devrites 5.10.2 → 5.12.0

package/pack/generated/devin/skills/rite-vet/reference/anti-patterns.md

@@ -0,0 +1,43 @@
+# /rite-vet: anti-patterns
+
+Read [universal anti-patterns](../../devrites-lib/reference/standards/anti-patterns.md).
+
+Authority: `.devin/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+## Phase rationalizations
+
+| Excuse | Rebuttal |
+|---|---|
+| "I'll write all the findings into `eng-review.md` and let the user read it." | Fold verified behavior-preserving findings together and recheck affected closure. Ask human-owned choices with recommendations and await answers. Recording alone resolves nothing; never silently change acceptance or mark unresolved choices READY. |
+| "The plan doesn't handle X: flag it." (without checking) | Quote the line first. If you can't quote where the plan handles X, you also can't be sure it doesn't: force confidence ≤4 and suppress. The "field/case doesn't exist" finding is the most common false positive; the verification gate exists to kill it. |
+| "It's an obvious fix. I'll just edit the plan." | Vet hardens verified plans; topology uses the marked action. |
+| "This dimension is thin but the others are strong: net it's fine." | The gate is the **floor**, not the average. A plan `broken` on test-coverage does not pass because it's `strong` on architecture. |
+| "I can see it's adequate. I'll note the band, the evidence is obvious." | Cite quoted evidence **before** the band; never score first and rationalize later. |
+| "8+ files but it all needs to change: proceed." | Apply `review-axes.md` §0: justify complexity against the smallest contract-complete alternative; fold technical reductions through the marked action. File count does not justify design or require a pause. Ask only for changed scope, behavior, or risk policy. |
+| "There's no test for this, but the user can add one later." | Coverage is designed **now**, before the code, so the build writes tests alongside it. A deferred test is a test that misses the boundary cases writing-it-now would expose. Regressions are non-negotiable. Critical, no question. |
+| "Performance looks fine." | "Looks fine" is not a measurement. A perf finding is "measure X against budget Y" or it's nothing: don't recommend speculative tuning, and don't wave past an N+1 you can quote. |
+| "Cross-model agrees, so apply it." | Consensus is a signal, not proof or approval. Verify the finding against source, then use the same technical-hardening or human-owned decision route; model agreement never authorizes a scope, acceptance, or policy change. |
+
+## Reslice classifier rationalizations
+
+**RSLICE-VET-001** — Slice/topology growth alone does not stop; fewer slices do not prove scope reduction; remediation does not grow product.
+
+## Red flags
+- `eng-review.md` / `test-plan.md` written but `plan.md` / `tasks.md` **not** hardened: the build
+  follows the plan, so the review changed nothing.
+- A finding raised with confidence ≥7 but **no quoted source line**, that defeats the verification gate.
+- Acceptance/product-behavior growth auto-applied in AFK, or an orthogonal human-owned gate that did not pause.
+- A failure-mode table with rows but no verdict column filled: a "no test + no handling + silent" row not marked Critical.
+- Repeating an exhausted causal failure under the shared no-progress rule in
+  [`afk-hitl.md`](../../devrites-lib/reference/standards/afk-hitl.md), or stopping a
+  distinct cause solely because the total review round exceeds three.
+- The reviewer / cross-model being handed the author's reasoning as independent
+  evidence (defeats the fresh-context point).
+- The skill writing code, implementing a slice, or running the build. That's `/rite-build`. Vet reviews and hardens the plan; it never implements.
+- Re-litigating the **spec's** scope/ambition, that was `/rite-temper`. Vet challenges *implementation* scope only.

package/pack/generated/devin/skills/rite-vet/reference/artifacts.md

@@ -0,0 +1,221 @@
+# `eng-review.md` + `test-plan.md` templates + fold-back rules
+
+`eng-review.md` records review; `test-plan.md` drives Build. Fold accepted findings
+into `plan.md`/`tasks.md`; prose alone never changes Build.
+
+Authority: `.devin/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+## `eng-review.md`: the record
+
+Write/update `.devrites/work/<slug>/eng-review.md`; never clobber.
+
+```markdown
+# Eng review: <slug>
+Vetted: <iso>   Cross-model: ran (codex) | off
+Implementation readiness: <READY | NEEDS CLARIFICATION | NEEDS REPLAN>
+(`NEEDS REPLAN` is the eng-review field value; `NEEDS_REPLAN` with an underscore
+is the autocomplete/reply-contract routing token — do not conflate.)
+Readiness inputs SHA-256: <64 lowercase hex>
+
+## 1. Depth
+light | full (<trigger that escalated it>)     # every plan is vetted — light or full, never skipped (see depth.md)
+
+## 2. Scope challenge
+- Existing reuse: <findings adopted by the plan>
+- Minimum diff: <accepted | trimmed n; list in NOT-in-scope>
+- Complexity: ok | smell (<n files, m new services) → asked → <reduce|proceed, why>
+- Built-in / completeness / distribution: <flags, with source citations>
+
+## 2a. Build-entry preflight
+| Gate | Command + cwd | Tool/version | Prerequisite owner | Full provenance inputs | Fixture/smoke | Verdict |
+|---|---|---|---|---|---|---|
+| <test/browser/package> | <command · cwd> | <version> | <owner + item> | <tool/manifest/lockfile/config SHA-256> | <what ran> | pass/fail/blocked |
+
+## 2b. Implementation readiness
+| Surface | Requirement/decision | Boundary/wiring | Slice | Proof | Verdict |
+|---|---|---|---|---|---|
+| <journey/data/interface/ops> | <REQ/AC + coverage row> | <contract + key link> | <SLICE-###> | <test-plan row> | ready/gap |
+
+Inventory/currentness: <pass/gaps> · slice order/independence: <pass/gaps> ·
+UX/spec/architecture: <pass/n-a/gaps> · operations/rollout/rollback: <pass/n-a/gaps>
+
+Shared contract proof: <pass | gap: missing/one-sided/duplicated-contract/vague/non-consuming>
+One-shot evidence completeness: <n/a | pass: action + retained artifact + bounds/sanitization + injective boundary map + per-seam/collision/cleanup fixtures | gap: exact missing proof>
+
+## 3. Axis findings (floor-gated)
+| Axis | Floor band | Findings (sev · confidence) |
+|---|---|---|
+| Architecture | strong/adequate/thin/broken | Critical (9) … |
+| Plan code-quality | … | … |
+| Test-coverage design | … | see test-plan.md |
+| Performance | … | … |
+Suppressed (confidence ≤4, unverified): <count — one line each>
+
+## 4. Failure modes
+| New codepath/boundary | Realistic failure | Partial/unknown effect | Recovery owner/path | Proof? | Silent? | Verdict |
+|---|---|---|---|---|---|---|
+| <path> | timeout / duplicate / race / stale | <state/effect> | <owner/action> | y/n | y/n | ok / **CRITICAL gap** |
+
+## 5. Dependency safety
+<declared order is safe | exact dependency/order correction>
+
+## 6. Native reviewer accounts
+- `devrites-plan-reviewer`: <findings + resolution | evidence-based No-findings>
+- `devrites-strategy-reviewer`: <current Temper verdict | Not-applicable: low-stakes skip>
+- `devrites-devex-reviewer`: <findings + resolution | No-findings | Not-applicable: no developer surface>
+- Recheck: <not-needed | one narrow recheck and result>
+- Cross-model (if --cross-model): <overlap / unique findings — informational until approved>
+- Final: floor = <band>; unresolved → <none | blocking qid>
+
+## 7. Completion summary
+- Outcome: <one sentence; REQ/AC refs>
+- Boundaries: <IN/OUT/must-NOT refs>
+- Design/flow: <UI/n-a; chosen seams/why; happy/error refs>
+- Delivery: <slice order + first>
+- Proof/gates: <test-plan rows; justified action-time gates>
+- Review: scope <accepted/reduced>; architecture <n>; quality <n>; coverage <x/y>,
+  gaps <n>, Critical regressions <n>; failure modes <n>, Critical gaps <n>.
+- Entry/records: preflight <pass/fail/blocked>; checkpoints <none/list>;
+  NOT-in-scope + existing written; plan <hardened | n Guard deltas>.
+```
+
+## `test-plan.md`: the build-readable coverage target
+
+Write/update `.devrites/work/<slug>/test-plan.md`. `/rite-build`'s slice-wright
+writes tests from it; `/rite-prove` walks it against `evidence.md`. Specify
+*what/where* to test, not implementation.
+
+```markdown
+# Test plan: <slug>
+From /rite-vet on <iso>. Runner + conventions: <detected framework + command>.
+
+## Build-entry preflight
+| Gate | Command | Cwd | Expected | Prerequisites | Provenance to recapture |
+|---|---|---|---|---|---|
+| <test/browser/package> | <exact command> | <path> | <exit/output> | <service/browser/credential owner> | <tool version + full SHA-256s> |
+
+Link any disposable parser fixture. Preflight values are planning evidence, not post-build proof;
+Prove recaptures the observed command, candidate identity, and result.
+
+Commands in this durable artifact are portable repository commands: no RTK or local shell
+aliases, user-specific absolute paths, or temporary proof trees. Evidence records
+the command actually executed.
+
+## Consumptive action gates
+| Action | Why one-shot/consumptive | Retained artifact | Bounds + sanitization | Boundary map + collision proof | Terminal-path fixtures | Cleanup survival | Retry authority |
+|---|---|---|---|---|---|---|---|
+| <exact approved action or n/a> | <one attempt/quota/state/evidence deletion> | <durable operator-controlled path/schema> | <size/cardinality + known/unknown/malformed handling> | <every emit seam -> stable boundary ID; per-seam injection + alias mutant rejected> | <success/known/unknown/hostile> | <assertion> | <none/fresh human authorization> |
+
+Every behavioral row names a positive, discriminating assertion and the decisive output it
+produces. A command or expected exit zero alone is not a behavioral assertion; static gates
+prove only their named static criterion.
+
+## Coverage diagram
+<the ASCII code-paths + user-flows diagram from review-axes.md, with COVERAGE / GAPS / REGRESSIONS line>
+
+## Per-gap test requirements
+| ID | Path / flow | Test file (match conventions) | Asserts (input → expected) | Kind | Slice | Priority |
+|---|---|---|---|---|---|---|
+| T1 | <path> | <path/to.test> | <empty list → 200 + []> | unit / E2E / eval | <slice> | P1 / **Regression-Critical** |
+
+## Interaction inventory (UI slices — every element + flow gets an asserting test)
+Enumerate every interactive element and user flow the feature exposes; one row each, none
+skipped. Level per [`testing.md`](../../devrites-lib/reference/standards/testing.md) "Completeness": elements/fields → unit/component, critical
+journeys → one E2E (never one-per-field). `/rite-build` must cover every row; `/rite-prove`
+fails any row with no passing result — an unverified element is a NO-GO, like an unproven criterion.
+```markdown
+| Element / flow | Kind (field/checkbox/select/radio/toggle/button/link/flow) | Level | Test file | Asserts (action → expected) |
+|---|---|---|---|---|
+| email field | field | unit | <form.test> | invalid → error; valid → accepted |
+| login | flow ★★★ | E2E | <login.e2e> | submit → dashboard |
+```
+
+Omit the whole section only for a slice with **no** interactive surface (pure backend/logic).
+
+## Acceptance → test map
+
+- <spec acceptance criterion> → <T1, T3>   # every criterion maps to ≥1 test
+
+For every row in `plan.md`'s `Shared contract proof`, the per-gap requirements name both
+provider- and consumer-side asserting tests and state how each consumes the same canonical
+artifact. Reference the plan row; do not reproduce its contract table here.
+
+## `gates.md`: the acceptance ledger
+
+Write `.devrites/work/<slug>/gates.md` once the preflight table is final —
+`devrites-engine gates scaffold <slug>` seeds one pending gate per `AC-###` in
+`spec.md`; never clobber a ledger that already carries evidence. Grammar,
+evidence binding, and oracle rules live in
+[`gates.md`](../../devrites-lib/reference/standards/gates.md); the engine
+enforces them, so author to the contract, not around it:
+
+- One gate per required outcome; reuse `AC-###` ids so readiness coverage and
+  the ledger name the same set.
+- A runnable gate's `CHECK` must be a `## Build-entry preflight` `Command`
+  verbatim with a matching `Cwd` — a gate whose command is absent from the
+  preflight table can never execute, so add the row first.
+- `EXPECT` names a line only success can print; `gates lint <slug>` flags
+  tautological commands and weak expectations before build.
+- Manual gates (`EVIDENCE` only) are for judgment-bound outcomes; Prove
+  attests them, Seal still requires them checked.
+
+## Parallelization table (in `eng-review.md` §5 when there's an opportunity)
+
+```markdown
+| Step / workstream | Modules touched (dir-level) | Depends on |
+|---|---|---|
+| API endpoints | controllers/, serializers/ | — |
+| Worker | jobs/, lib/queue/ | API endpoints |
+
+Lanes:  A: API → Worker (sequential, shared lib/)   ·   B: migration (independent)
+Order:  launch A + B in parallel worktrees → merge → C
+Conflicts: Lanes A and B both touch models/ — sequential or coordinate.
+```
+
+## Fold-back: the part the build follows
+
+Vet hardens the plan. Use the marked action before fold-back.
+
+- **Write directly into `plan.md` / `tasks.md`** (single canonical writer: you, not the reviewer):
+  - `plan.md` §Scope boundaries ← "NOT in scope" items.
+  - `plan.md` §Architecture decisions ← reuse-over-rebuild calls + named failure scenarios.
+  - `plan.md` §Applicability and system ownership ← corrected topology/data/integration
+    routing and each triggered standard's feature-specific output.
+  - `plan.md` §Dependency graph / §Implementation order ← any dependency or ordering fix
+    (e.g. refactor-before-feature split).
+  - `plan.md` §Complexity & deviations gate ← any deviation the §0 challenge surfaced + its justification.
+  - `tasks.md` slices ← added test requirements (point at `test-plan.md`), added error-handling /
+    failure-mode coverage, tightened slice scope, a split of a refactor+behavior slice into two.
+    Adjust a slice's `Gate:` upward when vet reveals higher stakes (e.g. an unflagged migration).
+  - Re-run the `plan.md` Readiness gate after edits; it must still pass.
+- **Reslice:** marked action only; no local predicate.
+- **`decisions.md`:** one ADR per material call: `context · decision · why-not-the-alternative ·
+  what-would-change-it`.
+- **`assumptions.md`:** every "we'll probably need X" demoted to an explicit assumption-to-verify,
+  never smuggled into scope as a fact.
+
+## Write discipline
+
+- **Single canonical writer.** The skill writes review/test-plan and edits plan/tasks;
+  `devrites-plan-reviewer` is **read-only** and returns findings + bands.
+- **No silent scope.** Growing acceptance without a decision, or dropping a criterion
+  without the Guard, is a defect.
+- Put `eng-review.md` + `test-plan.md` between `tasks.md` and `state.md`. Build/Prove
+  read test-plan as coverage; Review/Seal may consult eng-review for scope/failures.
+- Finish `test-plan.md`, fold-back, and rechecks first. Changes to `brief.md`, `spec.md`,
+  `decisions.md`, `assumptions.md`, or `questions.md` require revalidating the
+  affected decision-coverage rows, assumption audit, residual uncertainty, and closed gates.
+  Partial/Missing, an unowned material assumption, or an open blocking/escalating question routes
+  `/rite-clarify`/HITL. Re-read affected rows with current evidence; repeat the exact
+  plan-reviewer and applicable strategy/DevEx after edits. Root writes READY only after
+  the checklist. Normal readiness rejects missing/stale bindings; empty tables,
+  placeholders, non-passing preflight rows, or an
+  acceptance criterion with no meaningful test mapping remain native review blockers.
+  After the final recheck, emit the binding with `devrites-engine check readiness
+  --emit-binding <slug>` and replace its one exact line. Never refresh it without Vet.

package/pack/generated/devin/skills/rite-vet/reference/cross-model.md

@@ -0,0 +1,19 @@
+# `--cross-model`: explicit outside integration
+
+This optional pass runs only when the user supplies `--cross-model` and a
+different-model plugin, MCP server, or other native integration is explicitly
+connected. DevRites does not discover aliases, invent a fallback model, or wrap
+availability.
+
+Give the integration the same immutable `spec.md`, `plan.md`, and `tasks.md`
+candidate, without author reasoning. Ask for evidence-backed findings on
+boundaries, scope/reuse, proof design, performance, reversibility, and failure
+modes. The integration must remain read-only.
+
+If no explicit integration is connected, record `requested but not configured`
+and continue with the native `devrites-plan-reviewer`; absence is neither a pass
+nor a blocker.
+
+Verify every returned finding against the project before accepting it. Record
+only the integration used and accepted evidence in `eng-review.md`; do not
+maintain availability aliases or outside-review telemetry.

package/pack/generated/devin/skills/rite-vet/reference/depth.md

@@ -0,0 +1,59 @@
+# Depth calibration: always vet, scale the rigor (never skip)
+
+`/rite-vet` runs on **every** plan. Simple reversible work gets a **light pass**;
+big/risky work gets a **full pass**, never a skip. Standalone Vet and Autocomplete
+use these same depth rules.
+
+A four-section deep-dive on a one-file reversible plan is wasteful; rubber-stamping a
+migration-touching plan is dangerous. Match the effort to the stakes, but **always** leave a
+recorded engineering verdict and a coverage plan.
+
+Authority: `.devin/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+## Full pass when ANY trips
+- **Irreversible-risk contact:** the plan touches anything on the [`afk-hitl.md`](../../devrites-lib/reference/standards/afk-hitl.md) irreversible-risk
+  list: destructive data migration, auth/authz boundary, public-API break, external-service
+  contract, filesystem destruction outside the workspace.
+- **Data model:** new/changed entities, relationships, or persistence shape.
+- **Cross-module blast radius:** the impact (from a code-intelligence index if available (see
+  `../../devrites-lib/reference/standards/tooling.md`) or an honest estimate) crosses
+  module/service boundaries or has many dependents.
+- **Complexity:** `plan.md` touches **>8 files** or adds **>2 new services/modules/classes**.
+- **Multi-slice / multi-day work**, new dependency/pattern/design system. Slice count alone never creates a human pause.
+- **The user asked**, or `--full`.
+
+Full pass = §0 scope challenge + all four axes (each walked finding-by-finding) + the failure-mode
+table + dependency-safety review + the reviewer loop. See [`review-axes.md`](review-axes.md).
+
+## Light pass otherwise (the default for simple plans: still never a skip)
+When none of the full-pass triggers fire, run the **light pass**: a fast but real engineering
+check that still leaves a verdict and a coverage plan. In a handful of lines:
+- **§0 scope challenge, in brief:** confirm minimum diff + reuse (one line each); if a complexity
+  smell or missed reuse appears, escalate that to the full treatment.
+- **One-line scan per axis** (architecture / plan code-quality / test-coverage / performance):
+  "No issues" is a valid result, but you must look and say so per axis, not assume.
+- **Always** produce the acceptance→test map + any regression-Criticals in `test-plan.md`. This is
+  the part that makes "a correct engineering plan for *everything*" real. It never downgrades,
+  light or full.
+- Write the short `eng-review.md` (`Depth: light`) and harden `tasks.md` with the test requirements.
+
+A light-pass finding that turns out to be real **escalates that axis to full treatment** (walk it
+with the human, confidence-banded). Light means *less ceremony*, never *less honesty*.
+
+## In `/rite-autocomplete`
+Autocomplete runs `/rite-vet` after `/rite-define` on **every** feature: light or full per the
+triggers above, **never skipped**. Under the AFK gate ceiling:
+- **Auto-apply (no pause):** hardening findings: added test requirements, error-handling /
+  failure-mode coverage, tightened scope, reuse-over-rebuild, dependency-order fixes
+  (these never grow acceptance). Record the rationale in `decisions.md`.
+- **Topology findings:** marked action; slice count alone never pauses.
+- **Stops:** human-owned irreversible-risk findings pause. Technical recovery follows
+  [the canonical retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve),
+  with no depth-specific round limit; no-progress exhaustion blocks, never grants readiness.
+- **Cross-model** is off by default; it runs only if `--cross-model` was explicitly armed.

package/pack/generated/devin/skills/rite-vet/reference/eng-lenses.md

@@ -0,0 +1,48 @@
+# Senior-engineer lenses: how to *see* the findings
+
+These are not extra checklist items. They are the instincts an experienced staff engineer
+applies while reading a plan: the pattern recognition that separates "read the plan" from
+"caught the landmine". Apply them across all four axes in [`review-axes.md`](review-axes.md):
+each lens turns a vague unease into a concrete, quotable finding.
+
+## The lenses
+
+1. **Boring by default.** A team gets a few innovation tokens; everything else should be proven
+   technology. When the plan introduces something novel (a new datastore, a hand-rolled queue, a
+   bespoke pattern), ask whether this is a wise token to spend or whether a boring built-in does
+   it. → Architecture / Scope axes.
+2. **Blast radius.** For every decision: what's the worst case, and how many systems / callers /
+   users does it touch? A change with wide blast radius and no rollback is a different risk class
+   than a leaf change. → Architecture / Reversibility.
+3. **Reversibility preference.** Prefer the choice that's cheap to undo (feature flag, additive
+   migration, incremental rollout) over the one that's right only if you're right the first time.
+   Make the cost of being wrong low. → Architecture / Reversibility.
+4. **Incremental over revolutionary.** Strangler-fig, not big-bang rewrite; refactor first, then
+   change behavior: never both in one slice. If the plan does a structural rewrite and a behavior
+   change together, split them. → Plan code-quality / slice shape.
+5. **Systems over heroes.** Design for a tired engineer at 3am, not your sharpest engineer on
+   their best day. A plan that only works if every step is done perfectly is fragile. Favor
+   guard rails, explicit errors, and obvious failure paths. → Code-quality / Failure modes.
+6. **Essential vs accidental complexity.** Before anything the plan adds, ask Brooks's question:
+   is this solving a real problem, or one we created? Accidental complexity is the cheapest thing
+   to cut. → Scope / Code-quality.
+7. **Make the change easy, then make the easy change.** If a slice is hard because the surrounding
+   structure fights it, the first move is a (separate, behavior-preserving) refactor: call it out
+   so the plan sequences it before the feature work, not tangled into it. → Plan code-quality.
+8. **Failure is information.** Every new codepath fails *somehow* in production: timeout, nil,
+   race, stale data, partial write. The plan should name the failure and decide: test it, handle
+   it, or accept it loudly (never silently). → Failure-mode coverage.
+9. **DX is product quality.** Slow CI, painful local dev, untestable seams → worse software over
+   time. If the plan makes the code harder to test or run locally, that's a real finding, not a nit.
+   → Test-coverage / Code-quality.
+10. **Trust boundary discipline.** Every untrusted input crosses an explicit validation + authz
+    boundary before it reaches trusted core logic. A plan that lets a value skip the boundary is a
+    security finding even pre-code. → Architecture / Security seam.
+
+## Using them
+- A lens is a *prompt*, not a verdict. It turns "something's off here" into a finding you can
+  quote and band. If a lens fires, follow it to the specific plan line, then run it through the
+  confidence + verification gate.
+- Don't recite the lenses in the output: recite the *findings* they produced.
+- When a plan is genuinely clean against a lens, that's worth one line of evidence ("Reversibility:
+  additive migration + flag: strong"), not silence; it shows the lens was applied.

package/pack/generated/devin/skills/rite-vet/reference/review-axes.md

@@ -0,0 +1,206 @@
+# Vet review: scope, four axes, and outputs
+
+Run blocking §0, four axes, and outputs with [`eng-lenses.md`](eng-lenses.md);
+calibrate findings before presentation.
+
+Authority: `.devin/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+---
+
+## §0. Scope challenge (blocking gate)
+
+Before implementation review, check for work beyond the settled spec.
+
+1. **What exists?** Find reusable code/flows via
+   [`tooling.md`](../../devrites-lib/reference/standards/tooling.md). Reuse → extend →
+   build new; list missed reuse instead of planning parallel work.
+2. **Minimum diff.** Find the smallest contract-complete change. Flag non-blocking work;
+   use the marked action for topology cuts.
+3. **Complexity smell.** **>8 files** or **>2 new services/modules/classes** needs a justified
+   complexity gate; otherwise harden to the smallest contract-complete plan. Use the
+   marked action for topology reduction.
+   **Feature ceiling.** A plan over the
+   [feature ceiling](../../rite-plan/reference/slicing.md#feature-ceiling-split-an-epic-never-override-the-budget)
+   (over-budget `tasks.md`/`plan.md` from slice or AC count) is a scope finding, not a
+   `Budget override`: route to `/rite-plan course-correct` (`MVP cut`) with the
+   continuation sequence named; do not vet the whole epic.
+4. **Built-in check.** For each new pattern/infra/concurrency approach, invoke
+   `devrites-source-driven` inline to verify current framework/runtime support and cite it. Custom
+   work where a built-in suffices is a scope-reduction finding.
+5. **Completeness.** Find edge/error/test shortcuts; prefer the complete option when the
+   extra work is small, and flag small savings that leave known gaps.
+6. **Distribution check.** New artifacts (binary/package/container/deployable) need
+   build/publish/install plans or explicit deferral in "NOT in scope".
+7. **Applicability check.** Compare `spec.md`'s topology/data/integration/security/delivery
+   decisions with live seams. A false `not applicable` or an `applies` row without the
+   focused standard's owner, failure/recovery, deployment order, and proof output is `broken`.
+8. **Decision horizons.** Independently apply
+   [`plan-template.md`](../../rite-define/reference/plan-template.md#decision-horizons) to the
+   plan, questions, assumptions, decisions, and checkpoints; no known item may disappear.
+   Reject `local` for blockers or public contracts, security/data invariants, acceptance,
+   migration/rollback, dependencies, or cross-slice interfaces. Local/checkpoint deferral
+   needs bounded owner, evidence trigger, fallback, and resolution proof; a risk spike needs
+   necessary executable evidence, discriminating criteria, and fallback branches. Any defect is
+   `broken`; unresolved human blockers return to Clarify.
+
+> **STOP discipline.** Fold technical reduction into the plan; ask and stop only for a
+> human-owned choice.
+
+After justifying complexity or folding the contract-preserving reduction, present
+the §0 findings and proceed to Axis 1. A human-owned unresolved choice still pauses.
+
+---
+
+## Four axes (complete inventory, bounded presentation)
+
+Fold verified technical findings into the plan; present each human-owned decision in one
+`AskUserQuestion` packet. Combine support only for one owner/trade-off. HITL pauses; AFK
+uses `depth.md`. Never invent findings.
+Report every supported Critical/Important before repair. Group duplicates; compact
+presentation never caps the inventory or hides the ninth substantive defect.
+
+### 1. Architecture
+
+- Boundaries, coupling, data flow, single points of failure. Record invariants, not
+  scaffolding; medium+ decisions state `Binds:`/`Prevents:`.
+- Repository/deployable roots, canonical contract and mutable-state ownership, shared
+  resources, dependency cycles, and old/new deployment combinations when applicable.
+- Scaling ceiling under real load.
+- Security architecture at the seams (auth, data access, API boundaries): does the plan name
+  the trust boundary for each untrusted input?
+- One realistic production failure per new codepath/integration (feeds failure-mode table).
+- **Assumption delta:** when the plan or fresh evidence changes the *kind* of a spec
+  assumption (singular→plural, required→optional, chosen→derived, or back) that is an
+  identity-model change, not a detail. It needs an explicit promote-vs-add-alongside
+  decision routed through the Guard; silently widening the model in the plan is a
+  `broken` finding.
+- Does any key flow deserve an ASCII diagram in the plan or an inline comment in the code the
+  build will write? Name the files that should carry one.
+
+### 2. Plan code-quality
+
+- Implied modules and planned cross-slice repetition.
+- Error-handling + edge cases the plan names, and the ones it doesn't (call those out explicitly).
+- Over-engineering (premature abstraction, an extension point with no second caller) vs
+  under-engineering (fragile / hacky) relative to [`patterns.md`](../../devrites-lib/reference/standards/patterns.md) + [`coding-style.md`](../../devrites-lib/reference/standards/coding-style.md).
+- Tech-debt hotspots and diagrams the change makes stale.
+
+### 3. Test-coverage design
+
+Design tests before code.
+
+- **Framework:** match the existing runner/conventions; never add a runner for one change.
+- **Acceptance → tests.** Every AC maps to a planned surface assertion, not an internal proxy.
+- **Map applicable risk → tests.** Data and integration rows cover their relevant
+  duplicate/retry/concurrency/interruption/tenant/timeout/partial/outage/order/rollback cases,
+  or record an evidence-backed dismissal. A mock that cannot exhibit the named risk is a GAP.
+- **Tool per path:** unit for pure logic; integration/E2E for 3+ components,
+  auth/payment/data-loss, or mock-hidden failure; eval for LLM/prompt quality.
+- **UI inventory:** list every interactive element/flow in `test-plan.md`; assign
+  elements/fields a unit/component assertion and critical journeys an E2E. Untested = GAP;
+  no one-E2E-per-field (`artifacts.md`).
+- **Regression (mandatory):** changed behavior without path coverage adds a **Critical**
+  regression test—no question or skip. If uncertain, write it.
+- Produce the **coverage diagram** (shape below) and add a specific test requirement per GAP.
+
+#### Coverage diagram (write to `test-plan.md`)
+
+Both code paths and user flows in one view; mark E2E-worthy `[→E2E]` and eval-worthy `[→EVAL]`:
+
+```text
+CODE PATHS                                          USER FLOWS
+[+] services/billing                                [+] Checkout
+  ├── processPayment()                                ├── [★★★ planned] complete purchase — checkout.e2e
+  │   ├── [★★★ planned] happy + declined + timeout    ├── [GAP] [→E2E] double-click submit
+  │   └── [GAP]         invalid currency              └── [GAP]        navigate away mid-payment
+  └── refundPayment()                               [+] Error states
+      └── [★  planned] full refund only               └── [GAP]        network-timeout UX
+
+COVERAGE: 3/7 planned (43%)  |  GAPS: 4 (1 E2E)  |  REGRESSIONS: 0
+```
+
+Legend: ★★★ behavior+edge+error · ★★ happy path · ★ smoke · [→E2E] integration · [→EVAL] LLM eval.
+**Fast path:** every acceptance criterion already maps to a planned test → "Test coverage: all
+acceptance criteria covered ✓" and continue.
+
+### 4. Performance
+
+- N+1 / unbounded queries and DB access patterns; memory concerns; caching opportunities;
+  high-complexity hot paths.
+- Per [`performance.md`](../../devrites-lib/reference/standards/performance.md): name a number to measure or a budget: don't recommend speculative
+  micro-tuning. A perf finding is "measure X against budget Y", not "this feels slow".
+
+---
+
+## Confidence and verification gate
+
+Tag each finding `[severity] (confidence: N/10) <plan/task/spec ref> — finding`:
+
+- **9-10** verified against a quoted line · **7-8** strong pattern match → report normally.
+- **5-6** moderate → report with "verify this is real".
+- **≤4** speculative → **suppress from the walk-through**, appendix only.
+
+Quote supporting lines. Without them confidence is ≤4 and suppressed; never inflate it.
+`devrites-plan-reviewer` follows this rule.
+
+## Finding kind: contract or mechanism
+
+Tag every Critical/Important `kind: contract` or `kind: mechanism`; root confirms the tag
+at reconciliation.
+
+- **contract** — a *guarantee* (acceptance, interface, boundary, ownership, data shape,
+  ordering/durability, failure outcome, dependency choice) an implementer could build
+  differently and still pass the planned tests → plan text → `NEEDS REPLAN` + Plan repair.
+- **mechanism** — *how* a pinned clause is achieved (syscall order, fsync/rename shape,
+  lock scope, retry shape, parser detail): a test discriminates the wrong implementation
+  → root adds one named case row to `test-plan.md` (input → observable outcome + the
+  mutant that must fail) plus its `traceability.md` ref, re-emits the readiness binding,
+  rechecks mechanically (anchor, ID parity). No Plan repair, no reviewer redispatch;
+  Build's RED test proves it. Prove in code, not in prose.
+
+Mechanism becomes `contract` only when the plan asserts the opposite mechanism or the
+clause is a public/shared seam. **Failing case:** round after round of prose pins on
+already-pinned clauses.
+
+---
+
+## Present human-owned decisions
+
+Use standard `AskUserQuestion`:
+
+- **One decision = one call.** Never ask about agent work or batch unrelated choices.
+- Concrete: name the plan/task section + the quoted line.
+- 2-3 options, including "do nothing / proceed as-is" where reasonable.
+- Per option: **effort** (human/build agent), **risk**, **maintenance**; recommend complete
+  when marginally costlier than a shortcut.
+- **Map to a rule.** One sentence tying the recommendation to a DevRites rule (reuse-first,
+  fail-fast, test-behavior, measure-first, minimum diff).
+- **Coverage vs kind:** coverage options get `Completeness: N/10`; architecture/kind options
+  state “differ in kind” and get no fabricated score.
+- Record every material call: technical hardening/AFK in `decisions.md`; HITL in a resolved
+  `questions.md` qid. Do not turn agent work into questions.
+
+---
+
+## Required outputs (after the axes)
+
+1. **"NOT in scope":** considered/deferred work + rationale, folded into plan boundaries and
+   spec Non-goals via the Guard.
+2. **"What exists":** solving code/flows and reuse/rebuild disposition; missed reuse is §0.
+3. **Failure-mode table:** per new codepath: realistic failure, partial/unknown effect,
+   recovery owner, test, handling, and user-visible/silent result. No test + no handling +
+   silent = **Critical** (`artifacts.md`).
+4. **Dependency safety:** verify graph/order and shared file/state/contract/lock/port/queue/env
+   conflicts. Correct the plan; native host scheduling needs no lane artifact.
+5. **Build-entry preflight:** commands/cwds, tools, package state, parser/browser smoke,
+   prerequisites, and provenance ([`artifacts.md`](artifacts.md)).
+6. **Implementation readiness:** goal-backward coverage, wiring, dependency simulation,
+   alignment, operations, and rollback verdict.
+7. **Completion summary:** the compact recap defined in
+   [`artifacts.md`](artifacts.md).