devrites 4.7.0 → 5.1.0

package/pack/generated/omp/skills/rite-build/reference/one-slice-cycle.md

@@ -0,0 +1,47 @@
+# One-slice cycle
+
+One wright dispatch builds one thin, proven slice. HITL stops; only explicit
+`.devrites/AFK` lets the controlling root chain another pending slice under the
+green-proof, cap, and pause rules. Each wright returns after exactly one slice.
+This serial cycle is the default `/rite-build`. Opt-in fan-out: [`parallel-batch.md`](parallel-batch.md) (`--parallel N`).
+
+## The cycle
+
+The orchestrator (`/rite-build`) gates and records; the **wright** writes. See
+[`wright-dispatch.md`](wright-dispatch.md).
+
+```text
+SELECT    → orchestrator: restate slice goal + acceptance + scope boundary; HITL gate (pause pre-code)
+(SHAPE)   → orchestrator: missing UI design-brief.md → shape it, then /rite-vet before dispatch
+DISPATCH  → hand the slice contract to devrites-slice-wright (fresh context). Inside the wright:
+   ORIENT    → load only the files this slice touches; learn the project's idiom; reuse-first
+   (RED)     → if behavior change: write the failing test first
+   IMPLEMENT → smallest complete version; match conventions; devrites-frontend-craft for UI
+   VERIFY    → writer-safe tests/types/lint; return code + tests
+(DOUBT)   → orchestrator, on return: devrites-doubt each non-trivial decision the wright stood up
+PROVE     → root: required build/browser/E2E, then returned-diff/path review; fail-on-red
+RECORD    → orchestrator: after green verification, update state.md/evidence.md and
+            upsert the authoritative candidate manifest from the actual scoped diff
+(CHECKPOINT) → orchestrator: if .devrites/CHECKPOINT is set, commit the proven slice
+            local-only as WIP(<slug>) with a [devrites-context] body → survives a crash (checkpoint.md)
+NEXT      → HITL root reports and stops; AFK root may repeat only under afk-discipline.md
+```
+
+## Why the boundary matters
+
+Reviewable diffs, early drift signal, HITL decision point, no unproven pile-ups.
+
+## Restate the scope boundary
+
+Before coding, write what this slice will and will **not** touch. This is the contract
+you check yourself against: anything outside it is scope creep or a drift event.
+
+## When the slice can't be completed cleanly
+
+- Discovered the plan is wrong → **Spec Drift Guard** (record, classify;
+  agent-owned repair+vet inline; ask only for product/policy/irreversible-risk).
+- Slice is bigger than one cycle → `/rite-plan reslice` inline when AC is
+  preserved; do not emit a human Fix.
+- Blocked on a failing dependency → record in `state.md`, `/rite-plan unblock`
+  inline when the reroute is technical.
+Never power through by guessing.

package/pack/generated/omp/skills/rite-build/reference/output.md

@@ -0,0 +1,33 @@
+# rite-build output
+
+**Slices remain:**
+
+```text
+Done: built slice <n> — <name>.
+Changed: <files>; state.md, touched-files.md, evidence.md
+Evidence: acceptance met; tests <cmd> → pass; browser <summary|n/a>; drift <none|handled>
+Open: <none|blockers|questions>
+Next: /rite-build
+Record: .devrites/work/<slug>/evidence.md
+↻ Hygiene: /clear between slices; /rite-handoff if away > a few hours
+```
+
+**All built:**
+
+```text
+Done: built slice <n> — <name>; all slices built.
+Changed: <files>; state.md, touched-files.md, evidence.md
+Evidence: acceptance met; tests <cmd> → pass; browser <summary|n/a>; drift <none|handled>
+Open: <none|blockers|questions>
+Next: /rite-prove
+Record: .devrites/work/<slug>/evidence.md
+↻ Hygiene: /clear before /rite-prove; /rite-handoff if away > a few hours
+```
+
+HITL returns after one green slice. Only explicit `.devrites/AFK` lets the
+controlling root chain another pending slice after green-proof, cap, and pause
+gates. Every `devrites-slice-wright` returns after exactly one slice.
+
+At all built, Build never enters `/rite-prove` automatically; a higher-level
+orchestrator may invoke it only under its own contract. Awaiting-human or
+stopped states use the shared reply contract.

package/pack/generated/omp/skills/rite-build/reference/parallel-batch.md

@@ -0,0 +1,87 @@
+# Parallel batch (`--parallel N`)
+
+Opt-in only. Default `/rite-build` stays [`one-slice-cycle.md`](one-slice-cycle.md).
+
+## Entry
+
+| Input | Behavior |
+| --- | --- |
+| omitted / `--parallel 1` | Serial one-slice |
+| `--parallel N` (**2≤N≤10**) | Parallel when eligible + host pass |
+| non-integer / `N≤0` / `N>10` | Hard refuse (no silent clamp) |
+
+AFK caps `N` by remaining budget. Charge **only after successful integrate**
+(once per integrated green sibling). Abort / integrate-failed → **0**. A
+`running` lease blocks another `/rite-build`. Any present lease blocks
+`parallel create` until cleanup.
+
+## Path-disjoint
+
+Exact project-relative source/test paths only. Normalize `\`→`/`. Reject `..`,
+duplicates, absolutes, `.devrites/**`. Empty pairwise intersection required.
+
+**SSOT:** `devrites-engine check path-disjoint [--root <dir>] [<json-file>|-]`
+(N≥2 only; pass `--root`). Exit `0` → fan-out; else force serial. Inspect-time
+overlap → sibling **gap** → abort. **Failing case:** two parallel wrights share a
+path and fan-out proceeds without that check.
+
+## Control vs workers
+
+Control owns `.devrites/work/<slug>/` (lease + bookkeeping).
+Workers: `.scratch/parallel-wt/<batch>/<slice>/` on
+`devrites/parallel/<slug>/<batch>/<slice>` @ base `B`. Wrights never write
+`.devrites/**`.
+
+Lease: `batch_id`, `created_at`, `base_sha`, `n`,
+`status` (`running|aborted|integrate-failed|complete`), `control_pid_or_session`,
+`slices[]` (`id`, `paths`, `worktree_path`, `branch`, `wright_status`,
+`transfer_commit`).
+
+## Lifecycle
+
+1. Orient/gate; parse N; select ≤N path-disjoint pending slices.
+2. Write lease; freeze `B=HEAD`; `parallel create` worktrees.
+3. Dispatch ≤10 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`).
+4. Inspect + fail-on-red → `green|red|gap`. Independent-review Critical is `gap`
+   even when targeted tests are green.
+5. Any red/gap → **abort** (no partial integrate). All green → serial integrate.
+6. Integrate: `transfer_commit` descends from `B`; `` `<base>..<transfer>` ``
+   path-exact; apply in plan order. Conflict → reset to `B`, `integrate-failed`.
+7. Success: FF control; union `touched-files.md`; update state/evidence; AFK +1
+   per integrated sibling; optional `check candidate`.
+8. Cleanup: success removes worktrees/branches. Abort keeps them as repair
+   inputs until the root consumes them: agent-owned plan gaps (AC unchanged)
+   follow [`spec-drift-guard.md`](spec-drift-guard.md) — `/rite-plan repair` then
+   `/rite-vet` inline, then cleanup and resume Build. Do not emit
+   `Fix: /rite-plan repair`. Product/policy/irreversible-risk still stops.
+
+## Engine verbs
+
+```text
+devrites-engine parallel create|record-green|abort|integrate|cleanup|status
+devrites-engine parallel lease-write|lease-read|lease-clear
+```
+
+Go is SSOT. Skill calls the engine — never ad-hoc git/bash orchestration.
+
+## Runtime isolation
+
+Each parallel worktree must own isolated runtime resources. Before fan-out,
+assign per-slice env (document in the lease or worktree README):
+
+| Resource | Pattern |
+| --- | --- |
+| HTTP port | `PORT=<base+N>` or `DEVRITES_PARALLEL_PORT_<slice>` |
+| Compose | `COMPOSE_PROJECT_NAME=devrites-<slug>-<batch>-<slice>` |
+| SQLite/DB file | separate path under the worktree or `/tmp` |
+| Dev server | one process per worktree; never share a listener |
+
+Reusing the control worktree's running server, DB, or compose stack across
+siblings causes cross-slice pollution and flaky proof. Abort if isolation cannot
+be established.
+
+## Host
+
+omp: N concurrent `task` tool / `tasks[]` batch wrights (`acceptEdits`, cwd=worktree). Codex: require
+host-explicit concurrent worktree writers + native reconcile; else force serial.
+Never two writers in one worktree; never root-emulated concurrency.

package/pack/generated/omp/skills/rite-build/reference/phase-contract.md

@@ -0,0 +1,67 @@
+# rite-build phase contract
+
+See [`one-slice-cycle.md`](one-slice-cycle.md); candidate lifecycle is
+[`candidate-integrity.md`](../../devrites-lib/reference/candidate-integrity.md).
+Opt-in `--parallel N` uses [`parallel-batch.md`](parallel-batch.md) instead of steps 2–8.
+Spec Drift Guard still applies on abort or plan-gap.
+
+1. **Orient and gate.** Read core, `.devrites/ACTIVE`, `state.md`, and required
+   slice artifacts. Require `Implementation readiness: READY`, its current
+   `Readiness inputs SHA-256`, all applicable exact reviewer accounts,
+   ID-and-meaning traceability, and green proof preflight; run
+   `devrites-engine check readiness <slug>`. Any miss/nonzero stops.
+2. **Select one target.** Restate goal, acceptance criteria, exclusions, and exact
+   source/test paths. Reconcile the spec/plan applicability map and include only the
+   triggered topology/data/integration standards plus their named failure/recovery/proof
+   cases in the writer contract. Before dispatch, validate relevant `assumptions.md` rows
+   against live evidence. If one is disproved and changes acceptance, architecture,
+   scope, or proof, use the Spec Drift Guard/plan recovery; a human-owned unknown
+   stops. Resolve HITL before source work. AFK answers only permitted gates;
+   human-owned or irreversible risk persists a question and stops for `/rite-resolve`.
+   If the target is an exact Vet-ready Workflow Artifact set, apply
+   [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md)
+   instead of treating it as a product slice.
+3. **Dispatch or transact.** Product source/tests apply [`wright-dispatch.md`](wright-dispatch.md).
+   Put the smallest exact project-relative source/test path list directly in the task;
+   dispatch the exact `devrites-slice-wright` fresh. Root never writes those product
+   paths, wright never widens, and a missing profile stops.
+<!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"Build gate enters or resumes transaction","action":"invoke canonical operation table; reconcile exact result","return":"same slice/checkpoint cursor or Plan/Vet route"} -->
+4. **Inspect the return.** Wait; compare its file list and `git diff --name-only`
+   with the contract. Reject stale, partial, malformed, or out-of-scope work.
+   Preserve user work; source restoration uses the same bounded wright.
+5. **Challenge stood decisions.** For each stood decision, run exact
+   `devrites-doubt-reviewer` fresh/read-only and record accepted or resolved-rejected
+   in `decisions.md`. A missing verdict, principle breach, scope change, or
+   irreversible risk blocks.
+6. **Prove without guessing.** Against the frozen pre-slice candidate, inspect
+   test hunks for deletion, skipping/focus, tautology, or weaker expectations. Dispatch exact
+   `devrites-test-analyst` on that immutable diff; missing account or adverse criterion
+   verdict is Critical. Run only `test-plan.md` repository/CI commands, capture output,
+   and recheck `git diff --name-only`. Missing, weakened, red, or source-mutating proof
+   is not success.
+
+   A failure is `pre-existing` or environment-specific only with a same-command,
+   same-environment baseline predating the candidate; otherwise it remains unresolved.
+
+   Technical failure uses bounded `devrites-debug-recovery`: reapply the host gate
+   before an accepted in-slice correction, keep one exact fingerprint/three
+   no-progress attempts, and never rerun an unchanged check. A closed reproduction
+   is progress; a different Critical/Important invariant gets its own fingerprint.
+   Ask humans only for product decisions,
+   irreversible risk, or genuinely human-only access.
+7. **Record.** After green proof, upsert `touched-files.md`'s authoritative candidate
+   manifest from the actual scoped diff with explicit `present`/`deleted` rows;
+   update `state.md`, `evidence.md`, and applicable UI/browser evidence. The manifest
+   stays mutable until Polish closes it.
+   Record stood decisions/dead ends in `decisions.md`; update checked assumptions'
+   status/evidence, never leaving a disproved row live. If code reveals a durable
+   project rule, propose a reviewed `AGENTS.md`/nearest-doc update, not a scored ledger.
+8. **AFK and reply.** Under `afk-discipline.md`, root charges
+   exactly once after each green built slice, never below zero; stop before another dispatch at zero, and fail closed
+   on malformed budget. Use the reply contract; name the next pending slice or, only
+   when all slices are built, `/rite-prove`. Emit no decorative progress renderer or
+   dispatch telemetry.
+
+> **Mid-flight discipline.** One writer contract builds one slice. Do not skip
+> TDD, widen paths, fold in a second slice, or accept the writer's judgment as
+> independent review.

package/pack/generated/omp/skills/rite-build/reference/spec-drift-guard.md

@@ -0,0 +1,59 @@
+# Spec Drift Guard (build phase)
+
+Active throughout `/rite-build`. The spec is living, not sacred, but you may not
+silently code against a plan you know is wrong. This is the canonical Spec Drift Guard;
+other phases reference it here.
+
+## Drift has occurred when
+- the spec says X but the code makes X impossible/wrong;
+- the plan assumes a file/API/component/route/model/command that doesn't exist;
+- tests show the acceptance criteria are incomplete or wrong;
+- browser evidence shows the intended UX doesn't work as described;
+- an official doc contradicts the planned approach;
+- the design system / existing UX pattern contradicts the planned UI;
+- a missing user decision that affects product behavior surfaces.
+
+## Workflow
+```
+1. STOP coding.
+2. Record in drift.md (assumed vs observed, when).
+3. Classify: requirement ambiguity | implementation-plan error | codebase reality
+   mismatch | design-system mismatch | test/evidence mismatch | external-doc mismatch
+   | user-decision required.
+4. Local repair that preserves behavior/scope/architecture/data/UX/security/migration?
+     YES, active-slice technical/tool failure → log it and use Build's bounded debug
+       recovery. Do not ask for retry authorization and do not re-plan unless the
+       durable remaining-work instructions are wrong.
+     YES, durable plan is wrong → log it, save the caller's return cursor, then
+       invoke `/rite-plan repair` and `/rite-vet` inline without a question and resume.
+     NO, product/policy/irreversible-risk decision → ask the user (format below).
+5. Never continue on a known-wrong durable plan. A repaired active-slice implementation
+   may continue only after bounded recovery, returned-diff review, and proof gates pass.
+```
+
+## User question format
+```
+I hit spec drift:
+- Spec/plan assumed: ...
+- Code/evidence shows: ...
+- Why it matters: ...
+
+Which direction should DevRites take?
+1. Keep the requirement, change architecture by ...
+2. Adjust the requirement to match existing behavior ...
+3. Split into a follow-up feature ...
+4. Custom: describe the intended behavior
+```
+
+Never turn an objective defect, environment repair, tool bug, or proof rerun into a
+human permission question. Re-plan only when the durable plan changed.
+
+## Inline return contract
+
+The phase that detected agent-owned drift owns the whole backtrack. Preserve it
+as `return_phase`/`return_next_action`; consume Plan and Vet's nested `STOP`
+boundaries internally; follow any vetted remediation required by the settled
+acceptance; then restore the cursor and resume the failed step. Do not hand an
+intermediate command to the human. The shared three-attempt causal-fingerprint
+cap still applies: exhaustion produces one technical blocker, while a genuinely
+human-owned decision uses the question format below.

package/pack/generated/omp/skills/rite-build/reference/tdd.md

@@ -0,0 +1,27 @@
+# TDD / Prove-It pattern
+
+When a slice changes behavior, prove the change with a test that fails first, so you
+know the test can fail, and that your code is what makes it pass.
+
+## Red → Green → Refactor
+1. **Red:** write the smallest test that expresses the new behavior. Run it; watch it
+   fail for the *expected* reason (not a typo/import error).
+2. **Green:** write the minimum code to pass. Resist gold-plating.
+3. **Refactor:** clean up with the test as a safety net. Re-run; stay green.
+
+## Prove-It (when strict TDD doesn't fit)
+For code where a test-first flow is awkward (exploratory glue, config, some UI), still
+produce evidence:
+- Capture the current (wrong/absent) behavior: a failing assertion, a screenshot, a
+  log line.
+- Make the change.
+- Capture the new behavior the same way. The before/after pair *is* the proof.
+
+## Rules
+- Use the project's existing test framework and commands (per the discovery contract
+  `rite-prove/reference/test-command-discovery.md`). Don't introduce a new test runner
+  to prove a slice.
+- One behavior per test; name it for the behavior, not the function.
+- A green test you never saw fail proves nothing: always see red first.
+- Don't delete or weaken a failing test to "pass". If it's wrong, that may be drift.
+- Record the test command + result in `evidence.md`.

package/pack/generated/omp/skills/rite-build/reference/wright-dispatch.md

@@ -0,0 +1,86 @@
+# Slice-wright dispatch
+
+`/rite-build` gives one bounded task to exact `devrites-slice-wright`.
+Root owns scope, artifacts, inspection, and routing but never writes source/tests; only
+the wright writes them and invokes no agent.
+
+## Host gate
+
+Follow the canonical [source-writing boundary](../../devrites-lib/reference/standards/agents.md#source-writing-boundary):
+Claude grants only the exact wright `acceptEdits`; Codex uses its workspace root,
+the exact `:workspace` wright, and read-only specialists. Never bypass/substitute
+the wright or recreate an engine bridge.
+
+## Isolated writer-worktree pilot
+
+Use native isolation only when the current host exposes an explicit named-writer
+worktree plus result reconciliation; separate agent threads or inherited sandboxes do
+not qualify. Codex CLI custom subagents therefore use `same-worktree` unless a future
+supported interface passes this capability gate—never create a manual worktree from the
+read-only root to imitate it. Also require `git rev-parse
+--show-superproject-working-tree` to be empty; resolved git/common dirs; committed,
+clean candidate/index; all inputs at `HEAD`; no other writer; and green cheap isolated
+baseline proof. Otherwise use serial same-worktree dispatch—never stash, commit, or
+discard user work to qualify. Ask host for an explicit current-`HEAD` base when
+supported. Regardless of host defaults, the wright's first command must prove actual `git rev-parse HEAD` equals supplied
+`worktree_base`. Mismatch returns a gap with no write before project reads or baseline proof.
+
+The isolated wright returns one local unpushed `transfer_commit`, its `worktree_base`,
+and exact files. Root proves descendant base, exact `git diff --name-only`
+`` `<base>..<transfer>` ``, no `.devrites/**`/submodule/symlink/unrelated delta, unchanged
+source base, and no user-work overwrite. Use only host-native explicit reconciliation;
+never ad hoc copy, cherry-pick, or merge from read-only root. Compare transferred bytes,
+run approved proof, record evidence, then let host remove worktree.
+
+Conflict, extra/missing commit, moved base, or cleanup failure is `gap`/STOP:
+preserve the worktree and commit. Without explicit reconciliation, use same-worktree serial.
+Parallel isolated-writer worktrees remain forbidden until this serial pilot measures
+transfer, conflict, proof, and review outcomes on both hosts; opt-in `/rite-build --parallel N`
+(2≤N≤10) path-disjoint fan-out is the only sanctioned parallel mode. Same-worktree multi-writer / root-emulated
+worktrees stay forbidden.
+
+## Prepare
+
+1. Derive the smallest exact project-relative source/test path list; reject
+   directories/globs, traversal, symlink escapes, duplicates, and `.devrites/**`.
+   A target composed only of vetted executable workflow artifacts routes to the
+   controlling root under
+   [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
+   its rejection here is not a blocker.
+2. Put it in the task with goal, verbatim acceptance, exclusions, context,
+   `test-plan.md` proof commands, and applicable standards. For each triggered
+   topology/data/integration standard, include only the feature-specific owner/invariant,
+   failure or partial-state case, recovery rule, and required proof from the vetted plan.
+   Do not paste the whole standard or silently omit an applicable risk.
+   A new path requires a new bounded contract; the wright cannot widen the task.
+3. Record `git diff --name-only` before dispatch so unrelated work remains
+   distinguishable. For an isolated pilot, also record committed base SHA and exact
+   baseline status before asking the host for isolation. **Failing case:** paths that
+   were dirty at that baseline are listed as slice-owned after dispatch.
+
+## Run
+
+Ask the host for the exact writer in fresh context and wait. Use at most one writer
+across all linked worktrees for this workspace. Never run two writers in one worktree,
+run isolated and same-worktree writers concurrently, or substitute a generic agent.
+Opt-in `/rite-build --parallel N` fans out only under [`parallel-batch.md`](parallel-batch.md).
+
+## Inspect and prove
+
+1. Compare the returned file list and `git diff --name-only` with task paths.
+   Reject a result that omits any required key — the bookkeeping arrays count
+   whether empty or filled — or adds a path. Restore only through the same bounded
+   wright; root never widens scope or edits source.
+2. Inspect the test diff for deletion, skipping, focus markers, or loosened
+   assertions. Dedicated test analysis treats weakening as Critical.
+   Confirm a test for a data/integration/topology risk can actually exhibit that risk;
+   mocks that erase it and one-root proof offered for another root are unproven.
+3. Run only repository proof already approved by `test-plan.md`, then inspect
+   `git diff --name-only` again in case a proof tool changed source.
+4. Challenge decisions. Human choices return; native diagnosis routes failures.
+   The root counts the wright plus recovery failures by causal fingerprint from
+   the current context and recorded Dead ends/evidence. Three total failed
+   attempts is the limit; persist each and never dispatch a fourth related try.
+5. Reconcile returned reuse, conventions, principles, sources, assumptions,
+   decisions, dead ends, follow-ups, gates, and touched files. Persist the
+   relevant facts in canonical artifacts, not the wholesale report.

package/pack/generated/omp/skills/rite-clarify/SKILL.md

@@ -0,0 +1,99 @@
+---
+name: rite-clarify
+description: Audit a completed spec for missing decisions before strategy or architecture. Use after /rite-spec when coverage is incomplete or stale; not for spec writing.
+argument-hint: "[feature-slug]"
+user-invocable: true
+---
+
+# /rite-clarify: resolve product decisions
+
+Run this required pass between spec and strategy. If the spec covers every material
+decision, ask no questions. Otherwise stay until each material decision has an
+owner. This phase settles behavior and constraints; `/rite-define` settles
+implementation.
+
+Reuse [`devrites-interview`](../devrites-interview/SKILL.md) in `/clarify mode`. Write
+`decision-coverage.md` as scan evidence, not an interview transcript.
+
+## Rules consulted
+
+Read [`core.md`](../devrites-lib/reference/standards/core.md), its `afk-hitl.md`, and
+[`reference/decision-coverage.md`](reference/decision-coverage.md). Fresh evidence
+dispatch uses
+[`agents.md`](../devrites-lib/reference/standards/agents.md).
+
+## Rules
+
+- Search code/docs/contracts first. Facts and reversible implementation/test choices
+  are agent-owned; ask only about product, scope, policy, irreversible risk, or human-only access.
+- Enumerate the full topology before details so no sibling surface is omitted.
+- Ask one coherent human-owned decision packet at a time. One packet may close several rows
+  only when owner and trade-off match; never ask permission for routine repair/retry.
+- One scan may cap at five packets for cognitive load, but readiness has no question cap:
+  re-scan until clear.
+- Material assumptions carry evidence, confidence, owner, validation, and consequence.
+
+## Workflow
+
+1. **Orient.** Read `.devrites/ACTIVE`, `state.md`, and `spec.md`. Require
+   `Spec gate: passed`; otherwise stop at `/rite-spec`. Apply the native cursor
+   protocol below before changing workspace artifacts.
+2. **Enumerate the topology.** From the spec, live code, contracts, references,
+   and recorded decisions, list every material stakeholder/priority, invariant, actor,
+   journey/component, state, data lifecycle, integration, failure/recovery path,
+   operation, proof surface, applicability row, and must-NOT boundary.
+3. **Scan coverage.** Apply `devrites-interview` in clarify mode and mark each
+   material surface Clear, Partial, Missing, not-applicable, or justified
+   deferred-nonblocking with evidence and an owner. Use native repository search
+   first. Ask the host to run `devrites-evidence-scout` only for a bounded missing
+   fact, then reconcile its cited result.
+4. **Close decisions.** Record facts and reversible technical choices directly.
+   Ask one coherent option packet only for product, scope, policy, irreversible
+   risk, or human-only access. Persist answers in the owning artifacts and repeat
+   the scan until no blocking Partial/Missing row or unowned material assumption
+   remains.
+5. **Write the verdict.** Write `Decision coverage: CLEAR` only after re-reading all inputs and confirming
+   every material row has current evidence and an owner. Normal flow sets `phase=clarify` and
+   `next_action=/rite-temper`. A low-stakes spec — the significance trigger temper itself
+   skips (rite-temper step 1) — sets `next_action=/rite-define` instead. A contract-neutral later-phase return uses
+   the native restore below; changed behavior or acceptance routes to
+   `/rite-plan repair` instead. Stop without starting the next phase.
+
+## Native clarify cursor protocol
+
+The controlling root edits only cursor rows in `state.md`; it must preserve unrelated Markdown and the file's existing table/bullet presentation.
+
+- **Normal entry from Spec:** set `phase=clarify`, `status=running`, and
+  `next_action=/rite-clarify <slug>`; omit both return fields.
+- **Already in Clarify:** no-op. Do not overwrite an existing valid return
+  cursor.
+- **Later-phase entry:** only `temper`, `define`, `plan`, `vet`, `build`,
+  `converge`, `prove`, `polish`, `review`, `seal`, or `ship` may return. First
+  copy the current `phase` and non-empty `next_action` to `return_phase` and
+  `return_next_action`; then set `phase=clarify`, `status=running`, and
+  `next_action=/rite-clarify <slug>`. Missing/unknown cursor values fail closed
+  before any write.
+- **Contract-neutral restore:** after a fresh `Decision coverage: CLEAR`, require
+  `phase=clarify`, both return fields, a recognized later `return_phase`, and a
+  non-empty `return_next_action`. Restore those values to `phase` and
+  `next_action`, set `status=running`, and remove both return fields in the same
+  rewrite. Re-read the cursor and confirm the return rows are absent.
+- **Contract changed:** do not restore the saved cursor. Record drift and route
+  through `/rite-plan repair`, which owns the changed plan and next action.
+
+Never normalize or rewrite the rest of `state.md` while applying this protocol.
+
+## Output
+
+```text
+Done: decision coverage closed for <slug>; <n> topology surfaces scanned.
+Changed: decision-coverage.md, spec.md, decisions.md, assumptions.md, questions.md
+Evidence: Decision coverage: CLEAR; human packets <n>; agent-owned facts <n>
+Open: none blocking; deferred-nonblocking <n>
+Next: /rite-temper (or /rite-define for a low-stakes spec temper skips)
+Record: .devrites/work/<slug>/decision-coverage.md
+↻ Hygiene: /clear before /rite-temper (or /rite-define)
+```
+
+If not clear, name the exact rows and next genuine decision packet. An objective spec defect
+or factual search task never routes through `/rite-resolve`.

package/pack/generated/omp/skills/rite-clarify/reference/anti-patterns.md

@@ -0,0 +1,24 @@
+# /rite-clarify anti-patterns
+
+Load this when tempted to skip clarify, assume product choices, or write
+`Decision coverage: CLEAR` before every material row has an owner.
+
+Pack-wide rationalizations: see
+[standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-patterns.md).
+
+## Phase-specific rationalizations
+
+| Excuse | Rebuttal |
+| --- | --- |
+| "We already discussed this in chat." | Chat is not durable decision coverage. Scan topology and record owners in workspace artifacts. |
+| "The answer is obvious — assume it." | Product, scope, policy, and irreversible-risk choices are human-owned unless already recorded in an accepted decision. |
+| "Most rows are clear — good enough for AFK." | Partial/Missing material rows block CLEAR and block AFK arming. |
+| "Skip clarify for this small change." | Clarify is mandatory and adaptive; it may ask no questions, but it still runs the scan. |
+| "I'll clarify during build if needed." | Unowned decisions discovered in build are expensive drift. Close them before plan/vet. |
+
+## Red flags in your own output
+
+- `Decision coverage: CLEAR` with Partial/Missing material rows still open.
+- Product/policy choices recorded without a human packet or cited prior decision.
+- AFK armed or `/rite-define` started before CLEAR is durable.
+- Clarify skipped because the user said they were "in a hurry".

package/pack/generated/omp/skills/rite-clarify/reference/decision-coverage.md

@@ -0,0 +1,55 @@
+# Decision coverage contract
+
+`decision-coverage.md` proves a topology-first scan ran; reference canonical IDs instead of
+duplicating their prose.
+
+## Coverage taxonomy
+
+For each material surface scan: outcome/scope/must-NOT; behavior, permissions, and all states;
+domain/data lifecycle/invariants/order/concurrency; interfaces/integrations and failure
+contracts; security/privacy/compliance/accessibility/performance/reliability/compatibility;
+configuration/observability/support/rollout/rollback; and executable acceptance proof,
+environment, credentials/approvals, and evidence limits.
+
+## Status vocabulary
+
+- `closed`: the canonical artifact records the decision.
+- `agent-owned`: a reversible technical choice is explicitly delegated to define/vet.
+- `not-applicable`: evidence shows the dimension does not apply.
+- `deferred-nonblocking`: pre-code evidence is impossible or the item is an explicit
+  non-goal; owner and validation gate are named.
+
+`Partial`, `Missing`, open, unknown, or ownerless rows never produce `CLEAR`.
+
+## Artifact shape
+
+```markdown
+# Decision coverage
+
+Decision coverage: <CLEAR | NEEDS CLARIFICATION>
+
+## Topology
+| Surface | Kind | Related IDs | Evidence |
+| --- | --- | --- | --- |
+
+## Coverage matrix
+| Surface | Dimension | Status | Canonical reference | Owner / validation gate | Consequence if wrong |
+| --- | --- | --- | --- | --- | --- |
+
+## Assumption audit
+| Assumption | Evidence | Confidence | Owner | Validation | Consequence if wrong |
+| --- | --- | --- | --- | --- | --- |
+
+## Residual uncertainty
+| Item | Why nonblocking | Owner | Validation gate |
+| --- | --- | --- | --- |
+
+## Readiness verdict
+No Partial, Missing, unowned material assumption, or unresolved blocking/escalating
+question remains.
+```
+
+Combine rows only when one decision and owner genuinely close them. Re-read the current
+`brief.md`, `spec.md`, `decisions.md`, `assumptions.md`, and `questions.md` before writing
+`CLEAR`; the matrix itself is the freshness check. Any open blocking, validating, or
+escalating question prevents `CLEAR`.