devrites 4.7.0 → 5.1.0

package/pack/generated/omp/skills/rite-ship/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: rite-ship
+description: Commit, push, tag, archive, or close a sealed feature after /rite-seal GO. Use for repository mutation; not for GO/NO-GO readiness.
+argument-hint: "[feature-slug]"
+user-invocable: true
+---
+
+# /rite-ship: ship + close the task
+
+`/rite-seal` decides; `/rite-ship` mutates Git and closes. Read the active workspace;
+if absent, route to `/rite-spec <feature>`. Ship only with current **GO** in `seal.md`.
+
+## Rules consulted (read on demand from `.omp/skills/devrites-lib/reference/standards/`)
+**Step 0:** Read `core.md`, then pull as needed:
+- `git-workflow.md`: Conventional Commits, atomicity, never-commit list.
+- `afk-hitl.md`: AFK pause rules for irreversible actions (the type-GO gate itself: [`git-ship.md`](reference/git-ship.md), [`rollout.md`](reference/rollout.md)).
+- `definition-of-done.md`: acceptance, evidence, drift, rollback, docs.
+- [`release/ship-checklist.md`](../devrites-lib/reference/standards/release/ship-checklist.md): final pass/fail sweep.
+
+## Operating rules
+- **GO is prerequisite.** No current `seal.md` GO → stop at `/rite-seal`.
+- **Ship is candidate-read-only.** Follow
+  [`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md).
+  Ship must not change any candidate path or `touched-files.md`; it may write only
+  workspace `ship.md`, `state.md`, and archive bookkeeping. Project/manifest mutation
+  returns through Prove → Review → Seal.
+- **Bindings stay exact.** Rerun candidate/Seal checks; require the digest bound in
+  evidence, optional browser evidence, review, and seal. Any mismatch stops.
+- **Fresh approval.** Disclose the exact Git attempt; literal `GO` authorizes it once.
+  Change/retry means re-prompt. Native approval remains separate/authoritative.
+- **Archive, never delete,** every audit `.md`.
+
+## Workflow
+1. **Orient.** Snapshot; read seal, state, spec, touched files, evidence, and any UI
+   brief. Confirm GO/closed digest, then run:
+   ```bash
+   devrites-engine check candidate <slug>
+   devrites-engine check seal <slug>
+   ```
+   Nonzero/mismatch stops; never reinterpret it.
+1a. **Health (advisory).** Apply `/rite-doctor` read-only; surface WARN/FAIL without
+   repair. If ACTIVE is flagged, confirm the slug.
+2. **Prepare the exact Git candidate.** Follow
+   [`git-ship.md`](reference/git-ship.md): refuse out-of-manifest staged work; stage
+   exact manifest paths only after Seal GO; compare NUL-delimited staged state/path
+   sets, require identical index/worktree bytes, and rerun candidate/Seal checks.
+   From the verified index, build the exact project-conformant message/trailers,
+   branch, tag/PR, commands, and skips.
+2a. **Credential guard (HIGH blocks).** Scan staged blobs and any PR body. HIGH stops
+   and requires rotation/redaction; MEDIUM needs confirmation recorded in `ship.md`;
+   LOW is FYI.
+   ```bash
+   devrites-engine secret-scan --staged
+   ```
+   Scan a PR body with `devrites-engine secret-scan --stdin` only through non-logging
+   process stdin, then close it—never command/argv/env/heredoc/log/temp file. If that
+   channel is unavailable, stop. **rc=3 → STOP:** no type-GO/commit/push/archive.
+2b. **Reconcile residuals before type-GO.** Scan `strategy.md` deferrals,
+   `decisions.md` FYIs/revisit triggers, unresolved `review.md` non-blocking/if-minor/
+   FYI findings, and `seal.md` follow-ups. Deduplicate only rows with identical
+   obligation + disposition, preserving every source pointer. Each residual appears
+   once in the pending `ship.md` table as `tracked` (durable path/ID) or `no-action`
+   (prior decision or explicit human acceptance + reason/revisit). Type-GO never
+   implies `no-action`. Missing/vague/conflicting disposition blocks; `none` requires
+   empty sources.
+3. **Type-GO.** Render [`git-ship.md`](reference/git-ship.md)'s prompt and wait.
+   Literal `GO` proceeds once; anything else records cancellation in `ship.md` and
+   stops. Any command/scope/branch/message/tag/PR change or retry needs a fresh prompt;
+   native approval is still required.
+4. On GO, commit; verify committed state/path set and exact candidate digest; then push →
+   tag/PR as applicable via `git-ship.md`. Capture SHA(s), branch, tag/PR URL. Mismatch
+   stops before push/tag; retry needs fresh approval.
+4a. **PR only:** render [`git-ship.md`](reference/git-ship.md#pull-request-body)'s
+   structured body; omit empty sections.
+5. Re-scan the four residual sources; any new/missing/changed item blocks archive.
+   Write [the template](reference/ship-template.md) with shipment metadata and the
+   unchanged pre-GO reconciliation.
+6. **Close.** Set `state.md` phase `done`; follow
+   [`close-out.md`](reference/close-out.md) and run `devrites-engine state close <slug>`
+   to move `.devrites/work/<slug>` → `.devrites/archive/<slug>` and clear `ACTIVE`
+   only if it names this slug; preserve another active feature's cursor.
+   Preserve every `.md`; stable hierarchical instructions need no active-workspace sync.
+
+> **Mid-flight discipline.** No seal GO, skipped type-GO, out-of-manifest stage, or
+> deleted workspace. Stop and use [`anti-patterns`](reference/anti-patterns.md).

package/pack/generated/omp/skills/rite-ship/reference/anti-patterns.md

@@ -0,0 +1,28 @@
+# rite-ship: anti-patterns
+
+Load this before any irreversible action: `git commit`, `push`, `tag`, publish, deploy,
+or when tempted to skip the close-out.
+
+Pack-wide rationalizations + red flags: see
+[standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-patterns.md).
+
+## Phase-specific rationalizations
+
+| Excuse | Rebuttal |
+|---|---|
+| "Seal said GO, so I can just push." | A GO verdict is a decision, not authorization. **Render the type-GO prompt every time** and wait for the literal `GO`. |
+| "I'll push the tag now; type-GO is a formality." | Type-GO is the last safety net before an irreversible action. Always render it: even under auto-trigger. |
+| "`git add -A` is faster than listing touched files." | Stage only what's in `touched-files.md`. `-A` sweeps secrets, scratch files, and out-of-scope edits into the ship. |
+| "The evidence is probably still good." | Recheck the canonical candidate digest and every artifact binding. Any mismatch stops. |
+| "The ledger/DESIGN/ADR update is just ship bookkeeping." | Those are candidate paths. Route the change through Polish, affected Prove, Review, and Seal; Ship is read-only. |
+| "Delete the workspace, the feature's done." | Closing **archives** the workspace (`.devrites/archive/<slug>/`); it never deletes the audit trail. |
+
+## Red Flags
+
+- About to run `git push` / `git tag` without rendering the type-GO prompt.
+- Shipping without a `GO` verdict recorded in `seal.md`.
+- Staging files not listed in `touched-files.md`, or any secret / `.env`.
+- Changing a candidate path or the manifest after Seal.
+- Pushing or tagging before the committed NUL-delimited state/path and digest checks pass.
+- `rm`-ing `.devrites/work/<slug>/` instead of archiving it.
+- Marking the feature `done` but leaving `.devrites/ACTIVE` pointing at it.

package/pack/generated/omp/skills/rite-ship/reference/close-out.md

@@ -0,0 +1,54 @@
+# Close-out: archive the workspace, free the active slot
+
+Closing a feature means it stops being the *active* work, not that its record is
+deleted. DevRites keeps the audit trail; it just moves out of the live path.
+
+## What close-out does
+
+1. **Mark done.** Set `state.md` → `Phase: done`, `Status: done`, and a `Next step`
+   of `/rite-spec <next feature>`.
+2. **Archive.** Run the deterministic script:
+   ```bash
+   devrites-engine state close <slug>
+   ```
+   It moves `.devrites/work/<slug>/` → `.devrites/archive/<slug>/` (every `.md`
+   intact) and clears `.devrites/ACTIVE` **only if** ACTIVE still points at `<slug>`.
+   It refuses to clobber an existing `.devrites/archive/<slug>/` (exit 5).
+3. **Confirm the observed post-state.** The archive exists with its audit records
+   intact and the live workspace is absent. If ACTIVE named this slug, verify it is
+   empty; if it named another feature, verify that value remains unchanged. Only an
+   empty cursor permits the claim "no active feature".
+
+Any nonzero exit stops close-out. Archive collision (exit 5) never authorizes overwrite.
+If clearing ACTIVE fails, the engine attempts to move the archive back; that rollback
+can also fail. Inspect the actual live path, archive and cursor before reporting or
+retrying. Record the command/error and observed locations; never claim restored state
+from an attempted rollback or repeat a move against an unverified destination.
+
+## Why archive, not delete
+
+- The `.md` files (`spec`, `decisions`, `assumptions`, `evidence`, `seal`, `ship`, …)
+  are the project's record of *why* the feature is the way it is. A future
+  `/rite-zoom-out` or incident review reads them.
+- Deleting them would make the workflow's own "evidence over confidence" rule a lie.
+
+## Re-opening an archived feature
+
+Before restoring an archive, verify its identity, released cursor form and declared
+workspace schema, that the live destination is absent, and that ACTIVE is empty or
+already names this slug. A collision or another active feature stops restoration;
+do not replace its workspace or cursor. Supported released cursor forms remain valid:
+age or encoding alone never requires normalization (see
+[workspace-artifact-schema.md](../../devrites-lib/reference/workspace-artifact-schema.md)).
+An unsupported declared schema stops restoration: record the observed version,
+installed engine's recovery diagnostic and pending normalization owner. Do not guess
+a repair or claim `/rite-upgrade` migrates archives; archived/done work is its no-op.
+
+After an authorized restoration, verify the actual paths and cursor and preserve the
+audit records. Reconcile the resumed scope through `/rite-converge`; changes return to
+the applicable earlier lifecycle stage. Historical proof/GO remains historical: a new
+candidate requires fresh Prove → Polish → Review → Seal bindings before Ship. Restoring files
+does not reactivate an old GO.
+
+Cross-feature review is user-invoked through `/rite-learn`; close-out does not
+mine, score, nudge, or write a retrospective ledger.

package/pack/generated/omp/skills/rite-ship/reference/git-ship.md

@@ -0,0 +1,111 @@
+# The irreversible ship: type-GO + git ladder
+
+`/rite-ship` alone runs irreversible actions. A seal GO is never authorization for Git.
+Require fresh approval for one disclosed attempt plus native permission.
+
+## The type-GO prompt (render verbatim, wait)
+
+```
+Feature:  <slug>
+Verdict:  GO  (seal.md)
+Acceptance criteria proven: <n / total>
+Branch:   <target branch>
+Candidate paths: <exact project-relative paths>
+Checkpoint collapse: <exact `git reset --soft '<merge-base>'` command | skip>
+Stage plan: <exact argv-safe `git add -- '<path>'` command for every manifest row>
+Commit:   <exact git commit command>
+Push:     <exact git push command | skip>
+Tag:      <exact git tag command | skip>
+PR:       <exact PR command, target, title, and body source | skip>
+
+Type "GO" exactly to approve this attempt once. Anything else cancels.
+```
+
+Rules:
+- Render every attempt; autocomplete flags only reach this boundary.
+- Only literal `GO` proceeds. Anything else cancels, records
+  `user declined irreversible step at <ts>` in `ship.md`, and stops.
+- `GO` is one-use for the shown scope/commands; changed/retried plans re-prompt.
+- Prior answers, AFK, seal GO, and native approval do not replace type-GO;
+  type-GO never replaces/bypasses native permission or sandbox approval.
+
+## The candidate-safe Git ladder
+
+Follow `standards/git-workflow.md` and project convention; invent no release flow.
+Candidate identity always comes from `devrites-engine check candidate`; do not
+implement a Git-side hash.
+
+### Before type-GO
+
+Pre-GO is read-only. Do not run the disclosed collapse or staging commands.
+
+0. **Protect existing index work.** Read the NUL-delimited staged state/path set.
+   Refuse a pre-existing staged path outside the manifest; never unstage, stage,
+   reset, or discard user work.
+1. **Analyze checkpoint history without mutating it.** Read the upstream, merge
+   base, commit OIDs, and full subjects. If no checkpoint commit exists, disclose
+   `skip`. A collapse is eligible only when every commit in its range has the exact
+   `WIP(<active-slug>):` prefix for the validated active slug. A different slug,
+   missing colon, broad `WIP(` match, ordinary commit, or mixed history blocks;
+   never reinterpret the range.
+2. **Verify the candidate.** Rerun `devrites-engine check candidate <slug>` and
+   `devrites-engine check seal <slug>`, compare every binding, require the
+   candidate worktree paths to be unchanged, and inspect the existing staged
+   scope. These checks do not prepare the index.
+3. **Prepare the disclosure.** Build argv-safe commands from literal validated
+   paths, without `eval` or command-string interpolation. Run only read-only
+   secret scans of the existing staged state and proposed PR body. Render the
+   literal prompt with the exact optional collapse command or `skip`, exact stage
+   plan, commit, push, tag, and PR commands; then wait.
+
+### After type-GO
+
+1. **Optional checkpoint collapse.** If and only if the prompt disclosed it,
+   recheck that `HEAD`, merge base, and every subject are unchanged and that each
+   subject starts exactly `WIP(<slug>):` for the active slug, then run the exact
+   disclosed `git reset --soft "$mb"`. Otherwise skip. Any different or mixed
+   subject blocks without mutation.
+2. **Exact staging.** Run `git add -- "$path"` once for each disclosed manifest
+   row, passing each validated project-relative path as its own quoted argv
+   element. Use no glob, directory, `-A`, `.env`, secret, out-of-scope path,
+   `eval`, or interpolated command string.
+3. **Compare staged scope.** Compare the NUL-delimited output of
+   `git diff --cached --name-status --no-renames -z` to the manifest's exact
+   state/path set. `present` maps only to `A` or `M`; `deleted` maps only to `D`.
+   Reject missing, extra, renamed, duplicated, or differently classified paths.
+4. **Compare staged bytes.** Require no index-to-worktree difference for any
+   manifest path. A dirty manifest path stops; never stage or reinterpret it
+   after this comparison.
+5. **Revalidate immediately before commit.** With no intervening mutation,
+   rerun `devrites-engine check candidate <slug>` and
+   `devrites-engine check seal <slug>`, require the exact candidate digest and
+   every evidence/browser/review/Seal binding, then run the staged secret scan.
+   Any scope, byte, identity, binding, scan, history, or command drift invalidates
+   the one-use approval. Stop and render a fresh type-GO prompt; do not repair the
+   drift under the old approval.
+6. **Commit** one logical change using Conventional Commit and a why-body.
+   Non-trivial work adds applicable `Constraint:`, `Rejected:`, `Confidence:`,
+   `Scope-risk:`, and `Not-tested:` workspace trailers; trivial edits omit them.
+7. **Verify the commit.** Immediately after the authorized commit and before any
+   push or tag, compare
+   `git diff-tree --root --no-commit-id --name-status --no-renames -r -z HEAD`
+   to the manifest using the same exact state/path mapping. Require candidate
+   paths still match `HEAD`, then rerun `devrites-engine check candidate <slug>`
+   and `devrites-engine check seal <slug>` and compare the exact digest again.
+   Any mismatch stops; do not reinterpret it.
+8. **Push** to the project-conventional target branch.
+9. **Tag / PR** only when project convention requires it; otherwise skip.
+
+Record SHA(s), branch, and tag/PR URL in `ship.md`.
+
+## Pull request body
+
+When this ship opens a PR, include only applicable sections:
+
+- **Summary:** what shipped and acceptance proven.
+- **Risk & rollback:** migration/auth/destructive risk and reversal from `seal.md`.
+- **What to scrutinize:** highest-blast-radius review stops.
+- **Evidence:** condensed proof plus the archived evidence bundle.
+
+For an agent-owned staged rollout, apply [`rollout.md`](rollout.md). CI-owned deploys
+skip that branch. Delete empty sections rather than writing `N/A`.

package/pack/generated/omp/skills/rite-ship/reference/rollout.md

@@ -0,0 +1,62 @@
+# Staged rollout and recovery: live deploys only
+
+Load this only when `/rite-ship` itself is explicitly authorized to drive a live
+deployment. Git-only Ship stops before rollout; CI-owned deployment follows the pipeline's
+runbook. A Seal GO or AFK setting never authorizes production action.
+
+## Preconditions before exposure
+
+Record one rollout sheet in `ship.md`:
+
+| Item | Required decision/evidence |
+| --- | --- |
+| Units and order | Repository/deployable, schema, config, application, worker, contract, and flag order; safe old/new combinations. |
+| Exposure stages | Project-native internal/canary/cohort/percentage/region stages and hold window. |
+| Advance/hold/abort signals | Project baseline or SLO, measurement window, minimum sample, exact threshold, and owner. |
+| Recovery | Fastest safe mechanism, steps, owner, measured/rehearsed time, and data/external-effect reconciliation. |
+| Observability | Watched dashboard/query/alert, failure signal, and executable first action. |
+| Authorization | Exact target/action approved for this attempt; no inferred retry permission. |
+
+Do not import generic percentage, latency, error-rate, or time-to-rollback numbers. Use
+accepted product risk, current baseline/SLO, traffic volume, and platform capability. If the
+project has no defensible threshold or signal, the monitoring gap blocks live exposure.
+
+## Choose the smallest reversible mechanism
+
+- A feature flag is useful only when the off path preserves current behavior, both states
+  are tested, disabling it stops the risky effect, and it has an owner/removal trigger.
+  Do not add a flag to a change already reversible by a safe atomic deploy.
+- A flag cannot reverse destructive data/schema effects. Apply
+  [`data-integrity.md`](../../devrites-lib/reference/standards/data-integrity.md) and prove
+  restore or forward recovery separately.
+- External APIs, webhooks, queues, jobs, and caches apply
+  [`integration-reliability.md`](../../devrites-lib/reference/standards/integration-reliability.md):
+  reconcile unknown outcomes, drain/quarantine/replay safely, and protect downstream capacity.
+- Multi-root/service rollout follows
+  [`repository-topology.md`](../../devrites-lib/reference/standards/repository-topology.md);
+  references to another repository never grant write/deploy authority there.
+
+## Stage, observe, decide
+
+At each authorized stage:
+
+1. Verify the intended versions/config/schema and candidate identity on the exact target.
+2. Exercise one critical success path and the declared degradation/recovery signal.
+3. Observe for the recorded window and sample; bind results to the stage and baseline.
+4. **Advance** only when every advance condition holds. **Hold** on ambiguous or
+   insufficient evidence. **Abort/recover** immediately on an abort condition, security or
+   tenant breach, data-integrity violation, unreconciled duplicate/unknown effect, or loss of
+   observability.
+5. Re-verify after recovery; record partial effects and reconciliation. A rollback command
+   exiting zero is not proof the prior state or data was restored.
+
+Never compress stages because an early sample "looks fine," continue through a monitoring
+gap, or retry a failed live action without fresh authorization when the attempt/target changes.
+
+## Completion
+
+Rollout is complete only when full intended exposure meets the recorded window/signals,
+telemetry is still watched, migrations/backfills and queues/reconciliation are settled,
+documentation matches deployed behavior, and temporary flags/compatibility paths have a
+dated removal owner. Otherwise report the exact current stage and remaining risk; do not call
+the launch done.

package/pack/generated/omp/skills/rite-ship/reference/ship-template.md

@@ -0,0 +1,39 @@
+# `ship.md` template
+
+Write before close-out; it moves to `.devrites/archive/<slug>/ship.md`.
+
+```markdown
+# Ship: <slug>
+
+- Shipped at: <iso>
+- Verdict: GO (seal.md)
+- Branch: <branch>
+- Commit(s): <sha> [<sha> …]
+- Tag/PR: <value|none>
+
+## What shipped
+<project-vocabulary paragraph>
+
+## Acceptance
+- Proven: <n/total> (evidence.md/seal.md)
+- Outstanding: <rows below | none>
+
+## Evidence
+- seal.md — verdict/reconciliation
+- evidence.md — acceptance; browser-evidence.md if UI
+- review.md — review findings
+
+## Follow-up reconciliation
+Checked: strategy.md (if present), decisions.md, review.md, seal.md.
+
+| Source | Item | Disposition | Destination / rationale |
+|---|---|---|---|
+| <file + section> | <item> | tracked | <durable path/ID> |
+| <file + section> | <item> | no-action | <decision or explicit human no-action approval + reason/revisit> |
+
+<If empty: No residual items found.>
+```
+
+Keep pointers short. Acceptance MUST match `seal.md`. Each source residual appears
+once; a missing target, unsupported `no-action`, vague disposition, or conflict blocks
+close-out.

package/pack/generated/omp/skills/rite-spec/SKILL.md

@@ -0,0 +1,144 @@
+---
+name: rite-spec
+description: Specify new, vague, or high-risk behavior before code. Use for features, auth, migrations, or public API changes; not for planning an approved spec.
+argument-hint: "<feature or idea>"
+user-invocable: true
+---
+
+# /rite-spec: investigate and write the spec
+
+Investigate and resolve material gaps into a placed, covered `spec.md`.
+`/rite-clarify` audits topology next. Write no plan, task, or code here.
+
+> Use `/rite-quick` for a typo, copy/config edit, or one-function fix. It returns
+> here for auth, data, migration, public API, or multi-slice work.
+
+## Rules consulted (read on demand from `.omp/skills/devrites-lib/reference/standards/`)
+Pull `documentation.md` for significant decisions and `principles.md` for
+declared invariants; an unavoidable principle violation is blocking.
+For behavioral/high-risk acceptance, use `spec-grammar.md` plus workspace schema;
+simple criteria stay flat `AC-###`. Apply
+[`acceptance-criteria.md`](reference/acceptance-criteria.md) so each is binary and observable.
+Use [`edge-case-trace.md`](../devrites-lib/reference/standards/edge-case-trace.md)
+to populate only relevant edge/prohibition rows. The spec's applicability map routes
+topology, data, integration, security, and delivery concerns to their focused standard;
+load a routed standard to discover required behavior, not to prescribe implementation.
+
+## Operating rules (DevRites core)
+- No silent assumptions or guessing; prefer conventions; ask on scope,
+  placement, data, UX, security, migration, or acceptance changes.
+- **Root authority:** controlling chat asks humans, decides, and writes workspace;
+  evidence work follows [`agents.md`](../devrites-lib/reference/standards/agents.md).
+- **Author one section at a time:** problem → goal → requirements → acceptance →
+  edges. For contested requirements/boundaries/assumptions, apply
+  [`elicitation.md`](../devrites-lib/reference/standards/elicitation.md) before continuing.
+
+## Workflow
+0. Read core; if `.devrites/ACTIVE` exists, require its `state.md`.
+0a. **Adoption check.** For a never-adopted existing codebase, route first to
+   `/rite-adopt` with `$ARGUMENTS`; it derives baseline spec/principles. HITL
+   offers ranked adopt-first and spec-only choices; permitted AFK adopts.
+   Silently skip greenfield/onboarded projects, and never block solely on absence:
+   ```bash
+   if [ ! -d .devrites/archive ] \
+      && [ -z "$(ls .devrites/work 2>/dev/null)" ] \
+      && [ -n "$(git ls-files 2>/dev/null | grep -vE '^\.(devrites|claude)/' | head -1)" ]; then
+     echo "brownfield, not yet adopted → recommend /rite-adopt first (carry this idea as its next objective)"
+   else echo "greenfield or already onboarded → continue spec"; fi
+   ```
+1. **Understand the request** (`$ARGUMENTS`). State outcome and underlying
+   problem in one sentence. **Completion:** it includes both.
+1a. **Dedupe.** Search local issues/PRDs, work, and archive. On a close match ask
+   extend/adopt/new, then record the choice; otherwise continue silently.
+2. **Investigate:** follow [investigation](reference/investigation.md) through its
+   complete findings and done-when gate. Discover the project's **test /
+   build/typecheck/lint** commands, frontend/backend systems, and declared project guidance
+   (`PRODUCT.md`, `DESIGN.md`, `CLAUDE.md`, `AGENTS.md`, and `.devrites/principles.md` when
+   present).
+   **Consult the capability ledger**, which records current system behavior
+   ([`ledger.md`](../rite-polish/reference/ledger.md)); Polish folds accepted deltas
+   before Review. List `.devrites/specs/*/spec.md` with the
+   host filesystem and read only capabilities this feature touches. Search accepted ADRs and
+   relevant `.devrites/**/decisions.md` files directly before asking the human to revisit a
+   settled architecture, API, or auth choice. Compare exact requirement headers and meanings
+   with the current ledger to choose ADDED/MODIFIED/REMOVED; never classify from memory. Use
+   `spec-grammar.md`'s singular `Capability impact:` declaration to name the affected
+   capabilities and change, or give its specific `none` justification.
+   Inventory affected observable behavior from current test/contract/runtime/source
+   evidence; map each outcome to preserving REQ/AC. Greenfield `none` needs the
+   template's specific justification.
+   Identify proof constraints now: human-only credentials, unavailable environments, approval
+   windows, or acceptance not observable through existing test/runtime/browser surfaces.
+   An unfamiliar framework/version routes to `devrites-source-driven`; missing or
+   contradictory documentation is evidence to reconcile, never a license to guess.
+   Split independent placement, blast-radius, and external-fact questions into at most three
+   bounded `devrites-evidence-scout` tasks on one frozen candidate. Wait for and reconcile every
+   cited dossier before step 4. The scout supplies facts only; it never asks the human or writes
+   the spec.
+3. **Gather design references when provided:** [references-intake](reference/references-intake.md).
+   The human may attach screenshots, mockups, a Figma link, a video, links, or nothing.
+   Skip this step when none are provided. Otherwise, **view or fetch**
+   them, **save local files** into `.devrites/work/<slug>/references/`, and index them in
+   `references.md` as target, constraint, or inspiration. Later phases honor that role
+   rather than treating every reference as a fidelity target.
+   **Completion:** every supplied reference is saved and classified, or absence is explicit.
+3a. **Shape UX/UI before code when the feature is frontend**
+   ([frontend-trigger](../rite-build/reference/frontend-trigger.md)). Apply
+   `devrites-ux-shape` within the spec phase. It turns the
+   references and spec into a feature-level **`design-brief.md`** (design direction, key
+   states, interaction model, optional Figma/image visual-direction probe) that `/rite-build`
+   targets for the build. In HITL it pauses for the human to
+   confirm the direction; in AFK it asserts the best guess and logs it. Pure
+   backend/data/CLI features skip this.
+4. **Resolve human-owned gaps.** Recommend an option and let the human decide. Apply
+   [question-protocol](reference/question-protocol.md), the shared
+   [`afk-hitl.md` option-set and decision-ownership rules](../devrites-lib/reference/standards/afk-hitl.md#decision-ownership-search-before-asking),
+   and [`interview-patterns.md`](reference/interview-patterns.md) for a vague ask. Every
+   material dimension is resolved by a human pick or explicitly deferred as non-blocking;
+   only genuinely reversible, low-impact details go to `assumptions.md`. A paper-only
+   uncertainty may take one scoped `/rite-prototype` detour. A declared-principle conflict
+   remains blocking until the human approves a recorded, scoped exception.
+4a. **Build-interruption forecast.** Search first, then list and close foreseeable human needs:
+   product/acceptance ambiguity, irreversible/external approval, or human-only access. Record
+   owned prerequisites. Keep a build checkpoint only for unavailable pre-code evidence or a
+   mandatory action-time approval. **Completion:** no foreseeable human choice is deferred.
+5. **Create or update the workspace** + set `.devrites/ACTIVE` from
+   [state-workspace](reference/state-workspace.md). If the slug already exists,
+   update the existing workspace rather than overwrite it; preserve history and
+   unrelated settled content. Write every required artifact and conditional
+   annex exactly from [spec-template](reference/spec-template.md)
+   ([ai-spec-template](reference/ai-spec-template.md)), including its
+   capability impact, existing-behavior preservation, grammar/delta,
+   stakeholder/constraint/invariant, failure/recovery, applicability, coverage-seed,
+   qualified backstop, edge/prohibition, UI, and AI rules. Native
+   hierarchical instructions remain stable; do not rewrite `AGENTS.md` or
+   `CLAUDE.md` for the active workspace.
+5a. **Check the spec prose** with [spec-checklists](reference/spec-checklists.md).
+   Emit every applicable domain checklist and fix each CRITICAL by correcting the spec,
+   never by softening the question.
+6. **Run the complete readiness gate** at the bottom of
+   [spec-template](reference/spec-template.md), then apply the
+   **Native grammar re-read checklist** in `spec-grammar.md` to the complete
+   saved `spec.md`. Re-open the file after corrections and verify every
+   applicable item; there is no parser or replacement script. Natively compare
+   deltas with the current ledger using exact header semantics and the ledger's
+   complete-block preservation rule.
+   `tasks.md` deliberately does not exist yet; cross-artifact traceability starts in
+   `/rite-define`. Any grammar or delta failure blocks. The interruption forecast must be resolved, owned, or a justified
+   action-time gate. Then write `Spec gate: passed <iso>`.
+6a. **Existing-spec delta.** For a pre-existing slug/workspace, compare old/new
+   spec and questions, then show `Acceptance delta` (added/removed/reworded IDs)
+   and `Open-question delta` (opened/resolved/reworded IDs), using `none` for
+   empty categories. Show before proceeding; new workspaces skip.
+6b. **Review-before-code digest.** Before planning, render the compact human review:
+   `Intent` (one sentence), `Done means` (top acceptance/scenario IDs), `Scope/risk` (what is in/out
+   plus the hard gates), and `Build exactly this?` (yes → next phase; no → revise now). The digest
+   is a view over `spec.md`, not a new artifact. **Stop** after the digest.
+
+> **Mid-flight discipline.** Do not skip investigation, gap resolution, or placement
+> decisions. See [`anti-patterns`](reference/anti-patterns.md).
+
+## Output
+
+When the ask overlaps the ACTIVE feature (same intent, >50% scope), route to
+`/rite-plan revise` (its gate decides) rather than minting a parallel workspace.

package/pack/generated/omp/skills/rite-spec/reference/acceptance-criteria.md

@@ -0,0 +1,31 @@
+# Acceptance criteria
+
+Acceptance criteria are the contract the seal checks. Write them so each is
+**independently verifiable by evidence**, not opinion.
+
+## A good criterion
+- Is observable: a test passes, a command outputs X, a screenshot shows Y.
+- Is binary: met or not: no "mostly".
+- Names the evidence: "`npm test path/x.test.ts` passes" or "POST /export returns 200
+  with a CSV body" or "empty state renders 'No exports yet' at 375px".
+- Belongs to a slice: every criterion maps to at least one slice (mapped in `/rite-define`).
+
+## Forms
+| Type | Template |
+|---|---|
+| Functional | "Given <state>, when <action>, then <observable result>." |
+| API | "<METHOD> <route> with <input> returns <status> and <shape>." |
+| UI | "<screen> shows <element/state> at <viewport>; <interaction> does <result>." |
+| UI vs reference | "<screen> matches design reference <Rn> at <viewport>." |
+| Non-functional | "<operation> completes under <budget> / handles <volume>." |
+| Negative | "<invalid input> is rejected with <message>, no <side effect>." |
+
+## Anti-patterns
+- "Works well" / "is fast" / "looks good": unverifiable. Attach a number or an
+  observation.
+- Criteria with no slice: orphaned scope.
+- Criteria only provable by reading the code: require runtime/test evidence instead.
+
+## At seal time
+Each criterion gets a checkbox + the evidence that proves it. Unproven critical
+criteria force **NO-GO**.

package/pack/generated/omp/skills/rite-spec/reference/ai-spec-template.md

@@ -0,0 +1,40 @@
+# `ai-spec.md` template
+
+Create this annex only when the feature touches model calls, RAG, agents, evals,
+or LLM output.
+
+```markdown
+# AI-SPEC: <Feature>
+
+## AI surface
+| Surface | Purpose | Owner |
+| --- | --- | --- |
+| <model call/RAG/agent/eval> | <why it exists> | <module/team> |
+
+## Model/runtime choice
+- Framework/model/provider: <choice or project default>
+- Settings that matter: <temperature, tools, retrieval scope, limits>
+- Fallback/degradation: <what users see when AI is unavailable>
+
+## Domain evals
+| Eval ID | Scenario / slice | Dataset provenance | Expected signal + threshold | Gate |
+| --- | --- | --- | --- | --- |
+| EVAL-001 | <representative/adversarial/empty-context case> | <held-out source/version> | <pass condition and baseline delta> | build/seal |
+
+For RAG, cover retrieval relevance/context recall, context precision, answer
+faithfulness, citation support, tenant/ACL isolation, poisoned or conflicting documents,
+and insufficient-context fallback as applicable. A single polished example is not an eval.
+
+## Guardrails
+- Inputs: <validation, prompt-injection boundaries, tenant/data limits>
+- Retrieval: <source provenance, indexing validation, tenant/ACL filter, freshness/deletion>
+- Outputs: <schema checks, refusals, human review, citations only to supporting retrieved sources>
+- Privacy/security: <data sent to model, retention, secrets policy>
+- Unknown/insufficient context: <abstain, clarify, or bounded fallback; never fabricate>
+
+## Monitoring
+- Runtime metrics/logs: <latency, cost, retrieval/quality, refusal/error/fallback rates>
+- Alerts or manual review: <trigger>
+- Rollback/kill switch: <prompt/model/index version and reversible mechanism>
+- Drift evaluation: <reference set, schedule/trigger, regression threshold, owner>
+```

package/pack/generated/omp/skills/rite-spec/reference/anti-patterns.md

@@ -0,0 +1,27 @@
+# rite-spec: anti-patterns
+
+Load this when standing a non-trivial decision in `/rite-spec`, or when the
+agent feels reluctance toward investigation depth, gap-closing, or
+placement decisions.
+
+Pack-wide rationalizations + red flags: see [standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-patterns.md).
+
+## Phase-specific rationalizations
+
+| Excuse | Rebuttal |
+|---|---|
+| "User said *just make it work*: no spec needed." | Vague asks are exactly where `/rite-spec` earns its keep; load `devrites-interview` and ask one question at a time. |
+| "I already understand the request." | Then writing the placement + acceptance criteria takes minutes and saves drift later. Investigation isn't for *you*, it's for `/rite-define`. |
+| "Too small for a spec." | If it's big enough for `/rite-build`, it's big enough for one paragraph of WHAT/WHY + measurable acceptance. |
+| "No design refs were attached, so skip references." | Skip the *gathering*, not the *acknowledgement*. Note "no references provided" in the spec: silence is ambiguous. |
+| "I can resolve gaps as I build." | Drift discovered at slice 3 costs more than 5 questions answered now. |
+| "I'm confident of the answer, so I'll just decide this myself." | Confidence changes the *cost* of the question, not its *owner*. A material decision (scope · placement · data model · UX · security · migration · acceptance) is put to the human as a ranked option set: near-certainty just makes it a one-pick confirm, never a silent decision. |
+| "Presenting options for every gap is over-asking." | Over-asking is many questions at once or asking what the codebase answers. One ranked option set per *material* gap, recommended-first, is the opposite: it hands the human the decision cheaply. Reversible low-impact details you still auto-decide and log. |
+
+## Red Flags
+
+- About to start writing `spec.md` without a Placement & integration section.
+- Spec has no measurable acceptance criteria: "works as expected" is not measurable.
+- A `[NEEDS CLARIFICATION]` marker remains on a blocking item.
+- Design references were attached but never opened, saved, or indexed in `references.md`.
+- The investigation didn't read the module/component that currently owns this area.