devrites 5.10.2 → 5.12.0

package/pack/generated/devin/skills/rite-seal/reference/go-no-go.md

@@ -0,0 +1,30 @@
+# GO / NO-GO
+
+[`../SKILL.md`](../SKILL.md) owns gates. Draft native acceptance, test, doubt,
+and seven reviewer accounts in `seal.md`; then run
+`devrites-engine check seal <slug>` for structure/freshness.
+
+## NO-GO
+
+NO-GO on unproven acceptance/prohibitions/key links, red repository checks,
+stale proof, drift/open validating questions, Critical code/security, unsafe
+rollback, or an unapproved principle violation. Also block:
+- missing/adverse exact proof, spec, or test verdict;
+- deleted/skipped/focused/tautological/weakened tests;
+- missing/silent required review or invalid conditional account;
+- a stood decision without reconciled exact doubt verdict;
+- an unblessed loss vs the recorded progress baseline (`check regression` `BLOCKED`);
+- opted-in mutation missing/below threshold (otherwise optional).
+
+## GO
+
+GO needs fresh acceptance, green proof, resolved drift/human gates, acceptable
+security/data/rollback risk, every account, and no Critical.
+
+When only Important findings remain, ask:
+
+```text
+Important findings remain. Proceed to seal? [y/N]
+```
+
+Default NO-GO. `y` accepts named Important risks only, never Critical/missing proof.

package/pack/generated/devin/skills/rite-seal/reference/output.md

@@ -0,0 +1,5 @@
+# rite-seal output
+
+Use the shared [GO or NO-GO reply contract](../../devrites-lib/reference/reply-contract.md).
+
+Do not imply anything shipped. `/rite-seal` decides; `/rite-ship` executes.

package/pack/generated/devin/skills/rite-seal/reference/phase-contract.md

@@ -0,0 +1,49 @@
+# rite-seal phase contract
+
+1. **Read.** Resolve the explicit slug or `.devrites/ACTIVE`, require its
+   `state.md`, then read required workspace artifacts, conditional
+   browser/design/devex evidence, and final diff.
+2. **Recheck identity and real proof.** Run
+   `devrites-engine check candidate <slug>` and require its exact digest to match
+   the single evidence/review bindings and the browser binding when present.
+   Apply [`spec-grammar.md`](../../devrites-lib/reference/standards/spec-grammar.md)'s Native grammar re-read checklist and
+   [evidence validity](../../devrites-lib/reference/candidate-integrity.md#evidence-validity).
+   Run required `test-plan.md` commands unless valid observed proof already satisfies
+   them under that contract. Rerun the
+   candidate check afterward and require the identical digest and no source
+   mutation. Capture command, cwd, exit, decisive output, and identity.
+   Missing/red/mismatched blocks; unavailable is `cannot_verify`, never pass.
+3. **Judge acceptance.** Dispatch exact `devrites-proof-runner` on immutable
+   proof; admit valid same-candidate `devrites-spec-reviewer` evidence from Review
+   or dispatch that exact reviewer. Reconcile every
+   AC/REQ/scenario/key link by ID and meaning; missing/stale/self-attested/mismatched is NO-GO.
+4. **Judge tests.** Diff baseline/candidate tests for deletion, skip/focus,
+   tautology, or weakening; dispatch exact `devrites-test-analyst`. Missing or
+   adverse account, or green tests not asserting mapped behavior, is Critical.
+5. **Resolve gates.** Open blocking/escalating/validating questions and drift
+   block. Each stood decision needs a reconciled exact `devrites-doubt-reviewer` verdict.
+   Every deferred finding (`touched-files.md` `## Review trail`, `eng-review.md`
+   `## Deferred findings`) needs its `review.md` verdict; a row without one blocks.
+6. **Risk and native review.** Apply [`risk-and-rollback.md`](risk-and-rollback.md)
+   and the [`review roster`](../../devrites-lib/reference/parallel-dispatch.md) on
+   the candidate. Admit each result through
+   [`result admission`](../../devrites-lib/reference/standards/agents.md#result-admission).
+   `## Reviewer Accounts` preserves all seven; gap/missing/malformed blocks;
+   conditional `Not-applicable` names why.
+7. **Route corrections.** Reconcile cited findings/disagreements, but do not
+   edit the candidate or manifest in Seal. Route an accepted correction through
+   one bounded wright, update the manifest, run affected Prove, complete a fresh
+   Review under evidence validity, then restart Seal on the new digest.
+8. **Draft/check.** Write `seal.md` from
+   [`seal-template.md`](seal-template.md) with the GO/NO-GO rationale, acceptance map,
+   test-analysis account, stood-decision verdicts, all seven reviewer accounts,
+   and exactly one `Candidate SHA-256: <64 lowercase hex>` line. Then run:
+   ```bash
+   devrites-engine check seal "<slug>"
+   devrites-engine check regression "<slug>"
+   ```
+   Structure/bindings only: blocks exit `3`, invalid state `2`. A regression
+   `BLOCKED` is NO-GO; `unproven` (no baseline) does not block. GO sets
+   `Next step: /rite-ship`; NO-GO names the fix. No commit/push/tag/publish/deploy/close.
+
+Apply [`anti-patterns.md`](anti-patterns.md); never average away disagreement.

package/pack/generated/devin/skills/rite-seal/reference/risk-and-rollback.md

@@ -0,0 +1,56 @@
+# Risk & rollback
+
+Before GO, know how to undo the change and what could go wrong in production.
+
+## Risk scan
+Rank risks; for each, note likelihood × impact and any mitigation:
+- **Topology/ownership**: affected roots/deployables, shared contracts/state/resources,
+  dependency cycles, and intermediate deployment combinations.
+- **Data**: schema changes, migration/backfill interruption, concurrent/duplicate writes,
+  tenant/retention boundaries, destructive operations, and invariant reconciliation.
+- **Security**: new trust boundaries, auth/authz changes, secret handling, new deps.
+- **Compatibility**: API contract changes, breaking changes for existing clients,
+  feature interactions.
+- **Integration/operational**: timeouts/unknown outcomes, retry/idempotency, duplicate/order,
+  partial/invalid responses, provider/queue/cache outage, config/env, and rate limits.
+- **Delivery**: schema/config/application/worker/flag order, environment mismatch,
+  monitoring gap, exposure stages, and time to detect/recover.
+- **UX**: changed flows users rely on; unverified UI.
+
+## Rollback plan (required for risky changes)
+For each risky step, state how to back it out:
+- **Migrations**: is there a reversible `down` / a documented manual revert? Is data
+  loss possible on rollback? If rollback is unsafe, is bounded forward recovery rehearsed?
+- **Feature flag**: can it be disabled without a deploy?
+- **Revert boundary**: can the change be `git revert`-ed cleanly, or does it entangle
+  with other work?
+- **Data**: is there a backup / a way to restore prior state?
+- **External/async effects**: can an unknown outcome be reconciled without duplicating it;
+  who drains/replays/quarantines work and repairs partial state?
+- **Configuration/deployables**: what order restores compatible versions and values at
+  every root/environment?
+
+## Blocking rules
+- A **destructive or data-migration change with no rollback plan** is a **NO-GO**.
+- A data change with unknown invariant/tenant impact, no interruption/retry proof, or no
+  rollback/forward-recovery rehearsal is **NO-GO**.
+- A new/changed external or asynchronous boundary with blind retry, silent partial success,
+  or no outage/backlog recovery and monitoring is **NO-GO**.
+- Unsafe intermediate deployment order, unvalidated required configuration, or no watched
+  rollout signal/owner is **NO-GO** for live exposure.
+- Record the chosen rollback path in `seal.md` → "Risks / Rollback".
+
+## Fresh-context availability
+
+A required review must run in a fresh spawned agent:
+
+- If the named role is unavailable, record the roster skip reason and keep seal
+  **NO-GO**.
+- Never run the reviewer in the root context or log root work as a dispatched review.
+- AFK never auto-accepts a missing reviewer.
+- Security or irreversible-risk scope remains NO-GO while independent review is
+  unavailable.
+
+## Destructive operations
+Confirm any destructive step with the user before shipping. Verify backups exist where
+relevant. Never treat an irreversible action as routine.

package/pack/generated/devin/skills/rite-seal/reference/seal-template.md

@@ -0,0 +1,27 @@
+# `seal.md` template
+
+```md
+# Seal: <Feature>
+Verdict: GO / NO-GO
+Candidate SHA-256: <64 lowercase hex>
+## Acceptance Criteria
+- <AC>: <evidence>
+## Verification Evidence
+<proof>
+## Reviewer Accounts
+- devrites-spec-reviewer: <outcome>
+- devrites-code-reviewer: <outcome>
+- devrites-test-analyst: <outcome>
+- devrites-frontend-reviewer: <outcome>
+- devrites-security-auditor: <outcome>
+- devrites-performance-reviewer: <outcome>
+- devrites-devex-reviewer: <outcome>
+## Risks / Rollback
+<risks/recovery>
+## Stood Decisions
+<doubt verdict per stood decision>
+## Blockers / Follow-ups
+<blockers/follow-ups>
+## Final Decision
+<verdict/reason>
+```

package/pack/generated/devin/skills/rite-ship/SKILL.md

@@ -0,0 +1,91 @@
+---
+name: rite-ship
+description: Commit, push, tag, archive, or close a sealed feature after /rite-seal GO. Use for repository mutation; not for GO/NO-GO readiness.
+argument-hint: "[feature-slug]"
+---
+
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/candidate-integrity.md","devrites-lib/reference/standards/git-workflow.md","devrites-lib/reference/standards/definition-of-done.md","devrites-lib/reference/standards/release/ship-checklist.md","rite-ship/reference/git-ship.md","rite-ship/reference/rollout.md","rite-ship/reference/close-out.md","rite-ship/reference/ship-template.md","rite-ship/reference/anti-patterns.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","evidence.md","touched-files.md","review.md","seal.md"]} -->
+> Read-set manifest: `devrites-engine context <slug> --phase ship` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+
+
+# /rite-ship: ship + close the task
+
+`/rite-seal` decides; `/rite-ship` mutates Git and closes. Read the active workspace;
+if absent, route to `/rite-spec <feature>`. Ship only with current **GO** in `seal.md`.
+
+## Rules consulted (read on demand from `.devin/skills/devrites-lib/reference/standards/`)
+**Step 0:** Read [`core.md`](../devrites-lib/reference/standards/core.md), then pull as needed:
+- [`git-workflow.md`](../devrites-lib/reference/standards/git-workflow.md): Conventional Commits, atomicity, never-commit list.
+- [`afk-hitl.md`](../devrites-lib/reference/standards/afk-hitl.md): AFK pause rules for irreversible actions (the type-GO gate itself: [`git-ship.md`](reference/git-ship.md), [`rollout.md`](reference/rollout.md)). Trigger `afk` — load when `.devrites/AFK` exists.
+- [`definition-of-done.md`](../devrites-lib/reference/standards/definition-of-done.md): acceptance, evidence, drift, rollback, docs.
+- [`release/ship-checklist.md`](../devrites-lib/reference/standards/release/ship-checklist.md): final pass/fail sweep.
+
+## Operating rules
+- **GO is prerequisite.** No current `seal.md` GO → stop at `/rite-seal`.
+- **Ship is candidate-read-only.** Follow
+  [`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md).
+  Ship must not change any candidate path or `touched-files.md`; it may write only
+  workspace `ship.md`, `state.md`, and archive bookkeeping. Project/manifest mutation
+  returns through Prove → Review → Seal.
+- **Bindings stay exact.** Rerun candidate/Seal checks; require the digest bound in
+  evidence, optional browser evidence, review, and seal. Any mismatch stops.
+- **Fresh approval.** Disclose the exact Git attempt; literal `GO` authorizes it once.
+  Change/retry means re-prompt. Native approval remains separate/authoritative.
+- **Archive, never delete,** every audit `.md`.
+
+## Workflow
+1. **Orient.** Snapshot; read seal, state, spec, touched files, evidence, and any UI
+   brief. Confirm GO/closed digest, then run:
+   ```bash
+   devrites-engine check candidate <slug>
+   devrites-engine check seal <slug>
+   ```
+   Nonzero/mismatch stops; never reinterpret it.
+1a. **Health (advisory).** Apply `/rite-doctor` read-only; surface WARN/FAIL without
+   repair. If ACTIVE is flagged, confirm the slug.
+2. **Prepare the exact Git candidate.** Follow
+   [`git-ship.md`](reference/git-ship.md): refuse out-of-manifest staged work; stage
+   exact manifest paths only after Seal GO; compare NUL-delimited staged state/path
+   sets, require identical index/worktree bytes, and rerun candidate/Seal checks.
+   From the verified index, build the exact project-conformant message/trailers,
+   branch, tag/PR, commands, and skips.
+2a. **Credential guard (HIGH blocks).** Scan staged blobs and any PR body. HIGH stops
+   and requires rotation/redaction; MEDIUM needs confirmation recorded in `ship.md`;
+   LOW is FYI.
+   ```bash
+   devrites-engine secret-scan --staged
+   ```
+   Scan a PR body with `devrites-engine secret-scan --stdin` only through non-logging
+   process stdin, then close it—never command/argv/env/heredoc/log/temp file. If that
+   channel is unavailable, stop. **rc=3 → STOP:** no type-GO/commit/push/archive.
+2b. **Reconcile residuals before type-GO.** Scan `strategy.md` deferrals,
+   `decisions.md` FYIs/revisit triggers, unresolved `review.md` non-blocking/if-minor/
+   FYI findings, and `seal.md` follow-ups. Deduplicate only rows with identical
+   obligation + disposition, preserving every source pointer. Each residual appears
+   once in the pending `ship.md` table as `tracked` (durable path/ID) or `no-action`
+   (prior decision or explicit human acceptance + reason/revisit). Type-GO never
+   implies `no-action`. Missing/vague/conflicting disposition blocks; `none` requires
+   empty sources.
+3. **Type-GO.** Render [`git-ship.md`](reference/git-ship.md)'s prompt and wait.
+   Literal `GO` proceeds once; anything else records cancellation in `ship.md` and
+   stops. Any command/scope/branch/message/tag/PR change or retry needs a fresh prompt;
+   native approval is still required.
+4. On GO, commit; verify committed state/path set and exact candidate digest; then push →
+   tag/PR as applicable via `git-ship.md`. Capture SHA(s), branch, tag/PR URL. Mismatch
+   stops before push/tag; retry needs fresh approval.
+4a. **PR only:** render [`git-ship.md`](reference/git-ship.md#pull-request-body)'s
+   structured body; omit empty sections.
+5. Re-scan the four residual sources; any new/missing/changed item blocks archive.
+   Write [the template](reference/ship-template.md) with shipment metadata and the
+   unchanged pre-GO reconciliation.
+6. **Close.** Set `state.md` phase `done`; follow
+   [`close-out.md`](reference/close-out.md) and run `devrites-engine state close <slug>`
+   to move `.devrites/work/<slug>` → `.devrites/archive/<slug>` and clear `ACTIVE`
+   only if it names this slug; preserve another active feature's cursor.
+   Preserve every `.md`; stable hierarchical instructions need no active-workspace sync.
+   Report the recorded `Next step` verbatim — the exact `/rite-spec <parent>-<n> "<objective>"`
+   when a continuation sequence remains — so the next increment starts from one line,
+   never from chat memory.
+
+> **Mid-flight discipline.** No seal GO, skipped type-GO, out-of-manifest stage, or
+> deleted workspace. Stop and use [`anti-patterns`](reference/anti-patterns.md).

package/pack/generated/devin/skills/rite-ship/reference/anti-patterns.md

@@ -0,0 +1,28 @@
+# rite-ship: anti-patterns
+
+Load this before any irreversible action: `git commit`, `push`, `tag`, publish, deploy,
+or when tempted to skip the close-out.
+
+Pack-wide rationalizations + red flags: see
+[standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-patterns.md).
+
+## Phase-specific rationalizations
+
+| Excuse | Rebuttal |
+|---|---|
+| "Seal said GO, so I can just push." | A GO verdict is a decision, not authorization. **Render the type-GO prompt every time** and wait for the literal `GO`. |
+| "I'll push the tag now; type-GO is a formality." | Type-GO is the last safety net before an irreversible action. Always render it: even under auto-trigger. |
+| "`git add -A` is faster than listing touched files." | Stage only what's in `touched-files.md`. `-A` sweeps secrets, scratch files, and out-of-scope edits into the ship. |
+| "The evidence is probably still good." | Recheck the canonical candidate digest and every artifact binding. Any mismatch stops. |
+| "The ledger/DESIGN/ADR update is just ship bookkeeping." | Those are candidate paths. Route the change through Polish, affected Prove, Review, and Seal; Ship is read-only. |
+| "Delete the workspace, the feature's done." | Closing **archives** the workspace (`.devrites/archive/<slug>/`); it never deletes the audit trail. |
+
+## Red Flags
+
+- About to run `git push` / `git tag` without rendering the type-GO prompt.
+- Shipping without a `GO` verdict recorded in `seal.md`.
+- Staging files not listed in `touched-files.md`, or any secret / `.env`.
+- Changing a candidate path or the manifest after Seal.
+- Pushing or tagging before the committed NUL-delimited state/path and digest checks pass.
+- `rm`-ing `.devrites/work/<slug>/` instead of archiving it.
+- Marking the feature `done` but leaving `.devrites/ACTIVE` pointing at it.

package/pack/generated/devin/skills/rite-ship/reference/close-out.md

@@ -0,0 +1,68 @@
+# Close-out: archive the workspace, free the active slot
+
+Closing a feature means it stops being the *active* work, not that its record is
+deleted. DevRites keeps the audit trail; it just moves out of the live path.
+
+## What close-out does
+
+1. **Mark done.** Set `state.md` → `Phase: done`, `Status: done`, and a `Next step`.
+   When this workspace's `decisions.md` records an unfinished
+   [continuation sequence](../../rite-plan/reference/slicing.md#continuation-workspaces),
+   that step is the **exact** next command — `/rite-spec <parent>-<n> "<objective>"` —
+   and the ship reply prints the same line. Otherwise it stays
+   `/rite-spec <next feature>`. Nothing spawns the continuation automatically:
+   the recorded command is the handoff, so the human starts each increment knowingly.
+2. **Archive.** Run the deterministic script:
+   ```bash
+   devrites-engine state close <slug>
+   ```
+   It moves `.devrites/work/<slug>/` → `.devrites/archive/<slug>/` (every `.md`
+   intact) and clears `.devrites/ACTIVE` **only if** ACTIVE still points at `<slug>`.
+   It refuses to clobber an existing `.devrites/archive/<slug>/` (exit 5).
+3. **Confirm the observed post-state.** The archive exists with its audit records
+   intact and the live workspace is absent. If ACTIVE named this slug, verify it is
+   empty; if it named another feature, verify that value remains unchanged. Only an
+   empty cursor permits the claim "no active feature".
+
+Any nonzero exit stops close-out. Archive collision (exit 5) never authorizes overwrite.
+If clearing ACTIVE fails, the engine attempts to move the archive back; that rollback
+can also fail. Inspect the actual live path, archive and cursor before reporting or
+retrying. Record the command/error and observed locations; never claim restored state
+from an attempted rollback or repeat a move against an unverified destination.
+
+## Sequence predecessors
+
+A deferred-ship sequence leaves earlier milestones sealed and unarchived in
+`.devrites/work/`. The release ship's disclosed plan may close them
+(`devrites-engine state close '<slug>'` per predecessor) after the release commit
+lands; each close is safe because `ACTIVE` names the release workspace. Closing is
+bookkeeping only: the release commit already carries their bytes, and their audit
+records move intact.
+
+## Why archive, not delete
+
+- The `.md` files (`spec`, `decisions`, `assumptions`, `evidence`, `seal`, `ship`, …)
+  are the project's record of *why* the feature is the way it is. A future
+  `/rite-zoom-out` or incident review reads them.
+- Deleting them would make the workflow's own "evidence over confidence" rule a lie.
+
+## Re-opening an archived feature
+
+Before restoring an archive, verify its identity, released cursor form and declared
+workspace schema, that the live destination is absent, and that ACTIVE is empty or
+already names this slug. A collision or another active feature stops restoration;
+do not replace its workspace or cursor. Supported released cursor forms remain valid:
+age or encoding alone never requires normalization (see
+[workspace-artifact-schema.md](../../devrites-lib/reference/workspace-artifact-schema.md)).
+An unsupported declared schema stops restoration: record the observed version,
+installed engine's recovery diagnostic and pending normalization owner. Do not guess
+a repair or claim `/rite-upgrade` migrates archives; archived/done work is its no-op.
+
+After an authorized restoration, verify the actual paths and cursor and preserve the
+audit records. Reconcile the resumed scope through `/rite-converge`; changes return to
+the applicable earlier lifecycle stage. Historical proof/GO remains historical: a new
+candidate requires fresh Prove → Polish → Review → Seal bindings before Ship. Restoring files
+does not reactivate an old GO.
+
+Cross-feature review is user-invoked through `/rite-learn`; close-out does not
+mine, score, nudge, or write a retrospective ledger.

package/pack/generated/devin/skills/rite-ship/reference/git-ship.md

@@ -0,0 +1,120 @@
+# The irreversible ship: type-GO + git ladder
+
+`/rite-ship` alone runs irreversible actions. A seal GO is never authorization for Git.
+Require fresh approval for one disclosed attempt plus native permission.
+
+## The type-GO prompt (render verbatim, wait)
+
+```
+Feature:  <slug>
+Verdict:  GO  (seal.md)
+Acceptance criteria proven: <n / total>
+Branch:   <target branch>
+Candidate paths: <exact project-relative paths>
+Checkpoint collapse: <exact `git reset --soft '<merge-base>'` command | skip>
+Collapse slugs: <active slug plus every recorded sequence slug in the range | n/a>
+Stage plan: <exact argv-safe `git add -- '<path>'` command for every manifest row>
+Commit:   <exact git commit command>
+Push:     <exact git push command | skip>
+Tag:      <exact git tag command | skip>
+PR:       <exact PR command, target, title, and body source | skip>
+Close:    <exact `devrites-engine state close '<slug>'` for each sealed sequence predecessor | skip>
+
+Type "GO" exactly to approve this attempt once. Anything else cancels.
+```
+
+Rules:
+- Render every attempt; autocomplete flags only reach this boundary.
+- Only literal `GO` proceeds. Anything else cancels, records
+  `user declined irreversible step at <ts>` in `ship.md`, and stops.
+- `GO` is one-use for the shown scope/commands; changed/retried plans re-prompt.
+- Prior answers, AFK, seal GO, and native approval do not replace type-GO;
+  type-GO never replaces/bypasses native permission or sandbox approval.
+
+## The candidate-safe Git ladder
+
+Follow [`git-workflow.md`](../../devrites-lib/reference/standards/git-workflow.md) and project convention; invent no release flow.
+Candidate identity always comes from `devrites-engine check candidate`; do not
+implement a Git-side hash.
+
+### Before type-GO
+
+Pre-GO is read-only. Do not run the disclosed collapse or staging commands.
+
+0. **Protect existing index work.** Read the NUL-delimited staged state/path set.
+   Refuse a pre-existing staged path outside the manifest; never unstage, stage,
+   reset, or discard user work.
+1. **Analyze checkpoint history without mutating it.** Read the upstream, merge
+   base, commit OIDs, and full subjects. If no checkpoint commit exists, disclose
+   `skip`. A collapse is eligible only when every commit in its range has the exact
+   `WIP(<slug>):` prefix for the validated active slug — or, for a release ship of a
+   deferred-ship sequence, for a slug recorded in the parent's `decisions.md`
+   sequence whose workspace is sealed in this run
+   ([afk-hitl.md § Sequence continuation](../../devrites-lib/reference/standards/afk-hitl.md#sequence-continuation-continue_sequence-max_workspaces));
+   disclose the exact slug set. A different slug, missing colon, broad `WIP(` match,
+   ordinary commit, or mixed history blocks; never reinterpret the range.
+2. **Verify the candidate.** Rerun `devrites-engine check candidate <slug>` and
+   `devrites-engine check seal <slug>`, compare every binding, require the
+   candidate worktree paths to be unchanged, and inspect the existing staged
+   scope. These checks do not prepare the index.
+3. **Prepare the disclosure.** Build argv-safe commands from literal validated
+   paths, without `eval` or command-string interpolation. Run only read-only
+   secret scans of the existing staged state and proposed PR body. Render the
+   literal prompt with the exact optional collapse command or `skip`, exact stage
+   plan, commit, push, tag, and PR commands; then wait.
+
+### After type-GO
+
+1. **Optional checkpoint collapse.** If and only if the prompt disclosed it,
+   recheck that `HEAD`, merge base, and every subject are unchanged and that each
+   subject starts exactly `WIP(<slug>):` for the disclosed slug set, then run the
+   exact disclosed `git reset --soft "$mb"`. Otherwise skip. Any different or mixed
+   subject blocks without mutation.
+2. **Exact staging.** Run `git add -- "$path"` once for each disclosed manifest
+   row, passing each validated project-relative path as its own quoted argv
+   element. Use no glob, directory, `-A`, `.env`, secret, out-of-scope path,
+   `eval`, or interpolated command string.
+3. **Compare staged scope.** Compare the NUL-delimited output of
+   `git diff --cached --name-status --no-renames -z` to the manifest's exact
+   state/path set. `present` maps only to `A` or `M`; `deleted` maps only to `D`.
+   Reject missing, extra, renamed, duplicated, or differently classified paths.
+4. **Compare staged bytes.** Require no index-to-worktree difference for any
+   manifest path. A dirty manifest path stops; never stage or reinterpret it
+   after this comparison.
+5. **Revalidate immediately before commit.** With no intervening mutation,
+   rerun `devrites-engine check candidate <slug>` and
+   `devrites-engine check seal <slug>`, require the exact candidate digest and
+   every evidence/browser/review/Seal binding, then run the staged secret scan.
+   Any scope, byte, identity, binding, scan, history, or command drift invalidates
+   the one-use approval. Stop and render a fresh type-GO prompt; do not repair the
+   drift under the old approval.
+6. **Commit** one logical change using Conventional Commit and a why-body.
+   Non-trivial work adds applicable `Constraint:`, `Rejected:`, `Confidence:`,
+   `Scope-risk:`, and `Not-tested:` workspace trailers; trivial edits omit them.
+7. **Verify the commit.** Immediately after the authorized commit and before any
+   push or tag, compare
+   `git diff-tree --root --no-commit-id --name-status --no-renames -r -z HEAD`
+   to the manifest using the same exact state/path mapping. Require candidate
+   paths still match `HEAD`, then rerun `devrites-engine check candidate <slug>`
+   and `devrites-engine check seal <slug>` and compare the exact digest again.
+   Any mismatch stops; do not reinterpret it.
+8. **Push** to the project-conventional target branch.
+9. **Tag / PR** only when project convention requires it; otherwise skip.
+10. **Close sealed predecessors** only when the prompt disclosed them: run the
+    exact `devrites-engine state close '<slug>'` once per predecessor. Each is safe
+    because `ACTIVE` names the release workspace; a nonzero exit stops the rest and
+    is reported, never retried against an unverified destination.
+
+Record SHA(s), branch, and tag/PR URL in `ship.md`.
+
+## Pull request body
+
+When this ship opens a PR, include only applicable sections:
+
+- **Summary:** what shipped and acceptance proven.
+- **Risk & rollback:** migration/auth/destructive risk and reversal from `seal.md`.
+- **What to scrutinize:** highest-blast-radius review stops.
+- **Evidence:** condensed proof plus the archived evidence bundle.
+
+For an agent-owned staged rollout, apply [`rollout.md`](rollout.md). CI-owned deploys
+skip that branch. Delete empty sections rather than writing `N/A`.

package/pack/generated/devin/skills/rite-ship/reference/rollout.md

@@ -0,0 +1,62 @@
+# Staged rollout and recovery: live deploys only
+
+Load this only when `/rite-ship` itself is explicitly authorized to drive a live
+deployment. Git-only Ship stops before rollout; CI-owned deployment follows the pipeline's
+runbook. A Seal GO or AFK setting never authorizes production action.
+
+## Preconditions before exposure
+
+Record one rollout sheet in `ship.md`:
+
+| Item | Required decision/evidence |
+| --- | --- |
+| Units and order | Repository/deployable, schema, config, application, worker, contract, and flag order; safe old/new combinations. |
+| Exposure stages | Project-native internal/canary/cohort/percentage/region stages and hold window. |
+| Advance/hold/abort signals | Project baseline or SLO, measurement window, minimum sample, exact threshold, and owner. |
+| Recovery | Fastest safe mechanism, steps, owner, measured/rehearsed time, and data/external-effect reconciliation. |
+| Observability | Watched dashboard/query/alert, failure signal, and executable first action. |
+| Authorization | Exact target/action approved for this attempt; no inferred retry permission. |
+
+Do not import generic percentage, latency, error-rate, or time-to-rollback numbers. Use
+accepted product risk, current baseline/SLO, traffic volume, and platform capability. If the
+project has no defensible threshold or signal, the monitoring gap blocks live exposure.
+
+## Choose the smallest reversible mechanism
+
+- A feature flag is useful only when the off path preserves current behavior, both states
+  are tested, disabling it stops the risky effect, and it has an owner/removal trigger.
+  Do not add a flag to a change already reversible by a safe atomic deploy.
+- A flag cannot reverse destructive data/schema effects. Apply
+  [`data-integrity.md`](../../devrites-lib/reference/standards/data-integrity.md) and prove
+  restore or forward recovery separately.
+- External APIs, webhooks, queues, jobs, and caches apply
+  [`integration-reliability.md`](../../devrites-lib/reference/standards/integration-reliability.md):
+  reconcile unknown outcomes, drain/quarantine/replay safely, and protect downstream capacity.
+- Multi-root/service rollout follows
+  [`repository-topology.md`](../../devrites-lib/reference/standards/repository-topology.md);
+  references to another repository never grant write/deploy authority there.
+
+## Stage, observe, decide
+
+At each authorized stage:
+
+1. Verify the intended versions/config/schema and candidate identity on the exact target.
+2. Exercise one critical success path and the declared degradation/recovery signal.
+3. Observe for the recorded window and sample; bind results to the stage and baseline.
+4. **Advance** only when every advance condition holds. **Hold** on ambiguous or
+   insufficient evidence. **Abort/recover** immediately on an abort condition, security or
+   tenant breach, data-integrity violation, unreconciled duplicate/unknown effect, or loss of
+   observability.
+5. Re-verify after recovery; record partial effects and reconciliation. A rollback command
+   exiting zero is not proof the prior state or data was restored.
+
+Never compress stages because an early sample "looks fine," continue through a monitoring
+gap, or retry a failed live action without fresh authorization when the attempt/target changes.
+
+## Completion
+
+Rollout is complete only when full intended exposure meets the recorded window/signals,
+telemetry is still watched, migrations/backfills and queues/reconciliation are settled,
+documentation matches deployed behavior, and temporary flags/compatibility paths have a
+dated removal owner. Otherwise report the exact current stage and remaining risk; do not call
+the launch done.

package/pack/generated/devin/skills/rite-ship/reference/ship-template.md

@@ -0,0 +1,39 @@
+# `ship.md` template
+
+Write before close-out; it moves to `.devrites/archive/<slug>/ship.md`.
+
+```markdown
+# Ship: <slug>
+
+- Shipped at: <iso>
+- Verdict: GO (seal.md)
+- Branch: <branch>
+- Commit(s): <sha> [<sha> …]
+- Tag/PR: <value|none>
+
+## What shipped
+<project-vocabulary paragraph>
+
+## Acceptance
+- Proven: <n/total> (evidence.md/seal.md)
+- Outstanding: <rows below | none>
+
+## Evidence
+- seal.md — verdict/reconciliation
+- evidence.md — acceptance; browser-evidence.md if UI
+- review.md — review findings
+
+## Follow-up reconciliation
+Checked: strategy.md (if present), decisions.md, review.md, seal.md.
+
+| Source | Item | Disposition | Destination / rationale |
+|---|---|---|---|
+| <file + section> | <item> | tracked | <durable path/ID> |
+| <file + section> | <item> | no-action | <decision or explicit human no-action approval + reason/revisit> |
+
+<If empty: No residual items found.>
+```
+
+Keep pointers short. Acceptance MUST match `seal.md`. Each source residual appears
+once; a missing target, unsupported `no-action`, vague disposition, or conflict blocks
+close-out.