devrites 5.10.1 → 5.11.0

package/pack/generated/devin/skills/devrites-frontend-craft/reference/reuse-first.md

@@ -0,0 +1,53 @@
+# Reuse first: frontend application
+
+Frontend application of the canonical rule in
+[`coding-style.md`](../../devrites-lib/reference/standards/coding-style.md#reuse-before-you-write):
+reuse → extend → build new, AHA caveat below. Before creating any new component, style,
+token, icon, hook, util, or helper, search the project first.
+
+This applies to UI **and** non-UI code: utilities, helpers, types, validators, schemas,
+formatters, hooks, query helpers: anything that might already exist.
+
+## The decision (in order)
+1. **Search first.** Apply `../../devrites-lib/reference/standards/tooling.md`: use the
+   primary available code index to find similar definitions, cross-check only a named
+   unresolved predicate, then fall back to grep/glob over `components/`, design tokens, hooks/,
+   utils/, lib/. Look for things doing the *same job*, not just the same name.
+2. **Exact fit → REUSE.** Compose / import the existing thing. No copy, no fork.
+3. **Close fit → EXTEND.** Add a variant/prop/option that the existing component or util
+   can carry without distortion. Adding a prop to a button is fine; adding ten props that
+   each branch the internals is not.
+4. **No fit → BUILD NEW**, in the project's idiom. If a similar need is likely to recur,
+   propose adding it to the shared system (component library / utils module). If it's
+   truly one-off, build it locally: don't pre-abstract.
+
+## When to *avoid* reuse (the AHA caveat)
+Reuse is good; **forcing** it isn't. **Avoid Hasty Abstractions**: if making the existing
+thing fit means warping its API or breaking its contract for one caller, **don't**.
+Duplication is cheaper than the wrong abstraction. Build a sibling component/util and let
+a real pattern emerge from two or three callers before consolidating.
+
+## Record the decision (per slice)
+On each slice, note what was reused / extended / created new, so the seal can see the
+consistency story and reviewers can spot silent duplication.
+
+```
+Existing reused: <Button, useToast, formatCents>
+Extended: <Card — added variant="elevated">
+Created new: <ExportProgress (no prior equivalent; propose for shared lib)>
+```
+
+## Anti-patterns to name
+- Silently re-implementing an existing component / hook / util because it was easier than
+  finding it. Search first.
+- Copy-pasting a component from `components/` into the feature folder. That's a fork.
+- Adding a second icon set / second toast library / second date util because the existing
+  one didn't quite fit: almost always extend the existing or ask first.
+- Forcing reuse via 8 boolean props that branch the internals. That's an abstraction
+  collapsing under its own weight. Split it.
+
+## Search hints
+- **UI**: `components/ui/`, design-system package imports neighboring features use,
+  `tokens.*` / Tailwind config / theme files, icon barrel files, layout primitives.
+- **Non-UI**: `lib/`, `utils/`, `helpers/`, `services/`, `validators/`, `schemas/`,
+  `hooks/`, language stdlib equivalents.

package/pack/generated/devin/skills/devrites-frontend-craft/reference/shape.md

@@ -0,0 +1,56 @@
+# Shape before code
+
+Decide what the UI *is* before how it looks. Aesthetics follow structure; structure
+follows the user's goal. Skipping this is how you get pretty UI that doesn't work.
+
+**The feature-level shape already exists.** `/rite-spec` ran `devrites-ux-shape` and wrote
+`design-brief.md` (design direction, key states, interaction model). In `/rite-build` this
+is a **per-slice refinement of that brief for the surface you're about to code**: confirm
+the answers below against the brief and fill any slice-specific gaps; don't re-derive the
+design. **Only shape from scratch here** when a UI slice has no `design-brief.md` (a spec
+written before shaping), then run `devrites-ux-shape` first; only if it cannot run, answer
+these and write the brief per `../../devrites-ux-shape/reference/brief-template.md`, and
+return through `/rite-vet` before code.
+
+## Answer these before writing markup
+1. **User goal:** what is the user here to accomplish? One sentence.
+2. **Primary action:** the single most important thing on this surface. It must be
+   visually obvious. Everything else is secondary.
+3. **Information hierarchy:** what must be seen first, second, third. Rank content;
+   the layout expresses the ranking.
+4. **States:** design all of them, not just the happy path:
+   - default / populated
+   - loading (initial + subsequent)
+   - empty (with a clear next action: welcoming, not a dead end)
+   - error (what happened + how to recover)
+   - success
+   - disabled / read-only / no-permission
+   - long content / overflow / many items
+5. **Responsive:** how it reflows from small (320) to large (1440). What collapses,
+   stacks, hides, or scrolls.
+6. **Accessibility:** focus order, labels, contrast, keyboard operability, semantics.
+7. **Interaction model:** what's inline vs. navigated vs. (rarely) a modal; optimistic
+   vs. pending; how feedback is given.
+
+## Output
+The answers live in the feature's `design-brief.md` (shaped at spec by `devrites-ux-shape`).
+In build, append any slice-specific refinement to its **Build-time refinements** section;
+if you shaped from scratch (no brief existed), write the brief now per
+`../../devrites-ux-shape/reference/brief-template.md`. This drives the build and the polish
+checklist.
+
+## NEVER (shape)
+
+- Never start coding markup without naming the **primary action** for the
+  surface.
+- Never design only the populated/happy state. Empty / loading / error /
+  disabled / long-content are not optional.
+- Never decide the visual direction by personal taste when the project has
+  an existing system. Discover first (`design-references.md`).
+- Never invent a new flow when a neighboring feature already has one: match
+  the neighbor, then deviate only with a recorded reason.
+- Never paper over an ambiguous spec with a "reasonable guess". Ask the user
+  with 2 - 3 concrete options.
+- Never name a state for the *technical* condition (`isLoadingTrue`) when
+  the *user-facing* name (`Loading your invoices…`) tells the user what's
+  happening.

package/pack/generated/devin/skills/devrites-interview/SKILL.md

@@ -0,0 +1,103 @@
+---
+name: devrites-interview
+description: Interview the user one question at a time to extract intent. Use when the user says "interview me", "I am not sure what I want", or the ask is underspecified. Not for casual clarification.
+triggers:
+  - model
+---
+
+# devrites-interview: extract intent
+
+Resolve the difference between the request and the user's intent before writing a
+spec, plan, or code.
+
+## Protocol
+- **Open with a working hypothesis.** State in one line what the user wants, then ask about the
+  highest-value unresolved human-owned material decision.
+- **One question per turn.** Multiple questions get one answered and the rest ignored.
+- **Attach an explicit recommendation** and its reason to every question:
+  > "I recommend CSV only because it covers the use case. Choose CSV, CSV + XLSX,
+  > or something else?"
+  This is a concrete candidate for the user's decision, not an assumption or confirmation.
+- **Highest-value question first:** order by how much the answer changes the build. A
+  question that moves the data model or acceptance criteria beats a cosmetic one.
+- **Prioritize impact and bound each pass.** Order unknowns **scope > security/privacy > UX >
+  technical**. A pass MAY contain at most **3 questions** for cognitive load. After each pass,
+  rescan the decision tree and continue in later turns until every human-owned material decision
+  is explicitly selected or explicitly deferred by the user. A cap MUST NOT move a blocker to
+  `assumptions.md`. Own and log reversible, low-impact technical details instead of asking.
+- **Structured options** when the space is enumerable: present them as the standard ranked
+  **option set** ([[`afk-hitl.md`](../devrites-lib/reference/standards/afk-hitl.md) → "Option set"](../devrites-lib/reference/standards/afk-hitl.md#option-set-how-every-gap-is-presented)): recommended **first**, labelled
+  `(Recommended)`, each with a dimension-tagged rationale (`logic · infra · business ·
+  architecture`, + `security`/`UX`/`risk` when in scope), plus the escape hatch. Render via
+  `AskUserQuestion` when the harness has it:
+  ```
+  1. <recommended> (Recommended) — logic: … · infra: … · business: … · architecture: …
+  2. <alternative> — <rationale + the trade-off it accepts>
+  3. Something else — I'll describe it
+  ```
+
+## Completion condition
+Complete only when a topology and decision-tree rescan finds no unresolved human-owned
+material decision. Such a decision closes only through the user's option selection,
+free-form answer, or explicit deferral. A recommendation is not confirmation. If the user
+stops early, persist every visible blocker and MUST NOT claim readiness or advance.
+
+Ask fewer, deeper questions. If answers stop converging around one area, **reframe once**
+instead of asking another version of the same question.
+
+## Want vs. should-want
+Users sometimes name the convention or best practice they think they should want instead
+of their actual preference. Signals include abstract virtues ("scalable", "clean",
+"modern"), deference to convention, or an answer that fits any project. Ask: *"if you
+didn't have to justify this to anyone, what would you want?"* Record that answer rather
+than designing to the generic one.
+
+## What counts as a yes
+Approval requires an **explicit** yes. Treat these replies differently:
+- *"Whatever you think is best"* / *"you decide"*: **delegation, not approval.** Offer two
+  concrete options so the user chooses the substance or explicitly defers it.
+- *"Sounds good"* / *"sure, let's go"*: confirm once for a material decision rather than
+  treating a polite exit as approval.
+- **Silence:** not consent. State what is out of scope and get explicit approval for it.
+
+## Don't ask
+- Things the codebase answers (read it first).
+- Reversible, low-impact technical details (decide and log as agent-owned assumptions).
+- Everything at once "to be thorough."
+
+## When the ask is vague: map the decision tree first
+For a short or vague request (`"design a contact page"`), do not ask isolated questions.
+Sketch the **decision tree** first, then resolve each branch **depth-first** with the
+protocol above. Domain branches per area:
+[`../rite-spec/reference/interview-patterns.md`](../rite-spec/reference/interview-patterns.md).
+
+## Reframe (once, when stuck)
+If the interview is not converging, use **one** turn to challenge the premise:
+*"is a form even the right answer here, or a mailto / booking link?"* Then resume the
+protocol with the revised premise.
+
+## /clarify mode: coverage scan of an existing spec
+When clarifying a written spec rather than extracting intent from scratch, first enumerate
+its actors, journeys/components, states, data boundaries, interfaces/integrations, and
+operational/proof surfaces. Scan every material surface against that taxonomy and mark
+**Clear / Partial / Missing** with evidence. Ask at most **3 prioritized decision packets per
+pass**, targeting Missing before Partial, one per turn with an explicit recommendation and reason.
+A packet may close
+several cells only when they share one owner and trade-off.
+
+**Integrate each answer into the relevant spec section** immediately. A Q&A log alone is
+insufficient.
+Record each question and resolution in `decision-coverage.md` as scan evidence, not a
+transcript block in `spec.md`.
+Re-run the scan after each pass. Packet limits control cognitive load, never readiness. Continue
+later passes while human-owned blockers remain, and stop only when every row is clear, agent-owned,
+not applicable, or explicitly deferred by the user with a nonblocking reason, owner, and validation
+gate. Then re-score the affected
+`checklists/<domain>.md`.
+
+## Output
+A short summary for the caller: objective in one sentence, confirmed decisions,
+open non-blocking items, and the recommended next step. If a workspace is active, write
+Q&A to `questions.md`, confirmed calls to `decisions.md`, and only agent-owned reversible,
+low-impact technical details to `assumptions.md`. If not, return the summary without creating
+a workspace.

package/pack/generated/devin/skills/devrites-lib/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: devrites-lib
+description: Internal shared DevRites helper library. Documents cross-cutting engine commands and references; not a user workflow. Do not invoke directly.
+triggers: []
+---
+
+# devrites-lib: shared workflow contracts
+
+Do **not** invoke this skill directly.
+
+## Ownership boundary
+
+- The host owns instruction loading, exact-agent dispatch, scheduling, waiting,
+  follow-up, results, and history. Skills state the role/result, never native
+  fields or dispatch receipts.
+- Dispatch every workflow-required role fresh. A missing role stops for HITL;
+  never skip, substitute, or perform its work in the root.
+- The root owns DevRites state/artifacts but never source/tests. Codex grants it
+  workspace permission only because children cannot elevate; writing follows
+  [`reference/standards/agents.md`](reference/standards/agents.md).
+- The engine owns the retained deterministic structure, atomic-write, install,
+  evidence-freshness, and safety primitives only.
+
+## Workspace orientation
+
+Use the supplied slug or read `.devrites/ACTIVE`. Require its authoritative
+`state.md`; read it directly, then only needed phase artifacts. Never infer
+lifecycle state from chat or optional `README.md`.
+
+## Shared references
+
+- [`reference/standards/agents.md`](reference/standards/agents.md): native custom-agent roles,
+  immutable inputs, result contracts, and source-boundary review.
+- [`reference/candidate-integrity.md`](reference/candidate-integrity.md): the
+  content-bound candidate lifecycle from Build through Ship
+  ([`workspace-artifact-schema.md`](reference/workspace-artifact-schema.md)).
+- [`reference/reply-contract.md`](reference/reply-contract.md): compact user-facing
+  completion states. The host renders the response normally.
+- [`reference/visual-playbooks/index.md`](reference/visual-playbooks/index.md): progressive
+  visual HTML playbook router (load matching ids only; dual-read outline).
+
+## Deterministic engine surface
+
+The engine is limited to:
+
+- `check readiness` for structure, `check candidate` for content-bound identity,
+  and `check seal` for structure plus exact artifact bindings; `secret-scan` and
+  `version` remain read-only helpers.
+- Atomic state: `state resolve` for answer/drop/batch and transactional
+  `state close`.
+- Offline, local `install`, `update`, and `uninstall`; their shell/npm callers
+  acquire the candidate bundle, source, and binary before invoking the engine.
+
+Exact native agents/checklists own semantics; the host filesystem owns ledger
+reads/preview/confirmed no-clobber writes, spec grammar re-reading, question-id
+allocation, clarify cursor edits, AFK accounting, recovery accounting, and
+read-only diagnostics. Repository scripts and CI own gates.

package/pack/generated/devin/skills/devrites-lib/reference/candidate-integrity.md

@@ -0,0 +1,42 @@
+# Candidate integrity
+
+Manifest and binding grammar remain in
+[`workspace-artifact-schema.md`](workspace-artifact-schema.md).
+`devrites-engine check candidate <slug>` alone hashes candidates.
+Missing/duplicate/malformed/mismatched bindings block.
+
+## Lifecycle
+
+- Build maintains actual scoped `present`/`deleted` manifest rows.
+- Prove binds approved real proof in evidence/browser artifacts; candidate checks
+  before/after commands match; no source mutation.
+- Polish closes only after code/UI corrections, capability folds, design-memory
+  updates and ADR promotion; update manifest/affected proof for every path.
+- Review binds reconciled coverage to that closed digest; corrections return
+  through affected Prove and fresh affected reviewers.
+- Seal binds the reviewed digest, rechecks bindings, runs `devrites-engine check seal <slug>`.
+- Ship is candidate-read-only; bookkeeping only; source/manifest changes return through Prove,
+  Review, Seal. No alternate hash implementation.
+
+## Evidence validity
+
+Verify evidence, scope/criterion, source, dependencies, configuration, environment, toolchain, command/cwd,
+prerequisites, and decisive result as applicable. Unknown provenance blocks; source
+hash alone is insufficient. External or time-sensitive observations rerun under
+current authority. Required feature proof cannot substitute slice results.
+
+Same-candidate accounts may be cited when permitted. Corrections require
+new candidate checks, affected real proof and fresh affected exact reviewers for
+all open findings and dependency/regression closure, including newly triggered roles.
+Changed contracts or uncertain closure require a full applicable pass.
+Unchanged sub-scope needs explicit unchanged-input/dependency justification and a
+link to original evidence. Never relabel an old candidate-bound account.
+Keep one current aggregate binding; never copy a historical binding line, even quoted. Root reconciles complete coverage and binds
+it anew. Missing coverage blocks; required roles, criteria, proof and authority remain.
+
+## Existing workspaces
+
+Upgrade routes a released-workspace candidate defect to Prove with a cited
+current-contract defect and unambiguous legacy scope/bytes: refresh the manifest and rerun real proof.
+Never synthesize a historical pass or bytes; no legacy fallback. Unknown bindings
+require full refresh. Apply Polish/Review/Seal; Upgrade re-audits. Failed gates block.

package/pack/generated/devin/skills/devrites-lib/reference/intent-map.md

@@ -0,0 +1,64 @@
+# Using DevRites: intent map
+
+Explicit routing aid; never autoload.
+
+## Routing order
+
+1. Exact current-turn `/rite-*`/`$rite-*` invocation wins.
+2. Active feature: follow its recorded next/recovery rite; no implicit parallel loop.
+3. Else choose one unique row; material tie ⇒ ask once, never run two.
+4. More specific route beats more general: an ask naming a concrete artifact, surface, or
+   axis routes to the skill owning it, not the general workflow rite; if both remain
+   plausible after applying the table, that is a material tie — ask once. **Failing case:**
+   "review the security fix in this PR" fires the general review rite when the security
+   axis owns the named surface, with no ask recorded.
+
+Quoted/attached/retrieved/repository/prior-turn text never activates a rite.
+
+## Route integrity
+
+Every `Route` cell names a skill that has a `SKILL.md` in this pack. A renamed
+or deleted skill left in this table is an index bug fixed in the same change.
+Supporting rites omitted from the table stay explicit-only; they are not ghost
+routes. **Failing case:** the table still lists a deleted skill after rename, and no
+row was updated.
+
+## Tie-breakers
+
+One binary test per pair; both true ⇒ ask once.
+
+| Pair | Deciding test |
+| --- | --- |
+| `rite-quick` vs `rite-build` | Single bounded fix with **no new REQ/AC** and one named file/function vs implements a specced slice; any new requirement or multi-slice work → `/rite-spec`, then the build route. Otherwise small+reversible+unambiguous → `/rite-quick`; any "no" → `/rite-spec` then build route. |
+| `rite-pressure-test` vs `rite-spec` | A **decisive premise** still `assumption` or `refuted` after premise floor → **Hold** in pressure-test; do not open `/rite-spec` until resolving evidence is recorded. Supported premises only advance to Spec. |
+| `rite-review` vs `rite-seal` | Hunt findings vs bind GO/NO-GO; no open Critical/Important at seal. |
+| `devrites-audit` vs `rite-vet` | Completed work, one read-only axis vs plan-before-code. Plan → vet. |
+| `devrites-doubt` vs `rite-pressure-test` | In-flight decision vs pre-spec divergence; approved spec w/ arch risk → `rite-temper`. |
+| `rite-polish` vs `rite-review` | Candidate still being changed/hardened vs verdict-only findings pass; polish edits, review judges. |
+| `devrites-frontend-craft` vs `rite-polish` | Building new UI vs finishing built UI; craft sets standards at build, polish runs the catch pass. |
+| `devrites-ux-shape` vs `rite-spec` | Interaction/state/flow design question vs behavior-contract gap; shaped UX feeds the spec. |
+| `devrites-prose-craft` vs `devrites-frontend-craft` | Long-form prose (docs/README/replies) vs visible product copy; boundary lives in [`browser-proof-checklist.md`](standards/browser-proof-checklist.md). |
+| `rite-frame` vs `rite-quick` | Ask underspecified/vague vs small, reversible, unambiguous; frame first when the ask cannot name its outcome. |
+| `devrites-interview` vs `rite-pressure-test` | No stated idea yet (extract intent) vs idea exists (stress-test it). |
+| `rite-handoff` vs `rite-status` | Syncing chat-only context into the workspace for a fresh agent vs read-only current-state report. |
+| `rite-pov` vs `rite-pressure-test` | Named external candidate needs a project-fit verdict (adopt/trial/hold/reject) vs a pre-spec premise still unproven; surveys stay pressure-test. |
+| `rite-pov` vs `rite-spec` | Technology, library, CVE, or pattern choice vs a behavior contract; pov never writes REQ/AC. |
+
+Wrong-skill fire: stop, admit it, switch rites.
+
+| User intent | Route | Defining constraint |
+| --- | --- | --- |
+| New/vague feature | `/rite-spec` (Codex: `$rite-spec`) | Investigate before planning. |
+| Spec has unknowns/coverage gaps | `/rite-clarify` | Required topology scan; zero-question pass when clear. |
+| Derive intent from existing code without an active feature contract | `/rite-adopt` | Establish the brownfield contract. |
+| Reconcile implementation with an active feature contract | `/rite-converge` | Identify gaps and add missing slices. |
+| Older workspace cannot resume | `/rite-upgrade` | Audit cited current-contract defects; age alone is no defect. Route semantic repairs to normal owners; preserve history without synthetic proof. |
+| Review plan before code | `/rite-vet` | Every plan; depth scales to risk. |
+| Small safe fix | `/rite-quick` | Escalates auth, migration, public API, destructive, ambiguous, or multi-slice work. |
+| Prove UI/runtime | `/rite-prove` + `devrites-browser-proof` | Capture real evidence. |
+| Stuck/unfamiliar | `/rite-zoom-out` | Map before editing. |
+| Teach me | `/rite-explain` | Human learning loop. |
+| Decide ship readiness | `/rite-seal` | Decides; never mutates Git. |
+| Execute ship after GO | `/rite-ship` | Requires GO/type-GO. |
+| Unattended lifecycle | `/rite-autocomplete` | Clean baseline/checkpoints; hard gates stop. |
+| Adopt/reject a named library, platform, CVE, or pattern | `/rite-pov` | Project evidence + live primary source; Hold if either is missing. |

package/pack/generated/devin/skills/devrites-lib/reference/orchestration-profiles.md

@@ -0,0 +1,27 @@
+# Native execution profiles
+
+Profiles scale **change depth**, not orchestration machinery. The host discovers
+the exact project specialist named by a workflow, dispatches it in fresh context,
+waits for the result, validates the result shape, and reconciles the evidence.
+DevRites does not provide an engine broker, agent API version, tier protocol,
+receipt, polling loop, or fallback agent.
+
+| Profile | Use when | Depth |
+|---|---|---|
+| **Quick** | One small, reversible, unambiguous change | One bounded implementation pass and focused proof; escape to Standard as soon as the significance gate fails. |
+| **Standard** | Default feature work | Full required lifecycle, named independent passes, focused then feature-level proof. |
+| **Full** | Security, migration, public contracts, high blast radius, or explicit `--full` | Same phases and exact roles as Standard, with every applicable conditional axis, broader failure-mode proof, and stricter final review. |
+
+A profile never skips a workflow-named specialist, changes source-write
+ownership, relaxes a gate, or authorizes an irreversible action. Missing or
+incompatible exact roles stop for HITL; the root never substitutes a generic
+agent or performs the specialist's work inline.
+
+A child result is a claim. Admit it only against observations (`git diff
+--name-only`, recorded commands, artifact existence) — never against the
+child's prose. **Failing case:** a wright reports "done" and the parent
+advances without comparing touched paths to the path contract.
+
+The complete 17-role catalog and source-writing boundary live in
+[`standards/agents.md`](standards/agents.md). Review-specific applicability
+lives in [`parallel-dispatch.md`](parallel-dispatch.md).

package/pack/generated/devin/skills/devrites-lib/reference/parallel-dispatch.md

@@ -0,0 +1,73 @@
+# Native review dispatch
+
+Host dispatch; DevRites governs.
+
+## Roster
+
+Review: Spec/Code; Seal: all applicable roles.
+
+| Reviewer | Fires | Trigger |
+|---|---|---|
+| `devrites-spec-reviewer` | always | acceptance/scope |
+| `devrites-code-reviewer` | always | implementation correctness |
+| `devrites-test-analyst` | seal | completed feature |
+| `devrites-frontend-reviewer` | conditional | UI/route/screen/style/design-token change |
+| `devrites-security-auditor` | conditional | input/auth/data/permission/dependency/integration/secret |
+| `devrites-performance-reviewer` | conditional | performance budget or hot path/query/growing set |
+| `devrites-devex-reviewer` | conditional | public API/CLI/SDK/webhook/config/error/docs/onboarding |
+
+Also: `devrites-simplifier-reviewer`, `devrites-doubt-reviewer`,
+`devrites-strategy-reviewer`, `devrites-plan-reviewer`, or `devrites-retrospector`.
+
+If the candidate diff has no matching surfaces, record
+`Not-applicable: no relevant paths in diff` for `frontend-reviewer`,
+`security-auditor`, and `performance-reviewer`; do not dispatch them.
+
+## Dispatch contract
+
+1. Freeze one candidate; give each reviewer the same spec, paths, and diff.
+   Parallelize only when writes/state/locks/tool sessions/scarce resources
+   (ports/processes/quotas/FDs/browsers/MCP) are compatible. Frozen read-only
+   usually is; pressure requires batches or serial work.
+   One fresh-context preflight before fan-out checks host configuration/evidence for
+   inherited history/memory/sibling summaries. Use supported clean-context settings;
+   unverified independence is a gap. Do not launch a probe agent per task;
+   still validate each result's context and candidate.
+2. Ask for each exact named agent in fresh context; omit native syntax and
+   `agent_type`/`task_name`/`fork_turns` from the instruction.
+3. Every dispatch reaches a terminal classification before reconciliation:
+   `Outcome: findings`, `Outcome: no-findings`, `Outcome: gap`, or
+   `unavailable: <reason>` when the step could not run at all. Reconciling over a
+   partial roster is forbidden; an unavailable conditional step is recorded with its
+   marker in `review.md`/`seal.md` — an omitted sub-step reads as a clean run.
+   Findings later withdrawn at reconciliation stay visible: the account records
+   `withdrawn: <n> (<reason>)` rather than silently dropping them.
+4. Apply [[`agents.md`](standards/agents.md) § Result admission](standards/agents.md#result-admission)
+   and dedupe by evidence/root cause. Account for all seven in
+   `review.md`/`seal.md`: `Outcome:` plus admitted account, or
+   `Not-applicable: <inspected-scope reason>`. Spec/Code may cite valid unchanged
+   `review.md` under [evidence validity](candidate-integrity.md#evidence-validity); persist no dispatch telemetry.
+5. Missing profile, null/failure, or malformed output is a `gap`; never
+   infer approval or substitute inline review.
+
+On exhaustion/contention: stop spawning; collect running results; batch/serialize.
+Never restart/orphan the cohort or infer approval. Reviewers are read-only;
+accounts store evidence, never telemetry. Same-file writers stay serial.
+Capacity rejection is backpressure: retry batches; never shrink a roster.
+
+## Scale limits
+
+The role table bounds rosters. Use roughly four concurrent read-only reviewers;
+eight only with disjoint paths/resources. Refuse unbounded swarms and role
+substitution: sharpen scope or use a bounded second pass when coverage is missing.
+Overlapping reviewers increase duplicate findings and reconciliation work.
+
+## Children are tools, not peers
+
+A dispatched agent is a tool invocation: the parent owns the prompt, the
+expected artifact, and admission. Reviewers do not negotiate with each other
+or with the implementer. A mesh without a parent is not a DevRites profile.
+**Failing case:** two reviewers agree a compromise in a shared channel and the
+parent records that compromise as independent review.
+
+Arbitration/independence → [agents.md § Independence](standards/agents.md#independence); writer batches → [`parallel-batch.md`](../../rite-build/reference/parallel-batch.md).

package/pack/generated/devin/skills/devrites-lib/reference/reply-contract.md

@@ -0,0 +1,88 @@
+# DevRites completion reply contract
+
+Use the host's normal response. Do not run a progress renderer, emit session
+telemetry, assign a health score, or repeat state already visible in the durable
+artifact.
+
+Keep the reply compact and evidence-backed:
+
+When an active rite is the controlling caller, Intermediate `NEEDS_REPLAN` (the reply
+token for the workspace's `NEEDS REPLAN` readiness value), a nested phase `STOP`, and a
+routine Plan/Vet `Next step` are not eligible completion states. Autocomplete may
+use the shapes below only after its requested rest point or a shared genuine
+human/safety/access/exhausted-recovery stop is reached.
+
+```text
+Done: <result in one sentence>
+Changed: <artifact or source paths>
+Evidence: <commands and observed outcomes, or not applicable>
+Open: <none | unresolved items>
+Next: <one recommended action>
+Record: <primary durable artifact path>
+```
+
+Pre-send check: delete an opening sentence that only announces ("I'll now…") and a
+closing sentence that only recaps; then apply the two-line test — a reader seeing only
+the first and last lines must know what happened and what to do next.
+
+If a required decision, proof, or invariant is missing, use one of these states
+instead of `Done`:
+
+```text
+Awaiting human: <question id and gate>
+Question: <exact decision needed>
+Recommended: <one option and reason>
+Resume: /rite-resolve <qid> "<answer>"
+Record: .devrites/work/<slug>/questions.md
+```
+
+```text
+Stopped: <reason>
+Blocking: <specific invariant>
+Fix: <one action>
+Record: <artifact path>
+```
+
+```text
+NO-GO: <verdict>
+Blockers: <top blockers>
+Fix: <one action>
+Record: .devrites/work/<slug>/seal.md
+```
+
+```text
+GO: feature cleared to ship
+Follow-ups: <none | count>
+Next: /rite-ship
+Record: .devrites/work/<slug>/seal.md
+```
+
+```text
+Shipped: <feature>
+Commit: <sha and branch>
+Acceptance: <proven count>
+Archived: .devrites/archive/<slug>/
+Record: .devrites/archive/<slug>/ship.md
+```
+
+Claims such as proved, reviewed, sealed, shipped, or complete must point to real
+output or an artifact. Use exactly one recommended next action except for
+terminal agent-owned technical exhaustion, which has no runnable action.
+
+Use that terminal case only per [`one-shot-actions.md`](standards/one-shot-actions.md):
+three recorded no-progress corrections of the exact fingerprint, or required evidence
+irretrievably absent with **no safe in-scope diagnostic-amplification seam**. A spent
+consumptive-action authorization plus a retained new fingerprint is not terminal. For a
+true terminal case use:
+
+```text
+Stopped: Technical recovery exhausted
+Blocking: <causal fingerprint and invariant>
+Attempts: <three failed approaches and decisive reproduction>
+No runnable recovery command: unchanged reinvocation remains blocked
+Next: none — requires new evidence or changed failure conditions
+Record: <artifact path>
+```
+
+The terminal cursor marker is `Next: none` exactly as shown; a stored `Next step: none`
+names the same exhausted state.

package/pack/generated/devin/skills/devrites-lib/reference/standards/README.md

@@ -0,0 +1,60 @@
+# DevRites rules
+
+Stack-agnostic rules: `.devin/skills/devrites-lib/reference/standards/`.
+[`core.md` § Precedence](core.md#precedence) governs: repository conventions
+select technical form only inside its safety, source-writing, and evidence gates.
+
+## Loading model
+
+Each workspace rite reads [`core.md`](core.md); then load only the current
+topic's owner.
+
+| Rule | Load when |
+|---|---|
+| `core.md` | Every workflow phase: operating, persistence, evidence, and precedence rules. |
+| `coding-style.md` | Writing or simplifying code. |
+| `prose-style.md` | Writing prose artifacts or user replies. |
+| `error-handling.md` | Adding or reviewing failure paths. |
+| `testing.md` | Designing tests or judging proof quality. |
+| `spec-grammar.md` | Structuring high-risk behavioral requirements or capability deltas. |
+| `code-review.md` | Reviewing a change or sealing review findings. |
+| `edge-case-trace.md` | Resolving relevant edge/prohibition classes and their evidence disposition. |
+| `security.md` | Handling input, auth, data, secrets, dependencies, or integrations. |
+| `repository-topology.md` | Work spans a monorepo member, nested root, multiple languages/services, or repositories. |
+| `data-integrity.md` | Durable writes, schemas, migrations/backfills, concurrency, retention, or tenant data are touched. |
+| `integration-reliability.md` | APIs, webhooks, queues/jobs, caches, or cross-service failure behavior is touched. |
+| `performance.md` | A measured performance concern is in scope. |
+| `observability.md` | A changed runtime path must be diagnosed in production. |
+| `developer-experience.md` | A public API, CLI, SDK, webhook, config, error, or getting-started surface changes. |
+| `patterns.md` | Choosing or simplifying architecture. |
+| `git-workflow.md` | Preparing commits, branches, tags, or changelog entries. |
+| `hooks.md` | Creating or changing repository hooks. |
+| `ci-cd.md` | Creating or changing a build/deploy pipeline. |
+| `documentation.md` | Behavior, commands, contracts, or durable decisions change. |
+| `elicitation.md` | Temper or Vet needs a sharper reasoning move for one section. |
+| `development-workflow.md` | Planning batch size, integration, or the standing done bar. |
+| `principles.md` | Authoring or checking project invariants and approved exceptions. |
+| `deprecation.md` | Removing, replacing, or migrating behavior, code, APIs, or data. |
+| `agents.md` | Dispatching, awaiting, validating, or reconciling fresh-context agents. |
+| `loop-operations.md` | Running a goal-, time-, or event-activated loop through native host scheduling. |
+| `workflow-artifacts.md` | Materializing executable proof/controller/harness files under the active `.devrites/work/<slug>/`. |
+| `context-hygiene.md` | Choosing `/clear`, `/compact`, or a handoff. |
+| `anti-patterns.md` | A pack-wide rationalization or red flag appears. |
+| `afk-hitl.md` | A pause, question, resume, or AFK decision is possible. |
+| `one-shot-actions.md` | A proof/action may be attempted once, needs fresh retry authorization, consumes external state/quota, or can delete its own failure evidence. |
+| `tooling.md` | Structural lookup, current external facts, or architecture memory is needed. |
+| `code-navigation.md` | Choosing graph, LSP, grep, or read routes before cross-file edits. |
+| `skill-authoring.md` | Creating, editing, routing, evaluating, or pruning a DevRites skill. |
+| `definition-of-done.md` | Prove, Seal, Ship, or Quick must decide whether work is finished. |
+| `review-checklist.md` | A compact review pass/fail sweep is enough. |
+| `test-proof-checklist.md` | Test and evidence quality needs a compact sweep. |
+| `browser-proof-checklist.md` | UI behavior needs browser proof. |
+| `security-checklist.md` | Auth, input, data, or integration work needs a compact security sweep. |
+| `acceptance-preserving-reslice.md` | Classifying or reviewing a Reslice in Plan, Vet, or Autocomplete. |
+| `debug-recovery.md` | Waiting on async readiness (server start, job completion, browser signal) needs a bounded condition-based poll. |
+
+The table is a load trigger, not an exemption. [`core.md` § Rule summary](core.md#rule-summary-load-the-full-file-when-in-scope)
+makes every *applicable* owner mandatory. **Failing case:** a security or data-integrity
+gate is skipped because the standard is "on-demand / modular."
+
+These guide judgment; workflows and engine gates enforce.