devrites 5.11.0 → 5.12.0

package/pack/.claude/skills/devrites-lib/SKILL.md

@@ -44,11 +44,46 @@ lifecycle state from chat or optional `README.md`.
 
 The engine is limited to:
 
-- `check readiness` for structure, `check candidate` for content-bound identity,
-  and `check seal` for structure plus exact artifact bindings; `secret-scan` and
-  `version` remain read-only helpers.
-- Atomic state: `state resolve` for answer/drop/batch and transactional
-  `state close`.
+- Checks: `check candidate` (content-bound identity), `check readiness`
+  (structure; `--emit-binding` emits the Build-input binding), `check seal` (structure
+  plus exact artifact bindings and evidence freshness), `check slice` (slice
+  contract preflight before wright dispatch), `check task-graph`, `check
+  diff-scope` (mechanical changed-paths ⊆ allowlist before reviewer dispatch),
+  `check path-disjoint`, `check skill-trust`, `check indexes`, `check
+  regression` (progress high-water mark), `check drift` (readiness-input
+  attribution), `check windows` (deferral-marker waivers), `check dup`
+  (advisory near-duplicates), `detect commands` (repository test/lint wiring).
+- Observation: `observe summary` (`orient` alias), `observe slice`, `next`
+  (minimal remaining lifecycle path), `handoff` (deterministic resume record).
+- Coordination: `context` emits one deduplicated read-set bundle from each
+  skill's `loads:` manifest into `.devrites/work/<slug>/ctx/` — dispatch targets
+  read it instead of selecting files. It prints `unselected=[...]` for declared
+  triggers not passed; an omitted applicable trigger is a gap, not a shortcut. A
+  `--role` call is a dispatch, so the `agents` trigger auto-fires when declared
+  (`auto=[agents]` in output); a role with no agent contract file fails instead
+  of emitting a contract-less packet.
+  Manifest grammar: `always` loads every call; `triggers` maps names to files that
+  load only when passed or suggested; `workspace` lists the feature artifacts every
+  reader may need; `workspaceByRole` maps a dispatch role to its own artifact list —
+  present role wins, absent role falls back to `workspace`, an empty list means the
+  role reads no workspace files. The engine prints `suggested=[...]` triggers
+  inferred from workspace facts (AFK/parallel flags, frontend/security wording,
+  principles presence); confirm them rather than re-deriving conditions. Repeat
+  calls with unchanged inputs print `unchanged` and reuse the existing bundle.
+  `dispatch` owns the launch-wave barrier — seal needs a distinct handle per
+  role, return needs seal, and start/return auto-record into the `metrics`
+  ledger. `claim` owns the advisory session-scoped `claims.jsonl` ledger;
+  `note` owns anchored `notes.md` entries (`check seal` refuses non-exact
+  anchors); `parallel` owns deterministic worktree lease/create/integrate/
+  cleanup for parallel slices.
+- `gates` owns the machine-checked acceptance ledger (`gates.md`): `scaffold`,
+  `status`, `run`, `reverify`, `lint`, `attest`, `abandon` — grammar and
+  authoring rules in
+  [`reference/standards/gates.md`](reference/standards/gates.md).
+- Atomic state: `state resolve` for answer/drop/batch, `state merge-manifest`
+  for the predecessor-chain union, transactional `state close`, and `migrate`
+  for fail-closed workspace-schema normalization.
+- `secret-scan`, `open-visual`, and `version` remain read-only helpers.
 - Offline, local `install`, `update`, and `uninstall`; their shell/npm callers
   acquire the candidate bundle, source, and binary before invoking the engine.
 

package/pack/.claude/skills/devrites-lib/reference/_shared/reslice-autocomplete.md

@@ -0,0 +1,3 @@
+- `FOLD` → keep Plan repair/affected Vet internal; no stop solely for topology/count.
+- `GUARD_AND_REPAIR` → enter Spec Drift Guard/Clarify; pause only at an existing human-owned gate; resume Plan/Vet internally.
+- `BLOCKED_INPUT` → no planning writes; stop internal branch; exact diagnostic; recover authority; reclassify.

package/pack/.claude/skills/devrites-lib/reference/_shared/reslice-plan.md

@@ -0,0 +1,3 @@
+- `FOLD` → reconcile `architecture.md`, `plan.md`, `tasks.md`, and `traceability.md` atomically; invalidate Vet/readiness; Vet.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.

package/pack/.claude/skills/devrites-lib/reference/_shared/reslice-vet.md

@@ -0,0 +1,3 @@
+- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.

package/pack/.claude/skills/devrites-lib/reference/candidate-integrity.md

@@ -28,12 +28,29 @@ current authority. Required feature proof cannot substitute slice results.
 Same-candidate accounts may be cited when permitted. Corrections require
 new candidate checks, affected real proof and fresh affected exact reviewers for
 all open findings and dependency/regression closure, including newly triggered roles.
+After an all-met acceptance ledger has been executed, any candidate digest change
+requires `devrites-engine gates reverify <slug>` against the corrected frozen
+candidate before refreshed evidence or review bindings are written; ordinary
+`gates run` skips already-met rows and cannot refresh them.
 Changed contracts or uncertain closure require a full applicable pass.
 Unchanged sub-scope needs explicit unchanged-input/dependency justification and a
 link to original evidence. Never relabel an old candidate-bound account.
 Keep one current aggregate binding; never copy a historical binding line, even quoted. Root reconciles complete coverage and binds
 it anew. Missing coverage blocks; required roles, criteria, proof and authority remain.
 
+## Resume validation
+
+On resume — compaction, new session, reopened workspace — recorded evidence is
+a claim, not a fact. Before reusing any of it, compare the ledger's candidate
+digest, contract version, environment, gate/fingerprint counters, and coverage
+inventory against the live workspace. Rows whose dependencies changed or cannot
+be bounded invalidate; rows that provably still apply are cited as reuse with
+their original observation. Counters survive session restarts and version
+bumps — a renamed file or a fresh context never resets a spent attempt. See
+[`standards/verification-methods.md`](standards/verification-methods.md) for the
+status (`fresh`/`reused`/`failed`/`missing`/`blocked`) and result
+(`pass`/`fail`/`unverified`) vocabulary coverage rows carry.
+
 ## Existing workspaces
 
 Upgrade routes a released-workspace candidate defect to Prove with a cited

package/pack/.claude/skills/devrites-lib/reference/orchestration-profiles.md

@@ -17,6 +17,26 @@ ownership, relaxes a gate, or authorizes an irreversible action. Missing or
 incompatible exact roles stop for HITL; the root never substitutes a generic
 agent or performs the specialist's work inline.
 
+## Recorded route
+
+The decision is durable, not re-derived each phase: `brief.md` carries a
+`## Route` block (`Size`, `Profile`, `Why`) written by whichever rite first
+classified the change — `/rite-quick`'s significance gate or `/rite-spec` step
+5. Later phases read the recorded profile instead of re-judging size.
+
+| Recorded | Mapping |
+|---|---|
+| `small` + reversible + unambiguous | **Quick** — `/rite-quick` lane; the significance gate still escalates to Standard on auth, migration, public API, destructive, multi-slice, or ambiguous signals. |
+| `standard` (default) | **Standard** — the full required lifecycle. |
+| `large` or any high-stakes signal (security, migration, public contracts, high blast radius, explicit `--full`) | **Full**. |
+
+Route changes are one-directional without a recorded reason: any phase may
+escalate a profile when a significance signal appears; a downgrade needs an
+explicit recorded `Why` revision through the Spec Drift Guard. A recorded
+profile compresses artifact depth and reviewer breadth per the profile table —
+it never removes a named specialist, a required artifact, a gate, or an
+evidence binding.
+
 A child result is a claim. Admit it only against observations (`git diff
 --name-only`, recorded commands, artifact existence) — never against the
 child's prose. **Failing case:** a wright reports "done" and the parent

package/pack/.claude/skills/devrites-lib/reference/parallel-dispatch.md

@@ -33,21 +33,42 @@ If the candidate diff has no matching surfaces, record
    inherited history/memory/sibling summaries. Use supported clean-context settings;
    unverified independence is a gap. Do not launch a probe agent per task;
    still validate each result's context and candidate.
-2. Ask for each exact named agent in fresh context; omit native syntax and
+2. Build each reviewer's read-set once with
+   `devrites-engine context <slug> --phase <p> --role <role> --trigger <set>` and
+   hand the bundle path as the packet's source list instead of a file roster.
+   Evaluate the skill's trigger conditions and pass each that fires — a role's
+   Trigger column maps to manifest names: `security-auditor` → `security`,
+   `frontend-reviewer` → `ui`/`frontend`, `performance-reviewer` → `performance`.
+   The `agents` dispatch contract needs no flag: `--role` auto-fires it
+   (`auto=[agents]` in the output). The command prints `unselected=[...]`; an
+   omitted applicable trigger is a gap, not a shortcut.
+3. Enforce the launch barrier through the engine, not prose. Open the wave
+   (`devrites-engine dispatch <slug> open --phase <p> --wave <w> --role <r>...`),
+   launch every native agent nonblocking, record each returned host handle
+   (`dispatch ... start --wave <w> --role <r> --handle <id>`), then `seal` —
+   seal fails until every declared role has a distinct handle, which makes a
+   serial launch-then-wait pattern impossible to record. Record each completion
+   with `dispatch ... return`; `return` refuses before seal. `dispatch status`
+   exits nonzero while the wave is open, sealed, or abandoned. `start`/`return`
+   auto-record the dispatch/return metrics events — no separate ledger call. If
+   an opened wave cannot obtain every handle or reach `seal`, run
+   `devrites-engine dispatch <slug> abandon --wave <w> --reason <reason>` before
+   recording the gap; never leave an open wave to block a retry.
+4. Ask for each exact named agent in fresh context; omit native syntax and
    `agent_type`/`task_name`/`fork_turns` from the instruction.
-3. Every dispatch reaches a terminal classification before reconciliation:
+5. Every dispatch reaches a terminal classification before reconciliation:
    `Outcome: findings`, `Outcome: no-findings`, `Outcome: gap`, or
    `unavailable: <reason>` when the step could not run at all. Reconciling over a
    partial roster is forbidden; an unavailable conditional step is recorded with its
    marker in `review.md`/`seal.md` — an omitted sub-step reads as a clean run.
    Findings later withdrawn at reconciliation stay visible: the account records
    `withdrawn: <n> (<reason>)` rather than silently dropping them.
-4. Apply [[`agents.md`](standards/agents.md) § Result admission](standards/agents.md#result-admission)
+6. Apply [[`agents.md`](standards/agents.md) § Result admission](standards/agents.md#result-admission)
    and dedupe by evidence/root cause. Account for all seven in
    `review.md`/`seal.md`: `Outcome:` plus admitted account, or
    `Not-applicable: <inspected-scope reason>`. Spec/Code may cite valid unchanged
    `review.md` under [evidence validity](candidate-integrity.md#evidence-validity); persist no dispatch telemetry.
-5. Missing profile, null/failure, or malformed output is a `gap`; never
+7. Missing profile, null/failure, or malformed output is a `gap`; never
    infer approval or substitute inline review.
 
 On exhaustion/contention: stop spawning; collect running results; batch/serialize.
@@ -55,6 +76,17 @@ Never restart/orphan the cohort or infer approval. Reviewers are read-only;
 accounts store evidence, never telemetry. Same-file writers stay serial.
 Capacity rejection is backpressure: retry batches; never shrink a roster.
 
+## Cancellation and terminal reconciliation
+
+Cancellation acknowledgement means the host accepted a request, not that the
+child stopped. A transport timeout likewise leaves execution unknown. Keep the
+child's handle, path/resource ownership and capacity reservation until the
+native host confirms a terminal state and returned work has been reconciled.
+Query or wait on that handle; do not replace the child, release its slot, or
+reuse its resources while it may still run. If terminal state cannot be
+established, record a gap and retain ownership. A result classification alone
+does not prove host termination.
+
 ## Scale limits
 
 The role table bounds rosters. Use roughly four concurrent read-only reviewers;

package/pack/.claude/skills/devrites-lib/reference/reply-contract.md

@@ -21,6 +21,27 @@ Next: <one recommended action>
 Record: <primary durable artifact path>
 ```
 
+`Changed:` is the complete write set, not a highlight reel: every file written
+or edited this turn — workspace artifact and project source alike — appears
+there or inside one named grouped entry, so a reviewer can `git diff` exactly
+those paths. `Record:` then names the single durable artifact a later session
+reads first.
+
+Mid-flight replies — the turns between completion states — obey the same economy:
+
+- **Restate position.** The reader cannot hold "step 3 of 5" between turns; name it
+  (`step N of M` / `state: <where things stand>`) rather than asking them to remember.
+- **One next action, doable now.** `Next:` names one concrete action completable in
+  under two minutes — a command, a file to open, a yes/no decision. "Want me to
+  continue?" is a stall, not an action.
+- **Numbered steps for multi-step work**, one bounded action each; fold trivial steps
+  into the one before. A short path finished beats a complete path abandoned.
+- **Name the win before the remainder.** A landed slice, a green gate, a merged
+  piece is stated first — visible progress beats an undifferentiated list.
+- **Cap enumerations.** Long lists collapse to a few grouped items with counts;
+  the full enumeration lives in the durable artifact, not the reply.
+- **Errors are matter-of-fact** — cause and fix, never alarm noise.
+
 Pre-send check: delete an opening sentence that only announces ("I'll now…") and a
 closing sentence that only recaps; then apply the two-line test — a reader seeing only
 the first and last lines must know what happened and what to do next.
@@ -66,7 +87,9 @@ Record: .devrites/archive/<slug>/ship.md
 ```
 
 Claims such as proved, reviewed, sealed, shipped, or complete must point to real
-output or an artifact. Use exactly one recommended next action except for
+output or an artifact. An expected verification that was skipped, unavailable, or
+could not start is named in `Evidence:` or `Open:` — omitting it reads as
+ran-and-green. Use exactly one recommended next action except for
 terminal agent-owned technical exhaustion, which has no runnable action.
 
 Use that terminal case only per [`one-shot-actions.md`](standards/one-shot-actions.md):

package/pack/.claude/skills/devrites-lib/reference/standards/README.md

@@ -16,8 +16,12 @@ topic's owner.
 | `prose-style.md` | Writing prose artifacts or user replies. |
 | `error-handling.md` | Adding or reviewing failure paths. |
 | `testing.md` | Designing tests or judging proof quality. |
+| `gates.md` | Authoring, executing, or judging the `gates.md` acceptance ledger — runnable oracles, evidence binding, ABANDON handoffs. |
+| `verification-methods.md` | Choosing checks and counting coverage — method distinctness, the unit×check×environment denominator, status vs result, capability fallbacks, recipient-path execution. |
 | `spec-grammar.md` | Structuring high-risk behavioral requirements or capability deltas. |
 | `code-review.md` | Reviewing a change or sealing review findings. |
+| `review/README.md` | A diff touches source files — per-language defect-probe checklists (always with `code-review.md`). |
+| `duplicate-code.md` | Triage of near-duplicate clusters, the `check dup` scan, or the dup ignore ledger. |
 | `edge-case-trace.md` | Resolving relevant edge/prohibition classes and their evidence disposition. |
 | `security.md` | Handling input, auth, data, secrets, dependencies, or integrations. |
 | `repository-topology.md` | Work spans a monorepo member, nested root, multiple languages/services, or repositories. |
@@ -27,6 +31,7 @@ topic's owner.
 | `observability.md` | A changed runtime path must be diagnosed in production. |
 | `developer-experience.md` | A public API, CLI, SDK, webhook, config, error, or getting-started surface changes. |
 | `patterns.md` | Choosing or simplifying architecture. |
+| `architecture-health.md` | An audit needs a structural read on the whole codebase — coupling/cohesion/cycle score from a dependency index. |
 | `git-workflow.md` | Preparing commits, branches, tags, or changelog entries. |
 | `hooks.md` | Creating or changing repository hooks. |
 | `ci-cd.md` | Creating or changing a build/deploy pipeline. |
@@ -51,7 +56,12 @@ topic's owner.
 | `browser-proof-checklist.md` | UI behavior needs browser proof. |
 | `security-checklist.md` | Auth, input, data, or integration work needs a compact security sweep. |
 | `acceptance-preserving-reslice.md` | Classifying or reviewing a Reslice in Plan, Vet, or Autocomplete. |
+| `audit-coverage.md` | An audit covers a surface larger than one feature diff — ledger, hunter/critic waves, three-verdict findings. |
+| `architecture-health.md` | An audit needs a whole-codebase structural score from a code index — coupling, cohesion, cycles, god files, orphans, depth. |
+| `assumption-checkpoints.md` | Scope generalizes an existing boundary: a second case, a newly optional field, or a constant turned parameter. |
 | `debug-recovery.md` | Waiting on async readiness (server start, job completion, browser signal) needs a bounded condition-based poll. |
+| `windows.md` | A deferral marker (TODO/FIXME/skipped test/stub) is introduced or waived — the `check windows` ledger and grammar. |
+| `glossary.md` | A DevRites term is unclear; resolve it once here instead of inferring. |
 
 The table is a load trigger, not an exemption. [`core.md` § Rule summary](core.md#rule-summary-load-the-full-file-when-in-scope)
 makes every *applicable* owner mandatory. **Failing case:** a security or data-integrity

package/pack/.claude/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md

@@ -1,4 +1,6 @@
 # Acceptance-preserving Reslice
+> Applies when: before classifying or executing any reslice/split/reorder of an approved plan.
+
 ## Packet
 Exactly six groups;one slug/attempt;exact unordered keys
 <!-- BEGIN RESLICE PACKET -->

package/pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -1,5 +1,7 @@
 # AFK & HITL: the pause/resume contract
 
+> Applies when: any rite/devrites skill that can pause for a human or run unattended; irreversible-risk list, budgets, recovery accounting.
+
 Defines two modes for `rite-*`/`devrites-*` skills that may pause; main
 callers are `/rite-build`, `/rite-status`, `/rite-resolve`, and
 `devrites-doubt`.

package/pack/.claude/skills/devrites-lib/reference/standards/agents.md

@@ -1,5 +1,7 @@
 # Agent orchestration
 
+> Applies when: dispatching or admitting any devrites-* role; the source-writing boundary.
+
 Follow DevRites policy and [`depth profiles`](../orchestration-profiles.md).
 
 ## Authority
@@ -38,6 +40,12 @@ Files own briefs; [`parallel-dispatch.md`](../parallel-dispatch.md) owns rosters
 Skills name exact fresh roles, omit native fields;
 hosts spawn/wait/deliver. Root MUST NOT advance/claim completion before admitting required results;
 running/orphaned/unavailable = `gap` — no root/generic substitute.
+Where a feature workspace exists, every fresh dispatch to a named `devrites-*`
+role — wave or solo — builds its read-set with `devrites-engine context <slug>
+--phase <p> --role <role>` and tracks the launch through `devrites-engine
+dispatch <slug> open|start|seal|return` (a solo dispatch is a wave of one;
+start/return auto-record metrics). Without a workspace the plain host dispatch
+contract above applies and no engine tracking is required.
 Workflow-named skills (e.g. devrites-source-driven) are invoked inline in the root context, never dispatched as agents.
 
 ## Source-writing boundary
@@ -48,9 +56,21 @@ Isolated-worktree pilot only under [`wright-dispatch.md`](../../../rite-build/re
 
 Each job gets objective/exclusions, exact paths/immutable candidate, rubric/result shape, a **stop condition** (when to return), and the exact result shape; a dispatch missing them is malformed and re-issued. Briefs MUST NOT seed verdict/severity cap/conclusion/suppression. Results state status/scope, outcome, commands/escalation; wright adds paths, changed files, gates, stood decisions; results never widen scope.
 
+**Same-tree concurrent sessions claim first.** Worktree dispatch isolates
+parallel batch siblings, but two agent *sessions* (two hosts, two features, or
+a human plus an agent) can share one working tree. Before a same-tree writer
+starts, it records an advisory claim — `devrites-engine claim add --session
+<id> <paths>` — retains the returned `<claim-id>`, then checks the same paths
+with `devrites-engine claim check --session <id> <paths>`; a held claim from a
+live foreign session is a stop-and-report, not a merge-later problem. On every
+terminal path after `add` — success, gap, stop, or launch failure — run
+`devrites-engine claim release --session <id> --id <claim-id>`. Claims expire
+by TTL only as crash recovery; `claim list` shows who holds what. Claims are
+advisory coordination, never a substitute for the one-writer-per-worktree rule.
+
 ## Independence
 
-- A fresh result sees scope/paths-diff/rubric only — never another result's or the root's conclusions, severities, expected verdicts, or edited context; seeding voids the packet.
+- A fresh result sees scope/paths-diff/rubric only — never another result's or the root's conclusions, severities, expected verdicts, chosen verification methods, or edited context; seeding voids the packet.
 - **Verify the packet is clean before admitting the account.** Confirm the returned packet/trace carries no host-injected context: an automatic memory/summary banner naming an earlier phase verdict (e.g. `past Temper PASS … next is /rite-define`) or harness reminder text seeds the pass and voids it. Cancel that account — never admit it — name the lost coverage, and re-dispatch with the host's context injection disabled for that child. Tool config changes that do not stop native child auto-injection are not a fix; verify on the next spawn instead of assuming.
 - A parent-context pass contributes attributed evidence but is not independent: exclude it from independent accounting and name the lost coverage.
 - Final severity is set at reconciliation after re-verifying the claimed consequence at the cited site (reviewer severity advisory); dismissals record a reason, and true facts about neighboring code route elsewhere instead of being dismissed.

package/pack/.claude/skills/devrites-lib/reference/standards/anti-patterns.md

@@ -1,5 +1,7 @@
 # DevRites: universal anti-patterns
 
+> Applies when: universal rationalizations; load when tempted to shortcut any standard.
+
 The pack-wide rationalizations the agent reaches for when discipline gets in
 the way. Apply at every phase. Each `rite-*/reference/anti-patterns.md`
 extends this with phase-specific items.

package/pack/.claude/skills/devrites-lib/reference/standards/architecture-health.md

@@ -0,0 +1,64 @@
+# Architecture health
+
+> Applies when: an audit, vet, or seal needs a structural read on the whole
+> codebase — not the diff — and a dependency index is available.
+
+A health score compresses six structural signals into one 0–100 number with a
+letter grade. It is an *audit instrument*, not a gate: it ranks surfaces for
+attention and tracks drift between milestones. It never proves a change safe
+and never substitutes for review.
+
+## When to measure
+
+Compute a score only when a code index covers the repo (see
+[`code-navigation.md`](code-navigation.md) § Index freshness). With no index,
+report `unmeasured` — a placeholder number presented as a measurement is a
+false pass. **Failing case:** an audit reports "health: 100/100" on a repo the
+instrument could not parse.
+
+## Dimensions
+
+Weight the dimensions exactly once; do not invent extra dimensions ad hoc —
+record repo-specific signals as findings instead.
+
+| Dimension | Weight | What it measures | Healthy | Warning |
+| --- | --- | --- | --- | --- |
+| Coupling | 25% | Cross-file edges per file; penalize god-file outliers (max ≫ 3× mean) and >70% cross-directory share | avg ≤3 connections | avg >10 |
+| Cohesion | 20% | Share of a directory's edges that stay inside it | ≥70% internal | <30% |
+| Circular deps | 20% | File-level dependency cycles per 100 files | 0 cycles | >5 per 100 |
+| God files | 15% | Files with >3× mean connections | none | >6% of files |
+| Orphans & dead exports | 10% | Unreferenced files; exported symbols with zero dependents (60/40 blend) | 0% orphans | >10% orphans or >5% dead exports |
+| Depth | 10% | Longest dependency chain, cycles collapsed to one hop each (SCC-condensed DAG) | ≤4 levels | >8 |
+
+Grade bands: ≥90 A · ≥80 B · ≥70 C · ≥60 D · below F.
+
+## Rules
+
+- **Measure before and after.** A score's value is the delta: record
+  before/after for structural work in `evidence.md`; a drop >3 points needs a
+  named cause, not a shrug.
+- **Count runtime edges, not type-only edges.** `import type`-style
+  relationships inform dead-code analysis but do not execute; including them
+  overstates coupling.
+- **Exclude fixtures and generated files** from orphan/dead counts — a
+  directory of test fixtures is not dead code.
+- **Depth is computed on the condensed graph.** Collapse each cycle (strongly
+  connected component) to one node first; an exact longest-path search on a
+  cyclic graph is unbounded and returns no honest number.
+- **Every recommendation names the dimension it moves.** "Improve the
+  architecture" is not an action; "extract `x/` → `y/` edge to cut cross-dir
+  coupling (Coupling, est. +8)" is.
+- **Trend over snapshots.** Keep the score per milestone in `evidence.md` or
+  the feature's audit artifact; a single reading without a baseline is a
+  weather report, not a climate signal.
+
+## Orphan and dead-export semantics
+
+An orphan file has zero cross-file runtime edges. A dead export is an exported
+top-level symbol (function/class/interface/type/enum/constant) with zero
+incoming edges — member-level symbols (methods, properties) are excluded:
+they are not meaningful architecture-level candidates and produce false
+positives. Both counts feed only this dimension; the *removal decision* for a
+dead export follows [`deprecation.md`](deprecation.md), including its
+confidence rubric — a low-confidence dead lead is a watch item, never an
+automatic deletion.

package/pack/.claude/skills/devrites-lib/reference/standards/assumption-checkpoints.md

@@ -0,0 +1,42 @@
+# Assumption-delta checkpoints
+
+> Applies when: planning or vetting a slice whose scope generalizes an existing
+> boundary — the seam where a quiet assumption loses its monopoly.
+
+Most quietly imported architectural debt comes from the seam: a later change adds a
+*second case* — platform, auth method, tenant, region, source of truth — and nobody
+re-asks whether the original abstraction still names the right thing. The change that
+adds the second case is the cheap moment to ask.
+
+## The detector
+
+Scan the phase scope, spec delta, or task list for transition signals:
+
+| Signal | Shape | The question it raises |
+|---|---|---|
+| `pluralization` | A second X where exactly one existed (platform, provider, tenant, region, source of truth) | Does the identity model still name the right noun? |
+| `optionality` | A required or `only`-assumed field becomes optional | Is that field still the right anchor, or did the anchor move? |
+| `choice` | A derived value becomes chosen; a constant becomes a parameter | Has a config decision silently become a modeling decision? |
+
+Code blocks, comments, and prose that merely *mention* a trigger word do not count.
+
+## Firing the checkpoint
+
+A firing signal surfaces **one** question before the plan is finalized — not a
+redesign, one question: *does the name/model chosen when N=1 still hold at N=2?*
+
+- `detected:false` — skip the checkpoint; do not raise it.
+- `skipped` — the scope was never examined. A skipped check asserts *nothing*: never
+  record "no assumption changed" from a skipped result; skipped ≠ negative.
+- `detected:true` — ask the one question and record the answer in `decisions.md` or
+  `assumptions.md`; an answered checkpoint that leaves no trace re-fires next round.
+
+## Promote, don't add alongside
+
+When a generalization is real, the default-correct move is to **promote** the general
+representation to primary and demote the old specific one to a detail of one variant —
+not to add the new shape alongside the still-required old one, which silently
+contradicts the generalized intent.
+
+**Failing case:** `region` added as an optional column beside `primaryRegion`; every
+write now guesses which is authoritative.

package/pack/.claude/skills/devrites-lib/reference/standards/audit-coverage.md

@@ -0,0 +1,103 @@
+# Coverage-led auditing
+
+> Applies when: auditing a surface larger than one feature diff — a repo, subsystem,
+> or trust boundary — where "I looked at it" must become countable coverage.
+
+A surface audit must answer *what the run covered and what it never examined* — with
+a coverage ledger, not a summary paragraph.
+
+## Coverage ledger
+
+The coordinator alone maintains the ledger; a unit is one auditable cell — surface
+(path/endpoint/command) × trust boundary × check class.
+
+States: `planned` → `assigned` → `candidate` (produced a finding candidate) →
+`covered` (evidence recorded); plus `deferred` (postponed, reason recorded),
+`blocked` (exact blocker recorded), and `out_of_scope` (declared-scope exclusion —
+never written as `covered`). `deferred` and `blocked` are honest states; a unit
+silently dropped is a lie.
+
+Instruments obey the same honesty rule: a scanner or metric that could not read
+its target reports `unmeasured`/`no_data`, never a placeholder presented as a
+measurement. A health score computed over zero parseable files is not a 100.
+When the audit covers whole-repo structure, score it per
+[`architecture-health.md`](architecture-health.md) and record before/after
+deltas as ledger evidence.
+
+## Findings carry three verdicts, not two
+
+- **`confirmed`** — complete source trace plus a bounded observed or owner-observable
+  result; names the lower-trust principal, crossed boundary, affected
+  principal/resource, and concrete effect.
+- **`needs_validation`** — a real lead blocked on one exact unresolved fact, which is
+  named. Carries **no severity**: severity without established impact is theater.
+- **`rejected`** — a disproved candidate kept with its disproof; it suppresses
+  re-raising the same unchanged claim, never coverage of its unit.
+
+Hardening notes are not findings: if one layer already prevents the attack, the
+absent second layer is a depth observation, not a vulnerability.
+
+## Finder never verifies its own find
+
+Every surviving candidate goes to a fresh verifier that did not produce it and tries
+to **disprove** it, per [`agents.md`](agents.md) § Independence — a seeded packet
+voids the verification. Promotions to `confirmed` and material changes to root
+cause, trace, reproduction, impact, or severity require fresh independent
+verification. Without that independent evidence, keep the candidate unresolved;
+a rewritten explanation is not verification.
+
+## Critics between waves
+
+After each hunting wave, a **coverage critic** — a fresh agent comparing the ledger
+with targeted source and entry-point evidence — looks for holes: unseeded surfaces,
+boundaries with no check class,
+units stuck `assigned`, `rejected` patterns suggesting a hunter fires blanks.
+Accepted discoveries become `planned` units. Reserve critic and verifier capacity
+**before** spending on hunters; a wave launched with no verification reserve hunts
+for findings nobody may claim.
+
+## Re-runs are additive, never assumed
+
+A prior ledger must be re-checked against current source — a prior commit ref is not
+evidence a path is unchanged. Prior `confirmed` carries forward only when its source
+is unchanged **and** it re-passes current verification; prior `needs_validation` /
+`blocked` / `deferred` become current work and never suppress a unit. A partial prior
+run contributes recorded evidence and gaps, never an implied "the rest is fine"; no
+prior ledger → the report says so.
+
+## Profiles scale breadth, never the bar
+
+`quick` (one hunter wave + one critic pass, coarser units), `standard` (waves to
+critic-clean, per-candidate fresh verifier), `deep` (units split per
+subsystem/lifecycle; carried records re-verified). Profiles change granularity and
+redundancy, never the evidence bar: boundary-plus-result, independent verification,
+three verdicts, and honest `deferred`/`blocked` survive every profile. A scoped run
+presents itself as partial coverage.
+
+## Budget discipline
+
+A budget counts agent invocations, not effort. Reserve critic and verifier capacity
+before spending on hunters; a budget that cannot fund reconnaissance plus required
+reserves funds nothing — narrow scope or profile instead of silently thinning
+evidence. A run exhausted mid-verification ends `incomplete` with unvalidated
+candidates still linked to `candidate` units — never relabeled, never reported
+complete.
+
+## Target execution is sandboxed
+
+When a unit requires *running* the target — a build, a test, a probe — execute
+it under containment, never in the operator's ambient environment:
+
+- No external network and no live-service probing from the audit run.
+- No credentials, tokens, or secrets visible to target-controlled processes.
+- Only commands the repository or CI itself sanctions run verbatim; invented
+  commands are findings to propose, not actions to take.
+- Output captured through the harness, not through target-written files the
+  run then trusts.
+
+An audit that executed unaudited code with ambient privileges has crossed the
+boundary it was measuring; that run's `confirmed` rows name the execution
+context so reviewers can judge contamination.
+
+**Failing case:** "no critical findings" reported while 40% of units sit `planned` —
+the honest sentence was "60% of the surface was examined."

package/pack/.claude/skills/devrites-lib/reference/standards/browser-proof-checklist.md

@@ -1,5 +1,7 @@
 # Browser proof checklist
 
+> Applies when: UI proof: compact sweep before claiming a rendered/browser pass.
+
 Compact sweep only. Numbers and failing cases live in
 [`quality-standards.md`](../../../devrites-frontend-craft/reference/quality-standards.md)
 § Focus & states, § Responsive, and § Browser chrome — do not restate a shorter

package/pack/.claude/skills/devrites-lib/reference/standards/ci-cd.md

@@ -1,5 +1,7 @@
 # CI/CD & automation
 
+> Applies when: creating or changing a build/deploy pipeline or CI config.
+
 Read this only when creating or changing a build/deploy pipeline. [`hooks.md`](hooks.md) owns local checks, [`development-workflow.md`](development-workflow.md) owns trunk health, and [`deprecation.md`](deprecation.md) owns migrations.
 
 ## Pipeline gates
@@ -14,6 +16,15 @@ Read the specific failure, fix its root cause, verify locally, then push again.
 
 A designated Build Cop (a human/team role, not a pack agent) owns restoring a broken trunk by fixing or reverting, whichever is faster. Restoring trunk outranks feature work.
 
+## Verification economy
+
+Paid or remote validation runs once per prepared state, not per attempt: batch repairs,
+verify locally first, and never blind-retry an infra operation that already reported
+failure (deploy, migrate, seed) — read the failure output, fix the cause, then re-run.
+A green check the diff cannot affect is not re-run; an expected run that is deliberately
+skipped is named in the report, not omitted. Capture failure output as an artifact so the
+next attempt starts from evidence, not memory.
+
 ## Deploy versus release
 
 Keep incomplete or risky behavior disabled behind a flag so deploy and release remain separate and rollback does not require a redeploy. Every flag has an owner and a removal trigger; remove it through the [`deprecation.md`](deprecation.md) expand/contract path.