devrites 5.10.1 → 5.11.0

package/pack/generated/omp/skills/rite-build/reference/parallel-batch.md

@@ -9,6 +9,7 @@ Opt-in only. Default `/rite-build` stays [`one-slice-cycle.md`](one-slice-cycle.
 | omitted / `--parallel 1` | Serial one-slice |
 | `--parallel N` (**2≤N≤10**) | N is a **cap**, not a quota: run the largest eligible set ≤ N |
 | non-integer / `N≤0` / `N>10` | Hard refuse (no silent clamp) |
+| Autocomplete `--parallel N` | N is the cap for this run; leftover sentinel `max_parallel` is ignored, then `/rite-autocomplete` writes or replaces only `max_parallel: N` |
 | Autocomplete, no flag | Same path, cap from sentinel `max_parallel` else 10; serial only when ineligible |
 
 AFK caps `N`. Charge green siblings once after integrate; abort /
@@ -21,7 +22,8 @@ Size each batch by what is runnable **now**, never by the requested number:
 
 ```text
 N_eff = min(
-  cap                  -- --parallel N | sentinel max_parallel | 10 (autocomplete default)
+  cap                  -- this invocation's --parallel N (wins over leftover sentinel max_parallel)
+                       | else sentinel max_parallel | else 10 (autocomplete default)
   eligible set         -- dependency-satisfied pending slices, pairwise path-disjoint
   AFK headroom         -- remaining max_slices, max_agents, max_minutes, review queue
   host capacity        -- concurrent worktree writers + the runtime isolation table

package/pack/generated/omp/skills/rite-define/reference/plan-template.md

@@ -14,7 +14,7 @@ Spec: ./spec.md   Decision coverage: ./decision-coverage.md   Date: <date>
 - Language/runtime/version: <...>
 - Frameworks/libraries: <...>
 - Storage/data: <...>
-- Test commands: <discovered runner commands; discovery contract: rite-prove/reference/test-command-discovery.md>
+- Test commands: <discovered runner commands; discovery contract: .omp/skills/rite-prove/reference/test-command-discovery.md>
 - Target/platform/constraints: <...>
 - Approach-affecting product/constraint unknowns route to `/rite-clarify`;
   `[NEEDS CLARIFICATION]` blocks approval.

package/pack/generated/pi/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -56,14 +56,14 @@ max_minutes: 120                     # wall-clock minutes in one host activation
 max_review_queue: 8                  # unresolved review/gate items admitted before fan-out stops
 # max_tokens: 200000                 # optional stricter host-observed token cap
 # max_cost_usd: 10                   # optional stricter host-observed cost cap
-notify: "ntfy.sh/my-topic"           # shell command; examples: rite-build/reference/afk-discipline.md
+notify: "ntfy.sh/my-topic"           # shell command; examples: .pi/skills/rite-build/reference/afk-discipline.md
 allow_gates: [advisory, validating]  # gate severities AFK auto-handles (auto-picks the recommended option)
 continue_sequence: true              # after Seal GO, open the next recorded continuation
 max_workspaces: 5                    # workspaces one armed sequence may open
-max_parallel: 10                     # cap on eligible path-disjoint Build batches (1 = serial)
+max_parallel: 10                     # unattended default cap; `--parallel N` on this invocation wins and may rewrite only this field
 ```
 
-The file is **read-only config**: never rewritten in place. `max_slices` is the initial
+The file is **read-only config**: never rewritten in place, except `/rite-autocomplete --parallel N` writes or replaces only `max_parallel: N`. `max_slices` is the initial
 budget; the mutable remaining count is the `state.md` cursor
 `afk_slices_remaining` (`AFK slices remaining: <n>` in the released bullet
 form), owned by the controlling root. Recognize either spelling and preserve
@@ -119,11 +119,18 @@ candidate manifest to cover the whole recorded chain — run
 - Every human-owned, safety, access, exhaustion, and `NO-GO` condition still stops the
   run exactly as without this field.
 
-`max_parallel` caps a Build batch for unattended runs; `1` forces the serial cycle.
-Unattended runs take the largest eligible set ≤ cap and recompute after every completed
-round (serial slice or parallel integrate)
-([parallel-batch.md § Dynamic selection and re-batching](../../../rite-build/reference/parallel-batch.md#dynamic-selection-and-re-batching));
-an explicit `/rite-build --parallel N` cap wins for that invocation.
+`max_parallel` is the unattended default batch cap only when this invocation does
+not contain `--parallel N`; `1` forces the serial cycle only in that default
+case. An exact `--parallel N` on `/rite-autocomplete` or `/rite-build` is the
+batch cap for this run: do not consult leftover sentinel `max_parallel`, and do
+not treat `max_parallel: 1` as serial. `/rite-autocomplete --parallel N` writes
+or replaces only that field so later ticks keep the cap; `/rite-build --parallel N`
+wins for that invocation without rewriting the sentinel. Never write `max_slices`
+from `--max-slices`. **Failing case:** `/rite-autocomplete --parallel 5` honors a
+leftover `max_parallel: 1` and stays serial.
+Unattended runs take the largest eligible set ≤ that cap and recompute after
+every completed round (serial slice or parallel integrate)
+([parallel-batch.md § Dynamic selection and re-batching](../../../rite-build/reference/parallel-batch.md#dynamic-selection-and-re-batching)).
 
 ## Unattended resource envelope
 

package/pack/generated/pi/skills/rite-autocomplete/SKILL.md

@@ -87,18 +87,23 @@ executable controller/harness/bundle bytes or a missing writer, read
 3. **Arm AFK once.** Apply the loop's
    [one-write AFK contract](reference/loop.md#arm-afk-once): preserve valid
    existing bytes or create the sentinel once (`allow_gates: [advisory, validating]`); never
-   rewrite it after Vet. Preserve an existing sentinel byte-for-byte.
+   rewrite it after Vet except to write or replace only `max_parallel: N` when
+   this invocation contains `--parallel N`. Preserve an existing sentinel
+   byte-for-byte otherwise. **Failing case:** leftover `max_parallel: 1` keeps
+   the run serial after `--parallel 5`.
    **Completion:** a valid read-only AFK sentinel exists.
 4. **Drive phases.** Follow [the loop](reference/loop.md): `/rite-spec` →
    `/rite-clarify` → `/rite-temper` → `/rite-define` → `/rite-vet` →
    `/rite-build` batch loop → `/rite-prove` → `/rite-polish` →
    `/rite-review` → `/rite-seal`. Read and execute each skill; durable files, not
    chat, carry state. Apply the mutable post-vet budget before first Build.
-   Build runs the largest eligible path-disjoint batch (cap: `--parallel N`, else
-   sentinel `max_parallel`, else 10) and recomputes after every completed round until no
-   pending slice remains; a one-slice round is serial for that round only, then
+   Build runs the largest eligible path-disjoint batch (cap: this invocation's
+   `--parallel N`, else sentinel `max_parallel`, else 10) and recomputes after
+   every completed round until no pending slice remains; a one-slice round is serial for that round only, then
    selection runs again (host isolation still forces serial when concurrent writers
-   cannot be separated).
+   cannot be separated). When `--parallel N`
+   is present, pass it into `/rite-build` and do not consult leftover sentinel
+   `max_parallel`.
    **Completion:** loop reaches Seal GO or persists a valid stop before any later phase.
 5. **Apply stops.** At every gate use
    [stop-conditions.md](reference/stop-conditions.md). A `blocked` label alone is not a stop condition:

package/pack/generated/pi/skills/rite-autocomplete/reference/loop.md

@@ -17,18 +17,21 @@ allow_gates: [advisory, validating]
 # max_slices / max_agents / max_minutes / max_review_queue omitted: unlimited
 # continue_sequence: true          # opt-in: chain recorded continuations after Seal GO
 # max_workspaces: 5                # sequence budget when chaining
-# max_parallel: 10                 # Build batch cap; 1 = serial (default: eligible, cap 10)
+# max_parallel: 10                 # default cap when this invocation omits `--parallel N`; `--parallel N` wins and rewrites only this field
 # max_tokens: <N>
 # max_cost_usd: <amount>
 # notify: "<cmd>"
 ```
 
-Read an existing sentinel first. Preserve it byte-for-byte when valid; stop if
+Read an existing sentinel first. Preserve it byte-for-byte when valid, except
+when this invocation contains `--parallel N`: then write or replace only
+`max_parallel: N` and leave every other key unchanged. Stop if the sentinel is
 malformed. Do not stop because it names `max_slices` / `max_agents` /
 `max_minutes` / `max_review_queue` or only `[advisory]`. If absent, write it
-once after clarity. Never write `max_slices` from `--max-slices`.
-It is read-only: never rewrite it after Vet or reset it on resume. Leftover
-`expires_at` is ignored and never rewritten.
+once after clarity, and include `max_parallel: N` when that flag is present.
+Never write `max_slices` from `--max-slices`. It is otherwise read-only: never rewrite it after Vet or reset it on resume. Leftover `expires_at` is ignored
+and never rewritten. **Failing case:** leftover `max_parallel: 1` keeps the run
+serial after `--parallel 5`.
 
 ### Derive the mutable post-vet budget
 
@@ -44,7 +47,9 @@ readiness check first; reject overlap. Do not stop on `max_agents`,
 gets fresh activation-local counters but retains durable slice/recovery state.
 
 When driving `/rite-build`, ignore afk-discipline remaining-0, `--max-slices`,
-and parallel AFK headroom. Close validating questions and blocking questions
+and parallel AFK headroom as stop conditions. Pass this invocation's
+`--parallel N` into `/rite-build` when present; leftover sentinel
+`max_parallel` is then not the cap. Close validating questions and blocking questions
 that already name a ranked recommended option (recommended pick via
 `devrites-engine state resolve`) instead of queuing them or handing
 `/rite-resolve` to the user. Escalating, irreversible-risk, access, and
@@ -61,7 +66,7 @@ Workspace files carry state; chat does not. Read and execute each phase skill:
 | 3 | `/rite-temper` | harden, reduce, or expand; irreversible risk still pauses |
 | 4 | `/rite-define` | approved plan/tasks/traceability |
 | 5 | `/rite-vet` | every plan; derive mutable budget after READY |
-| 6 | `/rite-build` batch loop | largest eligible path-disjoint set (cap 10; one-slice round when <2 eligible); recompute after each round; charge once per green built slice |
+| 6 | `/rite-build` batch loop | largest eligible path-disjoint set (cap: this invocation's `--parallel N`, else sentinel `max_parallel`, else 10; one-slice round when <2 eligible); recompute after each round; charge once per green built slice |
 | 7 | `/rite-prove` | all slices built; approved proof; recovery on red |
 | 8 | `/rite-polish` | re-prove after code edits |
 | 9 | `/rite-review` | in-scope correction then fresh proof |

package/pack/generated/pi/skills/rite-build/SKILL.md

@@ -64,7 +64,9 @@ filled, and recomputes after every completed round (serial slice or parallel
 integrate) until no pending slice remains
 ([`parallel-batch.md` § Dynamic selection](reference/parallel-batch.md#dynamic-selection-and-re-batching)).
 Unattended runs (`/rite-autocomplete`, `.devrites/AFK` `max_parallel`) repeat batches
-inside the same run; HITL stops after each batch. Non-integer/`N≤0`/`N>10` hard refuse.
+inside the same run; HITL stops after each batch. This invocation's `--parallel N`
+is the cap: leftover sentinel `max_parallel` is not consulted. Autocomplete with
+that flag also writes or replaces only `max_parallel: N`. Non-integer/`N≤0`/`N>10` hard refuse.
 All-green (independent review + proof) then integrate as one local `WIP(<slug>):`
 commit per sibling onto the current control branch (never pushed). Do not
 integrate a sibling because the wright returned. A red/gap sibling gets a bounded repair

package/pack/generated/pi/skills/rite-build/reference/afk-discipline.md

@@ -16,9 +16,10 @@ control; irreversible work (destructive/auth/public API) always pauses.
 The controlling root owns the cap:
 
 1. **Before every dispatch**, re-read `.devrites/AFK`, `state.md`, and the
-   selected slice. When `--parallel N` or sentinel `max_parallel` is greater than
-   1, recompute `N_eff` via `parallel select` before the next dispatch — a prior
-   one-slice round does not keep the run serial. A configured `max_slices` and any existing
+   selected slice. This invocation's `--parallel N` is the cap when present;
+   leftover sentinel `max_parallel` is not consulted in that case. When that
+   flag or sentinel `max_parallel` is greater than 1, recompute `N_eff` via
+   `parallel select` before the next dispatch — a prior one-slice round does not keep the run serial. A configured `max_slices` and any existing
    `afk_slices_remaining` value, including its released bullet form, must each
    be a decimal nonnegative integer. A missing
    `state.md` or malformed configured value fails closed; an omitted cap is the

package/pack/generated/pi/skills/rite-build/reference/parallel-batch.md

@@ -9,6 +9,7 @@ Opt-in only. Default `/rite-build` stays [`one-slice-cycle.md`](one-slice-cycle.
 | omitted / `--parallel 1` | Serial one-slice |
 | `--parallel N` (**2≤N≤10**) | N is a **cap**, not a quota: run the largest eligible set ≤ N |
 | non-integer / `N≤0` / `N>10` | Hard refuse (no silent clamp) |
+| Autocomplete `--parallel N` | N is the cap for this run; leftover sentinel `max_parallel` is ignored, then `/rite-autocomplete` writes or replaces only `max_parallel: N` |
 | Autocomplete, no flag | Same path, cap from sentinel `max_parallel` else 10; serial only when ineligible |
 
 AFK caps `N`. Charge green siblings once after integrate; abort /
@@ -21,7 +22,8 @@ Size each batch by what is runnable **now**, never by the requested number:
 
 ```text
 N_eff = min(
-  cap                  -- --parallel N | sentinel max_parallel | 10 (autocomplete default)
+  cap                  -- this invocation's --parallel N (wins over leftover sentinel max_parallel)
+                       | else sentinel max_parallel | else 10 (autocomplete default)
   eligible set         -- dependency-satisfied pending slices, pairwise path-disjoint
   AFK headroom         -- remaining max_slices, max_agents, max_minutes, review queue
   host capacity        -- concurrent worktree writers + the runtime isolation table

package/pack/generated/pi/skills/rite-define/reference/plan-template.md

@@ -14,7 +14,7 @@ Spec: ./spec.md   Decision coverage: ./decision-coverage.md   Date: <date>
 - Language/runtime/version: <...>
 - Frameworks/libraries: <...>
 - Storage/data: <...>
-- Test commands: <discovered runner commands; discovery contract: rite-prove/reference/test-command-discovery.md>
+- Test commands: <discovered runner commands; discovery contract: .pi/skills/rite-prove/reference/test-command-discovery.md>
 - Target/platform/constraints: <...>
 - Approach-affecting product/constraint unknowns route to `/rite-clarify`;
   `[NEEDS CLARIFICATION]` blocks approval.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devrites",
-  "version": "5.10.1",
-  "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, and pi",
+  "version": "5.11.0",
+  "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, pi, and Devin CLI",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",
   "repository": {
@@ -14,6 +14,7 @@
   "keywords": [
     "claude-code",
     "codex",
+    "devin-cli",
     "skills",
     "agent-skills",
     "workflow",
@@ -37,6 +38,7 @@
     "scripts/codex-generate.sh",
     "scripts/omp-generate.sh",
     "scripts/pi-generate.sh",
+    "scripts/devin-generate.sh",
     "scripts/install-lib.sh",
     "install.sh",
     "uninstall.sh",

package/scripts/build-host-artifacts.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# build-host-artifacts.sh: render host-native Claude, Codex, omp, and pi
-# artifacts from the canonical pack.
+# build-host-artifacts.sh: render host-native Claude, Codex, omp, pi, and
+# Devin artifacts from the canonical pack.
 #
 # Default output is pack/generated/ so npm pack can ship prebuilt surfaces.
 # Tests may set DEVRITES_HOST_ARTIFACT_DIR to a temporary directory.
@@ -33,6 +33,8 @@ trap cleanup EXIT
 . "$ROOT/scripts/omp-generate.sh"
 # shellcheck source=pi-generate.sh
 . "$ROOT/scripts/pi-generate.sh"
+# shellcheck source=devin-generate.sh
+. "$ROOT/scripts/devin-generate.sh"
 
 copy_tree() {
   _src="$1"
@@ -116,8 +118,30 @@ render_pi_skill_tree() {
   done < <(find "$_sd" -type f)
 }
 
+render_devin_skill_tree() {
+  _sd="$1"
+  _dest="$2"
+  mkdir -p "$_dest"
+  while IFS= read -r f; do
+    _r="${f#$_sd/}"
+    _out="$_dest/$_r"
+    mkdir -p "$(dirname "$_out")"
+    case "$_r" in
+    SKILL.md)
+      gen_devin_skill_file "$f" "$_out"
+      ;;
+    *.md)
+      gen_devin_markdown_file "$f" "$_out"
+      ;;
+    *)
+      cp "$f" "$_out"
+      ;;
+    esac
+  done < <(find "$_sd" -type f)
+}
+
 rm -rf "$OUT_ROOT"
-mkdir -p "$OUT_ROOT/claude" "$OUT_ROOT/codex" "$OUT_ROOT/omp" "$OUT_ROOT/pi"
+mkdir -p "$OUT_ROOT/claude" "$OUT_ROOT/codex" "$OUT_ROOT/omp" "$OUT_ROOT/pi" "$OUT_ROOT/devin"
 
 # Claude artifacts are host-native copies of the canonical pack.
 copy_tree "$PACK_SRC/skills" "$OUT_ROOT/claude/skills"
@@ -181,6 +205,23 @@ done < <(find "$PACK_SRC/agents" -maxdepth 1 -type f -name '*.md')
 
 gen_pi_agents_bridge "$OUT_ROOT/pi/AGENTS.md"
 
+# Devin artifacts are generated host-native mirrors: skills under
+# .devin/skills and custom subagent profiles under .devin/agents, plus an
+# AGENTS.md bridge block (Devin reads project AGENTS.md as always-on rules).
+mkdir -p "$OUT_ROOT/devin/skills" "$OUT_ROOT/devin/agents"
+while IFS= read -r d; do
+  name="$(basename "$d")"
+  [ "$name" = ".impeccable" ] && continue
+  render_devin_skill_tree "$d" "$OUT_ROOT/devin/skills/$name"
+done < <(find "$PACK_SRC/skills" -mindepth 1 -maxdepth 1 -type d)
+
+while IFS= read -r f; do
+  name="$(basename "$f" .md)"
+  gen_devin_agent "$f" "$OUT_ROOT/devin/agents/$name.md"
+done < <(find "$PACK_SRC/agents" -maxdepth 1 -type f -name '*.md')
+
+gen_devin_agents_bridge "$OUT_ROOT/devin/AGENTS.md"
+
 cat >"$OUT_ROOT/README.md" <<'EOF'
 # Generated DevRites Host Artifacts
 
@@ -194,10 +235,12 @@ This directory is generated by `scripts/build-host-artifacts.sh`.
 - `pi/` contains pi-native skill mirrors, pi-subagents Markdown agents,
   prompt templates preserving the `/rite*` commands, and an `AGENTS.md`
   bridge block.
+- `devin/` contains Devin CLI skill mirrors, custom subagent profiles with
+  `allowed-tools` allowlists, and an `AGENTS.md` bridge block.
 
 Do not edit these files by hand. Edit `pack/.claude/`,
-`scripts/codex-generate.sh`, `scripts/omp-generate.sh`, or
-`scripts/pi-generate.sh`, then rebuild.
+`scripts/codex-generate.sh`, `scripts/omp-generate.sh`,
+`scripts/pi-generate.sh`, or `scripts/devin-generate.sh`, then rebuild.
 EOF
 
 echo "build-host-artifacts: wrote $OUT_ROOT"

package/scripts/devin-generate.sh

@@ -0,0 +1,222 @@
+#!/usr/bin/env bash
+# devin-generate.sh: shared Claude-to-Devin surface generators.
+#
+# This file is a shell library, not a standalone installer. Callers provide
+# TMP_GEN_DIR and then invoke the gen_* helpers below.
+
+# Rewrite canonical Claude (and leftover Codex/omp/pi) paths to installed
+# Devin paths. Slash /rite invocations stay slash-form: Devin discovers
+# .devin/skills/<name>/SKILL.md as /name. Dispatch wording uses the
+# `run_subagent` tool with `profile`, matching Devin CLI custom subagents.
+gen_devin_markdown_file() {
+  local _src="$1" _out="$2"
+  mkdir -p "$(dirname "$_out")"
+  sed -E \
+    -e 's#Try post-install path first, fall back to pre-install:#Resolve the installed skill path:#g' \
+    -e '/^\[ -f "\$F" \] \|\| F=[^ ].*SKILL\.md$/d' \
+    -e 's#(pack/)?\.claude/agents/devrites-\{security-auditor,performance-reviewer,simplifier-reviewer\}\.md#.devin/agents/devrites-security-auditor.md`, `.devin/agents/devrites-performance-reviewer.md`, or `.devin/agents/devrites-simplifier-reviewer.md#g' \
+    -e 's#(\.\./)+agents/devrites-\{security-auditor,performance-reviewer,simplifier-reviewer\}\.md#.devin/agents/devrites-security-auditor.md`, `.devin/agents/devrites-performance-reviewer.md`, or `.devin/agents/devrites-simplifier-reviewer.md#g' \
+    -e 's#pack/\.claude/skills/devrites-lib/scripts/#.devin/skills/devrites-lib/scripts/#g' \
+    -e 's#pack/\.claude/skills/#.devin/skills/#g' \
+    -e 's#pack/\.claude/agents/([A-Za-z0-9_-]+)\.md#.devin/agents/\1.md#g' \
+    -e 's#pack/\.claude/agents/#.devin/agents/#g' \
+    -e 's#\.claude/skills/devrites-lib/scripts/#.devin/skills/devrites-lib/scripts/#g' \
+    -e 's#\.claude/skills/#.devin/skills/#g' \
+    -e 's#\.claude/agents/([A-Za-z0-9_-]+)\.md#.devin/agents/\1.md#g' \
+    -e 's#\.claude/agents/#.devin/agents/#g' \
+    -e 's#(\.\./)+agents/([A-Za-z0-9_-]+)\.md#.devin/agents/\2.md#g' \
+    -e 's#\.agents/skills/devrites-lib/scripts/#.devin/skills/devrites-lib/scripts/#g' \
+    -e 's#\.agents/skills/#.devin/skills/#g' \
+    -e 's#\.codex/skills/devrites-lib/scripts/#.devin/skills/devrites-lib/scripts/#g' \
+    -e 's#\.codex/skills/#.devin/skills/#g' \
+    -e 's#\.codex/agents/([A-Za-z0-9_-]+)\.toml#.devin/agents/\1.md#g' \
+    -e 's#\.codex/agents/([A-Za-z0-9_-]+)\.md#.devin/agents/\1.md#g' \
+    -e 's#\.codex/agents/#.devin/agents/#g' \
+    -e 's#\.omp/skills/#.devin/skills/#g' \
+    -e 's#\.omp/agents/([A-Za-z0-9_-]+)\.md#.devin/agents/\1.md#g' \
+    -e 's#\.omp/agents/#.devin/agents/#g' \
+    -e 's#\.pi/skills/#.devin/skills/#g' \
+    -e 's#\.pi/agents/([A-Za-z0-9_-]+)\.md#.devin/agents/\1.md#g' \
+    -e 's#\.pi/agents/#.devin/agents/#g' \
+    -e '/^\(use the `[^`]*` mirror on Codex\)\.$/d' \
+    -e '/^\(`[^`]+` mirror on Codex\)\.$/d' \
+    -e 's# \(use the `[^`]*` mirror on Codex\)##g' \
+    -e 's# \(`[^`]+` mirror on Codex\)##g' \
+    -e 's#\(`[^`]+` mirror on Codex\); ##g' \
+    -e 's#\(`[^`]+` mirror on Codex\)##g' \
+    -e 's#^seeded verdicts#Seeded verdicts#' \
+    -e '/Rules in scope/{N;s#;\n[[:space:]]*`[^`]+` mirror on Codex##;}' \
+    -e '/On Codex, use the/{N;s# On Codex, use the mirrors under\n`[^`]+`\.##;s# On Codex, use the\nmirrors under `[^`]+`\.##;s# On Codex, use the\nmirror under `[^`]+`\.##;}' \
+    -e 's#Host mapping: Claude Code uses `Agent` \(`Task` is its legacy alias\); Codex uses#Host mapping: Devin fresh-context dispatch uses `run_subagent` with `profile`; hosts use#g' \
+    -e 's#`Agent` call#`run_subagent` call#g' \
+    -e 's#`spawn_agent` call#`run_subagent` call#g' \
+    -e 's#Claude: N concurrent Task wrights#Devin: N concurrent `run_subagent` wrights#g' \
+    -e 's#Task breakdown#Work-item breakdown#g' \
+    -e 's#dispatch `devrites-source-driven`#invoke `devrites-source-driven`#g' \
+    -e 's#Dispatch `devrites-source-driven`#Invoke `devrites-source-driven`#g' \
+    -e 's#pass-through dispatch to the matching `rite-<verb>` skill#pass-through invocation of the matching `rite-<verb>` skill#g' \
+    -e 's#verb dispatches to the matching `rite-<verb>` skill#verb invokes the matching `rite-<verb>` skill#g' \
+    -e 's#the dispatch map only#the invocation map only#g' \
+    -e 's#→ dispatch per the table above#→ invoke the matching skill per the table above#g' \
+    "$_src" >"$_out"
+}
+
+# Translate the Claude skill invocation flags into Devin's `triggers` list:
+# user-invocable maps to the `user` trigger and model invocation maps to the
+# `model` trigger. Both flags restrictive yields `triggers: []` (never
+# auto- or slash-invoked); neither restrictive omits the field so Devin's
+# default (user + model) applies.
+gen_devin_skill_file() {
+  local _src="$1" _out="$2"
+  local _ui _dmi _tmp="$TMP_GEN_DIR/devin-skill-$(basename "$(dirname "$_src")")-$(basename "$_src")"
+  _ui="$(awk 'NR==1&&$0=="---"{fm=1;next} fm&&$0=="---"{exit} fm&&/^user-invocable:[[:space:]]*/{sub(/^user-invocable:[[:space:]]*/,""); gsub(/[[:space:]]/,""); print; exit}' "$_src")"
+  _dmi="$(awk 'NR==1&&$0=="---"{fm=1;next} fm&&$0=="---"{exit} fm&&/^disable-model-invocation:[[:space:]]*/{sub(/^disable-model-invocation:[[:space:]]*/,""); gsub(/[[:space:]]/,""); print; exit}' "$_src")"
+  gen_devin_markdown_file "$_src" "$_tmp"
+  mkdir -p "$(dirname "$_out")"
+  awk -v ui="$_ui" -v dmi="$_dmi" '
+    NR==1 && $0=="---" { fm=1; print; next }
+    fm==1 && $0=="---" {
+      u = (ui != "false")
+      m = (dmi != "true")
+      if (!u && !m) {
+        print "triggers: []"
+      } else if (!u || !m) {
+        print "triggers:"
+        if (u) print "  - user"
+        if (m) print "  - model"
+      }
+      fm=0; print; next
+    }
+    fm==1 && (/^user-invocable:[[:space:]]/ || /^disable-model-invocation:[[:space:]]/) { next }
+    { print }
+  ' "$_tmp" >"$_out"
+}
+
+devin_yaml_escape() {
+  printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'
+}
+
+# Map Claude Code tool names onto Devin tool names. Devin's allowed-tools
+# field takes its builtin names: read, edit, write, exec, grep, glob,
+# webfetch, web_search, and skill. Unmapped Claude tools are dropped.
+_devin_map_tools() {
+  local _raw="$1" _name="$2"
+  local _tok _mapped _out="" _sep=""
+  if [ -z "$_raw" ]; then
+    if [ "$_name" = "devrites-slice-wright" ]; then
+      printf '%s' "read, edit, write, exec, grep, glob, skill"
+    else
+      printf '%s' "read, grep, glob, exec"
+    fi
+    return
+  fi
+  while IFS= read -r _tok; do
+    _tok="${_tok#"${_tok%%[![:space:]]*}"}"
+    _tok="${_tok%"${_tok##*[![:space:]]}"}"
+    [ -z "$_tok" ] && continue
+    case "$_tok" in
+      Read | read) _mapped="read" ;;
+      Edit | edit) _mapped="edit" ;;
+      Write | write) _mapped="write" ;;
+      Bash | bash | exec) _mapped="exec" ;;
+      Glob | glob) _mapped="glob" ;;
+      Grep | grep) _mapped="grep" ;;
+      Skill | skill) _mapped="skill" ;;
+      WebFetch | webfetch) _mapped="webfetch" ;;
+      WebSearch | web_search | websearch) _mapped="web_search" ;;
+      *) continue ;;
+    esac
+    _out="${_out}${_sep}${_mapped}"
+    _sep=", "
+  done < <(printf '%s\n' "$_raw" | tr ',' '\n')
+  if [ -z "$_out" ]; then
+    if [ "$_name" = "devrites-slice-wright" ]; then
+      _out="read, edit, write, exec, grep, glob, skill"
+    else
+      _out="read, grep, glob, exec"
+    fi
+  fi
+  printf '%s' "$_out"
+}
+
+_devin_csv_has() {
+  case ", ${1}, " in
+  *", ${2}, "*) return 0 ;;
+  *) return 1 ;;
+  esac
+}
+
+# Generate a Devin custom subagent profile from a Claude Code markdown agent.
+# Devin loads project profiles from .devin/agents/*.md (YAML frontmatter +
+# body). The allowed-tools allowlist carries the Claude permission boundary:
+# only devrites-slice-wright gets write/edit; reviewers stay read-only.
+# Claude's permissionMode has no Devin equivalent and is dropped. A canonical
+# `skills:` block grants the agent the `skill` tool so it can invoke that
+# skill inline (Devin has no agent-level skills preload field).
+gen_devin_agent() {
+  local _src="$1" _out="$2"
+  local _name _desc _tools_raw _tools _skills _desc_tmp _desc_devin _body_tmp _body_devin _tok
+  _name="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^name:[[:space:]]*/{sub(/^name:[[:space:]]*/, ""); print; exit}' "$_src")"
+  _desc="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^description:[[:space:]]*/{sub(/^description:[[:space:]]*/, ""); print; exit}' "$_src")"
+  _tools_raw="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^tools:[[:space:]]*/{sub(/^tools:[[:space:]]*/, ""); print; exit}' "$_src")"
+  _skills="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^skills:[[:space:]]*$/{list=1; next} list && /^[[:space:]]*-[[:space:]]*/{found=1; exit} list{exit} END{if(found) print "yes"}' "$_src")"
+  [ -n "$_name" ] || _name="$(basename "$_src" .md)"
+  [ -n "$_desc" ] || _desc="DevRites custom agent."
+  _tools="$(_devin_map_tools "$_tools_raw" "$_name")"
+  if [ -n "$_skills" ] && ! _devin_csv_has "$_tools" "skill"; then
+    _tools="$_tools, skill"
+  fi
+  _desc_tmp="$TMP_GEN_DIR/devin-agent-desc-$(basename "$_src").txt"
+  _desc_devin="$TMP_GEN_DIR/devin-agent-desc-$(basename "$_src").devin.txt"
+  printf '%s' "$_desc" >"$_desc_tmp"
+  gen_devin_markdown_file "$_desc_tmp" "$_desc_devin"
+  _desc="$(cat "$_desc_devin")"
+  [ -n "$_desc" ] || _desc="DevRites custom agent."
+  mkdir -p "$(dirname "$_out")"
+  {
+    printf '%s\n' "---"
+    printf 'name: %s\n' "$_name"
+    printf 'description: "%s"\n' "$(devin_yaml_escape "$_desc")"
+    printf 'allowed-tools:\n'
+    printf '%s\n' "$_tools" | tr ',' '\n' | while IFS= read -r _tok; do
+      _tok="${_tok#"${_tok%%[![:space:]]*}"}"
+      _tok="${_tok%"${_tok##*[![:space:]]}"}"
+      [ -n "$_tok" ] && printf '  - %s\n' "$_tok"
+    done
+    printf '%s\n' "---"
+    _body_tmp="$TMP_GEN_DIR/devin-agent-body-$(basename "$_src").md"
+    _body_devin="$TMP_GEN_DIR/devin-agent-body-$(basename "$_src").devin.md"
+    awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{fm=0; body=1; next} body{print}' "$_src" >"$_body_tmp"
+    gen_devin_markdown_file "$_body_tmp" "$_body_devin"
+    cat "$_body_devin"
+  } >"$_out"
+}
+
+gen_devin_agents_bridge() {
+  _out="$1"
+  cat >"$_out" <<'EOF'
+<!-- BEGIN DEVRITES DEVIN -->
+## DevRites For Devin
+
+This project has DevRites installed for Devin CLI.
+
+## Devin usage
+
+- DevRites workflow skills live in `.devin/skills`. Run them as `/rite`, `/rite-spec`, and the other `/rite-*` slash commands.
+- Before using any DevRites workflow skill, read `.devin/skills/devrites-lib/reference/standards/core.md`. Load other `.devin/skills/devrites-lib/reference/standards/*.md` files when the skill or rule index asks for them.
+- DevRites specialist agents live in `.devin/agents` as custom subagent profiles offered to `run_subagent`. If a required `devrites-<role>` profile is not among the offered profiles, stop for HITL - never skip the role, never substitute `subagent_general`, `subagent_explore`, or another generic profile, never inline the specialist prompt, and never execute the specialist role in the root context.
+- In DevRites guidance, **invoke** means run a skill inline in the current context; **dispatch** means start a fresh agent with `run_subagent` using the exact `profile` name, wait for it with `read_subagent`, and reconcile its result.
+- Only `devrites-slice-wright` may edit source or tests; every other specialist is read-only by `allowed-tools`. Exact paths are instruction-enforced: put the project-relative paths in the task, wait for the wright, compare its file list and `git diff --name-only` with that contract, and reject any extra path.
+- Custom profiles do not inherit interactive tool grants, and background subagents auto-deny unapproved tools. Dispatch the write-capable wright in the foreground, or make sure its `edit`, `write`, and `exec` tools are approved first. Specialists cannot use `ask_user_question`; the root relays user questions and answers through the task text and returned result.
+- DevRites runtime helpers run through the installed `devrites-engine` binary.
+- Skills and agent profiles are loaded when a session starts. If they were installed while this session was open, restart the session or reopen the project before relying on them.
+- A seal GO, AFK mode, or autocomplete flag never authorizes an irreversible action. Disclose the exact commit/push/tag/PR plan and obtain fresh explicit user approval for that attempt; any changed or retried plan needs fresh approval.
+
+## Workflow contract
+
+- Keep all feature state in `.devrites/work/<slug>/` and preserve `.devrites/ACTIVE`.
+- Follow the DevRites lifecycle: frame -> spec -> clarify -> temper -> define -> plan -> vet -> build -> converge -> prove -> polish -> review -> seal -> ship -> done.
+- Claims of completion need recorded evidence in the feature workspace, not confidence alone.
+<!-- END DEVRITES DEVIN -->
+EOF
+}

package/update.sh

@@ -37,7 +37,8 @@ trap 'exit 1' HUP INT TERM
 dr_acquire_engine "$SELF_DIR" update "$DEVRITES_REPO" || { echo "error: could not acquire a version-compatible devrites-engine${DR_ACQUIRE_FAILURE:+ ($DR_ACQUIRE_FAILURE)}." >&2; exit 1; }
 ENGINE="$DR_ENGINE_PATH"
 PAYLOAD="${DEVRITES_HOST_ARTIFACT_DIR:-$SELF_DIR/pack/generated}"
-if [ ! -d "$PAYLOAD/claude/skills" ] || [ ! -d "$PAYLOAD/codex/skills" ] || [ ! -f "$PAYLOAD/codex/config.toml" ]; then
+if [ ! -d "$PAYLOAD/claude/skills" ] || [ ! -d "$PAYLOAD/codex/skills" ] || [ ! -f "$PAYLOAD/codex/config.toml" ] ||
+  [ ! -d "$PAYLOAD/devin/skills" ] || [ ! -d "$PAYLOAD/devin/agents" ] || [ ! -f "$PAYLOAD/devin/AGENTS.md" ]; then
   BUILDER="$SELF_DIR/scripts/build-host-artifacts.sh"
   [ -f "$BUILDER" ] || { echo "error: generated update payload missing at $PAYLOAD and builder missing at $BUILDER" >&2; exit 1; }
   DEVRITES_HOST_ARTIFACT_DIR="$PAYLOAD" bash "$BUILDER" >/dev/null || { echo "error: could not generate update payload at $PAYLOAD" >&2; exit 1; }