproven: NO-GO.
 
 ## Cross-check
 
@@ -37,5 +36,5 @@ devrites-engine check seal "<slug>"
 ```
 
 This checks structure and exact candidate bindings, never acceptance, test
-quality, doubt, or review. Mutation stays optional unless project policy or
-`test-plan.md` requires it.
+quality, doubt, or review. Apply [`testing.md`'s safe perturbation](../../devrites-lib/reference/standards/testing.md#safe-perturbation)
+for its mandatory critical/regression cases and any additional project/test-plan requirement.

package/pack/generated/codex/skills/rite-seal/reference/risk-and-rollback.md

@@ -38,7 +38,7 @@ For each risky step, state how to back it out:
   or no outage/backlog recovery and monitoring is **NO-GO**.
 - Unsafe intermediate deployment order, unvalidated required configuration, or no watched
   rollout signal/owner is **NO-GO** for live exposure.
-- Record the chosen rollback path in `seal.md` → "Rollback / Recovery".
+- Record the chosen rollback path in `seal.md` → "Risks / Rollback".
 
 ## Fresh-context availability
 

package/pack/generated/codex/skills/rite-seal/reference/seal-template.md

@@ -18,6 +18,8 @@ Candidate SHA-256: <64 lowercase hex>
 - devrites-devex-reviewer: <outcome>
 ## Risks / Rollback
 <risks/recovery>
+## Stood Decisions
+<doubt verdict per stood decision>
 ## Blockers / Follow-ups
 <blockers/follow-ups>
 ## Final Decision

package/pack/generated/codex/skills/rite-ship/SKILL.md

@@ -13,7 +13,7 @@ if absent, route to `$rite-spec <feature>`. Ship only with current **GO** in `se
 ## Rules consulted (read on demand from `.agents/skills/devrites-lib/reference/standards/`)
 **Step 0:** Read `core.md`, then pull as needed:
 - `git-workflow.md`: Conventional Commits, atomicity, never-commit list.
-- `afk-hitl.md`: type-GO irreversible-action gate.
+- `afk-hitl.md`: AFK pause rules for irreversible actions (the type-GO gate itself: [`git-ship.md`](reference/git-ship.md), [`rollout.md`](reference/rollout.md)).
 - `definition-of-done.md`: acceptance, evidence, drift, rollback, docs.
 - [`release/ship-checklist.md`](../devrites-lib/reference/standards/release/ship-checklist.md): final pass/fail sweep.
 
@@ -77,7 +77,8 @@ if absent, route to `$rite-spec <feature>`. Ship only with current **GO** in `se
    unchanged pre-GO reconciliation.
 6. **Close.** Set `state.md` phase `done`; follow
    [`close-out.md`](reference/close-out.md) and run `devrites-engine state close <slug>`
-   to move `.devrites/work/<slug>` → `.devrites/archive/<slug>` and clear `ACTIVE`.
+   to move `.devrites/work/<slug>` → `.devrites/archive/<slug>` and clear `ACTIVE`
+   only if it names this slug; preserve another active feature's cursor.
    Preserve every `.md`; stable hierarchical instructions need no active-workspace sync.
 
 > **Mid-flight discipline.** No seal GO, skipped type-GO, out-of-manifest stage, or

package/pack/generated/codex/skills/rite-ship/reference/close-out.md

@@ -14,8 +14,16 @@ deleted. DevRites keeps the audit trail; it just moves out of the live path.
    It moves `.devrites/work/<slug>/` → `.devrites/archive/<slug>/` (every `.md`
    intact) and clears `.devrites/ACTIVE` **only if** ACTIVE still points at `<slug>`.
    It refuses to clobber an existing `.devrites/archive/<slug>/` (exit 5).
-3. **Confirm.** ACTIVE is now empty, so the next `$rite-spec` starts a clean feature
-   and `$rite-status` reports "no active feature".
+3. **Confirm the observed post-state.** The archive exists with its audit records
+   intact and the live workspace is absent. If ACTIVE named this slug, verify it is
+   empty; if it named another feature, verify that value remains unchanged. Only an
+   empty cursor permits the claim "no active feature".
+
+Any nonzero exit stops close-out. Archive collision (exit 5) never authorizes overwrite.
+If clearing ACTIVE fails, the engine attempts to move the archive back; that rollback
+can also fail. Inspect the actual live path, archive and cursor before reporting or
+retrying. Record the command/error and observed locations; never claim restored state
+from an attempted rollback or repeat a move against an unverified destination.
 
 ## Why archive, not delete
 
@@ -26,9 +34,21 @@ deleted. DevRites keeps the audit trail; it just moves out of the live path.
 
 ## Re-opening an archived feature
 
-To resume archived work, move it back:
-`mv .devrites/archive/<slug> .devrites/work/<slug>` and write `<slug>` into
-`.devrites/ACTIVE`. Nothing is lost: close-out is reversible by design.
+Before restoring an archive, verify its identity, released cursor form and declared
+workspace schema, that the live destination is absent, and that ACTIVE is empty or
+already names this slug. A collision or another active feature stops restoration;
+do not replace its workspace or cursor. Supported released cursor forms remain valid:
+age or encoding alone never requires normalization (see
+[workspace-artifact-schema.md](../../devrites-lib/reference/workspace-artifact-schema.md)).
+An unsupported declared schema stops restoration: record the observed version,
+installed engine's recovery diagnostic and pending normalization owner. Do not guess
+a repair or claim `$rite-upgrade` migrates archives; archived/done work is its no-op.
+
+After an authorized restoration, verify the actual paths and cursor and preserve the
+audit records. Reconcile the resumed scope through `$rite-converge`; changes return to
+the applicable earlier lifecycle stage. Historical proof/GO remains historical: a new
+candidate requires fresh Prove → Polish → Review → Seal bindings before Ship. Restoring files
+does not reactivate an old GO.
 
 Cross-feature review is user-invoked through `$rite-learn`; close-out does not
 mine, score, nudge, or write a retrospective ledger.

package/pack/generated/codex/skills/rite-ship/reference/rollout.md

@@ -6,7 +6,7 @@ runbook. A Seal GO or AFK setting never authorizes production action.
 
 ## Preconditions before exposure
 
-Record one rollout sheet in `ship.md`/`evidence.md`:
+Record one rollout sheet in `ship.md`:
 
 | Item | Required decision/evidence |
 | --- | --- |

package/pack/generated/codex/skills/rite-spec/SKILL.md

@@ -106,7 +106,8 @@ load a routed standard to discover required behavior, not to prescribe implement
    [state-workspace](reference/state-workspace.md). If the slug already exists,
    update the existing workspace rather than overwrite it; preserve history and
    unrelated settled content. Write every required artifact and conditional
-   annex exactly from [spec-template](reference/spec-template.md), including its
+   annex exactly from [spec-template](reference/spec-template.md)
+   ([ai-spec-template](reference/ai-spec-template.md)), including its
    capability impact, existing-behavior preservation, grammar/delta,
    stakeholder/constraint/invariant, failure/recovery, applicability, coverage-seed,
    qualified backstop, edge/prohibition, UI, and AI rules. Native

package/pack/generated/codex/skills/rite-spec/reference/anti-patterns.md

@@ -25,4 +25,3 @@ Pack-wide rationalizations + red flags: see [standards/anti-patterns.md](../../d
 - A `[NEEDS CLARIFICATION]` marker remains on a blocking item.
 - Design references were attached but never opened, saved, or indexed in `references.md`.
 - The investigation didn't read the module/component that currently owns this area.
-- A material decision landed in `spec.md` / `assumptions.md` that the human never picked from an option set: decided on the agent's confidence alone.

package/pack/generated/codex/skills/rite-spec/reference/investigation.md

@@ -47,9 +47,7 @@ Use native file search over `.devrites/archive/*/{spec,decisions}.md`.
    action-time decisions the acceptance path requires. Separate these from agent-owned
    implementation and diagnostic work.
 
-Gather any design or reference materials the human supplies, including screenshots,
-Figma, links, or video. See [references-intake](references-intake.md). Record whether
-each is a target, constraint, or inspiration for later phases.
+Design/reference materials the human supplies: see [references-intake](references-intake.md).
 
 ## Gap analysis (present → desired)
 State the present and desired states. Their delta defines the work; unknowns in that

package/pack/generated/codex/skills/rite-spec/reference/spec-checklists.md

@@ -76,7 +76,7 @@ Each question checks one requirement-prose failure mode:
 
 The spec **Readiness gate** at the bottom of
 [`spec-template.md`](spec-template.md) requires every
-emitted `checklists/<domain>.md` must reach `Verdict: pass` (zero CRITICAL fails) before the gate
+emitted `checklists/<domain>.md` to reach `Verdict: pass` (zero CRITICAL fails) before the gate
 passes. Minor fails are logged, not blocking. A single open CRITICAL keeps the spec `Status: Draft`.
 `$rite-define` reads the checklists at step 0 and **hard-blocks while any CRITICAL is
 unchecked**. A spec without checklists is not yet checked, so define stops and routes

package/pack/generated/codex/skills/rite-spec/reference/spec-template.md

@@ -138,7 +138,7 @@ status routes Define/Vet/Build/Prove to the named standard without copying it he
 | Q-001 | blocking | [NEEDS CLARIFICATION: <question>] | AC-001 |
 
 ## Readiness gate
-- [ ] No blocking clarification; REQ/AC IDs are valid and ACs independently provable.
+- [ ] No blocking clarification or open `blocking`/`escalating` question; REQ/AC IDs are valid and ACs independently provable.
 - [ ] Stakeholder conflicts/priority rules, constraints, and invariants are explicit;
       implementation preferences are not disguised as requirements.
 - [ ] Existing affected behavior maps to preserving REQ/AC + current evidence, or uses the exact justified greenfield `none`.

package/pack/generated/codex/skills/rite-spec/reference/state-workspace.md

@@ -14,6 +14,7 @@ Load that schema before creating or updating workspace artifacts.
       README.md                  # compact workspace map
       brief.md
       spec.md
+      checklists/                # from $rite-spec step 5a
       architecture.md            # from $rite-define
       flows.md                   # optional Mermaid-first; only when useful
       visual/                    # optional HTML+outline companions (never readiness)
@@ -21,6 +22,7 @@ Load that schema before creating or updating workspace artifacts.
       assumptions.md
       questions.md
       decision-coverage.md       # from $rite-clarify
+      strategy.md                # from $rite-temper
       plan.md                    # from $rite-define
       tasks.md                   # from $rite-define
       traceability.md            # from $rite-define
@@ -96,11 +98,12 @@ last_updated: <date>
 | brief.md | Objective and bounds |
 | spec.md | Product contract |
 | decision-coverage.md | Clarification verdict; absent until $rite-clarify |
+| strategy.md | Temper record; absent until $rite-temper |
 | architecture.md | Technical map; absent until $rite-define |
 | plan.md | Technical approach; absent until $rite-define |
 | tasks.md | Vertical slices; absent until $rite-define |
 | traceability.md | Coverage dashboard; absent until $rite-define |
-| evidence.md | Proof log; absent until $rite-prove |
+| evidence.md | Proof log; absent until $rite-build or $rite-prove |
 
 ## Read next
 | Phase / role | Read |
@@ -151,8 +154,7 @@ work preserves that valid cursor. Once the prerequisite chain is green, the
 controlling caller restores the saved phase/action and removes both rows in one
 rewrite. A real HITL or exhausted-recovery stop retains the cursor for cold
 resume. Never overwrite an existing valid return cursor, and preserve every
-unrelated Markdown byte. `$rite-clarify` applies its stricter native cursor
-protocol below.
+unrelated Markdown byte. `$rite-clarify` applies its stricter native cursor protocol in `$rite-clarify`.
 
 On cold resume, a terminal `next_action` is a claim to verify, not a counter.
 Reconcile the exact fingerprint and its attempts in `drift.md` / `evidence.md`.
@@ -177,6 +179,7 @@ slices remaining`; preserve that presentation rather than migrating it.
 status: open | answered | dropped
 slice: spec | plan | SLICE-001
 gate: advisory | validating | blocking | escalating
+route: <specialist tag> (escalating only; omit otherwise)
 question: <one crisp sentence>
 options:
   1. <recommended> (Recommended) - <trade-off>

package/pack/generated/codex/skills/rite-status/SKILL.md

@@ -28,7 +28,8 @@ If `state.md` is unreadable/malformed: report a gap with the defect and stop —
 4. the single `Next step` recorded in `state.md`;
 5. proven versus unproven evidence;
 6. open questions by gate, including the exact resolving command when awaiting
-   a human;
+   a human; list `gate: escalating` entries separately under **Escalating:**
+   with their `route:` specialist tag (do not mix with synchronous blockers);
 7. unresolved drift and material risks;
 8. handoff readiness.
 
@@ -47,6 +48,7 @@ Feature: <slug> — <objective>
 Phase: <phase>; slice: <slice|n/a>; mode: <HITL|AFK>; status: <status>
 Evidence: <fresh/proven summary | gaps>
 Open: <questions/drift/blockers | none>
+Escalating: <qid route:tag … | none>
 Handoff: <ready | missing durable context>
 Next: <single persisted command>
 ```

package/pack/generated/codex/skills/rite-temper/SKILL.md

@@ -53,7 +53,7 @@ the spec applicability map triggers that risk family.
    repair` (record in `drift.md`), not a blind spec edit.
 1. **Significance test:** [`reference/significance.md`](reference/significance.md). Low-stakes
    / shape-not-meaning work → write the exact one-line `skipped — low stakes (<trigger>)` verdict to `strategy.md`,
-   set `state.md` `Next step: $rite-define`, and recommend it. Otherwise fire the full pass below.
+   set `state.md` `Phase: temper` + `Next step: $rite-define`, and recommend it. Otherwise fire the full pass below.
 2. **FORWARD pass + mode selection:** [`reference/scope-modes.md`](reference/scope-modes.md).
    First, the **one-sentence-intent test**: state the whole change's intent in a single sentence.
    If you can't without an "and" that joins two unrelated outcomes, it is **two features**: the
@@ -85,21 +85,21 @@ the spec applicability map triggers that risk family.
    records the interactive review but does not replace it. Present each material scope decision through
    `AskUserQuestion`, one at a time, best-guess + **why**. Each material scope call ends as a
    **recorded decision**: a resolved `questions.md` qid (HITL) or a `decisions.md` ADR (AFK):
-   so the review leaves an auditable record outside chat. (AFK gate policy is single-sourced in
-   [`reference/significance.md`](reference/significance.md): `hold-rigor` + `reduce-to-MVP`
+   so the review leaves an auditable record outside chat. (AFK gate policy —
+   [`reference/significance.md`](reference/significance.md) — `hold-rigor` + `reduce-to-MVP`
    auto-apply, **any `expand` is a blocking pause**, irreversible-risk always pauses.)
    Apply objective clarity, mitigation, and assumption fixes directly.
 6. **Write `strategy.md` + fold back:** [`reference/strategy-template.md`](reference/strategy-template.md).
    **Choose the drift path based on whether a plan exists:** *no `plan.md` yet* (the normal pre-define
-   case) → update `spec.md` **through the Spec Drift Guard**. *Success criteria* **and**
-   *Acceptance criteria* for each opt-in expansion / cut, **Non-goals** for every deferred item,
-   *Constraints* **and** *Risks* the pre-mortem demands, and the gaps/decisions table; *`plan.md`
+   case) → update `spec.md` **through the Spec Drift Guard**. *Success metrics* (outcome-level, no AC id)
+   **and** *Acceptance criteria* for each opt-in expansion / cut, **Non-goals** for every deferred item,
+   *Constraints and invariants*, with top failure modes + mitigations folded into *Failure and recovery
+   behavior* rows, and the *Open questions* table; *`plan.md`
    already exists* → do **not** edit `spec.md` here: write the deltas to `drift.md` and hand off
    to `$rite-plan repair`. Either way, append `decisions.md` (one ADR per scope call: context ·
    decision · why-not · what-would-change-it) and `assumptions.md` (every "we'll probably need X" →
-   assumption-to-verify). **Every scope delta must carry a recorded human decision**: a resolved
-   `questions.md` qid (HITL) or a `decisions.md` ADR (AFK within the ceiling); a folded change with
-   no recorded decision is invalid. **Re-check the spec Readiness gate** (it fails if
+   assumption-to-verify). (every delta carries the step-5 recorded decision; an untraceable
+   fold is invalid). **Re-check the spec Readiness gate** (it fails if
    any folded scope delta lacks its decision or leaves a foreseeable human build choice).
    After any edit to `brief.md`, `spec.md`, `decisions.md`, `assumptions.md`, or
    `questions.md`, re-scan the affected coverage rows, assumption audit, residual uncertainty,

package/pack/generated/codex/skills/rite-temper/reference/review-dimensions.md

@@ -17,8 +17,8 @@ the gate uses the **lowest band**, not an average.
    human prerequisites and action-time approvals instead of deferring generic uncertainty to
    build. **Unmitigated top risks are gating.**
 5. **Over-engineering / YAGNI:** speculative capability, unused extension points, premature
-   abstraction, second-system bloat. Apply the pack's standard (`patterns.md`) + the "imagine
-   the later refactor" test. Defer unless now-cost is trivial AND deferred-cost is large.
+   abstraction, second-system bloat. Apply the pack's standard (`patterns.md`) and the YAGNI
+   ledger test (scope-modes.md Pass 2).
 6. **Acceptance testability and completion:** every acceptance criterion measurable, technology-
    agnostic, and comparable **down to a baseline** ("better than the current workaround"), not
    up to an unbounded ideal. Vague adjectives ("fast/robust/intuitive") and "handles X

package/pack/generated/codex/skills/rite-temper/reference/scope-modes.md

@@ -26,8 +26,8 @@ Invert. Two subtractive moves:
 - **YAGNI ledger.** Each candidate scope item gets the "imagine the later refactor" test: if
   adding it *later* isn't materially more expensive, **defer it** (with a revisit note).
   Bias hard toward defer: most presumed-needed features are never used. Reuse the
-  pack's existing `patterns.md` standards, including "no abstraction before two real callers"
-  and "speculative generality." Don't invent a new YAGNI rule.
+  pack's existing `patterns.md` standard ('no speculative abstraction or pattern
+  without a current need'). Don't invent a new YAGNI rule.
 
 ## The four modes: commit exactly one
 Mode selection is the first convergence move. Record the chosen mode + rationale + the

package/pack/generated/codex/skills/rite-temper/reference/significance.md

@@ -5,9 +5,6 @@ enough to earn it, a one-line skip otherwise. This is the shared definition used
 optional `$rite-temper` path and the always-run (significance-gated) `$rite-autocomplete` step,
 so they agree on when it fires.
 
-A strategic review of a five-line, reversible change is theatre; a strategic review of an
-auth rewrite is the cheapest insurance you'll buy. Gate on stakes and shape, not uniformly.
-
 ## Fire the FULL review when ANY trips
 - **Irreversible-risk contact:** the slice/spec touches anything on the `afk-hitl.md`
   irreversible-risk list: destructive data migration, auth/authz boundary, public-API break,
@@ -32,7 +29,10 @@ On skip, **don't run the passes**. Write only the one-line verdict to `strategy.
 
 ```markdown
 # Strategy: <slug>
-Significance: skipped — low stakes (<the trigger that was NOT met, e.g. "single-module, reversible, scope unambiguous">)
+Tempered: <iso>
+
+## 1. Significance
+skipped — low stakes (<trigger>)
 Next: $rite-define
 ```
 

package/pack/generated/codex/skills/rite-temper/reference/strategy-template.md

@@ -65,14 +65,14 @@ already exists, record in `drift.md` and route via `$rite-plan repair` instead o
 
 - **`spec.md`:** these are the spec template's actual section headings. Edit each named one;
   don't collapse pairs.
-  - Add to *Success criteria* **and** *Acceptance criteria* (separate sections) for
+  - Add to *Success metrics* **and** *Acceptance criteria* (separate sections) for
     every opt-in **expansion**; remove (via the Guard) from both for every **reduction**. Each
     must stay measurable + technology-agnostic.
   - *Non-goals*: append every deferred item (from the YAGNI ledger + the Deferred register), so
     it is neither silently dropped nor silently re-injected mid-build.
-  - *Constraints* **and** *Risks* (separate sections): tighten *Constraints* where the pre-mortem
-    demands; add the top failure modes + mitigations to *Risks*.
-  - *Gaps, issues & decisions* table: one row per scope call (options offered → decision → owner).
+  - *Constraints and invariants*: tighten where the pre-mortem demands; top failure modes +
+    mitigations go to *Failure and recovery behavior* rows.
+  - *Open questions* table: one row per scope call (options offered → decision → owner).
   - **Re-run the Readiness gate** at the bottom of the spec after edits; it must still pass, and
     **every folded scope delta must trace to a recorded decision** (a `questions.md` qid or a
     `decisions.md` ADR): an untraceable change is the batch-dump failure.
@@ -86,5 +86,5 @@ already exists, record in `drift.md` and route via `$rite-plan repair` instead o
   `devrites-strategy-reviewer` agent is **read-only** and only returns findings + bands.
 - **No silent scope.** An expansion that the human didn't opt into, or a reduction that drops an
   acceptance criterion without a recorded decision, is a defect, not a convenience.
-- Add `strategy.md` to the workspace between `spec.md` and `plan.md`; `$rite-define`,
-  `$rite-review`, and `$rite-seal` read it.
+- Add `strategy.md` to the workspace between `spec.md` and `plan.md`; `$rite-define` and
+  `$rite-ship` read it.

package/pack/generated/codex/skills/rite-upgrade/SKILL.md

@@ -8,7 +8,7 @@ disable-model-invocation: true
 
 # $rite-upgrade: reconcile a released workspace safely
 
-Use when an unfinished workspace from an older release cannot resume. This is a
+Use when an unfinished workspace from an older release cannot resume. This is an
 audit/orchestrator—not a pack update, cursor conversion, release replay,
 structural migration, or generic cleanup.
 
@@ -107,6 +107,6 @@ Changed: <admitted active-workspace paths | none>
 Evidence: assessment=current; candidate rc=<n|n/a>; seal rc=<n|n/a>; readiness rc=<n|n/a>; protected history/source unchanged
 Open: <none | exact unsupported shape, evidence gap, or human gate>
 Next: <state.md next action | one owning rite>
-Record: .devrites/work/<slug>/state.md
+Record: <owning rite's state.md — written by the owner, not Upgrade>
 ↻ Hygiene: /clear before the next lifecycle step
 ```