devrites 5.10.2 → 5.12.0

package/pack/generated/pi/skills/rite-spec/SKILL.md

@@ -5,6 +5,10 @@ argument-hint: "<feature or idea>"
 user-invocable: true
 ---
 
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/elicitation.md","devrites-lib/reference/standards/agents.md","rite-spec/reference/investigation.md","rite-spec/reference/question-protocol.md","rite-spec/reference/spec-template.md","rite-spec/reference/spec-checklists.md","rite-spec/reference/state-workspace.md","rite-spec/reference/acceptance-criteria.md","rite-spec/reference/interview-patterns.md","rite-spec/reference/ai-spec-template.md","rite-spec/reference/anti-patterns.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"applicability":["devrites-lib/reference/standards/repository-topology.md","devrites-lib/reference/standards/data-integrity.md","devrites-lib/reference/standards/integration-reliability.md"],"documentation":["devrites-lib/reference/standards/documentation.md"],"edge-cases":["devrites-lib/reference/standards/edge-case-trace.md"],"frontend":["rite-build/reference/frontend-trigger.md"],"grammar":["devrites-lib/reference/standards/spec-grammar.md"],"principles":["devrites-lib/reference/standards/principles.md"],"references":["rite-spec/reference/references-intake.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md"],"workspaceByRole":{"evidence-scout":["brief.md","spec.md","state.md","questions.md"]}} -->
+> Read-set manifest: `devrites-engine context <slug> --phase spec` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+
+
 # /rite-spec: investigate and write the spec
 
 Investigate and resolve material gaps into a placed, covered `spec.md`.
@@ -20,7 +24,7 @@ For behavioral/high-risk acceptance, use [`spec-grammar.md`](../devrites-lib/ref
 simple criteria stay flat `AC-###`. Apply
 [`acceptance-criteria.md`](reference/acceptance-criteria.md) so each is binary and observable.
 Use [`edge-case-trace.md`](../devrites-lib/reference/standards/edge-case-trace.md)
-to populate only relevant edge/prohibition rows. The spec's applicability map routes
+to populate only relevant edge/prohibition rows (trigger `edge-cases`). The spec's applicability map routes
 topology, data, integration, security, and delivery concerns to their focused standard;
 load a routed standard to discover required behavior, not to prescribe implementation.
 
@@ -57,8 +61,11 @@ load a routed standard to discover required behavior, not to prescribe implement
    an unfinished sequence, propose that next continuation (slug + objective) as the
    recommended option instead of a fresh slug.
 2. **Investigate:** follow [investigation](reference/investigation.md) through its
-   complete findings and done-when gate. Discover the project's **test /
-   build/typecheck/lint** commands, frontend/backend systems, and declared project guidance
+   complete findings and done-when gate. Resolve the project's **test /
+   build/typecheck/lint** commands with `devrites-engine detect commands`
+   (Makefile → package.json → language manifests; read-only) and record the
+   resolved text — an `unresolved` slot means the plan must name the concrete
+   command later, never an invented one. Discover frontend/backend systems, and declared project guidance
    (`PRODUCT.md`, `DESIGN.md`, `CLAUDE.md`, `AGENTS.md`, and `.devrites/principles.md` when
    present).
    **Consult the capability ledger**, which records current system behavior

package/pack/generated/pi/skills/rite-spec/reference/state-workspace.md

@@ -218,6 +218,11 @@ command.
 
 ## Success definition
 <One sentence that says what "done" means.>
+
+## Route
+Size: <small | standard | large>
+Profile: <quick | standard | full>
+Why: <one line — the significance signals that picked the profile>
 ```
 
 ## Compactness

package/pack/generated/pi/skills/rite-status/SKILL.md

@@ -5,6 +5,8 @@ argument-hint: "[feature-slug]"
 user-invocable: true
 disable-model-invocation: true
 ---
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md"],"workspace":["state.md","tasks.md","questions.md"]} -->
+> Read-set manifest: `devrites-engine context [slug] --skill rite-status` bundles every file named below into one deduplicated read.
 
 # /rite-status: active feature status
 
@@ -40,6 +42,13 @@ A workspace is handoff-ready when it records one next action, all unresolved
 questions, non-obvious decisions, load-bearing assumptions, current drift
 status, and evidence for its claims. If chat contains missing durable context,
 recommend `/rite-handoff` before the lifecycle command.
+`devrites-engine handoff [slug]` emits the deterministic resume record (cursor,
+`awaiting_human`, blocking question gates, ledger reduction, dead ends,
+read-next order) — cite it for items 3–6 and the handoff-readiness verdict
+rather than re-deriving them. When `metrics.jsonl` exists,
+`devrites-engine metrics summary <slug>` rolls up dispatch/return counts and
+bundle bytes per phase — cite it for dispatch accounting rather than
+re-counting the ledger.
 
 Do not derive a command from host identity or invent one from phase names. Read
 the persisted `Next step`.

package/pack/generated/pi/skills/rite-temper/SKILL.md

@@ -5,6 +5,10 @@ argument-hint: "[feature-slug] [--mode expand|selective|hold|reduce]"
 user-invocable: true
 ---
 
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/orchestration-profiles.md","devrites-lib/reference/standards/agents.md","rite-temper/reference/significance.md","rite-temper/reference/scope-modes.md","rite-temper/reference/review-dimensions.md","rite-temper/reference/strategy-template.md","rite-temper/reference/anti-patterns.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"applicability":["devrites-lib/reference/standards/repository-topology.md","devrites-lib/reference/standards/data-integrity.md","devrites-lib/reference/standards/integration-reliability.md"],"documentation":["devrites-lib/reference/standards/documentation.md"],"elicitation":["devrites-lib/reference/standards/elicitation.md"],"yagni":["devrites-lib/reference/standards/patterns.md","devrites-lib/reference/standards/coding-style.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","strategy.md","design-brief.md"],"workspaceByRole":{"strategy-reviewer":["brief.md","spec.md","decision-coverage.md","decisions.md","strategy.md","state.md"]}} -->
+> Read-set manifest: `devrites-engine context <slug> --phase temper` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+
+
 # /rite-temper: review scope and risk before planning
 
 Review the readied spec for ambition, scope, pre-mortem risk and unnecessary surface. Fold accepted decisions into the canonical contract before
@@ -16,7 +20,7 @@ the required exact strategy reviewer never changes with profile.
 
 ## Rules consulted (read on demand from `.pi/skills/devrites-lib/reference/standards/`)
 Pull on demand: [`patterns.md`](../devrites-lib/reference/standards/patterns.md) +
-[`coding-style.md`](../devrites-lib/reference/standards/coding-style.md) (the over-engineering / YAGNI rubric (reuse the pack's standard, don't
+[`coding-style.md`](../devrites-lib/reference/standards/coding-style.md) (the over-engineering / YAGNI rubric, trigger `yagni`; reuse the pack's standard, don't
 invent one), [`documentation.md`](../devrites-lib/reference/standards/documentation.md) (ADR-style `decisions.md` entries), [`afk-hitl.md`](../devrites-lib/reference/standards/afk-hitl.md)
 (irreversible-risk list + gate ceiling), [`elicitation.md`](../devrites-lib/reference/standards/elicitation.md) (the move-set to deepen a section
 that needs more than the default pre-mortem) selected by the section's risk). Load

package/pack/generated/pi/skills/rite-upgrade/SKILL.md

@@ -5,6 +5,8 @@ argument-hint: "[feature-slug]"
 user-invocable: true
 disable-model-invocation: true
 ---
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/agents.md"],"triggers":{"reslice":["rite-plan/reference/slicing.md"]},"workspace":["state.md","spec.md","plan.md","tasks.md","decisions.md","questions.md","evidence.md","touched-files.md","review.md","seal.md","polish-report.md","browser-evidence.md"],"workspaceByRole":{"upgrade-planner":["state.md","spec.md","plan.md","tasks.md","decisions.md","questions.md"]}} -->
+> Read-set manifest: `devrites-engine context [slug] --skill rite-upgrade` bundles every file named below into one deduplicated read.
 
 # /rite-upgrade: reconcile a released workspace safely
 
@@ -50,6 +52,11 @@ references, and only current phase contracts needed for the observed gap.
    Archive-only is `current`; otherwise require contained regular `state.md` and read its
    cursor. A damaged/mismatched install stops at Doctor; missing live work routes
    `/rite-spec`; `done` is `current`. An unknown cursor is `unsupported`.
+   A `state.md` whose cursor carries no `schema` row — or any engine refusal naming the
+   workspace schema — means the workspace predates the current engine schema: structural
+   normalization is a human-approved engine step that precedes this audit, not part of
+   it. Stop and surface the refusal verbatim (it names the fail-closed `migrate`
+   command with `--dry-run`/`--answer`); after the human runs it, restart at step 0.
 1. **Freeze preservation evidence.** Record `git status --short`, cursor form/fields,
    `devrites-engine orient <slug>` (cursor, `task_graph`, `artifact_budgets`,
    `bulk_files`), and
@@ -76,7 +83,8 @@ references, and only current phase contracts needed for the observed gap.
      `history/` / `packets/`, current view only; IDs, meaning, answers and decisions
      unchanged; nothing deleted);
    - unbuilt slices beyond the [feature ceiling](../rite-plan/reference/slicing.md#feature-ceiling-split-an-epic-never-override-the-budget)
-     → `/rite-plan course-correct` (`MVP cut` plus the named continuation sequence;
+     → `/rite-plan course-correct` (trigger `reslice` loads [`slicing.md`](../rite-plan/reference/slicing.md);
+     `MVP cut` plus the named continuation sequence;
      built slices and their evidence stay);
    - live code and recorded intent disagreement → `/rite-converge`;
    - any changed planning input or readiness defect → `/rite-vet`;

package/pack/generated/pi/skills/rite-vet/SKILL.md

@@ -5,6 +5,10 @@ argument-hint: "[slug] [--cross-model] [--full]"
 user-invocable: true
 ---
 
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/orchestration-profiles.md","devrites-lib/reference/parallel-dispatch.md","devrites-lib/reference/standards/gates.md","rite-vet/reference/review-axes.md","rite-vet/reference/artifacts.md","rite-vet/reference/depth.md","rite-vet/reference/eng-lenses.md","rite-vet/reference/anti-patterns.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"applicability":["devrites-lib/reference/standards/repository-topology.md","devrites-lib/reference/standards/data-integrity.md","devrites-lib/reference/standards/integration-reliability.md"],"assumption-delta":["devrites-lib/reference/standards/assumption-checkpoints.md"],"cross-model":["rite-vet/reference/cross-model.md"],"devex":["devrites-lib/reference/standards/developer-experience.md"],"dod":["devrites-lib/reference/standards/definition-of-done.md"],"elicitation":["devrites-lib/reference/standards/elicitation.md"],"errors":["devrites-lib/reference/standards/error-handling.md"],"grammar":["devrites-lib/reference/standards/spec-grammar.md"],"one-shot":["devrites-lib/reference/standards/one-shot-actions.md"],"performance":["devrites-lib/reference/standards/performance.md"],"principles":["devrites-lib/reference/standards/principles.md"],"reslice":["devrites-lib/reference/standards/acceptance-preserving-reslice.md"],"testing":["devrites-lib/reference/standards/testing.md"],"workflow":["devrites-lib/reference/standards/development-workflow.md"],"workflow-artifacts":["devrites-lib/reference/standards/workflow-artifacts.md"],"yagni":["devrites-lib/reference/standards/patterns.md","devrites-lib/reference/standards/coding-style.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md"],"workspaceByRole":{"devex-reviewer":["spec.md","plan.md","tasks.md","state.md"],"plan-reviewer":["spec.md","plan.md","tasks.md","test-plan.md","decision-coverage.md","architecture.md","decisions.md","state.md"],"strategy-reviewer":["brief.md","spec.md","plan.md","decisions.md","decision-coverage.md","state.md"]}} -->
+> Read-set manifest: `devrites-engine context <slug> --phase vet` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+
+
 # /rite-vet: review the plan before build
 
 Vet every plan's scope, architecture, quality, proof, performance, failures and writer
@@ -15,12 +19,16 @@ Vet owns implementation; current `$ARGUMENTS` (`--full`) feeds the depth trigger
 
 ## Rules
 
-Read the active standard from: [`principles.md`](../devrites-lib/reference/standards/principles.md), [`patterns.md`](../devrites-lib/reference/standards/patterns.md), [`coding-style.md`](../devrites-lib/reference/standards/coding-style.md),
+Read the active standard from: [`principles.md`](../devrites-lib/reference/standards/principles.md), [`patterns.md`](../devrites-lib/reference/standards/patterns.md) + [`coding-style.md`](../devrites-lib/reference/standards/coding-style.md) (over-engineering / YAGNI rubric, trigger `yagni`),
 [`testing.md`](../devrites-lib/reference/standards/testing.md), [`spec-grammar.md`](../devrites-lib/reference/standards/spec-grammar.md), [`performance.md`](../devrites-lib/reference/standards/performance.md), [`error-handling.md`](../devrites-lib/reference/standards/error-handling.md),
 [`development-workflow.md`](../devrites-lib/reference/standards/development-workflow.md), [`afk-hitl.md`](../devrites-lib/reference/standards/afk-hitl.md), [`one-shot-actions.md`](../devrites-lib/reference/standards/one-shot-actions.md),
 [`developer-experience.md`](../devrites-lib/reference/standards/developer-experience.md), [`elicitation.md`](../devrites-lib/reference/standards/elicitation.md), and [`definition-of-done.md`](../devrites-lib/reference/standards/definition-of-done.md). Load
 repository topology, data integrity, and integration reliability only when
-triggered. Before classifying any Reslice, read `.pi/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+triggered. When the plan's scope generalizes an existing boundary — a second
+platform/tenant/source of truth, a newly optional field, a constant turned parameter —
+confirm the [`assumption-checkpoints.md`](../devrites-lib/reference/standards/assumption-checkpoints.md) question (trigger `assumption-delta`)
+was answered and recorded, not skipped-as-negative.
+Before classifying any Reslice, read `.pi/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
 When a
 plan declares a root-authored executable workflow file, read
 [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md).
@@ -72,7 +80,8 @@ plan declares a root-authored executable workflow file, read
    recheck retains prior depth and enters 1b.
 1a. **Independent initial pass.** Freeze candidate and dispatch the exact fresh
    read-only plan reviewer — plus developer-experience reviewer for developer
-   surfaces and the current strategy reviewer after significant Temper — in
+   surfaces (trigger `devex`) and the current strategy reviewer after significant
+   Temper — in
    parallel under `../devrites-lib/reference/parallel-dispatch.md`; they are
    independent read-only passes on one frozen candidate. Missing
    required account blocks.
@@ -151,7 +160,18 @@ plan declares a root-authored executable workflow file, read
    assumptions, uncertainty, and gates. Keep state non-READY. Every scenario and
    criterion needs positive, discriminating proof; every slice must be one-pass
    implementable; developer plans need a predicted scorecard. Durable commands
-   are portable repository commands, not host wrappers.
+   are portable repository commands, not host wrappers — resolve them with
+   `devrites-engine detect commands` (Makefile/package.json/manifests, no
+   execution) and cite the resolved text verbatim; an `unresolved` slot means
+   name the concrete command in the plan, never guess one.
+   Once the `## Build-entry preflight` table is final, run
+   `devrites-engine gates scaffold <slug>` to seed `gates.md` (one pending gate
+   per `AC-###`; never clobber an existing ledger), then author each gate's
+   `CHECK`/`EXPECT`/`CWD` per artifacts.md §`gates.md` so every runnable oracle
+   is an approved preflight row. Run
+   `devrites-engine gates lint <slug> --strict` and resolve every finding before
+   READY; the readiness check refuses a missing or malformed ledger but does not
+   replace this oracle-quality gate.
 7. **Narrow recheck after edits.** Dispatch the exact plan reviewer once per
    fold — one dispatch covering every open fingerprint, preserving
    per correction/fingerprint accounting (each checked individually with its
@@ -171,8 +191,10 @@ plan declares a root-authored executable workflow file, read
    preflight, and sweep is green. Write phase/next step and emit one
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
-   must pass. Technical failure records reproduction, not qid. Human gap awaits
-   Clarify. Optional cross-model follows `reference/cross-model.md`.
+   must pass. Record the per-input drift baseline alongside it:
+   `devrites-engine check drift <slug> --record` — a later stale binding then
+   names the exact artifact that moved instead of "something changed". Technical failure records reproduction, not qid. Human gap awaits
+   Clarify. Optional cross-model follows `reference/cross-model.md` (trigger `cross-model`).
 
    With READY, no pending remediation, and a valid technical return cursor,
    restore and consume the return cursor instead of defaulting to Build. Preserve

package/pack/generated/pi/skills/rite-vet/reference/artifacts.md

@@ -146,6 +146,25 @@ For every row in `plan.md`'s `Shared contract proof`, the per-gap requirements n
 provider- and consumer-side asserting tests and state how each consumes the same canonical
 artifact. Reference the plan row; do not reproduce its contract table here.
 
+## `gates.md`: the acceptance ledger
+
+Write `.devrites/work/<slug>/gates.md` once the preflight table is final —
+`devrites-engine gates scaffold <slug>` seeds one pending gate per `AC-###` in
+`spec.md`; never clobber a ledger that already carries evidence. Grammar,
+evidence binding, and oracle rules live in
+[`gates.md`](../../devrites-lib/reference/standards/gates.md); the engine
+enforces them, so author to the contract, not around it:
+
+- One gate per required outcome; reuse `AC-###` ids so readiness coverage and
+  the ledger name the same set.
+- A runnable gate's `CHECK` must be a `## Build-entry preflight` `Command`
+  verbatim with a matching `Cwd` — a gate whose command is absent from the
+  preflight table can never execute, so add the row first.
+- `EXPECT` names a line only success can print; `gates lint <slug>` flags
+  tautological commands and weak expectations before build.
+- Manual gates (`EVIDENCE` only) are for judgment-bound outcomes; Prove
+  attests them, Seal still requires them checked.
+
 ## Parallelization table (in `eng-review.md` §5 when there's an opportunity)
 
 ```markdown

package/pack/generated/pi/skills/rite-vet/reference/review-axes.md

@@ -75,6 +75,11 @@ presentation never caps the inventory or hides the ninth substantive defect.
 - Security architecture at the seams (auth, data access, API boundaries): does the plan name
   the trust boundary for each untrusted input?
 - One realistic production failure per new codepath/integration (feeds failure-mode table).
+- **Assumption delta:** when the plan or fresh evidence changes the *kind* of a spec
+  assumption (singular→plural, required→optional, chosen→derived, or back) that is an
+  identity-model change, not a detail. It needs an explicit promote-vs-add-alongside
+  decision routed through the Guard; silently widening the model in the plan is a
+  `broken` finding.
 - Does any key flow deserve an ASCII diagram in the plan or an inline comment in the code the
   build will write? Name the files that should carry one.
 

package/pack/generated/pi/skills/rite-watch-pr/SKILL.md

@@ -4,6 +4,8 @@ description: Observe one GitHub PR and CI state without mutating code, Git, thre
 argument-hint: "[PR number|PR URL|blank for current branch]"
 user-invocable: true
 ---
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/loop-operations.md"],"triggers":{"security":["devrites-lib/reference/standards/security.md"]},"workspace":[]} -->
+> Read-set manifest: `devrites-engine context [slug] --skill rite-watch-pr` bundles every file named below into one deduplicated read.
 
 # /rite-watch-pr: read-only PR and CI observation
 

package/pack/generated/pi/skills/rite-zoom-out/SKILL.md

@@ -5,6 +5,8 @@ argument-hint: "[symbol | file | area to map]"
 user-invocable: true
 disable-model-invocation: true
 ---
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/tooling.md"],"workspace":["spec.md","plan.md","decisions.md","state.md"]} -->
+> Read-set manifest: `devrites-engine context [slug] --skill rite-zoom-out` bundles every file named below into one deduplicated read.
 
 # /rite-zoom-out: step up one abstraction layer
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devrites",
-  "version": "5.10.2",
-  "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, and pi",
+  "version": "5.12.0",
+  "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, pi, and Devin CLI",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",
   "repository": {
@@ -14,6 +14,7 @@
   "keywords": [
     "claude-code",
     "codex",
+    "devin-cli",
     "skills",
     "agent-skills",
     "workflow",
@@ -37,6 +38,7 @@
     "scripts/codex-generate.sh",
     "scripts/omp-generate.sh",
     "scripts/pi-generate.sh",
+    "scripts/devin-generate.sh",
     "scripts/install-lib.sh",
     "install.sh",
     "uninstall.sh",

package/scripts/build-host-artifacts.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# build-host-artifacts.sh: render host-native Claude, Codex, omp, and pi
-# artifacts from the canonical pack.
+# build-host-artifacts.sh: render host-native Claude, Codex, omp, pi, and
+# Devin artifacts from the canonical pack.
 #
 # Default output is pack/generated/ so npm pack can ship prebuilt surfaces.
 # Tests may set DEVRITES_HOST_ARTIFACT_DIR to a temporary directory.
@@ -27,12 +27,19 @@ TMP_GEN_DIR="$(mktemp -d)"
 cleanup() { rm -rf "$TMP_GEN_DIR"; }
 trap cleanup EXIT
 
+# Build into a scratch dir, then swap into place: file watchers were observed
+# deleting/recreating entries under the live output dir mid-build on macOS.
+REAL_OUT="$OUT_ROOT"
+OUT_ROOT="$TMP_GEN_DIR/out"
+
 # shellcheck source=codex-generate.sh
 . "$ROOT/scripts/codex-generate.sh"
 # shellcheck source=omp-generate.sh
 . "$ROOT/scripts/omp-generate.sh"
 # shellcheck source=pi-generate.sh
 . "$ROOT/scripts/pi-generate.sh"
+# shellcheck source=devin-generate.sh
+. "$ROOT/scripts/devin-generate.sh"
 
 copy_tree() {
   _src="$1"
@@ -116,12 +123,46 @@ render_pi_skill_tree() {
   done < <(find "$_sd" -type f)
 }
 
-rm -rf "$OUT_ROOT"
-mkdir -p "$OUT_ROOT/claude" "$OUT_ROOT/codex" "$OUT_ROOT/omp" "$OUT_ROOT/pi"
+render_devin_skill_tree() {
+  _sd="$1"
+  _dest="$2"
+  mkdir -p "$_dest"
+  while IFS= read -r f; do
+    _r="${f#$_sd/}"
+    _out="$_dest/$_r"
+    mkdir -p "$(dirname "$_out")"
+    case "$_r" in
+    SKILL.md)
+      gen_devin_skill_file "$f" "$_out"
+      ;;
+    *.md)
+      gen_devin_markdown_file "$f" "$_out"
+      ;;
+    *)
+      cp "$f" "$_out"
+      ;;
+    esac
+  done < <(find "$_sd" -type f)
+}
+
+mkdir -p "$OUT_ROOT/claude" "$OUT_ROOT/codex" "$OUT_ROOT/omp" "$OUT_ROOT/pi" "$OUT_ROOT/devin"
+
+# Canonical sources may use <!-- include:REL --> markers for shared blocks
+# (e.g. agents/_shared/). Expand them on a scratch copy so every host renders
+# identical text while the canonical pack stays deduplicated.
+EXPANDED_SRC="$TMP_GEN_DIR/canonical"
+mkdir -p "$EXPANDED_SRC"
+cp -R "$PACK_SRC/." "$EXPANDED_SRC/"
+python3 "$ROOT/scripts/expand-includes.py" "$EXPANDED_SRC"
+PACK_SRC="$EXPANDED_SRC"
+
+# `_shared` dirs exist only to feed expansion; no host ships them.
+find "$PACK_SRC" -type d -name _shared -prune -exec rm -rf {} +
 
 # Claude artifacts are host-native copies of the canonical pack.
 copy_tree "$PACK_SRC/skills" "$OUT_ROOT/claude/skills"
 copy_tree "$PACK_SRC/agents" "$OUT_ROOT/claude/agents"
+rm -rf "$OUT_ROOT/claude/agents/_shared" "$OUT_ROOT/claude/skills/devrites-lib/reference/_shared"
 copy_tree "$PACK_SRC/workflows" "$OUT_ROOT/claude/workflows"
 # Local editor caches under .impeccable/ must never ship in generated hosts.
 rm -rf "$OUT_ROOT/claude/agents/.impeccable" "$OUT_ROOT/claude/skills/.impeccable"
@@ -181,6 +222,23 @@ done < <(find "$PACK_SRC/agents" -maxdepth 1 -type f -name '*.md')
 
 gen_pi_agents_bridge "$OUT_ROOT/pi/AGENTS.md"
 
+# Devin artifacts are generated host-native mirrors: skills under
+# .devin/skills and custom subagent profiles under .devin/agents, plus an
+# AGENTS.md bridge block (Devin reads project AGENTS.md as always-on rules).
+mkdir -p "$OUT_ROOT/devin/skills" "$OUT_ROOT/devin/agents"
+while IFS= read -r d; do
+  name="$(basename "$d")"
+  [ "$name" = ".impeccable" ] && continue
+  render_devin_skill_tree "$d" "$OUT_ROOT/devin/skills/$name"
+done < <(find "$PACK_SRC/skills" -mindepth 1 -maxdepth 1 -type d)
+
+while IFS= read -r f; do
+  name="$(basename "$f" .md)"
+  gen_devin_agent "$f" "$OUT_ROOT/devin/agents/$name.md"
+done < <(find "$PACK_SRC/agents" -maxdepth 1 -type f -name '*.md')
+
+gen_devin_agents_bridge "$OUT_ROOT/devin/AGENTS.md"
+
 cat >"$OUT_ROOT/README.md" <<'EOF'
 # Generated DevRites Host Artifacts
 
@@ -194,10 +252,41 @@ This directory is generated by `scripts/build-host-artifacts.sh`.
 - `pi/` contains pi-native skill mirrors, pi-subagents Markdown agents,
   prompt templates preserving the `/rite*` commands, and an `AGENTS.md`
   bridge block.
+- `devin/` contains Devin CLI skill mirrors, custom subagent profiles with
+  `allowed-tools` allowlists, and an `AGENTS.md` bridge block.
 
 Do not edit these files by hand. Edit `pack/.claude/`,
-`scripts/codex-generate.sh`, `scripts/omp-generate.sh`, or
-`scripts/pi-generate.sh`, then rebuild.
+`scripts/codex-generate.sh`, `scripts/omp-generate.sh`,
+`scripts/pi-generate.sh`, or `scripts/devin-generate.sh`, then rebuild.
 EOF
 
-echo "build-host-artifacts: wrote $OUT_ROOT"
+# Swap the completed tree into place. Watchers can still re-create entries
+# mid-delete, so retry the clear until the old tree is gone, then rename. The
+# held-output security harness runs with the output root as the current
+# directory; that directory cannot be renamed away, so replace only its
+# generated children while leaving the held source tree in place.
+if [ "$REAL_OUT" = "." ]; then
+  for _name in claude codex devin omp pi README.md; do
+    rm -rf "$_name"
+  done
+  for _entry in "$OUT_ROOT"/*; do
+    [ -e "$_entry" ] || continue
+    mv "$_entry" .
+  done
+else
+  for _ in 1 2 3 4 5; do
+    rm -rf "$REAL_OUT" && break
+    sleep 1
+  done
+  [ ! -e "$REAL_OUT" ] || {
+    echo "build-host-artifacts: cannot clear $REAL_OUT" >&2
+    exit 1
+  }
+  mv "$OUT_ROOT" "$REAL_OUT"
+fi
+[ -f "$REAL_OUT/README.md" ] || {
+  echo "build-host-artifacts: swap left no tree at $REAL_OUT" >&2
+  exit 1
+}
+
+echo "build-host-artifacts: wrote $REAL_OUT"