devrites 5.10.2 → 5.12.0

package/pack/generated/devin/skills/devrites-lib/reference/standards/assumption-checkpoints.md

@@ -0,0 +1,42 @@
+# Assumption-delta checkpoints
+
+> Applies when: planning or vetting a slice whose scope generalizes an existing
+> boundary — the seam where a quiet assumption loses its monopoly.
+
+Most quietly imported architectural debt comes from the seam: a later change adds a
+*second case* — platform, auth method, tenant, region, source of truth — and nobody
+re-asks whether the original abstraction still names the right thing. The change that
+adds the second case is the cheap moment to ask.
+
+## The detector
+
+Scan the phase scope, spec delta, or task list for transition signals:
+
+| Signal | Shape | The question it raises |
+|---|---|---|
+| `pluralization` | A second X where exactly one existed (platform, provider, tenant, region, source of truth) | Does the identity model still name the right noun? |
+| `optionality` | A required or `only`-assumed field becomes optional | Is that field still the right anchor, or did the anchor move? |
+| `choice` | A derived value becomes chosen; a constant becomes a parameter | Has a config decision silently become a modeling decision? |
+
+Code blocks, comments, and prose that merely *mention* a trigger word do not count.
+
+## Firing the checkpoint
+
+A firing signal surfaces **one** question before the plan is finalized — not a
+redesign, one question: *does the name/model chosen when N=1 still hold at N=2?*
+
+- `detected:false` — skip the checkpoint; do not raise it.
+- `skipped` — the scope was never examined. A skipped check asserts *nothing*: never
+  record "no assumption changed" from a skipped result; skipped ≠ negative.
+- `detected:true` — ask the one question and record the answer in `decisions.md` or
+  `assumptions.md`; an answered checkpoint that leaves no trace re-fires next round.
+
+## Promote, don't add alongside
+
+When a generalization is real, the default-correct move is to **promote** the general
+representation to primary and demote the old specific one to a detail of one variant —
+not to add the new shape alongside the still-required old one, which silently
+contradicts the generalized intent.
+
+**Failing case:** `region` added as an optional column beside `primaryRegion`; every
+write now guesses which is authoritative.

package/pack/generated/devin/skills/devrites-lib/reference/standards/audit-coverage.md

@@ -0,0 +1,103 @@
+# Coverage-led auditing
+
+> Applies when: auditing a surface larger than one feature diff — a repo, subsystem,
+> or trust boundary — where "I looked at it" must become countable coverage.
+
+A surface audit must answer *what the run covered and what it never examined* — with
+a coverage ledger, not a summary paragraph.
+
+## Coverage ledger
+
+The coordinator alone maintains the ledger; a unit is one auditable cell — surface
+(path/endpoint/command) × trust boundary × check class.
+
+States: `planned` → `assigned` → `candidate` (produced a finding candidate) →
+`covered` (evidence recorded); plus `deferred` (postponed, reason recorded),
+`blocked` (exact blocker recorded), and `out_of_scope` (declared-scope exclusion —
+never written as `covered`). `deferred` and `blocked` are honest states; a unit
+silently dropped is a lie.
+
+Instruments obey the same honesty rule: a scanner or metric that could not read
+its target reports `unmeasured`/`no_data`, never a placeholder presented as a
+measurement. A health score computed over zero parseable files is not a 100.
+When the audit covers whole-repo structure, score it per
+[`architecture-health.md`](architecture-health.md) and record before/after
+deltas as ledger evidence.
+
+## Findings carry three verdicts, not two
+
+- **`confirmed`** — complete source trace plus a bounded observed or owner-observable
+  result; names the lower-trust principal, crossed boundary, affected
+  principal/resource, and concrete effect.
+- **`needs_validation`** — a real lead blocked on one exact unresolved fact, which is
+  named. Carries **no severity**: severity without established impact is theater.
+- **`rejected`** — a disproved candidate kept with its disproof; it suppresses
+  re-raising the same unchanged claim, never coverage of its unit.
+
+Hardening notes are not findings: if one layer already prevents the attack, the
+absent second layer is a depth observation, not a vulnerability.
+
+## Finder never verifies its own find
+
+Every surviving candidate goes to a fresh verifier that did not produce it and tries
+to **disprove** it, per [`agents.md`](agents.md) § Independence — a seeded packet
+voids the verification. Promotions to `confirmed` and material changes to root
+cause, trace, reproduction, impact, or severity require fresh independent
+verification. Without that independent evidence, keep the candidate unresolved;
+a rewritten explanation is not verification.
+
+## Critics between waves
+
+After each hunting wave, a **coverage critic** — a fresh agent comparing the ledger
+with targeted source and entry-point evidence — looks for holes: unseeded surfaces,
+boundaries with no check class,
+units stuck `assigned`, `rejected` patterns suggesting a hunter fires blanks.
+Accepted discoveries become `planned` units. Reserve critic and verifier capacity
+**before** spending on hunters; a wave launched with no verification reserve hunts
+for findings nobody may claim.
+
+## Re-runs are additive, never assumed
+
+A prior ledger must be re-checked against current source — a prior commit ref is not
+evidence a path is unchanged. Prior `confirmed` carries forward only when its source
+is unchanged **and** it re-passes current verification; prior `needs_validation` /
+`blocked` / `deferred` become current work and never suppress a unit. A partial prior
+run contributes recorded evidence and gaps, never an implied "the rest is fine"; no
+prior ledger → the report says so.
+
+## Profiles scale breadth, never the bar
+
+`quick` (one hunter wave + one critic pass, coarser units), `standard` (waves to
+critic-clean, per-candidate fresh verifier), `deep` (units split per
+subsystem/lifecycle; carried records re-verified). Profiles change granularity and
+redundancy, never the evidence bar: boundary-plus-result, independent verification,
+three verdicts, and honest `deferred`/`blocked` survive every profile. A scoped run
+presents itself as partial coverage.
+
+## Budget discipline
+
+A budget counts agent invocations, not effort. Reserve critic and verifier capacity
+before spending on hunters; a budget that cannot fund reconnaissance plus required
+reserves funds nothing — narrow scope or profile instead of silently thinning
+evidence. A run exhausted mid-verification ends `incomplete` with unvalidated
+candidates still linked to `candidate` units — never relabeled, never reported
+complete.
+
+## Target execution is sandboxed
+
+When a unit requires *running* the target — a build, a test, a probe — execute
+it under containment, never in the operator's ambient environment:
+
+- No external network and no live-service probing from the audit run.
+- No credentials, tokens, or secrets visible to target-controlled processes.
+- Only commands the repository or CI itself sanctions run verbatim; invented
+  commands are findings to propose, not actions to take.
+- Output captured through the harness, not through target-written files the
+  run then trusts.
+
+An audit that executed unaudited code with ambient privileges has crossed the
+boundary it was measuring; that run's `confirmed` rows name the execution
+context so reviewers can judge contamination.
+
+**Failing case:** "no critical findings" reported while 40% of units sit `planned` —
+the honest sentence was "60% of the surface was examined."

package/pack/generated/devin/skills/devrites-lib/reference/standards/browser-proof-checklist.md

@@ -0,0 +1,26 @@
+# Browser proof checklist
+
+> Applies when: UI proof: compact sweep before claiming a rendered/browser pass.
+
+Compact sweep only. Numbers and failing cases live in
+[`quality-standards.md`](../../../devrites-frontend-craft/reference/quality-standards.md)
+§ Focus & states, § Responsive, and § Browser chrome — do not restate a shorter
+viewport set here.
+
+- Open the real UI (never screenshot-only); check console and network for errors.
+- Before reading the builder's verdict, inventory the raw captures against the
+  required routes/states/viewports and candidate identity. Open each capture: a
+  wrong route, blank render, unexpected login wall, inconsistent dimensions, or
+  stale candidate is missing evidence. Recapture; until resolved, record
+  `cannot_verify` and block visual approval. A convincing narrative cannot repair it.
+- Interactive slices capture each relevant canonical state and the canonical
+  viewport set. Omission needs a one-line `not-needed` reason; states must exist
+  in source — an unreachable state's capture proves nothing.
+- Browser-default chrome is judged by § Browser chrome; reflow, zoom and bounded
+  two-dimensional exceptions by § Responsive. Compare to `design-brief.md` → Visual Verdict.
+- Tooling unavailable ⇒ record fallback + limitation. Backend-only changes record
+  that disposition instead of capturing quietly; UI copy follows
+  `devrites-frontend-craft`, long-form prose follows `devrites-prose-craft`
+  ([`prose-style.md`](prose-style.md)).
+
+Detailed skill: `devrites-browser-proof`.

package/pack/generated/devin/skills/devrites-lib/reference/standards/ci-cd.md

@@ -0,0 +1,61 @@
+# CI/CD & automation
+
+> Applies when: creating or changing a build/deploy pipeline or CI config.
+
+Read this only when creating or changing a build/deploy pipeline. [`hooks.md`](hooks.md) owns local checks, [`development-workflow.md`](development-workflow.md) owns trunk health, and [`deprecation.md`](deprecation.md) owns migrations.
+
+## Pipeline gates
+
+- Put each check at the earliest affordable stage: editor → pre-commit → pre-push → CI.
+- Keep batches small so failures are attributable and releases remain reversible.
+- Run lint → type-check → unit → build → integration → audit → E2E as applicable. A red gate stops the line; fix the defect rather than disabling the rule, weakening the test, or skipping the gate. CI is the source of truth for green.
+
+## Failure loop and ownership
+
+Read the specific failure, fix its root cause, verify locally, then push again. Do not blind-rerun a flaky pipeline. Use `devrites-debug-recovery` when a test or build failure needs reproduction.
+
+A designated Build Cop (a human/team role, not a pack agent) owns restoring a broken trunk by fixing or reverting, whichever is faster. Restoring trunk outranks feature work.
+
+## Verification economy
+
+Paid or remote validation runs once per prepared state, not per attempt: batch repairs,
+verify locally first, and never blind-retry an infra operation that already reported
+failure (deploy, migrate, seed) — read the failure output, fix the cause, then re-run.
+A green check the diff cannot affect is not re-run; an expected run that is deliberately
+skipped is named in the report, not omitted. Capture failure output as an artifact so the
+next attempt starts from evidence, not memory.
+
+## Deploy versus release
+
+Keep incomplete or risky behavior disabled behind a flag so deploy and release remain separate and rollback does not require a redeploy. Every flag has an owner and a removal trigger; remove it through the [`deprecation.md`](deprecation.md) expand/contract path.
+
+## Deployment order and configuration
+
+- Derive an explicit order for schema, application, worker, contract, config, and flag
+  changes. Prove the system remains safe at every intermediate old/new combination;
+  "deploy together" is not an atomicity guarantee across units.
+- Validate required configuration at startup or the earliest safe boundary. Record names,
+  owners, environments, safe defaults, and rollback values without recording secrets.
+  A staging value copied by memory is not production evidence; a configuration mismatch
+  blocks exposure until the exact target value/owner is verified.
+- Documentation drift in commands, configuration, migration order, or rollback steps is a
+  delivery defect: update the canonical doc and execute the documented path before exposure.
+- Migration and destructive steps apply [`data-integrity.md`](data-integrity.md); service,
+  queue, webhook, and cache changes apply
+  [`integration-reliability.md`](integration-reliability.md). Their recovery/observability
+  gates precede exposure.
+- Feature flags separate exposure only when both states are tested, the off path preserves
+  current behavior, and disabling the flag stops the risky effect. A flag cannot undo an
+  already destructive schema or data change.
+
+## Secrets
+
+Commit `.env.example` without values; never commit real `.env` files. Inject CI secrets from the platform store and scope them to the job. Build runners do not receive production credentials.
+
+## Slow pipelines
+
+When wall time exceeds roughly ten minutes, measure before and after. Improve in order: cache dependencies, parallelize independent jobs, path-filter, shard the slow suite, re-tier genuinely slow tests, then consider larger runners.
+
+## Scope
+
+Change only the pipeline surface in scope; record wider CI redesign as follow-up work.

package/pack/generated/devin/skills/devrites-lib/reference/standards/code-navigation.md

@@ -0,0 +1,110 @@
+# Code navigation
+
+> Applies when: choosing structural search tools (code index vs grep) before exploring.
+
+Decision tree for structural questions. Load with [`tooling.md`](tooling.md);
+this file is the pack-canonical routing table agents cite in Build, Vet, and
+Review.
+
+## Route by question
+
+| Question | First tool | Fallback |
+| --- | --- | --- |
+| Explore unfamiliar area, architecture, blast radius | `codegraph_explore` or codebase-memory `search_graph` / `get_architecture` | code-review-graph `detect_changes_tool` / `get_impact_radius_tool` |
+| Callers, callees, data flow across files | codebase-memory `trace_path` | code-review-graph `query_graph_tool` |
+| PR/review context for a diff | code-review-graph `get_review_context_tool` | `detect_changes_tool` |
+| Exact symbol body before edit | `read_symbol` / `module_report` (pi-lens) | `get_code_snippet` then targeted `Read` |
+| Rename, references, diagnostics | LSP (`lsp` rename/references) when available | graph trace + grep |
+| Known file, one-line fix | `Read` at offset/limit | — |
+| Literal string / config value | `Grep` | — |
+| Does a similar implementation already exist? | embedding/similarity tool when present | `search_graph` on purpose-words and name variants, then targeted `Read` |
+
+## Before cross-file edits
+
+1. Run **one** primary route from the table (record tool + query in the artifact).
+   **Compute the affected set before writing code, not after** — the blast-radius
+   list is the edit plan: every file on it is a touch or a conscious skip.
+2. Read symbol bodies you will change (`read_symbol` counts as read), comments
+   included — a why-comment is often the only record of a decision.
+3. After edits: LSP diagnostics + project tests. Compiler errors are the oracle
+   for callers the graph listed — fix them in dependency order, direct
+   dependents first. Errors absent from the list mean the list was incomplete
+   (see blind spots below); record the gap.
+
+Skipping step 1 on a multi-file slice is a Build orient gap unless recorded
+`cannot_verify`.
+
+## Query budget
+
+Spend the minimum that settles the question:
+
+- Minimal output first — pass the smallest detail/scope option a tool offers;
+  escalate to a fuller answer only when the minimal one cannot decide.
+- One structural question ≈ five index calls. The sixth means the question needs
+  re-scoping or a file read, not another query.
+- Stop at sufficiency: an index answer that names the symbols and their source
+  ends the search; re-verifying it with grep is waste, not diligence.
+
+## What the static graph cannot see
+
+Import/call edges are only the statically visible share of the dependency
+surface. A blast-radius answer that ignores the rest is a false negative
+factory:
+
+- **Cross-language edges:** HTTP/RPC call sites (`fetch("/api/…")` → the route
+  handler file), subprocess/CLI invocations, and queue topic names couple files
+  no import statement links. Grep the literal route/command/topic when a
+  producer or consumer file changes.
+- **Dynamic binding:** `import()`/dynamic `require`, reflection, string-keyed
+  DI/registries, plugin/extension loading, ORM model registration,
+  `require.context`-style glob imports. A symbol with zero static dependents
+  may be load-bearing at runtime.
+- **Co-change coupling:** files that change together in `git log` but share no
+  import edge are coupled by convention (paired configs, parallel
+  implementations, duplicated schemas). Before a structural edit, run
+  `git log --name-only` on the target file's recent history and treat repeat
+  companions as soft dependents.
+- **Type-only edges** (`import type`, generics-only references) inform impact
+  and dead-code reads but do not execute — do not count them as runtime
+  coupling (see [`architecture-health.md`](architecture-health.md)).
+
+The compiler and the test suite are the oracle for everything in this list:
+zero static dependents + zero compiler errors + green tests is evidence;
+zero static dependents alone is a hypothesis.
+
+## Index freshness
+
+| Index path | Provider |
+| --- | --- |
+| `.codegraph/` | CodeGraph |
+| `.code-review-graph/` | code-review-graph MCP |
+| `.codebase-memory/` | codebase-memory MCP |
+| `graph.json` | Graphify (`graphify query` / `graphify path A B`) |
+Run `devrites-engine check indexes` for a quick presence check. It detects
+**in-repo artifacts only** — codebase-memory may be indexed in the server's
+central store with no `.codebase-memory/` dir; when the MCP server answers
+(`list_projects`/`index_status`), trust it over the file probe. Stale or missing
+index: build/refresh per provider docs, or fall back to LSP + grep and note the gap.
+
+## Tool availability
+
+- On Claude hosts, provider tools arrive as `mcp__<server>__<tool>` — e.g.
+  `mcp__codegraph__codegraph_explore`, `mcp__code-review-graph__query_graph_tool`,
+  `mcp__codebase-memory-mcp__search_graph`. DevRites agent profiles and
+  `.claude/settings.json` already allowlist these servers; a server that is not
+  installed simply offers no tools — fall back per the table, no error path needed.
+- Server names are install-configured (`codebase-memory-mcp` and `codebase-memory`
+  are both allowlisted). If your server uses another name, add it to
+  `settings.json` allow and the agent `tools:` lines.
+- CodeGraph and Graphify also run as CLIs (`codegraph explore`,
+  `graphify query` / `graphify path A B`) — allowlisted via `Bash(...)` rules.
+- On non-Claude hosts the `mcp__*` entries are ignored by generation; use each
+  host's own nav extensions or the CLI forms. All listed tools are read-only
+  navigation — do not call index rebuild, refactor-apply, or mutation tools.
+
+## Anti-patterns
+
+- Duplicate graph queries for reassurance.
+- Whole-file reads when `read_symbol` or `module_report` suffices.
+- Grep-only blast-radius claims when an index is present.
+- Editing without reading the enclosing symbol body.

package/pack/generated/devin/skills/devrites-lib/reference/standards/code-review.md

@@ -0,0 +1,168 @@
+# Code review
+
+> Applies when: reviewing any diff for design clarity, logic, tests, risk.
+
+Ask whether the change improves or preserves design clarity, logic, tests, and risk.
+If it does not, do not merge it.
+
+## Keep changes small
+- One concern per change (a fix, an endpoint, a refactor), not three at once. Refactoring
+  that rides along with new behavior is two changes: split them.
+- Aim for small diffs: under ~200 lines reviews well and merges fast; treat ~400 as a
+  soft ceiling and self-split beyond it. Large diffs hide defects and get rubber-stamped.
+- Watch both **file size** and diff size: a small diff that grows an already-large file
+  (~1000+ total lines) is an inspection signal: extract the helper or module *first*,
+  then add.
+- To self-split: **stack** (land the smallest standalone piece, build on top) or cut a
+  **thinner vertical slice** ([`slicing.md`](../../../rite-plan/reference/slicing.md)). Whole-file deletions and
+  mechanical refactors may run large: review intent, not every line.
+
+## What to check (tests first)
+1. **Tests:** do they exist and prove the behavior + failure modes (empty, error,
+   boundary, concurrency)? Would they fail if the code were wrong? A `skip`/`only`/
+   `TODO` placeholder or assertion-free test is a finding, not coverage. Account
+   for coverage per changed function, not per file: name the test that drives each
+   changed function, or list the function under `Missing tests:` — a file-level
+   "tests exist" over a diff whose riskiest function is unexercised is a gap.
+2. **Bar integrity:** sweep the diff for a lowered bar masquerading as a change:
+   new suppression comments (`@ts-ignore`, `eslint-disable`, `noqa`, `nolint`),
+   loosened thresholds (coverage floors, budgets, lint levels, timeout bumps with
+   no justification), stripped assertions, deleted or skipped tests, and new
+   unimplemented stubs or `throw`-only placeholders. Each names what it lowers and
+   needs a recorded reason in the diff or `decisions.md`; unexplained is a finding.
+3. **Correctness:** logic, edge cases, error paths, race conditions, wrong assumptions. For branching or boundary changes, run the [`edge-case trace`](edge-case-trace.md): relevant probe classes, fixed-set siblings, real wiring, negative intent, and deletion contracts with an evidence disposition.
+4. **Readability:** names, function size, control flow, intent obvious without the author.
+5. **Architecture:** right seam, coupling/cohesion, fits existing patterns, no premature
+   abstraction. Check how it fits the larger system as well as its local behavior.
+   Search for a **reimplemented-elsewhere** twin: a new function/module that
+   semantically duplicates an existing one (renamed, reshaped, or vendored) is an
+   architecture finding; reuse the canonical implementation or justify the fork.
+   Run `devrites-engine check dup` in the mode matching the diff (`--base <ref>`
+   for committed work, `--staged`/`--worktree` for uncommitted) for leads and
+   triage each cluster per [`duplicate-code.md`](duplicate-code.md).
+6. **Security:** trust boundaries, input validation, authz, secrets.
+7. **Risk:** migrations, destructive changes, rollback.
+8. **Read depth matches risk:** the review's `Basis` names **full reads of the largest
+   diff files** (top three by changed lines), and any config/dependency/SQL/auth/migration
+   file is read in full — never skimmed. A review that cannot name what it fully read is
+   unproven. **Failing case:** a 600-line diff gets hunk-by-hunk commentary on the first
+   screen and silence on the migration file at the bottom.
+9. **Every file in the review set gets its own pass.** Reviewing an implementation
+   file does not cover its header, interface, test, or config counterpart — being the
+   smaller member of a group is no reason to skip it. Findings attach to files inside
+   the review set, never outside it. Report the accounting: a `Coverage:` line names
+   the files reviewed in full, reviewed at hunk level, and explicitly skipped with
+   reason (generated, vendored, lockfile). Files named nowhere count as not reviewed.
+10. **Per-language probes.** For each file, apply [`review/README.md`](review/README.md):
+    `review/default.md` always, plus the checklist for the file's language. These are
+    defect probes with explicit do-not-flag lists — a do-not-flag item raised as
+    Critical/Important is a review defect, not a finding.
+11. **Large diffs get a risk pass.** When the diff exceeds the soft ceiling (~400
+    lines) or touches a migration, auth, dependency, or config file, run a second
+    focused pass over just those surfaces after the general pass — first-pass
+    attention decays with diff size and the risk-bearing file is usually last.
+
+## Give actionable feedback
+- Read surrounding source before severity: call sites, existing guards, and the nearest consumer decide impact; a diff hunk alone is not enough.
+- Label severity so the author knows what blocks: each label names the author's action:
+
+  | Label | Author action |
+  |---|---|
+  | **Critical** | Blocks merge. Fix before anything else. |
+  | **Important** | Fix before merge. |
+  | **Suggestion** | Weigh it; adopt or answer why not. |
+  | **Nit** | May ignore. |
+  | **FYI** | No action: context only. |
+- Be specific: point at the line, name the problem, propose the fix. Frame non-blocking
+  ideas as questions ("what about a map here for readability?").
+- Apply [`agents.md` § Result admission](agents.md#result-admission). Before
+  reporting, an unverified hypothesis is a Suggestion at most. Once raised as
+  Critical/Important, missing proof is a blocking gap until verified or rejected—
+  never approval or silent demotion.
+- **Skipped checks are recorded.** A check you couldn't run gets a
+  `Skipped: <check> — <why>` line.
+- **Unreviewed is not clean.** A report that never names an area does not prove that area
+  was inspected; the consolidated account names what was not covered or marks `gap`.
+  **Failing case:** a findings list silent on, say, migration safety is not a clean
+  migration review — name the inspection or the gap.
+- **Separate the verdict from its context.** A verdict flips only on evidence
+  scoped to the change under review — its diffs, its acceptance criteria, its
+  blast radius. Whole-repo signals gathered along the way (a global health
+  score, an unrelated security note, a pre-existing smell) are recorded under
+  an informational/deferred heading with that label, never folded silently into
+  the verdict — and never used to soften or harden it either direction.
+  **Failing case:** a clean change is failed because a repo-wide scan surfaced
+  a decade-old finding the diff did not introduce — or a broken change is
+  approved because "overall health" still looked fine.
+- Let automation (linters, formatters, CI) catch the trivial stuff so review focuses on
+  design and correctness.
+
+## Report structural problems first
+If a change has one structural problem and ten nits, lead with the structural problem.
+Many nits disappear after the structure changes. Do not bury a wrong boundary behind
+formatting comments.
+
+## Resolve disagreements by evidence
+Resolve a review disagreement by the strongest ground available, in order: **facts** (a
+correctness bug, a failing case, a measured number) > **the project's stated style/convention** >
+**a general design principle** > **personal preference or consistency-for-its-own-sake**. If your
+objection bottoms out at the last tier, it's a Suggestion at most: say so, and don't block on it.
+An author who is factually right wins over a reviewer's taste.
+
+## Reviewer-vs-reviewer adjudication
+
+Root re-verifies each claimed consequence at the cited site, keeps the surviving evidence, sets final severity itself (reviewer severity advisory), records what decided ([agents.md § Independence](agents.md#independence)); unresolved conflicts stay open blockers.
+
+Adjudication is asymmetric: dropping a true finding destroys it silently, while
+keeping a false one costs only a re-check. A finding is removed only on two
+grounds, each citing evidence:
+
+1. **Refuted at the site** — the quoted code or a direct read shows the claim is
+   factually wrong (the guard exists, the value cannot be nil, the test asserts
+   it). "Looks unlikely" is not refutation.
+2. **Out of scope** — the file is not in the review set or the finding describes
+   pre-existing code the diff did not touch. Route it as a follow-up, never
+   delete the record.
+
+"Cannot verify", "suspicious", "would not have raised it", and "inconvenient to
+fix now" are not grounds for removal — the finding stays open.
+
+**Protected subjects** veto dismissal regardless of convenience: a claim of a
+correctness bug, a security exposure, a data-loss/migration risk, a silently
+dropped error, or a violated project principle survives unless ground 1 produces
+a direct counter-read at the cited site. Never drop a protected-subject finding
+because the fix is large or the release is close — escalate the decision instead.
+
+## Heuristic checks: FLAG vs NOTE
+
+A heuristic check that gates emits **FLAG** only when it can state the observed
+consequence and where to re-verify it; when context cannot disambiguate, it emits a
+**NOTE** that never gates. A check whose flag rate stays steady while every fix
+reads as progress is checking the wrong layer — retune it or retire it.
+**Failing case:** an ambiguous-identifier rule flags every pass, reviewers learn to
+skim the list, and a real defect hides inside the noise it created.
+
+## Scope discipline
+Review the change, not the whole project. Out-of-scope problems become follow-ups, not
+drive-by edits that balloon the diff.
+
+## Receiving review feedback
+Treat external review as claims to verify, not orders. Clarify unclear feedback first; check claims against live code; push back with evidence when wrong; implement blocking → simple → complex items one at a time with tests. State evidence and next action — "Fixed: <what> in <where>" beats gratitude theater.
+
+## Principles and charter are pass/fail gates
+Two project layers are evaluated at `/rite-vet` and re-checked against the diff
+at `/rite-review` / `/rite-seal`:
+
+1. **Project principles** (`.devrites/principles.md`): the authored invariants the project will
+   not break ([`principles.md`](principles.md)). A change that violates one with **no recorded,
+   human-approved exception** is a **Critical** finding and a **NO-GO** at seal, the same standing
+   as an unproven acceptance criterion. Check the diff against each principle's scope; an absent
+   or empty file means none are declared (gate passes).
+2. **The anti-slop charter** ([`anti-ai-slop.md`](../../../rite-polish/reference/anti-ai-slop.md)
+   UI + code lists; [`prose-style.md`](prose-style.md) for prose). [`coding-style.md`](coding-style.md)
+   points at the code list — it is not a second catalog. **Failing case:** a backend-only
+   diff is charged UI anti-slop (Inter / lavender / gradient); those fire only when a
+   rendered UI surface is in the diff.
+
+A principle violation is Critical. A charter violation is classified by its real
+impact. Record each finding with `file:line`.

package/pack/generated/devin/skills/devrites-lib/reference/standards/coding-style.md

@@ -0,0 +1,53 @@
+# Coding style
+
+> Applies when: writing or editing code; naming, reuse, guard clauses, readability.
+
+Write code the next engineer can read without you in the room. Match the project's
+existing idiom first; these rules fill the gaps.
+
+## Names reveal intent
+- A name should answer *what is this and why*. `daysSinceLastModification`, not `d`.
+- Avoid generic verbs that hide intent: `process()`, `handle()`, `doWork()`, `manage()`.
+- Be consistent: the same concept gets the same word across the codebase. Don't alias
+  `user` / `account` / `member` for one thing.
+
+## Functions do one thing
+- One responsibility per function; if you need "and" to describe it, split it.
+- Make edge cases explicit rather than implicit in clever control flow.
+
+## Guard clauses over nested pyramids
+
+Handle unwanted cases first and return early; keep the success path flat.
+
+## Comments explain *why*, not *what*
+- Self-explanatory code beats a comment restating it; delete commented-out code. The
+  full comment do-not list (what-comments, tutorial noise, ownerless TODOs, edit-narration,
+  hedging) is owned by [`anti-ai-slop.md`](../../../rite-polish/reference/anti-ai-slop.md)
+  § Code anti-slop — one canonical list, consumed by build, polish, and review.
+
+## Simplicity
+- Prefer the simplest thing that works. Don't add abstraction before you have two real
+  callers; premature generalization is a cost, not a saving.
+- Delete dead code you created; don't leave TODOs or stray debug logs in shipped code.
+
+## Reuse before you write
+Before adding a new util, helper, hook, type, component, or formatter, **search** for an
+existing one. Search by *problem shape*, not just name — the same problem solved under
+different names is still an existing implementation, and the hardest duplicates to spot
+are the renamed and reshaped ones. **Reuse → extend → build new**, in that order. Don't
+re-implement what the project (or stdlib) already provides. If forcing reuse would
+distort the existing thing's shape, build a sibling and consolidate later: duplication
+is cheaper than the wrong abstraction (AHA). When a plan or slice adds a new
+implementation, name the nearest existing analog it considered — or record `none found`.
+
+## Edit reliably, change only what's asked
+- **No elision.** Never write `// ... rest unchanged` / `# ... existing code` in place of an
+  edit: emit the whole coherent function. Don't anchor an edit on line numbers; match on the
+  surrounding code. If an edit fails to apply, **re-read the file before retrying**. It may
+  have changed under you.
+- **Do what's asked, no more, and no less.** Don't improve, comment, or refactor code unrelated
+  to the task while you're in the file (feature scope). And never leave a comment describing code
+  you didn't write: implement it.
+- **Never hand-edit a manifest or lockfile.** Add / update / remove dependencies through the
+  package manager (`npm install`, `pip install`, `go get`, `cargo add`) so the lockfile stays
+  consistent: don't paste a version into `package.json` / `requirements.txt` by hand.