devrites 5.10.2 → 5.12.0

package/pack/generated/devin/skills/rite-review/reference/cognitive-load.md

@@ -0,0 +1,90 @@
+# Cognitive load: a UX review lens
+
+Cognitive load is the total mental effort the interface demands. Overloaded users
+hesitate, misclick, abandon. Reviewing UI without this lens misses a whole class of
+defects that no a11y checker or perf tool will flag.
+
+DevRites' `/rite-review` uses this reference when the feature touches UI. It is
+descriptive (helps you spot defects) rather than scored: findings raised here
+roll up under the UX axis of the multi-axis review with the usual severity labels.
+
+## Three kinds of load
+
+| Type | Source | Reviewer's job |
+|---|---|---|
+| **Intrinsic** | The task itself: its inherent steps, decisions, and required knowledge. | Can't be eliminated, only **structured**: step the user through it, provide defaults, group related decisions, defer what isn't needed yet. |
+| **Extraneous** | Bad design: friction the task doesn't require: noisy hierarchy, redundant choices, jargon, layout that hides the next step. | **Eliminate it ruthlessly.** It's pure waste, and the easiest class of finding to land. |
+| **Germane** | Effort the user spends *forming a mental model* of the product. | **Invest deliberately.** Consistent flows, shared vocabulary, predictable affordances: anything that lets the user re-use what they already learned. |
+
+A surface can be intrinsic-heavy *and* extraneously-fine. That's a hard task done
+right. A simple surface that still feels heavy is extraneous load disguised as
+"complexity."
+
+## Symptoms reviewers should flag
+
+Treat each as a finding when present; classify by load type so the fix is obvious.
+
+### Extraneous (reduce / remove)
+- **Visual noise** that doesn't earn its place: redundant borders, shadows,
+  dividers, gratuitous icons next to every label, colour used decoratively.
+- **Competing primary actions:** two or three buttons of equal weight when one
+  is clearly the next step.
+- **Jargon and abbreviations** the user doesn't share: names from the codebase
+  or internal team that leaked into the UI.
+- **Restated headings** (the body of a section repeats the section title in
+  long-form).
+- **Decision paralysis:** too many options when one default + a "more options"
+  toggle would do.
+- **Form fields without obvious priority:** required vs optional, primary vs
+  secondary mixed in a single column with no rhythm.
+- **Premature error messaging** (validation that fires before the user has
+  finished typing).
+
+### Intrinsic (structure, don't try to eliminate)
+- **No progressive disclosure** on a genuinely complex task: every field
+  visible at once because "the user might need it".
+- **No safe defaults** on multi-step flows: the user has to choose at every step
+  even when one path is the obvious answer.
+- **Decisions grouped wrong:** "billing address" sandwiched between two
+  unrelated sections rather than next to "shipping address".
+- **No scaffolding** (no template, no example input, no recently-used value)
+  for tasks that have a high blank-page cost.
+
+### Germane (invest in)
+- **Inconsistent vocabulary** across the feature: same concept named two ways
+  (e.g. "member" in one screen, "user" in the next).
+- **Flow-shape divergence** from neighbouring features (modal where the project
+  uses inline; route-change where the project uses an overlay).
+- **Affordances that look interactive but aren't** (and vice versa): destroys
+  the mental model the user is trying to build.
+
+## Reviewing a flow: three-pass discipline
+
+1. **First pass: silent.** Walk the flow without reading any explainer copy.
+   Anything that stops you cold without copy is a finding: either extraneous
+   load you can't dismiss, or a germane-load problem (the user is missing a
+   mental model the UI assumes).
+2. **Second pass: with copy.** Read every label, helper, and error. Does the
+   copy resolve the friction the first pass surfaced, or just paper over it?
+   "Tooltip explaining a confusing button" is rarely the right fix: usually
+   the button needs a different label.
+3. **Third pass: empty + error.** Run the flow with no data, partial data, and
+   the worst inputs (offline / 500 / permission-denied). Most cognitive-load
+   defects hide in non-happy paths because nobody designs them.
+
+## The cheap-fix test
+
+If a finding would take more than 30 minutes to fix, classify it (token gap /
+component miss / flow misalignment per [`ui.md`](../../rite-polish/reference/ui.md)) and
+route to the appropriate bucket. Cognitive-load review surfaces problems; it
+doesn't decide the rewrite strategy.
+
+## What this lens **doesn't** cover
+
+- **Accessibility:** separate axis (WCAG 2.2; see
+  [`devrites-frontend-craft/reference/quality-standards.md`](../../devrites-frontend-craft/reference/quality-standards.md)).
+- **Performance:** separate axis (Core Web Vitals; see
+  [`performance-checklist.md`](performance-checklist.md)).
+- **Code quality:** covered by the simplification audit
+  (`devrites-audit simplify`).
+- **Security:** covered by the security audit (`devrites-audit security`).

package/pack/generated/devin/skills/rite-review/reference/feature-scoped-review.md

@@ -0,0 +1,26 @@
+# Feature-scoped review
+
+The review boundary is the **active feature**: the files in `touched-files.md` and the
+current diff. This is a hard rule, not a guideline.
+
+## In scope
+- Code added/changed by this feature.
+- Tests for this feature.
+- Files this feature intentionally inspected and depends on (read for context, but
+  don't refactor them).
+
+## Out of scope (do NOT)
+- Refactor unrelated modules because they're "nearby" or "while we're here".
+- Delete suspected dead code outside this feature without asking the user.
+- Restyle/upgrade dependencies or change project-wide config to suit this feature.
+- Expand the review into a project audit.
+
+## When you spot a real problem outside scope
+Record it as an **[FYI] follow-up** in `review.md` (and suggest a separate feature/issue).
+Don't fix it inline. Drive-by changes balloon the diff, dodge their own review, and
+mix concerns the seal can't cleanly evaluate.
+
+## Why scope discipline matters
+A tight diff gets a real review; a sprawling one gets a rubber stamp. Scope creep is how
+"a small fix" becomes an unreviewable, unprovable change. Keep the feature shippable and
+the review honest.

package/pack/generated/devin/skills/rite-review/reference/five-axis-review.md

@@ -0,0 +1,66 @@
+# Five-axis review: tests first, then six axes
+
+The dispatched `devrites-code-reviewer` checks tests first, then correctness, readability,
+architecture, maintainability, and standards under one severity scale (Critical / Important / Suggestion / Nit / FYI).
+The `/rite-review` inline lead **reconciles** the returned report against the Spec
+axis. It does not re-run these axes itself. This file is the shared definition of
+what "full code-review discipline" covers; use it to judge whether the agent's report
+is complete, and to scope anything the agent could not (e.g. UI-only lenses below).
+
+## 0. Tests (first)
+- Do tests exist for the changed behavior, and do they prove the acceptance criteria?
+- Would they fail if the code were wrong? (No assertion-free or tautological tests.)
+- Edge cases: empty, boundary, error, permission-denied, concurrency.
+- Applicable data/integration/topology cases use a risk-capable boundary; no
+  risk-erasing mock, one-tenant isolation claim, or one-root proof for another root.
+
+## 1. Correctness
+- Does it do what the spec says? Off-by-one, null/undefined, error paths, race
+  conditions, incorrect assumptions about inputs.
+- Does it handle the states the slice promised (loading/empty/error for UI)?
+- Does retry/interruption converge without duplicate effects; do partial/unknown external
+  outcomes, migrations, old/new versions, tenant scope, and rollback follow the accepted plan?
+
+## 2. Readability
+- Can the next engineer understand it without the author? Naming, function length,
+  nesting depth, comments that explain *why* not *what*.
+- Structural smells: a conditional **bolted onto an unrelated flow** (wants its own
+  helper/state/policy: a design smell, not a nit); **repeated conditionals on the same
+  shape** (a missing model or dispatcher).
+
+## 3. Architecture
+- Right seam/boundary? Coupling and cohesion. Does it fit existing patterns or
+  introduce a competing one? Is the abstraction earned (not premature)?
+- Does a refactor **reduce** complexity or just **relocate** it? Count the concepts a
+  reader must hold; a "cleaner" version that leaves that count unchanged isn't cleaner.
+- Is feature-specific logic **leaking into a shared module** instead of its owning layer?
+  Is a **type boundary** left implicit by a gratuitous `any`/cast or a silent fallback?
+- **Name the remedy, not just the smell:** replace a conditional chain with a typed
+  dispatcher, separate orchestration from business logic, move feature logic to its owning
+  package, delete a pass-through wrapper, split a large file. Prefer the move that removes
+  moving pieces over one that re-centralizes the same complexity.
+- Are repository/deployable roots, canonical contract and mutable-state owners, shared
+  resources, and synchronous/asynchronous consistency boundaries preserved without a cycle?
+
+## 4. Security
+- Trust boundaries, input validation, authz checks, secrets handling. Hand off to
+  `devrites-audit security` when input/auth/data/integration is in scope.
+
+## 5. Performance
+- Obvious N+1s, unnecessary work in hot paths, payload sizes. Hand off to
+  `devrites-audit perf` when perf is relevant: **measure before claiming**.
+
+## 6. Maintainability
+- Tests, docs/comments where needed, no dead code added, no TODOs left, consistent
+  with project conventions.
+
+## Frontend axes (if UI)
+- UX flow matches neighbors; all interaction states; a11y (focus, labels, contrast,
+  keyboard); responsive; design-system alignment (no drift, no anti-AI-slop).
+
+## Sizing & speed
+Prefer reviewing roughly one slice / ~100 lines of meaningful change at a time. Larger
+diffs hide defects: recommend splitting rather than rubber-stamping. Watch **file size,
+not just diff size**: a small diff that pushes an already-large file further past a healthy
+boundary wants decomposition (extract helpers / split modules) *first*: decompose, then
+add.

package/pack/generated/devin/skills/rite-review/reference/nielsen-heuristics.md

@@ -0,0 +1,126 @@
+# Nielsen's 10 usability heuristics: DevRites scoring rubric
+
+A structured UX rubric for `/rite-review` when the feature touches UI. Score each
+heuristic on a **0-4** scale; the per-heuristic scores feed the UX axis of the
+multi-axis review and shape the severity labels on UX findings.
+
+**Score honestly.** 4 means *genuinely excellent*, not "good enough", not "no
+findings". 3 is "good with minor gaps". 2 is "partial: significant gaps". 0-1 is a
+Critical / Important.
+
+## 1. Visibility of system status
+Users know what's happening, when, and where.
+- Loading indicators on async operations.
+- Confirmation when actions complete (save, submit, delete).
+- Progress on multi-step flows.
+- Current location in nav (active state, breadcrumbs).
+- Inline form validation, not just on submit.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| No feedback. | Critical actions lack feedback. | Most actions have feedback; gaps. | Consistent feedback; minor lag/lateness. | Anticipates uncertainty; reassures throughout. |
+
+## 2. Match between system and the real world
+The UI speaks the user's language and follows real-world conventions.
+- Domain vocabulary the *user* shares, not the team's internal names.
+- Familiar metaphors where they help (cart, inbox, draft).
+- Information ordered the way the user thinks about it, not the way the DB stores it.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Jargon throughout. | Mostly internal vocabulary. | Mixed: some user terms, some internal. | Clear user terms; a couple of leaks. | Reads like the user's own words. |
+
+## 3. User control and freedom
+Easy escape, undo, and back-out from any state.
+- Cancel / close / back on every modal, route, and form.
+- Undo on destructive operations (delete, archive, reset).
+- No dead-end states ("Error: refresh the page" with no recovery).
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Users trapped in states. | Limited escape on key flows. | Most flows reversible; gaps on destructive ops. | Good escape + undo on most flows. | Confident exploration possible everywhere. |
+
+## 4. Consistency and standards
+Internal consistency (this feature matches the project) + external consistency (the
+project matches platform / web norms).
+- Same concept named the same way across screens.
+- Same affordance (button vs link vs row) means the same thing across screens.
+- Platform conventions respected (browser back, focus rings, native controls where appropriate).
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Inconsistent vocabulary + affordances. | Major drift from neighbours. | Mostly aligned; visible drift. | Well-aligned; minor inconsistencies. | Indistinguishable from the rest of the product. |
+
+## 5. Error prevention
+Designed so the user *can't* make the error in the first place.
+- Confirmations on destructive operations.
+- Disabled / hidden actions when they're not valid.
+- Smart defaults; constrained inputs (date pickers vs free text).
+- Field formats validated as you type, not just on submit.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Many error-prone flows. | Some preventable errors still possible. | Common errors prevented; edge cases slip. | Most errors prevented before they occur. | Errors are genuinely rare; the easy path is the safe path. |
+
+## 6. Recognition rather than recall
+Show options; don't force the user to remember them.
+- Visible choices rather than free-text "type the command".
+- Recently-used values surfaced.
+- Labels persist (don't disappear after focus).
+- Context (where the user is, what they were doing) survives navigation.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Heavy recall required. | Critical flows demand recall. | Mixed: some visible, some hidden. | Mostly recognition; minor recall asks. | Pure recognition; nothing the user needs is hidden. |
+
+## 7. Flexibility and efficiency of use
+Novices and experts both productive.
+- Keyboard shortcuts on power flows; visible affordances for everyone else.
+- Sensible defaults for the common case; depth available when needed.
+- Saved views / templates / bulk actions on tasks done repeatedly.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| One-size-fits-all; no acceleration. | Limited shortcuts; novice-only. | Some efficiency for experts; uneven. | Strong shortcut + default story; small gaps. | Both populations measurably fast. |
+
+## 8. Aesthetic and minimalist design
+Every element earns its place. No decorative noise.
+- One primary action per screen / surface.
+- Visual hierarchy carries the eye to the next step.
+- Decoration in service of meaning, not for its own sake.
+- Whitespace used as a tool, not because the page felt empty.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Cluttered; no hierarchy. | Visible noise / competing actions. | Generally clean; some clutter. | Strong hierarchy; minor noise. | Every pixel deliberate; nothing extraneous. |
+
+## 9. Help users recognize, diagnose, and recover from errors
+Error states are designed, not afterthoughts.
+- Errors named in user language ("Your card was declined") not codes ("Stripe 4002").
+- A concrete next step ("Try a different card" + "Use PayPal instead").
+- Inline location: the error appears next to the field / action that caused it.
+- No blame: the message describes the situation, not the user.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Cryptic codes / silent failures. | Errors visible but unhelpful. | Some errors recoverable; others stranded. | Most errors actionable; minor gaps. | Every error has a clear cause + clear next step. |
+
+## 10. Help and documentation
+Users can find what they need without leaving the surface.
+- Inline hints on novel patterns.
+- Search-friendly help for deeper questions.
+- No help is needed for the common path, and that's documented as a goal.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| No in-product help. | Help exists but hidden / stale. | Help exists; quality uneven. | Good inline help; reachable docs. | Help feels native; users barely need it. |
+
+## Reporting
+
+In `/rite-review` output, surface heuristics scoring **≤2**, plus any 3 with a specific
+noted gap, as findings; every score feeds the UX axis. Each surfaced finding gets a
+severity label per [`SKILL.md`](../SKILL.md).
+
+The rubric is descriptive, not gating. A score of 2 on aesthetic-minimalist isn't
+an automatic NO-GO; the `rite-seal` gate is `Critical == 0`, not "every heuristic
+≥ 3".

package/pack/generated/devin/skills/rite-review/reference/performance-checklist.md

@@ -0,0 +1,91 @@
+# Performance checklist (baseline for the perf reviewer)
+
+The minimum baseline `devrites-performance-reviewer` checks against, in feature scope. It
+is a checklist, not a mandate: flag what the diff touches or what a measurement
+flags, never a project-wide sweep. The philosophy lives in
+[`standards/performance.md`](../../devrites-lib/reference/standards/performance.md) (measure first). This file is the
+concrete what-to-look-for.
+
+## Core Web Vitals targets
+
+| Metric | Good | Needs work | Poor |
+|---|---|---|---|
+| LCP: Largest Contentful Paint | ≤ 2.5s | ≤ 4.0s | > 4.0s |
+| INP: Interaction to Next Paint | ≤ 200ms | ≤ 500ms | > 500ms |
+| CLS: Cumulative Layout Shift | ≤ 0.1 | ≤ 0.25 | > 0.25 |
+
+A CWV value only counts when it carries a source: `Field (CrUX)`, `Lab (Lighthouse)`, or
+`Trace (DevTools)`. No source → it's a Source-mode hypothesis, not a measurement.
+
+## Frontend (only when the feature is UI-facing)
+
+Identify the framework first; apply only its idioms.
+
+- **Images:** modern format (WebP/AVIF); responsive `srcset`/`sizes`; explicit
+  `width`/`height` to reserve space (CLS); below-the-fold `loading="lazy"`; the LCP image
+  gets `fetchpriority="high"` and is **not** lazy-loaded.
+- **JavaScript:** initial bundle stays small (≈200KB gzipped is the usual line); code-split
+  routes and heavy features; no blocking script in `<head>` without `defer`/`async`; break
+  long tasks (>50ms) so the main thread stays free (the main INP lever); `memo`/`useMemo`/
+  `useCallback` only where profiling shows a win, not wrapped over everything.
+- **CSS:** critical CSS not render-blocking; no per-render CSS-in-JS runtime cost in prod.
+- **Fonts:** 2-3 families max; WOFF2; self-hosted where possible; preload the LCP font;
+  `font-display: swap`; subset with `unicode-range`.
+- **Rendering:** no layout thrashing (batch reads, then writes); animate `transform`/
+  `opacity` only; virtualize long lists; `content-visibility: auto` for off-screen sections;
+  check bfcache eligibility and restoration in supported browsers. Avoid `unload`
+  handlers, but preserve sensitive-data cache policy: `Cache-Control: no-store`
+  eligibility varies by browser and conditions. Never remove a security control
+  for a performance score; test account-switch and restored-page behavior.
+
+## Backend (every feature, UI or not)
+
+- No N+1 queries; eager-load / join / batch instead.
+- Compare query plans and representative measurements before/after adding an
+  index; account for write and storage costs, not just filter/sort columns.
+- Before raising connection caps, count pools across processes and instances,
+  inspect held connections and transactions, and compare aggregate demand with
+  database capacity.
+- List endpoints paginate: never an unbounded `SELECT *`.
+- Consider caching or hoisting measured repeated work only when its freshness
+  and sensitive-data contract allows it. Keys include every varying input and
+  principal when results differ; bound eviction and coalesce concurrent misses
+  where needed. Distinguish genuine negative results from origin failures; never
+  cache an outage as absence.
+- Responses compressed (gzip/brotli); bulk operations instead of a loop of single calls.
+
+## Network
+
+- Static assets cached with a long `max-age` + content hashing.
+- Known origins `preconnect`-ed; no unnecessary redirects; HTTP/2 or HTTP/3 where available.
+
+## AI-codegen perf smells (fold into the area above, not a separate finding category)
+
+- State duplicated instead of lifted; effects with over-broad deps that re-run needlessly.
+- Sequential `await`s where `Promise.all` / parallel fetch fits.
+- Over-fetching "just in case"; redundant calls a dedup would collapse.
+- Defensive memoization wrapping cheap components: cost with no benefit.
+
+## Modern APIs to consider (one-liners: reach for these, don't gate on them)
+
+`scheduler.yield()` to keep input responsive in long loops · Speculation Rules for
+prefetch/prerender · View Transitions on SPA navigation · Long Animation Frames (LoAF) for
+production INP attribution · `fetchpriority` on critical non-image resources.
+
+## Measurement commands (name these in Source mode; don't run installs in review)
+
+```bash
+# Lighthouse (lab)
+npx lighthouse <url> --output json --output-path ./report.json
+# or via the Chrome DevTools MCP CLI, no install:
+npx -p chrome-devtools-mcp chrome-devtools lighthouse_audit --output-format=json > report.json
+
+# Bundle size
+npx vite-bundle-visualizer        # Vite
+npx webpack-bundle-analyzer stats.json   # webpack
+
+# Field data: CrUX / PageSpeed Insights (real users, p75) — needs an API key
+```
+
+Field is what real users experienced; lab is one synthetic run. Don't present one as the
+other.

package/pack/generated/devin/skills/rite-review/reference/performance-review.md

@@ -0,0 +1,14 @@
+# Performance review (feature-scoped)
+
+Apply only when a stated budget or visible regression risk makes performance relevant.
+The canonical measurement, pitfall, optimization, and scope rules live in
+[`performance.md`](../../devrites-lib/reference/standards/performance.md); apply every
+one before filing a performance finding.
+
+The agent runs **Source mode** (static scan, findings tagged `potential` + the verify
+command) or **Measured mode** (real CWV numbers → a source-labeled scorecard). Baseline
+checks + measurement commands: [`performance-checklist.md`](performance-checklist.md).
+
+## Labels
+A perf issue that breaches a stated budget is **Important** or **Critical**; a
+speculative micro-optimization is a **Suggestion** at most.

package/pack/generated/devin/skills/rite-review/reference/security-review.md

@@ -0,0 +1,42 @@
+# Security review (feature-scoped)
+
+Apply when the feature involves user input, auth/authz, data storage, external
+integrations, secrets, or permissions. Delegates to `devrites-audit security`.
+
+## OWASP-Top-10-oriented checks
+
+This is the **single-sourced OWASP-web checklist** both `/rite-review` and the
+`devrites-security-auditor` agent apply (trust-boundary + the OWASP **LLM** Top 10 live in
+[`standards/security.md`](../../devrites-lib/reference/standards/security.md)). Keep the enumeration here; don't restate it.
+
+- **Injection:** parameterized queries; no string-built SQL/shell/HTML; validate &
+  encode at boundaries.
+- **Broken access control:** every sensitive action checks authz server-side; no
+  trusting client-supplied IDs/roles/tenant; no IDOR, cross-tenant read/write/cache/search,
+  confused-deputy path, or privilege change without re-authorization.
+- **Auth / session:** secure session handling; no credentials in code/logs; correct
+  password/token handling.
+- **Sensitive data:** PII/secrets not logged or returned; encryption where required;
+  least data exposed.
+- **SSRF / external calls:** validate/allowlist outbound URLs; timeouts; don't reflect
+  untrusted input into requests.
+- **Misconfiguration:** safe defaults; debug off; CORS scoped; security headers as the
+  project uses them.
+- **Files / request integrity:** resolved paths remain below the allowed root across
+  traversal/encoding/symlink/archive cases; state-changing browser requests use the
+  framework's forgery protection; CORS is not treated as CSRF defense.
+- **Vulnerable dependencies:** new/updated deps audited; no known-vuln versions added.
+- **Integrity / deserialization:** safe non-executable parsing with type/size/depth limits;
+  untrusted data cannot instantiate executable objects.
+
+## Trust boundary
+Apply the three-tier discipline (untrusted → boundary → trusted) per the canonical rule
+in [`standards/security.md`](../../devrites-lib/reference/standards/security.md#trust-boundary-three-tiers). A value
+that skips the boundary tier is a finding.
+
+## Rules
+- Findings labeled Critical/Important/Suggestion. A real auth/data-exposure issue is
+  **Critical** → NO-GO until fixed.
+- Secrets management: never commit secrets; use the project's secret mechanism.
+- Don't expand into a project-wide security audit: feature scope. Record out-of-scope
+  risks as follow-ups.

package/pack/generated/devin/skills/rite-seal/SKILL.md

@@ -0,0 +1,98 @@
+---
+name: rite-seal
+description: Decide GO/NO-GO for an active feature; /rite-ship owns commit, push, tag, and close.
+argument-hint: "[feature-slug] [--full]"
+---
+
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/candidate-integrity.md","devrites-lib/reference/orchestration-profiles.md","devrites-lib/reference/parallel-dispatch.md","devrites-lib/reference/standards/verification-methods.md","rite-seal/reference/phase-contract.md","rite-seal/reference/final-evidence.md","rite-seal/reference/go-no-go.md","rite-seal/reference/risk-and-rollback.md","rite-seal/reference/seal-template.md","rite-seal/reference/output.md","rite-seal/reference/anti-patterns.md"],"triggers":{"agents":["devrites-lib/reference/standards/agents.md"],"browser":["devrites-lib/reference/standards/browser-proof-checklist.md"],"code-review":["devrites-lib/reference/standards/code-review.md"],"deprecation":["devrites-lib/reference/standards/deprecation.md"],"documentation":["devrites-lib/reference/standards/documentation.md"],"dod":["devrites-lib/reference/standards/definition-of-done.md"],"observability":["devrites-lib/reference/standards/observability.md"],"principles":["devrites-lib/reference/standards/principles.md"],"security":["devrites-lib/reference/standards/security.md"],"testing":["devrites-lib/reference/standards/testing.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","evidence.md","touched-files.md","review.md","seal.md"],"workspaceByRole":{"code-reviewer":["spec.md","plan.md","tasks.md","test-plan.md","architecture.md","decisions.md","state.md","evidence.md","touched-files.md","review.md"],"devex-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"doubt-reviewer":["spec.md","plan.md","tasks.md","state.md","decisions.md","review.md"],"frontend-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"performance-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"proof-runner":["spec.md","test-plan.md","tasks.md","evidence.md","state.md"],"security-auditor":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"simplifier-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","review.md"],"spec-reviewer":["brief.md","spec.md","decision-coverage.md","questions.md","decisions.md","assumptions.md","state.md","review.md"],"test-analyst":["spec.md","tasks.md","test-plan.md","state.md","evidence.md","review.md"]}} -->
+> Read-set manifest: `devrites-engine context <slug> --phase seal` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+
+
+# /rite-seal: GO / NO-GO
+
+Verify final candidate in `seal.md`; `/rite-ship` owns authorized irreversible
+actions and close-out.
+
+## Authority
+
+Read [`core.md`](../devrites-lib/reference/standards/core.md) plus only
+final-diff-relevant standards: agents, code-review, testing, browser-proof-checklist,
+security, principles, documentation, observability, deprecation,
+definition-of-done, and [`verification-methods.md`](../devrites-lib/reference/standards/verification-methods.md)
+for coverage-denominator and evidence-status judgment.
+Load [`final-evidence.md`](reference/final-evidence.md) and
+[`go-no-go.md`](reference/go-no-go.md) for proof and verdict safety.
+Follow the shared
+[`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md) for
+the reviewed digest and artifact bindings.
+
+The host runs/reconciles named read-only reviewers; engine checks invariants.
+**Standard** is default; **Full** broadens conditional axes per
+[`devrites-lib/reference/orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md).
+
+## Gate
+
+| State | Verdict |
+|---|---|
+| Acceptance proven, deterministic checks pass, no unresolved drift or human gate, `Critical == 0`, `Important == 0` | **GO** |
+| Same, but `Important > 0` | Ask `Important findings remain. Proceed to seal? [y/N]`; default **N** |
+| `Critical > 0` | **NO-GO** |
+| Any acceptance criterion, resolved prohibition, or declared key link lacks proof | **NO-GO** |
+| `gates status` is not `all-met` — an unmet, stale, unapproved, or abandoned ledger gate remains | **NO-GO** |
+| Evidence is stale, or native diff review plus the exact test analyst finds weakened tests | **NO-GO: Critical** |
+| Any exact required reviewer account is missing or silent | **NO-GO** |
+| Any deferred finding (`touched-files.md` `## Review trail`, `eng-review.md` `## Deferred findings`) lacks a `review.md` verdict | **NO-GO** |
+| Any `gate: validating` question remains open | **NO-GO** |
+| Material UI acceptance lacks or fails required browser proof | **NO-GO** |
+| Unresolved drift, unsafe migration/removal, or unapproved principle violation remains | **NO-GO** |
+| `check regression` reports an unblessed loss vs the recorded progress baseline | **NO-GO** |
+| `check windows` reports a deferral marker the change introduced without a `windows.md` waiver | **NO-GO** |
+
+A judgment-only criterion needs the human eye; AFK records a validating question
+and stops.
+
+## Workflow
+
+Follow [`reference/phase-contract.md`](reference/phase-contract.md)
+([`risk-and-rollback.md`](reference/risk-and-rollback.md),
+[`seal-template.md`](reference/seal-template.md),
+[`anti-patterns.md`](reference/anti-patterns.md)):
+
+1. read workspace and final diff;
+2. recheck the canonical candidate/bindings and approved repository/CI proof;
+3. admit valid Spec/Code accounts; dispatch remaining required exact roles under
+   `../devrites-lib/reference/parallel-dispatch.md` on the same frozen candidate;
+4. reconcile their read-only verdicts against source and immutable evidence;
+5. draft GO/NO-GO `seal.md` with acceptance, tests, decisions, and seven accounts;
+6. write exactly one candidate binding, then run
+   `devrites-engine check seal <slug>` for structure and identity, never semantics,
+   and, when that check reports a stale readiness-input binding, run
+   `devrites-engine check drift <slug>` before returning to Vet so the repair
+   starts at the named changed, missing, or added input,
+   and `devrites-engine check regression <slug>` to confirm no recorded progress
+   fact was lost since the last checkpoint — `BLOCKED` is NO-GO; `unproven`
+   (no baseline) does not block — plus `devrites-engine check windows <slug>
+   --base <release-base>` so each deferral marker the feature diff introduced
+   carries a `windows.md` waiver row ([`windows.md`](../devrites-lib/reference/standards/windows.md));
+   unwaived hits are NO-GO. The engine already refuses a `gates.md` ledger
+   that is malformed, unmet,
+   stale, unapproved, or abandoned — a seal-side `gates status` reading anything
+   but `all-met` means Prove's evidence is not current; return there, never
+   attest past it. It likewise refuses a malformed `notes.md` or any anchor
+   graded other than `exact`: `devrites-engine note check <slug> --repair`
+   re-anchors `moved` notes; `stale`/`ambiguous`/`lost` ones are corrected or
+   removed before GO.
+
+Corrections return through affected Prove/Review before restarting Seal under
+[evidence validity](../devrites-lib/reference/candidate-integrity.md#evidence-validity).
+
+Only repository scripts/CI authorize commands; never guess.
+
+## On GO
+
+Set `state.md` `Next step: /rite-ship` and stop. A GO is a verdict, not
+authorization to perform an irreversible action.
+
+## Output
+
+Use [`reference/output.md`](reference/output.md).

package/pack/generated/devin/skills/rite-seal/reference/anti-patterns.md

@@ -0,0 +1,29 @@
+# rite-seal: anti-patterns
+
+Load this when standing the final GO/NO-GO decision, or when tempted to round
+NO-GO up to GO. (The irreversible push/tag/deploy and its type-GO gate now live in
+`/rite-ship`: see that skill's anti-patterns for the type-GO discipline.)
+
+Pack-wide rationalizations + red flags (incl. user-wants-it-bypass-gate):
+see [standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-patterns.md).
+
+## Phase-specific rationalizations
+
+| Excuse | Rebuttal |
+|---|---|
+| "All Important findings are minor; just GO." | `Important > 0` triggers an interactive y/N: do not bypass the prompt, present it. |
+| "User clearly wants this to ship." | Ship is evidence-driven, not consent-driven. A Critical finding outranks "the user said go". |
+| "Drift is small; resolve it inline and seal." | Unresolved drift = NO-GO, no exceptions. Route through `/rite-plan` to repair, then seal. |
+| "Reviewer findings overlap; average them away." | Surface disagreements explicitly. Averaging hides where the reviewers disagree. |
+| "Carry the old reviewer verdicts though the diff changed." | If the diff changed since `/rite-review`, re-run the Spec + Code axes: don't carry stale verdicts forward. |
+| "The wright was confident in a material decision. GO without independent review." | Confidence is not independent evidence. Ask the exact `devrites-doubt-reviewer` to test a boundary / data-model / auth / public-API / migration claim, reconcile its result against source, and record the verdict in `decisions.md`; unresolved irreversible risk is NO-GO. |
+
+## Red Flags
+
+- About to write `Verdict: GO` while any `Critical` finding is open.
+- Writing `Next step` as anything other than `/rite-ship` after a GO verdict.
+- Reviewer subagents spawned with the author's reasoning attached (defeats the fresh-context point).
+- `seal.md` written before walking *every* acceptance criterion one by one.
+- A NO-GO rounded up to GO "to be agreeable".
+- Unresolved drift, unresolved questions, or pending tasks, and you're sealing anyway.
+- A stood irreversible-risk decision (auth / public-API / migration) has no recorded independent `devrites-doubt` verdict, and you are sealing GO anyway.

package/pack/generated/devin/skills/rite-seal/reference/final-evidence.md

@@ -0,0 +1,41 @@
+# Final evidence check
+
+Map spec promises to valid observed proof.
+
+## Acceptance
+
+For each AC/REQ/scenario/key link, exact `devrites-proof-runner` maps immutable
+results and exact `devrites-spec-reviewer` checks implementation and proof
+against its meaning. Bug fixes require original-symptom proof; self-report,
+inspection alone, and generic "tests pass" do not count.
+
+Apply [[`testing.md`](../../devrites-lib/reference/standards/testing.md)'s positive, discriminating proof](../../devrites-lib/reference/standards/testing.md#positive-discriminating-proof),
+including invalid-result exclusions and static/textual criterion boundaries.
+Unproven behavior: NO-GO.
+
+## Cross-check
+
+Require built slices, resolved or accepted findings, no drift/open validating
+question, required UI/boundary proof, and an exact doubt verdict per stood decision.
+Reconcile the final diff with the spec applicability map. Every triggered topology,
+data, integration, security, and delivery owner needs its relevant observed failure/
+recovery evidence or an evidence-backed dismissal; a generic green suite cannot close it.
+
+## Candidate binding and test integrity
+
+Run `devrites-engine check candidate <slug>` and require its digest to match the
+single evidence/review bindings and browser binding when present. Diff tests,
+dispatch exact `devrites-test-analyst`; apply
+[evidence validity](../../devrites-lib/reference/candidate-integrity.md#evidence-validity)
+to approved proof, then require unchanged digest/sources. Deleted/skipped/focused/
+weakened/tautological tests are Critical.
+
+After recording verdicts in `seal.md`, run:
+
+```bash
+devrites-engine check seal "<slug>"
+```
+
+This checks structure and exact candidate bindings, never acceptance, test
+quality, doubt, or review. Apply [[`testing.md`](../../devrites-lib/reference/standards/testing.md)'s safe perturbation](../../devrites-lib/reference/standards/testing.md#safe-perturbation)
+for its mandatory critical/regression cases and any additional project/test-plan requirement.