devrites 5.10.1 → 5.11.0

package/pack/generated/devin/skills/rite-review/reference/nielsen-heuristics.md

@@ -0,0 +1,126 @@
+# Nielsen's 10 usability heuristics: DevRites scoring rubric
+
+A structured UX rubric for `/rite-review` when the feature touches UI. Score each
+heuristic on a **0-4** scale; the per-heuristic scores feed the UX axis of the
+multi-axis review and shape the severity labels on UX findings.
+
+**Score honestly.** 4 means *genuinely excellent*, not "good enough", not "no
+findings". 3 is "good with minor gaps". 2 is "partial: significant gaps". 0-1 is a
+Critical / Important.
+
+## 1. Visibility of system status
+Users know what's happening, when, and where.
+- Loading indicators on async operations.
+- Confirmation when actions complete (save, submit, delete).
+- Progress on multi-step flows.
+- Current location in nav (active state, breadcrumbs).
+- Inline form validation, not just on submit.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| No feedback. | Critical actions lack feedback. | Most actions have feedback; gaps. | Consistent feedback; minor lag/lateness. | Anticipates uncertainty; reassures throughout. |
+
+## 2. Match between system and the real world
+The UI speaks the user's language and follows real-world conventions.
+- Domain vocabulary the *user* shares, not the team's internal names.
+- Familiar metaphors where they help (cart, inbox, draft).
+- Information ordered the way the user thinks about it, not the way the DB stores it.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Jargon throughout. | Mostly internal vocabulary. | Mixed: some user terms, some internal. | Clear user terms; a couple of leaks. | Reads like the user's own words. |
+
+## 3. User control and freedom
+Easy escape, undo, and back-out from any state.
+- Cancel / close / back on every modal, route, and form.
+- Undo on destructive operations (delete, archive, reset).
+- No dead-end states ("Error: refresh the page" with no recovery).
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Users trapped in states. | Limited escape on key flows. | Most flows reversible; gaps on destructive ops. | Good escape + undo on most flows. | Confident exploration possible everywhere. |
+
+## 4. Consistency and standards
+Internal consistency (this feature matches the project) + external consistency (the
+project matches platform / web norms).
+- Same concept named the same way across screens.
+- Same affordance (button vs link vs row) means the same thing across screens.
+- Platform conventions respected (browser back, focus rings, native controls where appropriate).
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Inconsistent vocabulary + affordances. | Major drift from neighbours. | Mostly aligned; visible drift. | Well-aligned; minor inconsistencies. | Indistinguishable from the rest of the product. |
+
+## 5. Error prevention
+Designed so the user *can't* make the error in the first place.
+- Confirmations on destructive operations.
+- Disabled / hidden actions when they're not valid.
+- Smart defaults; constrained inputs (date pickers vs free text).
+- Field formats validated as you type, not just on submit.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Many error-prone flows. | Some preventable errors still possible. | Common errors prevented; edge cases slip. | Most errors prevented before they occur. | Errors are genuinely rare; the easy path is the safe path. |
+
+## 6. Recognition rather than recall
+Show options; don't force the user to remember them.
+- Visible choices rather than free-text "type the command".
+- Recently-used values surfaced.
+- Labels persist (don't disappear after focus).
+- Context (where the user is, what they were doing) survives navigation.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Heavy recall required. | Critical flows demand recall. | Mixed: some visible, some hidden. | Mostly recognition; minor recall asks. | Pure recognition; nothing the user needs is hidden. |
+
+## 7. Flexibility and efficiency of use
+Novices and experts both productive.
+- Keyboard shortcuts on power flows; visible affordances for everyone else.
+- Sensible defaults for the common case; depth available when needed.
+- Saved views / templates / bulk actions on tasks done repeatedly.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| One-size-fits-all; no acceleration. | Limited shortcuts; novice-only. | Some efficiency for experts; uneven. | Strong shortcut + default story; small gaps. | Both populations measurably fast. |
+
+## 8. Aesthetic and minimalist design
+Every element earns its place. No decorative noise.
+- One primary action per screen / surface.
+- Visual hierarchy carries the eye to the next step.
+- Decoration in service of meaning, not for its own sake.
+- Whitespace used as a tool, not because the page felt empty.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Cluttered; no hierarchy. | Visible noise / competing actions. | Generally clean; some clutter. | Strong hierarchy; minor noise. | Every pixel deliberate; nothing extraneous. |
+
+## 9. Help users recognize, diagnose, and recover from errors
+Error states are designed, not afterthoughts.
+- Errors named in user language ("Your card was declined") not codes ("Stripe 4002").
+- A concrete next step ("Try a different card" + "Use PayPal instead").
+- Inline location: the error appears next to the field / action that caused it.
+- No blame: the message describes the situation, not the user.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Cryptic codes / silent failures. | Errors visible but unhelpful. | Some errors recoverable; others stranded. | Most errors actionable; minor gaps. | Every error has a clear cause + clear next step. |
+
+## 10. Help and documentation
+Users can find what they need without leaving the surface.
+- Inline hints on novel patterns.
+- Search-friendly help for deeper questions.
+- No help is needed for the common path, and that's documented as a goal.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| No in-product help. | Help exists but hidden / stale. | Help exists; quality uneven. | Good inline help; reachable docs. | Help feels native; users barely need it. |
+
+## Reporting
+
+In `/rite-review` output, surface heuristics scoring **≤2**, plus any 3 with a specific
+noted gap, as findings; every score feeds the UX axis. Each surfaced finding gets a
+severity label per [`SKILL.md`](../SKILL.md).
+
+The rubric is descriptive, not gating. A score of 2 on aesthetic-minimalist isn't
+an automatic NO-GO; the `rite-seal` gate is `Critical == 0`, not "every heuristic
+≥ 3".

package/pack/generated/devin/skills/rite-review/reference/performance-checklist.md

@@ -0,0 +1,80 @@
+# Performance checklist (baseline for the perf reviewer)
+
+The minimum baseline `devrites-performance-reviewer` checks against, in feature scope. It
+is a checklist, not a mandate: flag what the diff touches or what a measurement
+flags, never a project-wide sweep. The philosophy lives in
+[`standards/performance.md`](../../devrites-lib/reference/standards/performance.md) (measure first). This file is the
+concrete what-to-look-for.
+
+## Core Web Vitals targets
+
+| Metric | Good | Needs work | Poor |
+|---|---|---|---|
+| LCP: Largest Contentful Paint | ≤ 2.5s | ≤ 4.0s | > 4.0s |
+| INP: Interaction to Next Paint | ≤ 200ms | ≤ 500ms | > 500ms |
+| CLS: Cumulative Layout Shift | ≤ 0.1 | ≤ 0.25 | > 0.25 |
+
+A CWV value only counts when it carries a source: `Field (CrUX)`, `Lab (Lighthouse)`, or
+`Trace (DevTools)`. No source → it's a Source-mode hypothesis, not a measurement.
+
+## Frontend (only when the feature is UI-facing)
+
+Identify the framework first; apply only its idioms.
+
+- **Images:** modern format (WebP/AVIF); responsive `srcset`/`sizes`; explicit
+  `width`/`height` to reserve space (CLS); below-the-fold `loading="lazy"`; the LCP image
+  gets `fetchpriority="high"` and is **not** lazy-loaded.
+- **JavaScript:** initial bundle stays small (≈200KB gzipped is the usual line); code-split
+  routes and heavy features; no blocking script in `<head>` without `defer`/`async`; break
+  long tasks (>50ms) so the main thread stays free (the main INP lever); `memo`/`useMemo`/
+  `useCallback` only where profiling shows a win, not wrapped over everything.
+- **CSS:** critical CSS not render-blocking; no per-render CSS-in-JS runtime cost in prod.
+- **Fonts:** 2-3 families max; WOFF2; self-hosted where possible; preload the LCP font;
+  `font-display: swap`; subset with `unicode-range`.
+- **Rendering:** no layout thrashing (batch reads, then writes); animate `transform`/
+  `opacity` only; virtualize long lists; `content-visibility: auto` for off-screen sections;
+  don't break bfcache (no `unload` handler, no `Cache-Control: no-store` on HTML).
+
+## Backend (every feature, UI or not)
+
+- No N+1 queries; eager-load / join / batch instead.
+- New queries have the indexes they need for their filter/sort columns.
+- List endpoints paginate: never an unbounded `SELECT *`.
+- Per-request work that doesn't change per call is cached or hoisted.
+- Responses compressed (gzip/brotli); bulk operations instead of a loop of single calls.
+
+## Network
+
+- Static assets cached with a long `max-age` + content hashing.
+- Known origins `preconnect`-ed; no unnecessary redirects; HTTP/2 or HTTP/3 where available.
+
+## AI-codegen perf smells (fold into the area above, not a separate finding category)
+
+- State duplicated instead of lifted; effects with over-broad deps that re-run needlessly.
+- Sequential `await`s where `Promise.all` / parallel fetch fits.
+- Over-fetching "just in case"; redundant calls a dedup would collapse.
+- Defensive memoization wrapping cheap components: cost with no benefit.
+
+## Modern APIs to consider (one-liners: reach for these, don't gate on them)
+
+`scheduler.yield()` to keep input responsive in long loops · Speculation Rules for
+prefetch/prerender · View Transitions on SPA navigation · Long Animation Frames (LoAF) for
+production INP attribution · `fetchpriority` on critical non-image resources.
+
+## Measurement commands (name these in Source mode; don't run installs in review)
+
+```bash
+# Lighthouse (lab)
+npx lighthouse <url> --output json --output-path ./report.json
+# or via the Chrome DevTools MCP CLI, no install:
+npx -p chrome-devtools-mcp chrome-devtools lighthouse_audit --output-format=json > report.json
+
+# Bundle size
+npx vite-bundle-visualizer        # Vite
+npx webpack-bundle-analyzer stats.json   # webpack
+
+# Field data: CrUX / PageSpeed Insights (real users, p75) — needs an API key
+```
+
+Field is what real users experienced; lab is one synthetic run. Don't present one as the
+other.

package/pack/generated/devin/skills/rite-review/reference/performance-review.md

@@ -0,0 +1,14 @@
+# Performance review (feature-scoped)
+
+Apply only when a stated budget or visible regression risk makes performance relevant.
+The canonical measurement, pitfall, optimization, and scope rules live in
+[`performance.md`](../../devrites-lib/reference/standards/performance.md); apply every
+one before filing a performance finding.
+
+The agent runs **Source mode** (static scan, findings tagged `potential` + the verify
+command) or **Measured mode** (real CWV numbers → a source-labeled scorecard). Baseline
+checks + measurement commands: [`performance-checklist.md`](performance-checklist.md).
+
+## Labels
+A perf issue that breaches a stated budget is **Important** or **Critical**; a
+speculative micro-optimization is a **Suggestion** at most.

package/pack/generated/devin/skills/rite-review/reference/security-review.md

@@ -0,0 +1,42 @@
+# Security review (feature-scoped)
+
+Apply when the feature involves user input, auth/authz, data storage, external
+integrations, secrets, or permissions. Delegates to `devrites-audit security`.
+
+## OWASP-Top-10-oriented checks
+
+This is the **single-sourced OWASP-web checklist** both `/rite-review` and the
+`devrites-security-auditor` agent apply (trust-boundary + the OWASP **LLM** Top 10 live in
+[`standards/security.md`](../../devrites-lib/reference/standards/security.md)). Keep the enumeration here; don't restate it.
+
+- **Injection:** parameterized queries; no string-built SQL/shell/HTML; validate &
+  encode at boundaries.
+- **Broken access control:** every sensitive action checks authz server-side; no
+  trusting client-supplied IDs/roles/tenant; no IDOR, cross-tenant read/write/cache/search,
+  confused-deputy path, or privilege change without re-authorization.
+- **Auth / session:** secure session handling; no credentials in code/logs; correct
+  password/token handling.
+- **Sensitive data:** PII/secrets not logged or returned; encryption where required;
+  least data exposed.
+- **SSRF / external calls:** validate/allowlist outbound URLs; timeouts; don't reflect
+  untrusted input into requests.
+- **Misconfiguration:** safe defaults; debug off; CORS scoped; security headers as the
+  project uses them.
+- **Files / request integrity:** resolved paths remain below the allowed root across
+  traversal/encoding/symlink/archive cases; state-changing browser requests use the
+  framework's forgery protection; CORS is not treated as CSRF defense.
+- **Vulnerable dependencies:** new/updated deps audited; no known-vuln versions added.
+- **Integrity / deserialization:** safe non-executable parsing with type/size/depth limits;
+  untrusted data cannot instantiate executable objects.
+
+## Trust boundary
+Apply the three-tier discipline (untrusted → boundary → trusted) per the canonical rule
+in [`standards/security.md`](../../devrites-lib/reference/standards/security.md#trust-boundary-three-tiers). A value
+that skips the boundary tier is a finding.
+
+## Rules
+- Findings labeled Critical/Important/Suggestion. A real auth/data-exposure issue is
+  **Critical** → NO-GO until fixed.
+- Secrets management: never commit secrets; use the project's secret mechanism.
+- Don't expand into a project-wide security audit: feature scope. Record out-of-scope
+  risks as follow-ups.

package/pack/generated/devin/skills/rite-seal/SKILL.md

@@ -0,0 +1,74 @@
+---
+name: rite-seal
+description: Decide GO/NO-GO for an active feature; /rite-ship owns commit, push, tag, and close.
+argument-hint: "[feature-slug] [--full]"
+---
+
+# /rite-seal: GO / NO-GO
+
+Verify final candidate in `seal.md`; `/rite-ship` owns authorized irreversible
+actions and close-out.
+
+## Authority
+
+Read [`core.md`](../devrites-lib/reference/standards/core.md) plus only
+final-diff-relevant standards: agents, code-review, testing, browser-proof-checklist,
+security, principles, documentation, observability, deprecation, and
+definition-of-done.
+Load [`final-evidence.md`](reference/final-evidence.md) and
+[`go-no-go.md`](reference/go-no-go.md) for proof and verdict safety.
+Follow the shared
+[`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md) for
+the reviewed digest and artifact bindings.
+
+The host runs/reconciles named read-only reviewers; engine checks invariants.
+**Standard** is default; **Full** broadens conditional axes per
+[`devrites-lib/reference/orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md).
+
+## Gate
+
+| State | Verdict |
+|---|---|
+| Acceptance proven, deterministic checks pass, no unresolved drift or human gate, `Critical == 0`, `Important == 0` | **GO** |
+| Same, but `Important > 0` | Ask `Important findings remain. Proceed to seal? [y/N]`; default **N** |
+| `Critical > 0` | **NO-GO** |
+| Any acceptance criterion, resolved prohibition, or declared key link lacks proof | **NO-GO** |
+| Evidence is stale, or native diff review plus the exact test analyst finds weakened tests | **NO-GO: Critical** |
+| Any exact required reviewer account is missing or silent | **NO-GO** |
+| Any deferred finding (`touched-files.md` `## Review trail`, `eng-review.md` `## Deferred findings`) lacks a `review.md` verdict | **NO-GO** |
+| Any `gate: validating` question remains open | **NO-GO** |
+| Material UI acceptance lacks or fails required browser proof | **NO-GO** |
+| Unresolved drift, unsafe migration/removal, or unapproved principle violation remains | **NO-GO** |
+
+A judgment-only criterion needs the human eye; AFK records a validating question
+and stops.
+
+## Workflow
+
+Follow [`reference/phase-contract.md`](reference/phase-contract.md)
+([`risk-and-rollback.md`](reference/risk-and-rollback.md),
+[`seal-template.md`](reference/seal-template.md),
+[`anti-patterns.md`](reference/anti-patterns.md)):
+
+1. read workspace and final diff;
+2. recheck the canonical candidate/bindings and approved repository/CI proof;
+3. admit valid Spec/Code accounts; dispatch remaining required exact roles under
+   `../devrites-lib/reference/parallel-dispatch.md` on the same frozen candidate;
+4. reconcile their read-only verdicts against source and immutable evidence;
+5. draft GO/NO-GO `seal.md` with acceptance, tests, decisions, and seven accounts;
+6. write exactly one candidate binding, then run
+   `devrites-engine check seal <slug>` for structure and identity, never semantics.
+
+Corrections return through affected Prove/Review before restarting Seal under
+[evidence validity](../devrites-lib/reference/candidate-integrity.md#evidence-validity).
+
+Only repository scripts/CI authorize commands; never guess.
+
+## On GO
+
+Set `state.md` `Next step: /rite-ship` and stop. A GO is a verdict, not
+authorization to perform an irreversible action.
+
+## Output
+
+Use [`reference/output.md`](reference/output.md).

package/pack/generated/devin/skills/rite-seal/reference/anti-patterns.md

@@ -0,0 +1,29 @@
+# rite-seal: anti-patterns
+
+Load this when standing the final GO/NO-GO decision, or when tempted to round
+NO-GO up to GO. (The irreversible push/tag/deploy and its type-GO gate now live in
+`/rite-ship`: see that skill's anti-patterns for the type-GO discipline.)
+
+Pack-wide rationalizations + red flags (incl. user-wants-it-bypass-gate):
+see [standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-patterns.md).
+
+## Phase-specific rationalizations
+
+| Excuse | Rebuttal |
+|---|---|
+| "All Important findings are minor; just GO." | `Important > 0` triggers an interactive y/N: do not bypass the prompt, present it. |
+| "User clearly wants this to ship." | Ship is evidence-driven, not consent-driven. A Critical finding outranks "the user said go". |
+| "Drift is small; resolve it inline and seal." | Unresolved drift = NO-GO, no exceptions. Route through `/rite-plan` to repair, then seal. |
+| "Reviewer findings overlap; average them away." | Surface disagreements explicitly. Averaging hides where the reviewers disagree. |
+| "Carry the old reviewer verdicts though the diff changed." | If the diff changed since `/rite-review`, re-run the Spec + Code axes: don't carry stale verdicts forward. |
+| "The wright was confident in a material decision. GO without independent review." | Confidence is not independent evidence. Ask the exact `devrites-doubt-reviewer` to test a boundary / data-model / auth / public-API / migration claim, reconcile its result against source, and record the verdict in `decisions.md`; unresolved irreversible risk is NO-GO. |
+
+## Red Flags
+
+- About to write `Verdict: GO` while any `Critical` finding is open.
+- Writing `Next step` as anything other than `/rite-ship` after a GO verdict.
+- Reviewer subagents spawned with the author's reasoning attached (defeats the fresh-context point).
+- `seal.md` written before walking *every* acceptance criterion one by one.
+- A NO-GO rounded up to GO "to be agreeable".
+- Unresolved drift, unresolved questions, or pending tasks, and you're sealing anyway.
+- A stood irreversible-risk decision (auth / public-API / migration) has no recorded independent `devrites-doubt` verdict, and you are sealing GO anyway.

package/pack/generated/devin/skills/rite-seal/reference/final-evidence.md

@@ -0,0 +1,41 @@
+# Final evidence check
+
+Map spec promises to valid observed proof.
+
+## Acceptance
+
+For each AC/REQ/scenario/key link, exact `devrites-proof-runner` maps immutable
+results and exact `devrites-spec-reviewer` checks implementation and proof
+against its meaning. Bug fixes require original-symptom proof; self-report,
+inspection alone, and generic "tests pass" do not count.
+
+Apply [[`testing.md`](../../devrites-lib/reference/standards/testing.md)'s positive, discriminating proof](../../devrites-lib/reference/standards/testing.md#positive-discriminating-proof),
+including invalid-result exclusions and static/textual criterion boundaries.
+Unproven behavior: NO-GO.
+
+## Cross-check
+
+Require built slices, resolved or accepted findings, no drift/open validating
+question, required UI/boundary proof, and an exact doubt verdict per stood decision.
+Reconcile the final diff with the spec applicability map. Every triggered topology,
+data, integration, security, and delivery owner needs its relevant observed failure/
+recovery evidence or an evidence-backed dismissal; a generic green suite cannot close it.
+
+## Candidate binding and test integrity
+
+Run `devrites-engine check candidate <slug>` and require its digest to match the
+single evidence/review bindings and browser binding when present. Diff tests,
+dispatch exact `devrites-test-analyst`; apply
+[evidence validity](../../devrites-lib/reference/candidate-integrity.md#evidence-validity)
+to approved proof, then require unchanged digest/sources. Deleted/skipped/focused/
+weakened/tautological tests are Critical.
+
+After recording verdicts in `seal.md`, run:
+
+```bash
+devrites-engine check seal "<slug>"
+```
+
+This checks structure and exact candidate bindings, never acceptance, test
+quality, doubt, or review. Apply [[`testing.md`](../../devrites-lib/reference/standards/testing.md)'s safe perturbation](../../devrites-lib/reference/standards/testing.md#safe-perturbation)
+for its mandatory critical/regression cases and any additional project/test-plan requirement.

package/pack/generated/devin/skills/rite-seal/reference/go-no-go.md

@@ -0,0 +1,29 @@
+# GO / NO-GO
+
+[`../SKILL.md`](../SKILL.md) owns gates. Draft native acceptance, test, doubt,
+and seven reviewer accounts in `seal.md`; then run
+`devrites-engine check seal <slug>` for structure/freshness.
+
+## NO-GO
+
+NO-GO on unproven acceptance/prohibitions/key links, red repository checks,
+stale proof, drift/open validating questions, Critical code/security, unsafe
+rollback, or an unapproved principle violation. Also block:
+- missing/adverse exact proof, spec, or test verdict;
+- deleted/skipped/focused/tautological/weakened tests;
+- missing/silent required review or invalid conditional account;
+- a stood decision without reconciled exact doubt verdict;
+- opted-in mutation missing/below threshold (otherwise optional).
+
+## GO
+
+GO needs fresh acceptance, green proof, resolved drift/human gates, acceptable
+security/data/rollback risk, every account, and no Critical.
+
+When only Important findings remain, ask:
+
+```text
+Important findings remain. Proceed to seal? [y/N]
+```
+
+Default NO-GO. `y` accepts named Important risks only, never Critical/missing proof.

package/pack/generated/devin/skills/rite-seal/reference/output.md

@@ -0,0 +1,5 @@
+# rite-seal output
+
+Use the shared [GO or NO-GO reply contract](../../devrites-lib/reference/reply-contract.md).
+
+Do not imply anything shipped. `/rite-seal` decides; `/rite-ship` executes.

package/pack/generated/devin/skills/rite-seal/reference/phase-contract.md

@@ -0,0 +1,47 @@
+# rite-seal phase contract
+
+1. **Read.** Resolve the explicit slug or `.devrites/ACTIVE`, require its
+   `state.md`, then read required workspace artifacts, conditional
+   browser/design/devex evidence, and final diff.
+2. **Recheck identity and real proof.** Run
+   `devrites-engine check candidate <slug>` and require its exact digest to match
+   the single evidence/review bindings and the browser binding when present.
+   Apply [`spec-grammar.md`](../../devrites-lib/reference/standards/spec-grammar.md)'s Native grammar re-read checklist and
+   [evidence validity](../../devrites-lib/reference/candidate-integrity.md#evidence-validity).
+   Run required `test-plan.md` commands unless valid observed proof already satisfies
+   them under that contract. Rerun the
+   candidate check afterward and require the identical digest and no source
+   mutation. Capture command, cwd, exit, decisive output, and identity.
+   Missing/red/mismatched blocks; unavailable is `cannot_verify`, never pass.
+3. **Judge acceptance.** Dispatch exact `devrites-proof-runner` on immutable
+   proof; admit valid same-candidate `devrites-spec-reviewer` evidence from Review
+   or dispatch that exact reviewer. Reconcile every
+   AC/REQ/scenario/key link by ID and meaning; missing/stale/self-attested/mismatched is NO-GO.
+4. **Judge tests.** Diff baseline/candidate tests for deletion, skip/focus,
+   tautology, or weakening; dispatch exact `devrites-test-analyst`. Missing or
+   adverse account, or green tests not asserting mapped behavior, is Critical.
+5. **Resolve gates.** Open blocking/escalating/validating questions and drift
+   block. Each stood decision needs a reconciled exact `devrites-doubt-reviewer` verdict.
+   Every deferred finding (`touched-files.md` `## Review trail`, `eng-review.md`
+   `## Deferred findings`) needs its `review.md` verdict; a row without one blocks.
+6. **Risk and native review.** Apply [`risk-and-rollback.md`](risk-and-rollback.md)
+   and the [`review roster`](../../devrites-lib/reference/parallel-dispatch.md) on
+   the candidate. Admit each result through
+   [`result admission`](../../devrites-lib/reference/standards/agents.md#result-admission).
+   `## Reviewer Accounts` preserves all seven; gap/missing/malformed blocks;
+   conditional `Not-applicable` names why.
+7. **Route corrections.** Reconcile cited findings/disagreements, but do not
+   edit the candidate or manifest in Seal. Route an accepted correction through
+   one bounded wright, update the manifest, run affected Prove, complete a fresh
+   Review under evidence validity, then restart Seal on the new digest.
+8. **Draft/check.** Write `seal.md` from
+   [`seal-template.md`](seal-template.md) with the GO/NO-GO rationale, acceptance map,
+   test-analysis account, stood-decision verdicts, all seven reviewer accounts,
+   and exactly one `Candidate SHA-256: <64 lowercase hex>` line. Then run:
+   ```bash
+   devrites-engine check seal "<slug>"
+   ```
+   Structure/bindings only: blocks exit `3`, invalid state `2`. GO sets
+   `Next step: /rite-ship`; NO-GO names the fix. No commit/push/tag/publish/deploy/close.
+
+Apply [`anti-patterns.md`](anti-patterns.md); never average away disagreement.

package/pack/generated/devin/skills/rite-seal/reference/risk-and-rollback.md

@@ -0,0 +1,56 @@
+# Risk & rollback
+
+Before GO, know how to undo the change and what could go wrong in production.
+
+## Risk scan
+Rank risks; for each, note likelihood × impact and any mitigation:
+- **Topology/ownership**: affected roots/deployables, shared contracts/state/resources,
+  dependency cycles, and intermediate deployment combinations.
+- **Data**: schema changes, migration/backfill interruption, concurrent/duplicate writes,
+  tenant/retention boundaries, destructive operations, and invariant reconciliation.
+- **Security**: new trust boundaries, auth/authz changes, secret handling, new deps.
+- **Compatibility**: API contract changes, breaking changes for existing clients,
+  feature interactions.
+- **Integration/operational**: timeouts/unknown outcomes, retry/idempotency, duplicate/order,
+  partial/invalid responses, provider/queue/cache outage, config/env, and rate limits.
+- **Delivery**: schema/config/application/worker/flag order, environment mismatch,
+  monitoring gap, exposure stages, and time to detect/recover.
+- **UX**: changed flows users rely on; unverified UI.
+
+## Rollback plan (required for risky changes)
+For each risky step, state how to back it out:
+- **Migrations**: is there a reversible `down` / a documented manual revert? Is data
+  loss possible on rollback? If rollback is unsafe, is bounded forward recovery rehearsed?
+- **Feature flag**: can it be disabled without a deploy?
+- **Revert boundary**: can the change be `git revert`-ed cleanly, or does it entangle
+  with other work?
+- **Data**: is there a backup / a way to restore prior state?
+- **External/async effects**: can an unknown outcome be reconciled without duplicating it;
+  who drains/replays/quarantines work and repairs partial state?
+- **Configuration/deployables**: what order restores compatible versions and values at
+  every root/environment?
+
+## Blocking rules
+- A **destructive or data-migration change with no rollback plan** is a **NO-GO**.
+- A data change with unknown invariant/tenant impact, no interruption/retry proof, or no
+  rollback/forward-recovery rehearsal is **NO-GO**.
+- A new/changed external or asynchronous boundary with blind retry, silent partial success,
+  or no outage/backlog recovery and monitoring is **NO-GO**.
+- Unsafe intermediate deployment order, unvalidated required configuration, or no watched
+  rollout signal/owner is **NO-GO** for live exposure.
+- Record the chosen rollback path in `seal.md` → "Risks / Rollback".
+
+## Fresh-context availability
+
+A required review must run in a fresh spawned agent:
+
+- If the named role is unavailable, record the roster skip reason and keep seal
+  **NO-GO**.
+- Never run the reviewer in the root context or log root work as a dispatched review.
+- AFK never auto-accepts a missing reviewer.
+- Security or irreversible-risk scope remains NO-GO while independent review is
+  unavailable.
+
+## Destructive operations
+Confirm any destructive step with the user before shipping. Verify backups exist where
+relevant. Never treat an irreversible action as routine.

package/pack/generated/devin/skills/rite-seal/reference/seal-template.md

@@ -0,0 +1,27 @@
+# `seal.md` template
+
+```md
+# Seal: <Feature>
+Verdict: GO / NO-GO
+Candidate SHA-256: <64 lowercase hex>
+## Acceptance Criteria
+- <AC>: <evidence>
+## Verification Evidence
+<proof>
+## Reviewer Accounts
+- devrites-spec-reviewer: <outcome>
+- devrites-code-reviewer: <outcome>
+- devrites-test-analyst: <outcome>
+- devrites-frontend-reviewer: <outcome>
+- devrites-security-auditor: <outcome>
+- devrites-performance-reviewer: <outcome>
+- devrites-devex-reviewer: <outcome>
+## Risks / Rollback
+<risks/recovery>
+## Stood Decisions
+<doubt verdict per stood decision>
+## Blockers / Follow-ups
+<blockers/follow-ups>
+## Final Decision
+<verdict/reason>
+```