devrites 5.10.2 → 5.12.0

package/pack/generated/devin/skills/rite-plan/reference/slicing.md

@@ -0,0 +1,168 @@
+# Slicing
+
+DevRites builds in **thin vertical slices**: each slice cuts through every layer it
+needs (data → logic → API → UI) and leaves the system in a working, testable state.
+
+## Vertical, not horizontal
+Horizontal layering delays integration feedback. Vertical slicing delivers a usable path:
+```
+SLICE-001: Create a task   (DB + API + minimal UI)   -> user can create + test passes
+SLICE-002: List tasks      (query + API + UI)         -> user can see them
+SLICE-003: Edit a task     (update + API + UI)        -> user can modify
+SLICE-004: Delete a task   (delete + API + UI + confirm) -> full CRUD
+```
+
+## Sizing a slice
+A slice is the right size when it:
+- delivers one observable capability end-to-end;
+- can finish its writer, independent review, and slice proof within `/rite-build`;
+- has acceptance criteria you can verify with evidence;
+- can be rolled back on its own;
+- is worth its own review gate: a reviewer could meaningfully reject *this* slice while
+  approving its neighbor. If two slices can only pass or fail together, they're one slice.
+
+Size by independent invariants, failure modes, and proof seams, not file count or
+the word "and". Split independently acceptable/provable responsibilities; several
+files may serve one inseparable capability. Full feature `/rite-prove` follows all
+slices; slice proof never replaces final integration or acceptance proof.
+
+For `Complexity` and irreducible boundaries, use the canonical
+[`tasks.md` slice grammar](../../devrites-lib/reference/workspace-artifact-schema.md#canonical-slice-grammar).
+Keep the smallest cut that stands alone end-to-end; do not add slices or gates for
+fragments that can only pass together. No slice size guarantees first-pass correctness.
+
+## How many slices?: derive, don't dictate
+The slice **count is an output, not an input.** It falls out of the work: one slice per
+independently-shippable vertical increment that satisfies one (or a tight group of)
+acceptance criteria and passes the sizing test above. A 2-criterion feature is 1-2 slices;
+a 12-criterion feature is however many thin end-to-end cuts those 12 need.
+
+- **Never slice to a target number.** Don't pad a small feature into "5 slices" or
+  compress a large one into "3" because a figure was named.
+- **A user-supplied count is a hint at most.** If the user says "do it in 4", slice the
+  work logically first; if your honest decomposition differs, present the logical count
+  and *why*, then let them redirect: don't silently force their number.
+- **Re-size by the rule, not the tally** (`/rite-plan reslice`): split a slice because it
+  failed the sizing test, not to hit a count.
+
+`.devrites/AFK` `max_slices` limits unattended execution, never plan decomposition.
+
+## Feature ceiling: split an epic, never override the budget
+
+The derived count is also a size signal. A decomposition that cannot fit the
+`tasks.md` / `plan.md` / `traceability.md` budgets in
+[`workspace-artifact-schema.md`](../../devrites-lib/reference/workspace-artifact-schema.md)
+(about ten canonical slices) is an epic: every Vet/Doubt/Build review re-reads the
+whole surface, each round finds new material, and the loop never converges.
+`Budget override` never covers slice or acceptance-criteria count.
+
+- Keep the thinnest independently shippable subset here; the rest becomes spec
+  `Non-goals` (via the Spec Drift Guard), each continuation a named future `/rite-spec`
+  workspace. Record the sequence once in `decisions.md`.
+- Acceptance-preserving: every REQ/AC keeps its ID, owned by exactly one workspace.
+- Earliest owner wins: Temper's one-sentence test → Define/Plan decomposition → Vet §0
+  scope finding → `/rite-plan course-correct` (`MVP cut`). Mid-build, unbuilt slices
+  beyond the ceiling move; built slices stay.
+- The ceiling bounds one **workspace**, never the product: the sequence delivers every
+  slice, in order, each with its own Vet/Build/Review loop. A human may still accept a
+  single larger workspace by recording the decision in `decisions.md` and a structural
+  `Budget override:` in the affected artifacts; the extra review rounds on the whole
+  surface are then the accepted, named cost. The deterministic gate
+  (`check readiness`/`check seal`) blocks only a material overshoot without such an
+  override, so the choice stays explicit rather than accidental.
+
+### Continuation workspaces
+
+Granularity is a real cost choice, not a formality: a workspace costs ~8–12 fixed
+dispatches (drafter, plan reviewer, proof runner, spec/code reviewers, seal roster;
+Temper is skippable when the parent's `strategy.md` already covers the scope) plus
+~3–5 per slice. The split does not remove per-slice cost; it bounds each round's
+context, stops the non-convergent whole-surface loop, isolates a plan defect's blast
+radius to its own workspace, and lets independent continuations run in parallel.
+
+Make each continuation cheap and drift-free:
+
+- `brief.md` names the parent slug and the sequence position; `decisions.md` holds the
+  sequence once (in the parent).
+- The child's `state.md` seeds the durable cursor at creation — `sequence_parent` =
+  parent slug, `sequence_position` = parent position + 1,
+  `sequence_workspaces_remaining` = parent remaining − 1, and `sequence_role:
+  release` only when the recorded entry is the sequence's release milestone.
+  Values derive from the parent's `state.md` and its `decisions.md` record,
+  exactly once; resume re-derives the same values rather than charging again.
+  A workspace that is not a recorded continuation leaves all four rows absent.
+  This is what `state merge-manifest` walks and what the release-union gate reads,
+  so a manually opened continuation needs the same seeding as an armed run.
+- Read the parent's `architecture.md`, `plan.md`, `decisions.md` (or its archived copy)
+  as **design input** — never re-derive settled architecture, dependency choices, or
+  interfaces. Proof is always fresh for the new candidate; parent evidence is cited as
+  input, never as proof for this workspace.
+- Shared interfaces, data shapes, and contracts are pinned **once**, in the workspace
+  that introduces them, and referenced afterwards. A continuation that must change a
+  pinned contract does so through its own `plan.md` shared-contract proof and an ADR
+  that names the superseded owner — never by silently re-deciding it.
+- A request that names a recorded continuation is a new workspace, not
+  `/rite-plan revise` on the parent.
+- Phases chain automatically only **inside** one workspace (`/rite-autocomplete`
+  drives spec → clarify → temper → define → vet → build × slices → prove → polish →
+  review → seal; plain HITL chains plan↔vet inline and stops at each other boundary).
+  Next continuation is a new invocation by default. Same-run chaining is
+  `continue_sequence: true` (Deferred-ship).
+
+### Release milestone (full-picture gate)
+
+Milestone gates are feature-scoped: `prove` proves *that* workspace's acceptance,
+`review`/`seal` judge *that* candidate. A product release therefore needs one more
+workspace — the **release milestone** — planned last, whose subject is the assembled
+product:
+
+- Its ACs are product-level: cross-milestone integration, end-to-end journeys,
+  performance/release budgets, docs/rollout. Milestone ACs stay owned by their
+  milestones and are **referenced** here, never re-owned.
+- Its candidate manifest lists the union of shipped surfaces, so one `prove` → `review`
+  → `seal` binds the whole product, and one `ship` commits/pushes/tags the release.
+  Its `state.md` cursor carries `sequence_role: release` (seeded when the recorded
+  continuation is the sequence's release entry); `check candidate`/`check seal`
+  then require the manifest to cover the whole recorded chain. Build that union
+  deterministically: `devrites-engine state merge-manifest <release-slug>` walks
+  the recorded `sequence_parent` chain (live `work/` first, then `archive/`) and
+  folds every predecessor's manifest into the release `## Candidate manifest`;
+  on a path collision the later sequence position's row wins. An explicit
+  ordered `<pred>...` argument exists for chains recorded before the sequence
+  cursor fields.
+- Earlier milestones keep their own slice-level proof and their own prove/review/seal;
+  that is what stops a late defect from invalidating 170 slices of work. Skipping a
+  milestone's proof is allowed only by recording the decision — the release milestone
+  then carries the full acceptance burden, and that cost is the named trade-off.
+- The capability ledger (`.devrites/specs/<capability>/spec.md`) accumulates the
+  product picture across milestones; Polish folds each milestone's deltas.
+- **Deferred-ship sequence** (`.devrites/AFK` `continue_sequence: true`, `max_workspaces: N`):
+  milestones are sealed but not shipped, and the armed run opens the next recorded
+  continuation automatically; local `WIP(<slug>):` checkpoints still land with
+  human summaries (never a slice id),
+  so the tree stays clean. One release ship at the end collapses the sequence's
+  checkpoints into the single release commit, pushes/tags it, and may archive the
+  sealed predecessors. Because no milestone boundary was shipped, later work can touch
+  an earlier milestone's surfaces without an affected-re-proof trigger — so the release
+  milestone re-proves the union acceptance map, and that full re-proof is this mode's
+  named cost. Trade-off against per-milestone ship: no shared-history rollback point
+  per increment, one Git approval at the end.
+- What is full-surface here is the **review**: reviewers see the whole product diff.
+  Re-proof stays targeted — this milestone's product ACs, everything a later milestone
+  touched, and any uncertain closure. Milestone evidence is cited only under
+  [evidence validity](../../devrites-lib/reference/candidate-integrity.md#evidence-validity)
+  with explicit unchanged-input/dependency justification and a link to the original
+  account; a blind re-proof of every milestone AC is a recorded decision, not a default.
+
+## First slice
+Make slice 1 the **thinnest useful end-to-end path**. It flushes out integration and
+convention surprises early, while changes are cheap.
+
+**Risk-first exception.** When the biggest risk is a technical *unknown*: "will this library
+even do X?", "can we hit the latency target?": let slice 1 (or a throwaway spike ahead of it)
+prove that unknown, even if it isn't the thinnest user-facing path. Fail the risky bet first,
+while pivoting is still cheap.
+
+## Slice independence
+Order by dependency, but minimize coupling. A slice that needs three other slices first
+is a smell: look for a thinner cut that stands alone.

package/pack/generated/devin/skills/rite-plan/reference/task-breakdown.md

@@ -0,0 +1,44 @@
+# Work-item breakdown
+
+How to turn a spec into ordered, vertical slices in `tasks.md`.
+
+## Each slice is one task
+
+Use the complete canonical grammar in
+[`workspace-artifact-schema.md`](../../devrites-lib/reference/workspace-artifact-schema.md#canonical-slice-grammar).
+This reference owns decomposition; the shared schema owns field names and meanings.
+
+## Process
+1. List the capabilities the spec promises.
+2. Map each to a vertical slice (thinnest end-to-end cut).
+3. Order by dependency; risk-first within a tier (do the scary slice early while it's
+   cheap to change).
+4. Mark which slices touch UI (→ frontend craft + browser proof), map each to the design
+   brief states, and give each a binary visual acceptance target. Mark which slices cross
+   a module/service boundary (→ `devrites-api-interface`, `devrites-doubt`). For a changed
+   provider/consumer boundary, map the plan's `Shared contract proof` artifact before its
+   provider- and consumer-side asserting tests; both tests consume that same artifact and
+   their slice dependencies preserve the order. Do not duplicate the contract in each slice.
+   For each applicable topology/data/integration row, assign its owner, failure/recovery
+   case, and proof to a slice; preserve deployment/resource ordering from the plan.
+5. Write or update `traceability.md` so every `AC-###` maps to ≥1 `SLICE-###`, a
+   planned proof, evidence status, and likely touched files.
+6. Sanity check: every acceptance criterion in `spec.md` maps to ≥1 slice; no slice has
+   an unowned criterion.
+7. Resolve every foreseeable human-owned checkpoint now. Keep a build-time checkpoint only
+   when it needs evidence unavailable before code or mandatory action-time approval, and say why.
+8. Make every `Tests/proof` entry executable: exact command, working directory, prerequisites,
+   expected signal, and mutable inputs whose provenance evidence must bind. Source the command
+   from `devrites-engine detect commands` output where a slot resolves; an `unresolved` slot
+   means the plan names the concrete command explicitly, never an invented one.
+
+## Keep it honest
+- **Interfaces prevent cross-slice drift.** A slice-wright sees only its own contract; the
+  `Interfaces` line is how it learns the names and types neighboring slices use. A function
+  called `clearLayers()` in slice 3 and `clearFullLayers()` in slice 7 is a planning bug:
+  name shared symbols once, here.
+- Don't pre-write code in the task: describe the outcome, not the implementation.
+- Don't bundle "while we're here" work into a slice. That's scope creep; log it as a
+  follow-up instead.
+- Don't slice to a target number: the count comes from the capabilities + the sizing
+  rule (`slicing.md`), not a figure anyone named.

package/pack/generated/devin/skills/rite-polish/SKILL.md

@@ -0,0 +1,116 @@
+---
+name: rite-polish
+description: Polish the active feature's code and any touched UI before review. Use for finish or normalization requests; not for repository-wide refactors.
+argument-hint: "[target | bolder | quieter | distill | harden | normalize-only]"
+---
+
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/candidate-integrity.md","rite-polish/reference/code.md","rite-polish/reference/anti-patterns.md","rite-polish/reference/anti-ai-slop.md","rite-polish/reference/harden-checklist.md","rite-polish/reference/ledger.md","rite-build/reference/checkpoint.md"],"triggers":{"adr":["rite-polish/reference/adr-promotion.md"],"agents":["devrites-lib/reference/standards/agents.md"],"backend":["rite-polish/reference/backend-polish.md"],"coding":["devrites-lib/reference/standards/coding-style.md","devrites-lib/reference/standards/duplicate-code.md"],"errors":["devrites-lib/reference/standards/error-handling.md"],"ui":["rite-polish/reference/ui.md","rite-polish/reference/design-memory.md","rite-polish/reference/design-system-discovery.md","rite-polish/reference/browser-polish-evidence.md","devrites-lib/reference/standards/browser-proof-checklist.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","evidence.md","touched-files.md","design-brief.md","browser-evidence.md","polish-report.md"],"workspaceByRole":{"slice-wright":["spec.md","architecture.md","plan.md","tasks.md","test-plan.md","state.md","decisions.md","design-brief.md"]}} -->
+> Read-set manifest: `devrites-engine context <slug> --phase polish` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+
+
+# /rite-polish: finish before review
+
+Polish code for every feature. When the feature touches UI, normalize and polish the
+UI as well. Complete this self-review before `/rite-review`. The code and UI phases
+live in [`reference/code.md`](reference/code.md)
+([`anti-ai-slop.md`](reference/anti-ai-slop.md),
+[`backend-polish.md`](reference/backend-polish.md))
+and [`reference/ui.md`](reference/ui.md)
+([`browser-polish-evidence.md`](reference/browser-polish-evidence.md),
+[`design-system-discovery.md`](reference/design-system-discovery.md),
+[`harden-checklist.md`](reference/harden-checklist.md));
+read only the phase in scope.
+
+## Operating rules
+
+- **Functionality complete first.** Polish runs after `/rite-prove` (full
+  feature proven).
+- Follow the shared
+  [`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md).
+  Polish owns every candidate-affecting correction and durable rollup before Review.
+- Feature scope only.
+- For UI, **normalize before polishing**. Do not add decoration on top of drift.
+- **Bounded polish passes.** Verification runs in bounded passes, not a loop: after the
+  Phase 4 assessment, at most one more correction round for **new** findings, then stop —
+  residual subjective preference is recorded in `polish-report.md`, not re-polished.
+  **Failing case:** the same surface reopened a third time with no new failing evidence.
+- **Root selects; wright edits.** The controlling chat assesses and reconciles, but every
+  accepted source/test correction is dispatched to the sole writer,
+  `devrites-slice-wright`, through
+  [`agents.md`](../devrites-lib/reference/standards/agents.md). Never edit source inline or
+  run two correction writers concurrently.
+
+## Polish axes (C3 — completeness vs craft)
+
+Score **separately**; conflating them hides gaps:
+
+| Axis | Question | Failing case |
+| --- | --- | --- |
+| **ux_coverage** | Did we compare every stated alternative/state? | Omitted empty/error state treated as agreement |
+| **completeness** | Are required states, copy, and flows present? | Hero-only layout with no loading/error |
+| **craft / anti-slop** | Does the UI avoid generic template patterns? | Inter + purple gradient hero with no product-specific hierarchy |
+| **distinction** | Is there one intentional signature detail? | Polished but indistinguishable from a template |
+
+Incomplete comparison is **not** agreement. Record axis deltas in `polish-report.md`.
+
+## Orchestration
+
+0. **Read** `.devin/skills/devrites-lib/reference/standards/core.md` first (the always-on operating rules). The
+   per-phase rule files ([`coding-style.md`](../devrites-lib/reference/standards/coding-style.md), [`error-handling.md`](../devrites-lib/reference/standards/error-handling.md), …) load on demand
+   from `reference/code.md` / `reference/ui.md` when their phase runs; for UI scope also read
+   `.devin/skills/devrites-lib/reference/standards/browser-proof-checklist.md`.
+   Then read the explicit or active workspace's `state.md` directly.
+1. **Read** `state.md`, `touched-files.md`, the current candidate digest, and the
+   `git diff` for the active workspace (or `$ARGUMENTS` if a target was given).
+2. **Detect UI scope:** UI is touched if the diff or `touched-files.md`
+   contains any of: `.tsx`, `.jsx`, `.vue`, `.svelte`, `.html`, `.css`,
+   `.scss`, `.sass`, `.less`, `.styl`, component dirs (`components/`,
+   `pages/`, `routes/`, `app/`, `views/`, `screens/`), Storybook stories,
+   or design-token files. When in doubt, look for visual changes that need
+   verification.
+3. **Always** read [`reference/code.md`](reference/code.md) and assess **Phase 1
+   (code polish)**; if backend was touched, assess **Phase 2 (backend polish)** from
+   the same file. Reconcile the findings, then send accepted corrections as one bounded
+   wright contract: build its read-set with
+   `devrites-engine context <slug> --phase polish --role slice-wright`, run the
+   single-agent wave through `devrites-engine dispatch <slug> open|start|seal|return`
+   (auto-records dispatch/return metrics), and gate returned paths
+   with `devrites-engine check diff-scope <slug> --allow <contract-paths>` before
+   proof.
+4. **If UI scope detected** read [`reference/ui.md`](reference/ui.md), and read
+   `design-brief.md` if present so the polish follows the direction and states established
+   by `devrites-ux-shape` and refined by `devrites-frontend-craft`. **Read the
+   `## Visual Verdict` table in `browser-evidence.md` if present:
+   its `FAIL` and `PARTIAL` rows are the normalize/quality-bar worklist**: identify the root
+   cause of each (a missing state, an off-token CTA, or an anti-slop hit) rather than
+   hiding it with decoration. Assess **Phase 3 (normalize)** → **Phase 4 (UI polish)**,
+   then send accepted UI
+   corrections to the wright (which invokes the relevant craft skill). Honor argument modes:
+   - `bolder | quieter | distill | harden`: passed to Phase 4 as the
+     emphasis dial.
+   - `normalize-only`: assess Phase 3 and stop (no Phase 4).
+5. **Finish durable rollups before Review.** Apply the capability
+   [`ledger`](reference/ledger.md) when requirements changed, the optional UI
+   [`design memory`](reference/design-memory.md), and durable
+   [`ADR promotion`](reference/adr-promotion.md). Add every changed project path
+   to the candidate manifest; none of these writes waits for Ship.
+6. **Re-prove and close.** After all accepted code/UI corrections and rollups,
+   run `devrites-engine check candidate <slug>` and `devrites-engine check
+   windows <slug>` — an unwaived deferral marker surfaces here, not at Seal.
+   Any digest change requires
+   affected real re-proof using the approved commands, fresh proof-runner
+   validation, refreshed evidence/browser bindings, and an updated candidate
+   manifest. Record a **`Re-verification:`** line in `polish-report.md`. Close
+   the candidate for Review only after these checks are green. Then checkpoint
+   remaining candidate diffs per
+   [`checkpoint.md`](../rite-build/reference/checkpoint.md).
+7. **Aggregate output:** each phase appends to the single `polish-report.md`.
+
+## Refinement modes
+
+Pass the requested UI direction to Phase 4. Modes do not bypass normalization or the
+quality bar; they apply after the system is aligned. See `reference/ui.md`.
+
+> **Mid-flight discipline.** When tempted to polish UI without normalize, cite
+> clean lint as proof of quality, skip Phase 2 on a backend diff, or delete a
+> Chesterton's Fence: see [anti-patterns](reference/anti-patterns.md).

package/pack/generated/devin/skills/rite-polish/reference/adr-promotion.md

@@ -0,0 +1,11 @@
+# ADR promotion
+
+During Polish, promote a `decisions.md` architecture/interface choice only when it is
+hard to reverse, surprising without context, and a real trade-off. Otherwise leave it in
+the archived workspace. If the project has no `docs/adr/`, ask before creating that
+convention.
+
+Write the next append-only `docs/adr/ADR-NNN.md` with Context, Decision, Status
+`accepted`, and Consequences. Never rewrite an accepted ADR; supersede it with a linked
+new ADR. Add it to the candidate manifest, run affected real re-proof, and refresh evidence
+and browser bindings before Review. Ship performs no ADR promotion.

package/pack/generated/devin/skills/rite-polish/reference/anti-ai-slop.md

@@ -0,0 +1,187 @@
+# Anti-AI-slop
+
+Tells of generic LLM-generated work — in **UI** and in **code**. Applies at two stages:
+
+- **At build time** (preventive) — `/rite-build` checks against these as it writes; the
+  cheap moment to avoid them.
+- **At polish time** (catch) — `/rite-polish` Phase 1 (Code) + Phase 2 (Backend) + Phase 4
+  (UI) scrub anything that slipped through.
+
+Avoid these unless the project's existing system explicitly uses them. When in doubt,
+match the neighbors.
+
+## UI anti-slop (banned defaults)
+- Default **purple/blue gradients** as the brand look. Special case: any
+  hero hex in the `#6366f1 → #a855f7 → #ec4899` family applied as a default.
+- **Gradient text** (`background-clip: text`) used decoratively on headings.
+- **Glassmorphism** (`backdrop-filter: blur(...)` on translucent panels) as
+  a default surface.
+- **Side-stripe colored borders** on cards/sections — the
+  "tiny-bar-of-meaningful-accent-color-on-the-left" pattern. Distinctive
+  templating tell.
+- **Pure `#000` / `#fff`** as raw text or background — too clinical; use
+  near-black/near-white tokens (`oklch(0.18 0 0)` / `oklch(0.98 0 0)` or
+  the project's surface tokens).
+- **All-CAPS body text** for paragraphs/labels. Reserve uppercase for short
+  micro-copy (badges, eyebrows); never for sentences.
+- **Em-dashes in UI copy — zero.** Soft limits ("use sparingly") get ignored; the rule
+  is binary and greppable: no `—` in any visible string. Use a comma, period, or colon.
+- **Cards inside cards** — nested bordered/elevated containers.
+- **Identical card grids** for everything, regardless of content.
+- A **generic rounded-square icon tile** above every heading/section.
+- **Gray text on colored backgrounds** (fails contrast, looks templated).
+- The **hero-metric cliché** — three big numbers in a row with no real meaning.
+- **Decorative bounce / elastic easing** on everything; motion without purpose.
+- **Reflex fonts** picked because they're the default in a tutorial:
+  - Inter for every product when the project has its own choice.
+  - **DM Sans**, **Plus Jakarta Sans**, **Fraunces**, **Newsreader** when
+    they're not the project's actual type system.
+  Match the project; don't reach for the "tasteful default" of 2024.
+- **Modal-first thinking** — reaching for a modal as the answer to every interaction.
+- **Ghost-card** — a `1px` border *and* a soft (blur ≥16px) shadow on the same element.
+  Borders separate; shadows lift — pick one
+  ([`quality-standards.md`](../../devrites-frontend-craft/reference/quality-standards.md) — Materiality).
+- **Balloon radius** — `border-radius` above ~16px on cards, inputs, panels. Cards top
+  out around 12–16px; full pills are for tags and buttons only.
+- **Uppercase tracked eyebrow above every section** — one named kicker is voice; one per
+  section is template grammar (countable cap below).
+- **Numbered-section scaffolding** (`01 / 02 / 03`) when the sections aren't a sequence.
+- **Fake UI-in-a-div** — a "product screenshot" assembled from nested divs, or hand-drawn/
+  sketchy SVG scenery. Ship a real capture/asset or nothing (quality-standards — Materiality).
+- **Hero prop badges** — version labels (`V0.6`, `BETA`) and decorative pulsing status
+  dots as set dressing.
+- **Unstyled UA chrome** — shipping the browser's default blue selection, caret,
+  scrollbar, or focus outline as the look (quality-standards § Browser chrome).
+- **Invented metrics** — precise-looking numbers with no source (`+247% faster`,
+  `99.99% uptime`). **Off-token color** — a hex used inline that the token set doesn't
+  define. Both are realism failures, not styling choices.
+
+### Required remediations (fix the hit, don't just flag it)
+A slop finding names its remediation from this table; a ban without a stated fix is
+an incomplete finding.
+
+| Signature | Required remediation |
+| --- | --- |
+| Default purple/blue gradient; gradient text; glassmorphism default | Re-derive from the scene sentence and colour commitment, then re-run both category-reflex tests |
+| Invented metric | Replace with the state lattice's missing-data placeholder (quality-standards § Focus & states) plus a "metric to confirm" question, or delete the proof slot |
+| Off-token color | Lift into the token set as a named color; replace every inline use |
+| Wrapping CTA / nav overflow | Shorter label, `white-space: nowrap`, or a collapsed nav — never a shrunken tap target |
+| Horizontal scroll in 320–1920 | `minmax(0, 1fr)` on content tracks + `overflow-x: clip` on `html`/`body` (quality-standards § Responsive) |
+| Fake UI-in-a-div screenshot | Ship a real capture/asset or remove the block |
+| Sticky sub-nav hidden by a banner | Offset by the banner's token height; split z-index roles instead of one raised value |
+| Unstyled UA selection / focus ring / caret / scrollbar | Theme from tokens per quality-standards § Browser chrome, or decline in `design-brief.md` |
+
+### Copy & data realism
+Placeholder content is a tell even when the layout is clean: fake-perfect numbers
+(`99.99%`, `10,000+` — real data is ragged), placeholder people/brands ("John Doe",
+"Acme"), filler verbs (Elevate / Seamless / Unleash). Re-read every visible string before
+shipping; AI-cute copy is worse than boring copy.
+
+### Category-reflex check — run at two altitudes
+
+Most generic-AI design fails one of these two reflex tests. Run both — the
+second one catches what the first one misses.
+
+- **First-order:** if someone could guess the theme + palette *from the
+  category alone* — "observability → dark blue", "healthcare → white +
+  teal", "fintech → navy + gold", "AI tool → black with a violet accent",
+  "crypto → neon on black" — the styling is on the first training-data
+  reflex. Rework the scene sentence
+  ([`design-references.md`](../../devrites-frontend-craft/reference/design-references.md)) and the
+  colour-commitment strategy
+  ([`quality-standards.md`](../../devrites-frontend-craft/reference/quality-standards.md)) until the
+  answer isn't obvious from the domain.
+- **Second-order:** if a stranger looked at the surface with *no copy
+  visible* and confidently said "this is a CRM / fitness tracker / fintech
+  / AI workflow tool", the styling is still on a category template — just
+  one tier deeper. The first reflex was avoided, the second wasn't.
+  Re-shape until the surface doesn't telegraph its category from looks
+  alone.
+
+Both pass = the surface looks like *this product*, not "an app in this category".
+
+### Mechanical pre-flight (countable — run, don't vibe)
+Each is pass/fail by counting or grep, not judgment:
+- **Em-dashes** in visible UI strings: exactly **0**.
+- **Eyebrows** (uppercase-tracked kickers): ≤ `ceil(sections / 3)`.
+- **Layout families** (hero, image+text split, card grid, bento, table…): no family more
+  than twice per page; never 3 consecutive image+text zigzags.
+- **Icons**: 0 emoji-as-icon; exactly one icon set imported.
+- **State presence in code**: default+hover+focus-visible+active+disabled for every interactive element; loading/error/empty where data delays or fails — an unreachable state's screenshot proves nothing.
+- **Form inputs**: no border-width shifts between states; focus ring from outline/ring (not border swap); consistent control height; reserved helper slot; disabled beyond opacity alone.
+
+## Code anti-slop (UI **and** backend)
+- **Over-defensive checks** — `if (x && x.length > 0)` repeated, layered null guards,
+  belt-and-braces nullability the surrounding code already proves. Signals lack of
+  confidence in the flow.
+- **Blanket `catch` / "robust" error handling** that swallows errors or wraps them in
+  generic "Something went wrong." Hides bugs. Catch narrow; rethrow with context; fail
+  closed on auth/permission/transaction.
+- **Useless wrapper functions** — `function getUser(id){ return User.find(id); }` adds a
+  hop with no value. Inline or remove.
+- **Over-engineered abstractions** for trivial problems — a factory + interface + plugin
+  registry for a 10-line function. **Don't add abstraction before two real callers**
+  (see [`coding-style.md`](../../devrites-lib/reference/standards/coding-style.md), [`patterns.md`](../../devrites-lib/reference/standards/patterns.md)).
+- **Convention-blind** code — ignores the repo's naming, file layout, error patterns,
+  validation style. "Generic good code" beats the project's idiom; reuse first (see
+  [`coding-style.md`](../../devrites-lib/reference/standards/coding-style.md)).
+- **Going beyond the spec** — features/options/configs/flags the spec didn't ask for.
+  Implement exactly what was specified; flag extras as follow-ups.
+- **Comment noise — the most common code tell.** Default to **zero** comments; the code and
+  the names carry the meaning. A comment earns its place only by answering *why* in one
+  sentence (intent, a trade-off, a non-obvious constraint, a "here be dragons" warning). Cut
+  every comment that restates the code:
+  - *What-comments* — `// increment i by 1`, `// set the user name`, `// return the result`.
+  - *Tutorial comments* — `// loop through the array` over a `.forEach`; `// check if null`.
+  - *Sycophant / filler* — `// helper function`, `// this is important`, `// magic happens here`.
+  - *Ownerless TODOs* — `// TODO: improve this later` with no issue/owner.
+  - *Meta / edit-process comments* — the agent narrating its own edit: `// Now I'll add error
+    handling`, `// Updated to handle the edge case`, `// As requested`, `// Step 1: … Step 2:`.
+    The reader doesn't care how the diff was produced.
+  - *Hedging / apologetic / overconfident comments* — `// should work`, `// hopefully handles
+    this`, `// I think`, `// hacky`, `// sorry`, or `// obviously` / `// just` / `// trivial`.
+    They admit the code is unverified (or paper over it). Verify the code; delete the doubt.
+  Density smell: more than roughly **one comment per ~10 lines of straightforward code** means
+  you are narrating, not explaining. Rename the thing or delete the comment.
+- **Names must match the contract.** A name is a promise about what the symbol does — keep it
+  honest. A `validateUser()` that actually checks payment status, an `isReady` that mutates
+  state, a `getUser()` that also writes a log: the name lies. Models pick names that *sound*
+  plausible for the category; verify the name says what the code does.
+- **Generic AI naming** — `process_data`, `handle_thing`, `do_it`, `result`, `data`,
+  `temp`, `manager`, `helper`, `util2`. Name for *intent*, in the repo's casing and idiom —
+  not for the action's category.
+- **Premature config** — feature flags / config knobs / extension points with no current
+  user.
+- **Dead leftovers** — TODOs without an owner/issue, commented-out code, unused imports,
+  `console.log`s, debug prints.
+- **Hallucinated imports & APIs** — an import of a package or module the project doesn't
+  declare (absent from the manifest/lockfile) or that doesn't exist, and invented methods or
+  parameters on a real library. Unused imports are dead code; *non-existent* ones are the model
+  inventing dependencies. Verify every import resolves and every unfamiliar API exists at the
+  source (`devrites-source-driven`) — never invent one.
+- **Placeholder bodies posing as complete** — a function that looks implemented but only does
+  `pass` / `...` / `return None` / `throw NotImplementedError` / returns a constant. It promises
+  functionality that isn't there. A genuine `@abstractmethod` / interface / Protocol stub is
+  fine — the slop is the stub pretending to be the real implementation.
+- **Fake or inflated docstrings** — a generic "This function does X" / "Handles the logic" that
+  restates the signature, or a 10-line docstring over a 2-line body. A real public-API docstring
+  earns its place; the slop is the one that inflates or says nothing. Follow the project's doc
+  convention either way.
+- **Oversized units (smell, not a hard gate)** — a function past ~50 logical lines, cyclomatic
+  complexity >10, more than ~4 parameters, or nesting ≥4 deep is a god-function smell. Split it
+  or flatten with guard clauses; judge in context, don't game the metric.
+- **Unexplained magic constants** — a bare literal, a hardcoded URL/endpoint, or an embedded
+  account/provider/test ID inline with no name or source. Give it a name (a const) or a home
+  (config/env). The mirror image of premature config, and just as much a tell.
+- **Copy-paste duplication** — a near-identical block pasted and tweaked instead of reused.
+  Reuse → extend → build new ([`coding-style.md`](../../devrites-lib/reference/standards/coding-style.md), [`patterns.md`](../../devrites-lib/reference/standards/patterns.md)); duplication beats the *wrong*
+  abstraction, but pasted clones are slop, not a deliberate AHA call.
+
+## Why banned, what instead
+They signal model-generated rather than team-designed work: they ignore register and
+idiom, add noise, hide bugs (defensive catches), bloat diffs, and often fail a11y or
+correctness review. Instead: project tokens/components, validate at trust boundaries,
+catch narrow and rethrow, one clear name per concept, reuse first ([`coding-style.md`](../../devrites-lib/reference/standards/coding-style.md)),
+implement exactly the spec. If the project intentionally uses one of these, follow the
+project — consistency beats the rule. A check or abstraction you can't justify in one
+sentence is slop: delete it or ask.

package/pack/generated/devin/skills/rite-polish/reference/anti-patterns.md

@@ -0,0 +1,30 @@
+# rite-polish: anti-patterns
+
+Load this when standing a non-trivial polish decision, or when tempted to
+skip normalize, polish without Chesterton's Fence, or cite clean lint/build
+as proof of quality.
+
+Pack-wide rationalizations + red flags (incl. lint-pass-as-quality): see
+[standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-patterns.md).
+
+## Phase-specific rationalizations
+
+| Excuse | Rebuttal |
+|---|---|
+| "Tests pass; the feature is done." | Tests don't measure ship-quality, design drift, anti-slop, or backend polish. |
+| "UI looks fine to me." | Must align to the design system + meet CWV/WCAG 2.2, not match a personal taste. |
+| "Code is simple enough; no need to audit." | Measure first. If there's no hotspot, that's fine, but record "no hotspots found", don't skip silently. |
+| "It's a small UI change; polish without normalize is fine." | **NO**: decoration on drift is banned. Phase 3 runs before Phase 4, always. |
+| "Backend looks OK; skip Phase 2." | If the diff touched BE, Phase 2 runs: error responses, logging hygiene, queries, anti-slop. |
+| "Fewer lines is simpler, so this is done." | The bar is the comprehension test, not line count: would a new reader understand it *faster* than the original? A cryptic one-liner fails it. Fewer-but-slower is churn: revert it. |
+
+## Red Flags
+
+- About to polish UI (Phase 4) without running normalize (Phase 3) first.
+- No browser evidence saved for a UI polish.
+- Code polish ran without naming a single technique (guard clauses, Extract Method, ...).
+- Backend was touched but `polish-report.md` shows no Phase 2 section.
+- A "simplification" that changes observable behavior. That's not behavior-preserving.
+- Reading a Chesterton's Fence as "looks dead" and deleting without explaining what it guards.
+- Simplifying, reflowing, or "tidying" a block marked `devrites:keep` / `simplify-ignore`: the marker is an explicit fence; leave it in place.
+- Hand-editing a >500-line simplification that a codemod / AST transform should have applied uniformly.

package/pack/generated/devin/skills/rite-polish/reference/backend-polish.md

@@ -0,0 +1,80 @@
+# Backend polish (when backend touched)
+
+Runs as Phase 2 of `/rite-polish` when the feature touches server-side code: handlers /
+controllers / services / routes / models / migrations / queries / jobs / workers / auth /
+schemas. Polishes the **server side** to ship-quality before review, the way UI normalize
++ polish does for the client side.
+
+## Scope detection (BE is in scope if any of these are touched)
+- API/route handlers (REST/GraphQL/gRPC); controllers/services/middleware.
+- DB layer: models, queries, migrations, schemas, ORM calls.
+- Auth/session/permission code; trust-boundary checks.
+- Background jobs, workers, schedulers, queue handlers.
+- Server-side files in the project's language (`.rb`/`.py`/`.go`/`.rs`/`.java`/`.cs`/
+  `.php`/`.ts`-server etc.) outside the UI layer.
+
+## Polish checklist
+
+### Error handling (consistent + meaningful)
+- [ ] **Consistent error response shape** across endpoints (e.g. an RFC 7807 problem
+      document or the project's existing convention). One shape, not three.
+- [ ] **Correct HTTP / protocol status codes** (4xx for client errors, 5xx for server
+      errors; not 200 with `{ error: ... }`).
+- [ ] **Custom error classes** (or equivalent) so callers can distinguish error kinds.
+- [ ] **Fail closed** on auth/permission/transaction errors: deny + roll back; never
+      default to allow or partial commit ([`error-handling.md`](../../devrites-lib/reference/standards/error-handling.md), [`security.md`](../../devrites-lib/reference/standards/security.md)).
+- [ ] **Narrow `catch`**: no blanket `catch (e) {}` swallows. If you catch, recover or
+      rethrow with context.
+
+### Logging hygiene
+- [ ] **Structured logs** (key/value or JSON) with **context**: request id, user/actor
+      id, operation, duration.
+- [ ] Log the **events that matter**: failures, access violations, validation rejections,
+      retries, auth events.
+- [ ] **Never log** secrets, tokens, full credentials, PII, full request bodies for
+      sensitive endpoints. Mask or omit.
+- [ ] No `console.log` / debug prints left in. No noisy "got here" lines.
+
+### Data & queries
+- [ ] **No N+1**: fetch in batches / use joins or includes.
+- [ ] **No unbounded result sets**: pagination/limits where data can grow.
+- [ ] **Parameterized queries** only; never string-built SQL/shell/HTML.
+- [ ] **Indexes** exist for new query patterns (or recorded as a follow-up if the project
+      adds them by migration).
+- [ ] **Transaction boundaries** are right: one logical write = one transaction; rollback
+      on error; no partial commits.
+- [ ] Don't return more fields than the caller needs.
+
+### API contract
+- [ ] Response shape matches the contract the spec set (and what the UI / consumers
+      expect: match against `references/` if any).
+- [ ] **Idempotency** where applicable (PUT/DELETE; retry-safe POSTs with idempotency
+      keys).
+- [ ] **Pagination, sorting, filtering** consistent with neighboring endpoints.
+- [ ] **Validation at the boundary**: type/length/format/range on untrusted input;
+      reject what doesn't match (see [`security.md`](../../devrites-lib/reference/standards/security.md) three-tier).
+
+### Performance (measure first)
+- [ ] Hot-path work measured; obvious wins (cache, batch, hoist) applied; perf claims
+      cite a number (`devrites-audit perf`).
+- [ ] No accidental quadratic loops over growing collections.
+
+### Cleanup
+- [ ] **Dead routes / unused endpoints** removed if this feature created them and they're
+      unused.
+- [ ] Naming + comments in touched server code: clear, intent-revealing, no fake-helpful
+      "// gets the user" lines.
+- [ ] No leftover `TODO`s without an owner/issue.
+- [ ] **Migrations** are reversible where reasonable; destructive ones have rollback notes.
+
+### Anti-slop (code patterns: see `anti-ai-slop.md`)
+- [ ] No over-defensive null/length checks layered redundantly.
+- [ ] No useless wrapper functions ("`function getUser(id) { return User.find(id); }`").
+- [ ] No generic AI naming (`process_data`, `handle_thing`, `do_it`).
+- [ ] No "robust" code that catches everything and hides bugs.
+- [ ] Didn't go **beyond the spec**: implemented what the spec asked, no extras.
+
+## Rules
+- Feature scope only. Don't refactor unrelated server code.
+- Re-prove after changes: targeted tests + a real request/response observation.
+- A polish change that breaks a test isn't behavior-preserving: revert and reconsider.