devrites 5.10.1 → 5.11.0

package/pack/generated/devin/skills/rite-build/reference/output.md

@@ -0,0 +1,33 @@
+# rite-build output
+
+**Slices remain:**
+
+```text
+Done: built slice <n> — <name>.
+Changed: <files>; state.md, touched-files.md, evidence.md
+Evidence: acceptance met; tests <cmd> → pass; browser <summary|n/a>; drift <none|handled>
+Open: <none|blockers|questions>
+Next: /rite-build
+Record: .devrites/work/<slug>/evidence.md
+↻ Hygiene: /clear between slices; /rite-handoff if away > a few hours
+```
+
+**All built:**
+
+```text
+Done: built slice <n> — <name>; all slices built.
+Changed: <files>; state.md, touched-files.md, evidence.md
+Evidence: acceptance met; tests <cmd> → pass; browser <summary|n/a>; drift <none|handled>
+Open: <none|blockers|questions>
+Next: /rite-prove
+Record: .devrites/work/<slug>/evidence.md
+↻ Hygiene: /clear before /rite-prove; /rite-handoff if away > a few hours
+```
+
+HITL returns after one green slice. Only explicit `.devrites/AFK` lets the
+controlling root chain another pending slice after green-proof, cap, and pause
+gates. Every `devrites-slice-wright` returns after exactly one slice.
+
+At all built, Build never enters `/rite-prove` automatically; a higher-level
+orchestrator may invoke it only under its own contract. Awaiting-human or
+stopped states use the shared reply contract.

package/pack/generated/devin/skills/rite-build/reference/parallel-batch.md

@@ -0,0 +1,214 @@
+# Parallel batch (`--parallel N`)
+
+Opt-in only. Default `/rite-build` stays [`one-slice-cycle.md`](one-slice-cycle.md).
+
+## Entry
+
+| Input | Behavior |
+| --- | --- |
+| omitted / `--parallel 1` | Serial one-slice |
+| `--parallel N` (**2≤N≤10**) | N is a **cap**, not a quota: run the largest eligible set ≤ N |
+| non-integer / `N≤0` / `N>10` | Hard refuse (no silent clamp) |
+| Autocomplete `--parallel N` | N is the cap for this run; leftover sentinel `max_parallel` is ignored, then `/rite-autocomplete` writes or replaces only `max_parallel: N` |
+| Autocomplete, no flag | Same path, cap from sentinel `max_parallel` else 10; serial only when ineligible |
+
+AFK caps `N`. Charge green siblings once after integrate; abort /
+integrate-failed → **0**. `parallel create` refuses while a lease exists.
+Reconcile retained repair-round artifacts by exact causal fingerprint before honoring a stored blocked status/verdict. Blocked status, round count, or distinct finding alone cannot stop cold resume: establish missing or stale review coverage under step 4; repair unless a stop condition remains evidenced.
+
+## Dynamic selection and re-batching
+
+Size each batch by what is runnable **now**, never by the requested number:
+
+```text
+N_eff = min(
+  cap                  -- this invocation's --parallel N (wins over leftover sentinel max_parallel)
+                       | else sentinel max_parallel | else 10 (autocomplete default)
+  eligible set         -- dependency-satisfied pending slices, pairwise path-disjoint
+  AFK headroom         -- remaining max_slices, max_agents, max_minutes, review queue
+  host capacity        -- concurrent worktree writers + the runtime isolation table
+)
+```
+
+Select **greedily in plan order**: pass every currently dependency-ready pending slice
+(plan order, `Files likely touched`) to
+`devrites-engine parallel select --cap N [--root <dir>]`. `N_eff ≥ 2` → parallel batch;
+`N_eff = 1` → one serial round; nothing pending → Prove. A cap that cannot be filled
+is normal: take fewer. Serial is this round's size, not the rest of the run.
+
+**Re-batch automatically after every completed round** (parallel integrate+cleanup or
+a serial slice). Re-read `state.md`, pending slices, and the tree, then run
+`parallel select` again: finished work leaves the pending set, and satisfied
+dependencies unlock new slices. Under `.devrites/AFK` and `/rite-autocomplete` the
+repeat is the same run — HITL stops after each batch. `--parallel 5` with one eligible
+slice runs that one; when two to five then become eligible, the next round takes that
+many. **Failing case:** the run stays one-by-one after a serial round even though more
+slices are now eligible under the same cap.
+
+## Path-disjoint
+
+Exact project-relative source/test paths only. Normalize `\`→`/`. Reject `..`,
+duplicates, absolutes, `.devrites/**`. Empty pairwise intersection required.
+
+**SSOT:** `devrites-engine check path-disjoint [--root <dir>] [<json-file>|-]`
+(N≥2 only; pass `--root`). Input is `{"slices":[{"id":"SLICE-002","paths":["src/policy.rs","src/policy/mod.rs"]}]}`
+(or a top-level array) built from each candidate's `Files likely touched`.
+Exit `0` → fan-out; else force serial. Inspect-time
+overlap → sibling **gap** (a shared path is a contract defect). **Failing
+case:** two parallel wrights share a path and fan-out proceeds without that
+check.
+
+## Control vs workers
+
+Control owns `.devrites/work/<slug>/` (lease + bookkeeping).
+Workers: `.scratch/parallel-wt/<batch>/<slice>/` on
+`devrites/parallel/<slug>/<batch>/<slice>` @ base `B`. Wrights never write
+`.devrites/**`.
+
+Lease: `batch_id`, `created_at`, `base_sha`, `n`,
+`status` (`running|aborted|integrate-failed|complete`), `control_pid_or_session`,
+`slices[]` (`id`, `paths`, `worktree_path`, `branch`, `wright_status`,
+`transfer_commit`).
+
+## Lifecycle
+
+1. Orient/gate; parse the cap; compute `N_eff` and select the eligible set
+   ([Dynamic selection and re-batching](#dynamic-selection-and-re-batching)) —
+   candidates from `orient` `task_graph.slices` + built list, each candidate's
+   `Files likely touched` via `observe slice`, then
+   `parallel select --cap N` (pairwise disjointness is inside that verb).
+2. Write lease; freeze `B=HEAD`; `parallel create` worktrees.
+3. Dispatch ≤10 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`).
+4. Inspect each returned path list, cumulative diff from `B`, transfer identity,
+   and required result fields against the immutable contract. Reject malformed,
+   stale, or out-of-scope work. Apply
+   [independent Build review](phase-contract.md#independent-build-review): first
+   full inventory, then bounded owning-role rechecks after repairs. Gap or
+   Critical/Important → `gap`; else approved proof → `green|red|gap`.
+   Reviewer fan-out for a batch is itself batched under
+   [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md#scale-limits)
+   (≈4 concurrent read-only reviewers, 8 only with disjoint paths), and `max_agents`
+   headroom bounds the batch size — one batch never assumes unbounded reviewers.
+5. Non-green siblings → **repair round** (below) in the same worktrees; lease
+   stays `running` — no abort while repair budget remains. A green sibling →
+   `parallel record-green`. No partial integrate. All green → integrate.
+   A recoverable RED blocks integration but does not cancel independent safe running siblings.
+   Expected test-first RED is not a terminal gate failure. Cancel only for a shared
+   invalid foundation, safety/access failure, resource boundary, or explicit stop;
+   preserve completed and in-progress recoverable work and classify each result.
+6. `parallel integrate --apply-to-control` **only after steps 4–5 are green**:
+   each `transfer_commit` descends from `B` and diffs path-exact vs
+   `B`; apply each in plan order as its own local `WIP(<slug>):` commit
+   (imperative summary, never a slice id). Staging branch, then FF. Conflict →
+   reset to `B`, `integrate-failed`; classify under repair rounds (siblings stay
+   in place). Never integrate because a wright returned.
+7. Success: FF control (the branch that held `HEAD` when the batch started —
+   often `main`/`master`, otherwise whatever the user was on) to the integrate
+   tip: N local commits, never pushed; union `touched-files.md`; update
+   state/evidence; AFK +1 per integrated sibling; optional `check candidate`.
+8. Cleanup runs only after `integrate` marks the lease `complete` — work
+   landed in control, so `parallel cleanup` removes worktrees/branches.
+   Blocked/human-stopped batches keep lease, worktrees, branches — nothing is
+   removed while the batch may resume. `parallel abort` + `cleanup --force`
+   abandons the batch — the explicit human discard path; the single
+   orchestrator-emitted use is the automatic re-batch under Repair rounds,
+   where it acts as the salvage step only (uncommitted allowlisted changes →
+   slice-branch commit; branches past `B` kept; a failed salvage keeps the
+   worktree) and prints retained refs for the record. `abort` marks the lease
+   only — never rewinds control: a moved HEAD is external work, reported not
+   reset. Never integrate a rejected transfer commit.
+
+## Repair rounds
+
+Repair rejected work in place; never discard/rebuild while budget remains.
+
+- Record each round as `build-parallel-<batch>-repair-<round>.json`: each
+  non-green sibling's status, verbatim findings, transfer_commit/null.
+- Use step 4's initial inventory or affected recheck as appropriate; never start
+  a correction from an early reviewer result while required accounts are pending.
+- Classify the complete inventory: **implementation defect** (review
+  Critical/Important on the diff, red wright/proof) → one repair-all wright in
+  the same worktree with the full inventory. **Durable-plan defect**
+  (falsified contract assumption, AC unchanged) →
+  [`spec-drift-guard.md`](spec-drift-guard.md): batch-sweep contract
+  assumptions, one folded `/rite-plan repair` + one `/rite-vet` recheck
+  inline, resume repair in the same worktrees under the amended contract;
+  never emit `Fix:`. **Frozen-lease scope defect** (correction needs
+  out-of-allowlist paths or re-slicing; lease allowlists are immutable) →
+  **automatic re-batch, no human gate**: `parallel cleanup --force` salvages
+  and records refs; `parallel create` starts from control `HEAD` under the
+  corrected decomposition. Give each new wright its salvaged
+  `devrites/parallel/<slug>/<old-batch>/<slice>` ref. If the inventory proves the accepted
+  approach unsound and no corrected decomposition exists, that is exhaustion
+  → blocked, preserve, STOP. **Reviewer stall/cancel or missing
+  verdict** → re-dispatch the reviewer, not the wright. **Product/policy/
+  irreversible** → stops for the human.
+- Dispatch one fresh repair-all `devrites-slice-wright` (cwd=worktree; step 3
+  rules) with the original contract + complete inventory +
+  "preserve what works; fix every finding; **then attack your own correction** —
+  probe the changed hunks for defects the fix itself introduced (adjacent cases of
+  the same rule, new observation/ordering windows, alias or boundary escapes) and
+  fold them in before returning; return a new `transfer_commit`". A correction whose
+  own diff is unexamined is not ready: a green writer gate plus an unexamined fix is
+  how the same defect family reappears one case deeper each round. Never reset
+  to `B` — that destroys the work under repair. The commit must still descend
+  from `B` and diff path-exact vs `B`.
+- Budget and exhaustion follow only
+  [the canonical retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve).
+  Record one failed invariant, mechanism, reproduction, correction, and decisive
+  recheck per fingerprint; never use an umbrella like "covering" or "review is red again".
+- A distinct post-repair Critical/Important gets a new fingerprint: refresh the
+  inventory and affected owning-role rechecks. It proves neither plan defect nor
+  exhaustion. Use plan path only if inventory proves the approach unsound.
+- Stop under the canonical retry/authority/resource conditions, or when evidence
+  proves the approach unsound and no in-scope corrected decomposition exists.
+- Exhaustion is not abort: record one technical blocker (`Status: blocked`;
+  `Next step: none — technical recovery exhausted; requires new evidence or changed failure conditions`), preserve
+  lease/worktrees/branches, STOP — same fingerprint stays blocked on
+  reinvoke; new evidence resumes repair in place. Human-owned decisions use
+  the drift-guard question and wait.
+
+## Engine verbs
+
+```text
+devrites-engine parallel select --cap <1-10> [--root <dir>] [<json-file>|-]
+devrites-engine parallel create --root <repo> --slug <slug> --batch <id> --base <B> --json <file>|-
+devrites-engine parallel record-green --root <repo> --slug <slug> --slice <id> --commit <sha>
+devrites-engine parallel integrate --root <repo> --slug <slug> --apply-to-control
+devrites-engine parallel status --root <repo> --slug <slug>
+devrites-engine parallel lease-write|lease-read|lease-clear --root <repo> --slug <slug>
+# abandoning the batch is human discard only; a frozen-lease re-batch may emit
+# cleanup --force as its salvage step (see Repair rounds):
+#   parallel abort --root <repo> --slug <slug>
+#   parallel cleanup --root <repo> --slug <slug> --force   (salvages, prints retained refs)
+```
+
+`integrate` without `--apply-to-control` stages the per-sibling commits, leaves
+the lease `running` and control at `B`; cleanup still refuses — the commits
+cannot be lost. `record-green` and `integrate` also accept an `integrate-failed`
+lease, so a failed integrate retries after repair. `--apply-to-control`
+refuses when control moved past `B` or holds uncommitted changes on slice
+paths — commit/stash and retry; the batch is untouched. Go is SSOT; never
+ad-hoc git/bash orchestration.
+
+## Runtime isolation
+
+Each parallel worktree must own isolated runtime resources. Before fan-out,
+assign per-slice env (document in the lease or worktree README):
+
+| Resource | Pattern |
+| --- | --- |
+| HTTP port | `PORT=<base+N>` or `DEVRITES_PARALLEL_PORT_<slice>` |
+| Compose | `COMPOSE_PROJECT_NAME=devrites-<slug>-<batch>-<slice>` |
+| SQLite/DB file | separate path under the worktree or `/tmp` |
+| Dev server | one process per worktree; never share a listener |
+
+Reusing the control worktree's running server, DB, or compose stack across
+siblings causes cross-slice pollution and flaky proof. Force serial if
+isolation cannot be established.
+
+## Host
+
+Devin: N concurrent `run_subagent` wrights (`acceptEdits`, cwd=worktree). Codex: require
+host-explicit concurrent worktree writers + native reconcile; else force serial.
+Never two writers in one worktree; never root-emulated concurrency.

package/pack/generated/devin/skills/rite-build/reference/phase-contract.md

@@ -0,0 +1,89 @@
+# rite-build phase contract
+
+Apply [`one-slice-cycle.md`](one-slice-cycle.md) and
+[`candidate-integrity.md`](../../devrites-lib/reference/candidate-integrity.md).
+Opt-in `--parallel N` replaces steps 2–8 with [`parallel-batch.md`](parallel-batch.md);
+Spec Drift Guard still applies.
+
+1. **Gate.** Read core, `.devrites/ACTIVE`, then `devrites-engine orient <slug>`
+   and the Build read-next in
+   [`workspace-artifact-schema.md`](../../devrites-lib/reference/workspace-artifact-schema.md#read-next-by-phase):
+   the selected slice via `devrites-engine observe slice <slug> <SLICE-ID>`, not whole
+   `tasks.md`; over-budget or `bulk_files` artifacts are read by anchor only. Require
+   `Implementation readiness: READY`, current `Readiness inputs SHA-256`, exact
+   required accounts, ID/meaning traceability and green proof preflight.
+   Run `devrites-engine check readiness <slug>`; any miss/nonzero blocks.
+2. **Select.** Pick the lowest pending slice whose `depends_on` are all built, using
+   `orient` `task_graph.slices` plus the `state.md` built list — never by scanning
+   `tasks.md`; then `observe slice` it. Restate its goal, ACs, exclusions and exact paths. Include
+   applicable topology/data/integration invariants and failure/recovery/proof cases.
+   Verify relevant assumptions live; falsified acceptance/architecture/scope/proof
+   routes through Spec Drift Guard. Resolve human-owned/irreversible gates before
+   source work; AFK follows its ceiling. Vet-ready Workflow Artifacts use
+   [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md).
+3. **Dispatch.** Apply [`wright-dispatch.md`](wright-dispatch.md). Put the smallest
+   exact project-relative source/test path list directly in the task;
+   dispatch the exact `devrites-slice-wright` fresh. Root never writes product
+   paths; wright cannot widen scope; missing profile blocks.
+<!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"Build gate enters or resumes transaction","action":"invoke canonical operation table; reconcile exact result","return":"same slice/checkpoint cursor or Plan/Vet route"} -->
+4. **Inspect.** Wait; compare returned paths and `git diff --name-only` with the
+   contract. Reject stale/partial/malformed/out-of-scope work; preserve user work.
+   Restoration uses the bounded wright.
+5. **Review.** Apply [Independent Build review](#independent-build-review).
+   Missing verdicts, principle breaches and open Critical/Important block acceptance.
+6. **Prove.** Against the frozen pre-slice candidate inspect
+   test hunks for deletion, skipping/focus, tautology, or weaker expectations.
+   Use step 5's exact test-analyst account; missing/adverse criterion verdict is
+   Critical. Run only `test-plan.md` repository/CI commands, record output, recheck
+   `git diff --name-only`. Missing/weakened/red/source-mutating proof cannot pass.
+   Pre-existing/environment-specific claims need a predating same-command,
+   same-environment baseline; otherwise unresolved.
+
+   Technical failure uses `devrites-debug-recovery` and
+   [canonical recovery](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve).
+   Reapply host admission before correction; affected proof/evidence follows candidate
+   integrity. Human gates remain product/irreversible/access decisions.
+7. **Record green.** Upsert actual scoped `present`/`deleted` rows in `touched-files.md`;
+   update state, evidence and applicable UI/browser proof. Checkpoint per
+   [`checkpoint.md`](checkpoint.md) only after steps 5–6 are green and every
+   repair wright has been re-reviewed and re-proved; never on wright return.
+   Manifest stays mutable until Polish. For a release milestone, after the last slice's rows run
+   `devrites-engine state merge-manifest <slug>` to fold the recorded
+   predecessor chain into the union manifest before Prove. Record stood
+   decisions/dead ends; refresh verified/falsified
+   assumptions. Propose reviewed durable project rules in the nearest guidance.
+8. **Account/reply.** Apply `afk-discipline.md`: charge
+   exactly once after each green built slice; never negative, stop at zero,
+   malformed budget fails closed. Reply names next pending slice or `/rite-prove`
+   only when all built; no decorative renderer/dispatch telemetry.
+
+One contract builds one slice: preserve TDD, exact paths and independent judgment.
+
+## Independent Build review
+
+After inspection, freeze full slice scope and cumulative baseline diff. Initial
+inventory: one full-diff `devrites-code-reviewer`, one `devrites-test-analyst`,
+and one exact `devrites-doubt-reviewer` per stood decision that meets
+`devrites-doubt` § When to use (boundary, data model, auth, public API, migration,
+user flow, assumption tests cannot prove); other stood decisions are recorded in
+`decisions.md` without dispatch. Dispatch fresh,
+read-only under [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md).
+Wait for every required account to become terminal; missing/gap needs a valid result.
+Fold supported in-scope Critical/Important findings by cause into one inventory.
+Dispatch one repair-all wright instructed to fix every finding, then attack its own
+correction for fix-introduced defects before returning; durable contract defects use Spec
+Drift Guard.
+Suggestion/Nit/FYI cannot prolong recovery.
+
+Rechecks use Vet's bounded pattern: each exact responsible reviewer checks
+all open findings owned by that role and affected dependency/regression closure
+in one fresh dispatch. Supply new candidate, inventory, correction diff, tests
+and unchanged-coverage evidence under candidate integrity; include newly triggered
+roles. A changed contract or uncertain impact requires the full inventory.
+Collect all required rechecks before another folded correction. Canonical recovery
+owns fingerprints/budget and the
+[late-finding rule](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve):
+a recheck's `Late:` rows on hunks unchanged since that role's previous pass go to
+`touched-files.md` `## Review trail` for `/rite-review`, not into another slice
+repair, unless Critical with a failure path. Evidenced scope coverage never
+guarantees no later defect; the feature-level Review and Seal gates still run.

package/pack/generated/devin/skills/rite-build/reference/spec-drift-guard.md

@@ -0,0 +1,84 @@
+# Spec Drift Guard (build phase)
+
+Canonical Spec Drift Guard, active in `/rite-build` and referenced by other
+phases. Never silently code against a known-wrong plan.
+
+## Drift has occurred when
+- the spec says X but the code makes X impossible/wrong;
+- the plan assumes a file/API/component/route/model/command that doesn't exist;
+- tests show the acceptance criteria are incomplete or wrong;
+- browser evidence shows the intended UX doesn't work as described;
+- an official doc contradicts the planned approach;
+- the design system / existing UX pattern contradicts the planned UI;
+- a missing user decision that affects product behavior surfaces.
+
+## Workflow
+```
+1. STOP coding.
+2. Record drift.md (assumed vs observed, when).
+3. Classify: requirement ambiguity | implementation-plan error | codebase reality
+   mismatch | design-system mismatch | test/evidence mismatch | external-doc mismatch
+   | user-decision required.
+4. Local repair that preserves behavior/scope/architecture/data/UX/security/migration?
+     YES, active-slice technical/tool failure → log it and use Build's bounded debug
+       recovery. Do not ask for retry authorization and do not re-plan unless the
+       durable remaining-work instructions are wrong.
+     YES, durable plan is wrong → run the batch sweep below, log every
+       violation, save the caller's return cursor, then invoke `/rite-plan repair` and `/rite-vet` inline
+       without a question — ONE folded repair for all open entries, ONE
+       recheck for every open fingerprint — and resume.
+     NO, product/policy/irreversible-risk decision → ask the user (format below).
+5. Never continue on a known-wrong durable plan. A repaired active-slice implementation
+   may continue only after bounded recovery, returned-diff review, and proof gates pass.
+```
+
+## Batch sweep (before repair)
+
+Repair durable-plan drift as a folded set:
+
+1. Trace the falsified assumption's full dependency/consumer closure and affected
+   frontier, including dependent future slices. Verify unchecked paths, symbols/APIs/
+   signatures, routes, commands, versions, and artifacts there against live source.
+   Reuse the wright inventory and unchanged evidence; deterministic existence checks
+   need no dispatch. Do not rescan unrelated slices. Broaden unknown closure or shared
+   contract changes until coverage is justified; retain every known gap.
+2. Record each violation as its own `drift.md` entry/fingerprint; one folded
+   repair + one batched recheck resolves the set.
+3. A recheck-surfaced gap is a new fingerprint with its own budget — loop
+   internally, never hand an intermediate command to the human. When
+   consecutive folded repairs keep landing on the same clause set, the
+   repair packet's `convergence_pressure` marking applies (see `/rite-plan`
+   repair): bounded declared residuals may close refinements of
+   already-pinned clauses; a newly surfaced failure mode is never
+   residual-eligible. A suspect seam's declare-limitation-or-continue choice
+   routes to `/rite-clarify` like any human-owned gate — it is not an
+   intermediate command.
+4. Nothing skips or defers silently: every entry ends resolved, human-escalated,
+   or fingerprint-exhausted. Execution-only gaps (tests, UX, evidence) get the
+   identical path when they surface.
+
+## User question format
+```
+I hit spec drift:
+- Spec/plan assumed: ...
+- Code/evidence shows: ...
+- Why it matters: ...
+
+Which direction should DevRites take?
+1. Keep the requirement, change architecture by ...
+2. Adjust the requirement to match existing behavior ...
+3. Split into a follow-up feature ...
+4. Custom: describe the intended behavior
+```
+
+Never turn an objective defect, environment repair, tool bug, or proof rerun into a
+human permission question. Re-plan only when the durable plan changed.
+
+## Inline return contract
+
+The detecting phase owns backtracking and the batch sweep. Save
+`return_phase`/`return_next_action`; consume nested Plan/Vet `STOP` internally, complete
+vetted acceptance-preserving remediation, then restore the cursor and failed step.
+Never hand the human an intermediate command. The shared three-attempt causal-fingerprint
+cap still applies: exhaustion produces one technical blocker, while a genuinely
+human-owned decision uses the question format below.

package/pack/generated/devin/skills/rite-build/reference/tdd.md

@@ -0,0 +1,27 @@
+# TDD / Prove-It pattern
+
+When a slice changes behavior, prove the change with a test that fails first, so you
+know the test can fail, and that your code is what makes it pass.
+
+## Red → Green → Refactor
+1. **Red:** write the smallest test that expresses the new behavior. Run it; watch it
+   fail for the *expected* reason (not a typo/import error).
+2. **Green:** write the minimum code to pass. Resist gold-plating.
+3. **Refactor:** clean up with the test as a safety net. Re-run; stay green.
+
+## Prove-It (when strict TDD doesn't fit)
+For code where a test-first flow is awkward (exploratory glue, config, some UI), still
+produce evidence:
+- Capture the current (wrong/absent) behavior: a failing assertion, a screenshot, a
+  log line.
+- Make the change.
+- Capture the new behavior the same way. The before/after pair *is* the proof.
+
+## Rules
+- Use the project's existing test framework and commands (per the discovery contract
+  [`test-command-discovery.md`](../../rite-prove/reference/test-command-discovery.md)). Don't introduce a new test runner
+  to prove a slice.
+- One behavior per test; name it for the behavior, not the function.
+- A green test you never saw fail proves nothing: always see red first.
+- Don't delete or weaken a failing test to "pass". If it's wrong, that may be drift.
+- Record the test command + result in `evidence.md`.

package/pack/generated/devin/skills/rite-build/reference/wright-dispatch.md

@@ -0,0 +1,96 @@
+# Slice-wright dispatch
+
+`/rite-build` gives one bounded task to exact `devrites-slice-wright`.
+Root owns scope/artifacts/inspection; never writes source/tests.
+Wright alone writes; no agents.
+
+## Host gate
+
+Apply [source-writing boundary](../../devrites-lib/reference/standards/agents.md#source-writing-boundary):
+Claude grants only the exact wright `acceptEdits`; Codex uses its workspace root,
+the exact `:workspace` wright, and read-only specialists. Never bypass/substitute
+the wright or recreate an engine bridge.
+
+## Isolated writer-worktree pilot
+
+Use native isolation only when the current host exposes an explicit named-writer
+worktree plus result reconciliation; separate agent threads or inherited sandboxes do
+not qualify. Codex CLI custom subagents therefore use `same-worktree` unless a future
+supported interface passes this capability gate—never create a manual worktree from the
+read-only root to imitate it. Also require `git rev-parse
+--show-superproject-working-tree` to be empty; resolved git/common dirs; committed,
+clean candidate/index; all inputs at `HEAD`; no other writer; and green cheap isolated
+baseline proof. Otherwise use serial same-worktree dispatch—never stash, commit, or
+discard user work to qualify. Ask host for an explicit current-`HEAD` base when
+supported. Regardless of host defaults, the wright's first command must prove actual `git rev-parse HEAD` equals supplied
+`worktree_base`. Mismatch returns a gap with no write before project reads or baseline proof.
+
+The isolated wright returns one local unpushed `transfer_commit` (contract
+`WIP(<slug>):` subject, no slice id), its `worktree_base`, and exact files.
+That commit is worker-branch transport, not the control-branch checkpoint. Root proves descendant base, exact `git diff --name-only`
+`` `<base>..<transfer>` ``, no `.devrites/**`/submodule/symlink/unrelated delta, unchanged
+source base, and no user-work overwrite. Use only host-native explicit reconciliation;
+never ad hoc copy, cherry-pick, or merge from read-only root. Land on control
+only per [`checkpoint.md`](checkpoint.md).
+
+Conflict, extra/missing commit, moved base, or cleanup failure is `gap`/STOP:
+preserve the worktree and commit. Without explicit reconciliation, use same-worktree serial.
+Parallel isolated-writer worktrees remain forbidden until this serial pilot measures
+transfer, conflict, proof, and review outcomes on both hosts; opt-in `/rite-build --parallel N`
+(2≤N≤10) path-disjoint fan-out is the only sanctioned parallel mode. Same-worktree multi-writer / root-emulated
+worktrees stay forbidden.
+
+## Prepare
+
+1. Derive the smallest exact project-relative source/test path list; reject
+   directories/globs, traversal, symlink escapes, duplicates, and `.devrites/**`.
+   A target composed only of vetted executable workflow artifacts routes to the
+   controlling root under
+   [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
+   its rejection here is not a blocker.
+2. Include goal, verbatim acceptance, exclusions, context,
+   `test-plan.md` proof commands, applicable standards, and the exact
+   `WIP(<slug>):` subject (no slice id). For each triggered
+   topology/data/integration standard, include only the feature-specific owner/invariant,
+   failure or partial-state case, recovery rule, and required proof from the vetted plan.
+   Do not paste the whole standard or silently omit an applicable risk.
+   A new path requires a new bounded contract; the wright cannot widen the task.
+3. Record `git diff --name-only` before dispatch so unrelated work remains
+   distinguishable. For an isolated pilot, also record committed base SHA and exact
+   baseline status before asking the host for isolation. **Failing case:** paths that
+   were dirty at that baseline are listed as slice-owned after dispatch.
+
+## Run
+
+Ask the host for the exact writer in fresh context and wait. Use at most one writer
+across all linked worktrees for this workspace. Never run two writers in one worktree,
+run isolated and same-worktree writers concurrently, or substitute a generic agent.
+Opt-in `/rite-build --parallel N` fans out only under [`parallel-batch.md`](parallel-batch.md).
+
+## Inspect and prove
+
+1. Compare the returned file list and `git diff --name-only` with task paths.
+   Reject a result that omits any required key — the bookkeeping arrays count
+   whether empty or filled — or adds a path. Restore only through the same bounded
+   wright; root never widens scope or edits source.
+2. Inspect the test diff for deletion, skipping, focus markers, or loosened
+   assertions. Dedicated test analysis treats weakening as Critical.
+   Confirm a test for a data/integration/topology risk can actually exhibit that risk;
+   mocks that erase it and one-root proof offered for another root are unproven.
+3. Apply [independent Build review](phase-contract.md#independent-build-review)
+   before proof. Human choices return; technical failures follow
+   [the canonical retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve).
+   Derive accounting from recorded reproductions, corrections, and decisive rechecks.
+4. Run only repository proof already approved by `test-plan.md`, then inspect
+   `git diff --name-only` again in case a proof tool changed source.
+   **Do not land on control until review and proof are green.** Isolated
+   `transfer_commit` stays on the worker branch; same-worktree diffs stay
+   uncommitted. Serial: [`checkpoint.md`](checkpoint.md), then host may remove the
+   worktree. Parallel: `record-green` only; land with `parallel integrate
+   --apply-to-control` after the batch; `parallel cleanup` removes worktrees.
+5. Reconcile returned reuse, conventions, principles, sources, assumptions,
+   decisions, dead ends, follow-ups, gates, and touched files. Persist the
+   relevant facts in canonical artifacts, not the wholesale report. A plan-gap
+   escalation without the checked-assumption list (verified|falsified) is
+   malformed; root sweeps the unchecked remainder per
+   [`spec-drift-guard.md`](spec-drift-guard.md) before repair.

package/pack/generated/devin/skills/rite-clarify/SKILL.md

@@ -0,0 +1,98 @@
+---
+name: rite-clarify
+description: Audit a completed spec for missing decisions before strategy or architecture. Use after /rite-spec when coverage is incomplete or stale; not for spec writing.
+argument-hint: "[feature-slug]"
+---
+
+# /rite-clarify: resolve product decisions
+
+Run this required pass between spec and strategy. If the spec covers every material
+decision, ask no questions. Otherwise stay until each material decision has an
+owner. This phase settles behavior and constraints; `/rite-define` settles
+implementation.
+
+Reuse [`devrites-interview`](../devrites-interview/SKILL.md) in `/clarify mode`. Write
+`decision-coverage.md` as scan evidence, not an interview transcript.
+
+## Rules consulted
+
+Read [`core.md`](../devrites-lib/reference/standards/core.md), its [`afk-hitl.md`](../devrites-lib/reference/standards/afk-hitl.md), and
+[`reference/decision-coverage.md`](reference/decision-coverage.md). Fresh evidence
+dispatch uses
+[`agents.md`](../devrites-lib/reference/standards/agents.md).
+
+## Rules
+
+- Search code/docs/contracts first. Facts and reversible implementation/test choices
+  are agent-owned; ask only about product, scope, policy, irreversible risk, or human-only access.
+- Enumerate the full topology before details so no sibling surface is omitted.
+- Ask one coherent human-owned decision packet at a time. One packet may close several rows
+  only when owner and trade-off match; never ask permission for routine repair/retry.
+- One scan may cap at five packets for cognitive load, but readiness has no question cap:
+  re-scan until clear.
+- Material assumptions carry evidence, confidence, owner, validation, and consequence.
+
+## Workflow
+
+1. **Orient.** Read `.devrites/ACTIVE`, `state.md`, and `spec.md`. Require
+   `Spec gate: passed`; otherwise stop at `/rite-spec`. Apply the native cursor
+   protocol below before changing workspace artifacts.
+2. **Enumerate the topology.** From the spec, live code, contracts, references,
+   and recorded decisions, list every material stakeholder/priority, invariant, actor,
+   journey/component, state, data lifecycle, integration, failure/recovery path,
+   operation, proof surface, applicability row, and must-NOT boundary.
+3. **Scan coverage.** Apply `devrites-interview` in clarify mode and mark each
+   material surface Clear, Partial, Missing, not-applicable, or justified
+   deferred-nonblocking with evidence and an owner. Use native repository search
+   first. Ask the host to run `devrites-evidence-scout` only for a bounded missing
+   fact, then reconcile its cited result.
+4. **Close decisions.** Record facts and reversible technical choices directly.
+   Ask one coherent option packet only for product, scope, policy, irreversible
+   risk, or human-only access. Persist answers in the owning artifacts and repeat
+   the scan until no blocking Partial/Missing row or unowned material assumption
+   remains.
+5. **Write the verdict.** Write `Decision coverage: CLEAR` only after re-reading all inputs and confirming
+   every material row has current evidence and an owner. Normal flow sets `phase=clarify` and
+   `next_action=/rite-temper`. A low-stakes spec — the significance trigger temper itself
+   skips (rite-temper step 1) — sets `next_action=/rite-define` instead. A contract-neutral later-phase return uses
+   the native restore below; changed behavior or acceptance routes to
+   `/rite-plan repair` instead. Stop without starting the next phase.
+
+## Native clarify cursor protocol
+
+The controlling root edits only cursor rows in `state.md`; it must preserve unrelated Markdown and the file's existing table/bullet presentation.
+
+- **Normal entry from Spec:** set `phase=clarify`, `status=running`, and
+  `next_action=/rite-clarify <slug>`; omit both return fields.
+- **Already in Clarify:** no-op. Do not overwrite an existing valid return
+  cursor.
+- **Later-phase entry:** only `temper`, `define`, `plan`, `vet`, `build`,
+  `converge`, `prove`, `polish`, `review`, `seal`, or `ship` may return. First
+  copy the current `phase` and non-empty `next_action` to `return_phase` and
+  `return_next_action`; then set `phase=clarify`, `status=running`, and
+  `next_action=/rite-clarify <slug>`. Missing/unknown cursor values fail closed
+  before any write.
+- **Contract-neutral restore:** after a fresh `Decision coverage: CLEAR`, require
+  `phase=clarify`, both return fields, a recognized later `return_phase`, and a
+  non-empty `return_next_action`. Restore those values to `phase` and
+  `next_action`, set `status=running`, and remove both return fields in the same
+  rewrite. Re-read the cursor and confirm the return rows are absent.
+- **Contract changed:** do not restore the saved cursor. Record drift and route
+  through `/rite-plan repair`, which owns the changed plan and next action.
+
+Never normalize or rewrite the rest of `state.md` while applying this protocol.
+
+## Output
+
+```text
+Done: decision coverage closed for <slug>; <n> topology surfaces scanned.
+Changed: decision-coverage.md, spec.md, decisions.md, assumptions.md, questions.md
+Evidence: Decision coverage: CLEAR; human packets <n>; agent-owned facts <n>
+Open: none blocking; deferred-nonblocking <n>
+Next: /rite-temper (or /rite-define for a low-stakes spec temper skips)
+Record: .devrites/work/<slug>/decision-coverage.md
+↻ Hygiene: /clear before /rite-temper (or /rite-define)
+```
+
+If not clear, name the exact rows and next genuine decision packet. An objective spec defect
+or factual search task never routes through `/rite-resolve`.