devrites 5.11.0 → 5.12.0

package/pack/.claude/skills/rite-upgrade/SKILL.md

@@ -5,6 +5,8 @@ argument-hint: "[feature-slug]"
 user-invocable: true
 disable-model-invocation: true
 ---
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/agents.md"],"triggers":{"reslice":["rite-plan/reference/slicing.md"]},"workspace":["state.md","spec.md","plan.md","tasks.md","decisions.md","questions.md","evidence.md","touched-files.md","review.md","seal.md","polish-report.md","browser-evidence.md"],"workspaceByRole":{"upgrade-planner":["state.md","spec.md","plan.md","tasks.md","decisions.md","questions.md"]}} -->
+> Read-set manifest: `devrites-engine context [slug] --skill rite-upgrade` bundles every file named below into one deduplicated read.
 
 # /rite-upgrade: reconcile a released workspace safely
 
@@ -50,6 +52,11 @@ references, and only current phase contracts needed for the observed gap.
    Archive-only is `current`; otherwise require contained regular `state.md` and read its
    cursor. A damaged/mismatched install stops at Doctor; missing live work routes
    `/rite-spec`; `done` is `current`. An unknown cursor is `unsupported`.
+   A `state.md` whose cursor carries no `schema` row — or any engine refusal naming the
+   workspace schema — means the workspace predates the current engine schema: structural
+   normalization is a human-approved engine step that precedes this audit, not part of
+   it. Stop and surface the refusal verbatim (it names the fail-closed `migrate`
+   command with `--dry-run`/`--answer`); after the human runs it, restart at step 0.
 1. **Freeze preservation evidence.** Record `git status --short`, cursor form/fields,
    `devrites-engine orient <slug>` (cursor, `task_graph`, `artifact_budgets`,
    `bulk_files`), and
@@ -76,7 +83,8 @@ references, and only current phase contracts needed for the observed gap.
      `history/` / `packets/`, current view only; IDs, meaning, answers and decisions
      unchanged; nothing deleted);
    - unbuilt slices beyond the [feature ceiling](../rite-plan/reference/slicing.md#feature-ceiling-split-an-epic-never-override-the-budget)
-     → `/rite-plan course-correct` (`MVP cut` plus the named continuation sequence;
+     → `/rite-plan course-correct` (trigger `reslice` loads [`slicing.md`](../rite-plan/reference/slicing.md);
+     `MVP cut` plus the named continuation sequence;
      built slices and their evidence stay);
    - live code and recorded intent disagreement → `/rite-converge`;
    - any changed planning input or readiness defect → `/rite-vet`;

package/pack/.claude/skills/rite-vet/SKILL.md

@@ -5,6 +5,10 @@ argument-hint: "[slug] [--cross-model] [--full]"
 user-invocable: true
 ---
 
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/orchestration-profiles.md","devrites-lib/reference/parallel-dispatch.md","devrites-lib/reference/standards/gates.md","rite-vet/reference/review-axes.md","rite-vet/reference/artifacts.md","rite-vet/reference/depth.md","rite-vet/reference/eng-lenses.md","rite-vet/reference/anti-patterns.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"applicability":["devrites-lib/reference/standards/repository-topology.md","devrites-lib/reference/standards/data-integrity.md","devrites-lib/reference/standards/integration-reliability.md"],"assumption-delta":["devrites-lib/reference/standards/assumption-checkpoints.md"],"cross-model":["rite-vet/reference/cross-model.md"],"devex":["devrites-lib/reference/standards/developer-experience.md"],"dod":["devrites-lib/reference/standards/definition-of-done.md"],"elicitation":["devrites-lib/reference/standards/elicitation.md"],"errors":["devrites-lib/reference/standards/error-handling.md"],"grammar":["devrites-lib/reference/standards/spec-grammar.md"],"one-shot":["devrites-lib/reference/standards/one-shot-actions.md"],"performance":["devrites-lib/reference/standards/performance.md"],"principles":["devrites-lib/reference/standards/principles.md"],"reslice":["devrites-lib/reference/standards/acceptance-preserving-reslice.md"],"testing":["devrites-lib/reference/standards/testing.md"],"workflow":["devrites-lib/reference/standards/development-workflow.md"],"workflow-artifacts":["devrites-lib/reference/standards/workflow-artifacts.md"],"yagni":["devrites-lib/reference/standards/patterns.md","devrites-lib/reference/standards/coding-style.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md"],"workspaceByRole":{"devex-reviewer":["spec.md","plan.md","tasks.md","state.md"],"plan-reviewer":["spec.md","plan.md","tasks.md","test-plan.md","decision-coverage.md","architecture.md","decisions.md","state.md"],"strategy-reviewer":["brief.md","spec.md","plan.md","decisions.md","decision-coverage.md","state.md"]}} -->
+> Read-set manifest: `devrites-engine context <slug> --phase vet` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+
+
 # /rite-vet: review the plan before build
 
 Vet every plan's scope, architecture, quality, proof, performance, failures and writer
@@ -15,20 +19,22 @@ Vet owns implementation; current `$ARGUMENTS` (`--full`) feeds the depth trigger
 
 ## Rules
 
-Read the active standard from: [`principles.md`](../devrites-lib/reference/standards/principles.md), [`patterns.md`](../devrites-lib/reference/standards/patterns.md), [`coding-style.md`](../devrites-lib/reference/standards/coding-style.md),
+Read the active standard from: [`principles.md`](../devrites-lib/reference/standards/principles.md), [`patterns.md`](../devrites-lib/reference/standards/patterns.md) + [`coding-style.md`](../devrites-lib/reference/standards/coding-style.md) (over-engineering / YAGNI rubric, trigger `yagni`),
 [`testing.md`](../devrites-lib/reference/standards/testing.md), [`spec-grammar.md`](../devrites-lib/reference/standards/spec-grammar.md), [`performance.md`](../devrites-lib/reference/standards/performance.md), [`error-handling.md`](../devrites-lib/reference/standards/error-handling.md),
 [`development-workflow.md`](../devrites-lib/reference/standards/development-workflow.md), [`afk-hitl.md`](../devrites-lib/reference/standards/afk-hitl.md), [`one-shot-actions.md`](../devrites-lib/reference/standards/one-shot-actions.md),
 [`developer-experience.md`](../devrites-lib/reference/standards/developer-experience.md), [`elicitation.md`](../devrites-lib/reference/standards/elicitation.md), and [`definition-of-done.md`](../devrites-lib/reference/standards/definition-of-done.md). Load
 repository topology, data integrity, and integration reliability only when
-triggered. Before classifying any Reslice, read `.claude/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+triggered. When the plan's scope generalizes an existing boundary — a second
+platform/tenant/source of truth, a newly optional field, a constant turned parameter —
+confirm the [`assumption-checkpoints.md`](../devrites-lib/reference/standards/assumption-checkpoints.md) question (trigger `assumption-delta`)
+was answered and recorded, not skipped-as-negative.
+Before classifying any Reslice, read `.claude/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
 When a
 plan declares a root-authored executable workflow file, read
 [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md).
 
 <!-- BEGIN RESLICE ROUTE-TO-ACTION -->
-- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
-- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
-- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- include:../devrites-lib/reference/_shared/reslice-vet.md -->
 <!-- END RESLICE ROUTE-TO-ACTION -->
 
 ## Invariants
@@ -72,7 +78,8 @@ plan declares a root-authored executable workflow file, read
    recheck retains prior depth and enters 1b.
 1a. **Independent initial pass.** Freeze candidate and dispatch the exact fresh
    read-only plan reviewer — plus developer-experience reviewer for developer
-   surfaces and the current strategy reviewer after significant Temper — in
+   surfaces (trigger `devex`) and the current strategy reviewer after significant
+   Temper — in
    parallel under `../devrites-lib/reference/parallel-dispatch.md`; they are
    independent read-only passes on one frozen candidate. Missing
    required account blocks.
@@ -151,7 +158,18 @@ plan declares a root-authored executable workflow file, read
    assumptions, uncertainty, and gates. Keep state non-READY. Every scenario and
    criterion needs positive, discriminating proof; every slice must be one-pass
    implementable; developer plans need a predicted scorecard. Durable commands
-   are portable repository commands, not host wrappers.
+   are portable repository commands, not host wrappers — resolve them with
+   `devrites-engine detect commands` (Makefile/package.json/manifests, no
+   execution) and cite the resolved text verbatim; an `unresolved` slot means
+   name the concrete command in the plan, never guess one.
+   Once the `## Build-entry preflight` table is final, run
+   `devrites-engine gates scaffold <slug>` to seed `gates.md` (one pending gate
+   per `AC-###`; never clobber an existing ledger), then author each gate's
+   `CHECK`/`EXPECT`/`CWD` per artifacts.md §`gates.md` so every runnable oracle
+   is an approved preflight row. Run
+   `devrites-engine gates lint <slug> --strict` and resolve every finding before
+   READY; the readiness check refuses a missing or malformed ledger but does not
+   replace this oracle-quality gate.
 7. **Narrow recheck after edits.** Dispatch the exact plan reviewer once per
    fold — one dispatch covering every open fingerprint, preserving
    per correction/fingerprint accounting (each checked individually with its
@@ -171,8 +189,10 @@ plan declares a root-authored executable workflow file, read
    preflight, and sweep is green. Write phase/next step and emit one
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
-   must pass. Technical failure records reproduction, not qid. Human gap awaits
-   Clarify. Optional cross-model follows `reference/cross-model.md`.
+   must pass. Record the per-input drift baseline alongside it:
+   `devrites-engine check drift <slug> --record` — a later stale binding then
+   names the exact artifact that moved instead of "something changed". Technical failure records reproduction, not qid. Human gap awaits
+   Clarify. Optional cross-model follows `reference/cross-model.md` (trigger `cross-model`).
 
    With READY, no pending remediation, and a valid technical return cursor,
    restore and consume the return cursor instead of defaulting to Build. Preserve

package/pack/.claude/skills/rite-vet/reference/anti-patterns.md

@@ -5,9 +5,7 @@ Read [universal anti-patterns](../../devrites-lib/reference/standards/anti-patte
 Authority: `.claude/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
 
 <!-- BEGIN RESLICE ROUTE-TO-ACTION -->
-- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
-- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
-- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- include:../../devrites-lib/reference/_shared/reslice-vet.md -->
 <!-- END RESLICE ROUTE-TO-ACTION -->
 
 ## Phase rationalizations

package/pack/.claude/skills/rite-vet/reference/artifacts.md

@@ -6,9 +6,7 @@ into `plan.md`/`tasks.md`; prose alone never changes Build.
 Authority: `.claude/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
 
 <!-- BEGIN RESLICE ROUTE-TO-ACTION -->
-- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
-- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
-- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- include:../../devrites-lib/reference/_shared/reslice-vet.md -->
 <!-- END RESLICE ROUTE-TO-ACTION -->
 
 ## `eng-review.md`: the record
@@ -146,6 +144,25 @@ For every row in `plan.md`'s `Shared contract proof`, the per-gap requirements n
 provider- and consumer-side asserting tests and state how each consumes the same canonical
 artifact. Reference the plan row; do not reproduce its contract table here.
 
+## `gates.md`: the acceptance ledger
+
+Write `.devrites/work/<slug>/gates.md` once the preflight table is final —
+`devrites-engine gates scaffold <slug>` seeds one pending gate per `AC-###` in
+`spec.md`; never clobber a ledger that already carries evidence. Grammar,
+evidence binding, and oracle rules live in
+[`gates.md`](../../devrites-lib/reference/standards/gates.md); the engine
+enforces them, so author to the contract, not around it:
+
+- One gate per required outcome; reuse `AC-###` ids so readiness coverage and
+  the ledger name the same set.
+- A runnable gate's `CHECK` must be a `## Build-entry preflight` `Command`
+  verbatim with a matching `Cwd` — a gate whose command is absent from the
+  preflight table can never execute, so add the row first.
+- `EXPECT` names a line only success can print; `gates lint <slug>` flags
+  tautological commands and weak expectations before build.
+- Manual gates (`EVIDENCE` only) are for judgment-bound outcomes; Prove
+  attests them, Seal still requires them checked.
+
 ## Parallelization table (in `eng-review.md` §5 when there's an opportunity)
 
 ```markdown

package/pack/.claude/skills/rite-vet/reference/depth.md

@@ -11,9 +11,7 @@ recorded engineering verdict and a coverage plan.
 Authority: `.claude/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
 
 <!-- BEGIN RESLICE ROUTE-TO-ACTION -->
-- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
-- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
-- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- include:../../devrites-lib/reference/_shared/reslice-vet.md -->
 <!-- END RESLICE ROUTE-TO-ACTION -->
 
 ## Full pass when ANY trips

package/pack/.claude/skills/rite-vet/reference/review-axes.md

@@ -6,9 +6,7 @@ calibrate findings before presentation.
 Authority: `.claude/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
 
 <!-- BEGIN RESLICE ROUTE-TO-ACTION -->
-- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
-- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
-- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- include:../../devrites-lib/reference/_shared/reslice-vet.md -->
 <!-- END RESLICE ROUTE-TO-ACTION -->
 
 ---
@@ -75,6 +73,11 @@ presentation never caps the inventory or hides the ninth substantive defect.
 - Security architecture at the seams (auth, data access, API boundaries): does the plan name
   the trust boundary for each untrusted input?
 - One realistic production failure per new codepath/integration (feeds failure-mode table).
+- **Assumption delta:** when the plan or fresh evidence changes the *kind* of a spec
+  assumption (singular→plural, required→optional, chosen→derived, or back) that is an
+  identity-model change, not a detail. It needs an explicit promote-vs-add-alongside
+  decision routed through the Guard; silently widening the model in the plan is a
+  `broken` finding.
 - Does any key flow deserve an ASCII diagram in the plan or an inline comment in the code the
   build will write? Name the files that should carry one.
 

package/pack/.claude/skills/rite-watch-pr/SKILL.md

@@ -4,6 +4,8 @@ description: Observe one GitHub PR and CI state without mutating code, Git, thre
 argument-hint: "[PR number|PR URL|blank for current branch]"
 user-invocable: true
 ---
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/loop-operations.md"],"triggers":{"security":["devrites-lib/reference/standards/security.md"]},"workspace":[]} -->
+> Read-set manifest: `devrites-engine context [slug] --skill rite-watch-pr` bundles every file named below into one deduplicated read.
 
 # /rite-watch-pr: read-only PR and CI observation
 

package/pack/.claude/skills/rite-zoom-out/SKILL.md

@@ -5,6 +5,8 @@ argument-hint: "[symbol | file | area to map]"
 user-invocable: true
 disable-model-invocation: true
 ---
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/tooling.md"],"workspace":["spec.md","plan.md","decisions.md","state.md"]} -->
+> Read-set manifest: `devrites-engine context [slug] --skill rite-zoom-out` bundles every file named below into one deduplicated read.
 
 # /rite-zoom-out: step up one abstraction layer
 

package/pack/generated/claude/agents/devrites-code-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-code-reviewer
 description: Reviews a full DevRites feature diff once for /rite-review and /rite-seal. Checks tests, correctness, readability, architecture, maintainability, and standards; returns every supported finding.
-tools: Read, Grep, Glob, Bash
+tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
 permissionMode: plan
 ---
 
@@ -35,6 +35,10 @@ mirrors under `.agents/skills/devrites-lib/reference/standards/`. Apply the curr
 files, not a summary you remember.
 From `spec.md`'s applicability map, load only triggered [`repository-topology.md`](../skills/devrites-lib/reference/standards/repository-topology.md),
 [`data-integrity.md`](../skills/devrites-lib/reference/standards/data-integrity.md), or [`integration-reliability.md`](../skills/devrites-lib/reference/standards/integration-reliability.md); their cases remain feature-scoped.
+For per-file defect probes, load [`review/README.md`](../skills/devrites-lib/reference/standards/review/README.md):
+[`review/default.md`](../skills/devrites-lib/reference/standards/review/default.md) applies to every file, plus the language checklist matching
+each file's extension. A do-not-flag item raised as Critical/Important is a
+review defect — check that list before reporting.
 
 ## Inputs
 
@@ -74,10 +78,21 @@ for the feature scope and read the touched files.
     cast, or silent fallback that hides an unclear invariant?
   - Are repository/deployable roots, canonical contract and mutable-state ownership,
     shared resources, and sync/async consistency boundaries preserved without a cycle?
+  - Run `devrites-engine check dup <slug>` for near-duplicate leads, using the
+    mode that matches the packet's diff: `--base <ref>` when the feature's work
+    is committed, `--staged`/`--worktree` for uncommitted diffs. Triage each
+    reported cluster per
+    [`duplicate-code.md`](../skills/devrites-lib/reference/standards/duplicate-code.md)
+    — merge, keep-with-reason, or watch. A `*`-marked unit the diff added needs a
+    verdict, not suppression.
 - **Maintainability:** dead code, leftover TODOs or logs, and convention drift. Check
   **file size as well as diff size**. If a small diff pushes an already-large file
   past a healthy boundary, flag decompose-then-add and recommend extracting helpers
   or splitting modules first.
+- **Anchored notes:** when the workspace carries `notes.md`, run
+  `devrites-engine note list <slug>` and grade each anchor; a
+  `moved`/`stale`/`ambiguous`/`lost` note is a finding — the rationale it carries
+  no longer matches the code it names.
 - **Standards:** conformance to the project's conventions and the DevRites rules
   (naming, error handling, security, git/commit hygiene where the diff touches them).
 - **Hand-offs:** when input/auth/data/integration or a hot path/budget is in scope, flag
@@ -129,6 +144,7 @@ Return the report in this shape:
 Code review (<slug>) — independent
 Outcome: <findings | no-findings | gap>
 Account: <admitted findings | No-findings | Gap per Result admission>
+Coverage: <files read fully | hunk-level | skipped: name — reason>
 Finding: <severity> | <file:line> | <observed> | <impact> | <minimum fix>
 Basis: <files read · commands run to reach this finding>
 Tests: <adequate? gaps>

package/pack/generated/claude/agents/devrites-devex-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-devex-reviewer
 description: Reviews developer experience for one DevRites feature in fresh context. Predicts at /rite-vet and measures at /rite-seal for public APIs, CLIs, SDKs, libraries, webhooks, configuration, errors, and onboarding; reports where the next developer gets stuck.
-tools: Read, Grep, Glob
+tools: Read, Grep, Glob, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
 permissionMode: plan
 ---
 

package/pack/generated/claude/agents/devrites-doubt-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-doubt-reviewer
 description: Stress-tests one claim or decision for the devrites-doubt loop from a fresh context. Tries to break the claim rather than validate it.
-tools: Read, Grep, Glob, Bash
+tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
 permissionMode: plan
 ---
 

package/pack/generated/claude/agents/devrites-evidence-scout.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-evidence-scout
 description: Answers one bounded evidence question for spec, clarify, converge, or external-fact work from a fresh, read-only context. Returns a cited dossier from live code, project records, installed source, or authoritative versioned documentation. Never asks the user, chooses scope, edits artifacts, or advances a phase.
-tools: Read, Grep, Glob, Bash, WebFetch, WebSearch
+tools: Read, Grep, Glob, Bash, WebFetch, WebSearch, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
 permissionMode: plan
 ---
 

package/pack/generated/claude/agents/devrites-frontend-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-frontend-reviewer
 description: Reviews one DevRites UI feature for /rite-seal from a fresh context. Checks UX flow, accessibility, responsive behavior, design-system alignment, and AI slop independently and adversarially.
-tools: Read, Grep, Glob, Bash
+tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
 skills:
   - devrites-frontend-craft
 permissionMode: plan

package/pack/generated/claude/agents/devrites-performance-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-performance-reviewer
 description: Reviews one DevRites feature's performance for /rite-seal in fresh context. Uses source mode for potential static findings or measured mode for Lighthouse, PSI, CrUX, and traces; reports source-labeled numbers without presenting lab data as field data.
-tools: Read, Grep, Glob
+tools: Read, Grep, Glob, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
 permissionMode: plan
 ---
 

package/pack/generated/claude/agents/devrites-plan-drafter.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-plan-drafter
 description: Read-only planning drafter for /rite-define and /rite-plan repair. From a fresh context, produces one consistent candidate bundle covering architecture, plan, vertical slices, traceability, and proof mapping. Proposes the technical approach, flags user-owned choices, and never edits workspace artifacts or source.
-tools: Read, Grep, Glob, Bash
+tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
 permissionMode: plan
 ---
 

package/pack/generated/claude/agents/devrites-plan-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-plan-reviewer
 description: Read-only /rite-vet reviewer for engineering plans before code. Checks plan.md and tasks.md against spec.md for architecture, quality, tests, performance, scope, reversibility, and failure modes; reports high-confidence, line-supported findings and gates on the weakest axis.
-tools: Read, Grep, Glob
+tools: Read, Grep, Glob, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
 permissionMode: plan
 ---
 

package/pack/generated/claude/agents/devrites-proof-runner.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-proof-runner
 description: Validates root-produced test, build, lint, typecheck, and browser evidence for /rite-prove and affected re-proof; maps it to acceptance and reports gaps. Never executes gates or edits code or evidence.
-tools: Read, Grep, Glob
+tools: Read, Grep, Glob, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
 permissionMode: plan
 ---
 

package/pack/generated/claude/agents/devrites-retrospector.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-retrospector
 description: Read-only analyst of recurring cross-feature lessons in reviewed Markdown.
-tools: Read, Grep, Glob, Bash
+tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
 permissionMode: plan
 ---
 

package/pack/generated/claude/agents/devrites-security-auditor.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-security-auditor
 description: Audits one DevRites feature for /rite-seal from a fresh context. Checks the diff independently for OWASP Top 10 issues, trust-boundary violations, secrets, and dependency risk. For model calls, agents, RAG, or tool use, also checks the OWASP LLM Top 10. Assumes all input is hostile.
-tools: Read, Grep, Glob, Bash
+tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
 permissionMode: plan
 ---
 
@@ -80,6 +80,28 @@ Explicitly trace authn versus per-resource authz, tenant scope across storage/ca
 jobs/model context, privilege-changing actions, resolved filesystem/archive paths, request
 forgery control, unsafe deserialization, and fail-closed environment defaults when relevant.
 
+## Verification discipline
+
+- Enumerate the diff's security-relevant units before judging: endpoints, handlers,
+  trust boundaries, auth paths, deserialization sinks, and touched files. Audit each
+  and report audited-vs-total; unchecked units are a declared gap, never coverage by
+  omission.
+- Try to disprove every candidate before reporting it: re-check the cited site for
+  validation, authorization, escaping, or an existing guard that already neutralizes
+  it. A candidate that survives disproof is a finding; an unresolved fact names the
+  exact unknown (no severity claim); a disproved candidate stays visible as rejected
+  with the disproof, per [`agents.md`](../skills/devrites-lib/reference/standards/agents.md) § Result admission.
+- **Severity is capped at demonstrated impact in this codebase.** A candidate that
+  names principal, input, boundary, and observed crossing earns Critical; one that
+  weakens but does not defeat an explicit control caps at Important; a pattern
+  match with no shown crossing is Suggestion/FYI at most. "Best practice says so"
+  without a demonstrated boundary crossing is not a finding.
+- When scope is a surface larger than this diff — a subsystem, protocol surface, or
+  repo sweep — apply `.claude/skills/devrites-lib/reference/standards/audit-coverage.md`
+  (`.agents/skills/` mirror on Codex): coverage ledger, finder≠verifier, three-verdict
+  records, honest `deferred`/`blocked`. A unit never audited is a declared gap, not
+  coverage.
+
 ## Rules
 
 - Don't edit. Findings only, labeled Critical / Important / Suggestion / Nit / FYI with

package/pack/generated/claude/agents/devrites-simplifier-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-simplifier-reviewer
 description: Read-only simplification reviewer for /rite-polish Phase 1. From a fresh context, finds measured, behavior-preserving ways to reduce complexity in one DevRites feature diff, using guard clauses, Extract Method, simpler conditionals, and Chesterton's Fence. Returns findings only for the caller to apply in feature scope.
-tools: Read, Grep, Glob, Bash
+tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
 permissionMode: plan
 ---
 
@@ -41,7 +41,11 @@ files.
   points without removing them. Skip code that is already simple.
 - **Behavior-preserving only.** Observable behavior must stay identical and tests
   must remain green. Report any behavior-changing proposal separately because it is
-  not simplification.
+  not simplification. Green tests alone do not prove equivalence: inspect
+  observable representation, prototypes and key behavior, order, aliasing and
+  mutation, synchronous throws versus promise rejections and timing, and resource
+  lifetime where the proposed transformation touches them. Name the preserving
+  evidence or the unresolved edge case.
 - **Chesterton's Fence.** Explain *why* something exists before recommending its
   removal. If you cannot, flag "needs author intent" instead. A line that looks
   "useless" may protect a real edge case.
@@ -68,7 +72,13 @@ files.
 - **Simplify conditionals:** replace a long `if` and `else` chain with a switch,
   lookup table, or map, or split a complex boolean into well-named parts.
 - **Dedupe:** remove duplication, inline single-use indirection, or replace a
-  hand-rolled utility with the standard library or an existing helper.
+  hand-rolled utility with the standard library or an existing helper. Run
+  `devrites-engine check dup <slug>` for near-duplicate leads that survive
+  renaming — `--base <ref>`/`--worktree` matching the packet's diff, or `--all`
+  when the packet asks for a repo-wide pass. Read both units before proposing a
+  merge — convergent code is a keep, not a dedupe. Report each actionable
+  cluster with its hash per
+  [`duplicate-code.md`](../skills/devrites-lib/reference/standards/duplicate-code.md).
 - **Delete dead code:** remove only unreachable code added by this feature.
 
 ## Output

package/pack/generated/claude/agents/devrites-slice-wright.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-slice-wright
 description: Sole source/test writer for one /rite-build slice or accepted prove, polish, or review correction. Executes a fresh path-bounded contract, proves the smallest complete change, returns evidence, and never plans, reviews, or writes workspace bookkeeping.
-tools: Read, Edit, Write, Bash, Glob, Grep, Skill
+tools: Read, Edit, Write, Bash, Glob, Grep, Skill, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
 permissionMode: acceptEdits
 ---
 

package/pack/generated/claude/agents/devrites-spec-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-spec-reviewer
 description: Independently checks one feature candidate against its spec for /rite-review and /rite-seal. Finds missing or wrong acceptance coverage, preservation regressions, scope creep, placement drift, and design-reference mismatches. Never edits.
-tools: Read, Grep, Glob, Bash
+tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
 permissionMode: plan
 ---
 

package/pack/generated/claude/agents/devrites-strategy-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-strategy-reviewer
 description: Read-only /rite-temper reviewer for a hardened spec before planning or code. Tests ambition, scope, premise, pre-mortem risk, over-engineering, testability, irreversibility, cross-cutting concerns, and convention fit; scores from evidence and reports defects without editing.
-tools: Read, Grep, Glob
+tools: Read, Grep, Glob, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
 permissionMode: plan
 ---
 

package/pack/generated/claude/agents/devrites-test-analyst.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-test-analyst
 description: Reviews test quality for /rite-seal from a fresh context. Independently checks whether a DevRites feature's tests prove its acceptance criteria and flags missing, assertion-free, or tautological tests.
-tools: Read, Grep, Glob, Bash
+tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
 permissionMode: plan
 ---
 

package/pack/generated/claude/agents/devrites-upgrade-planner.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-upgrade-planner
 description: Read-only /rite-upgrade assessor returning a cited current, repairable, unsupported, or gap outcome; never writes/delegates.
-tools: Read, Grep, Glob
+tools: Read, Grep, Glob, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
 permissionMode: plan
 ---
 

package/pack/generated/claude/settings.json

@@ -6,12 +6,27 @@
       "Bash(devrites-engine check candidate *)",
       "Bash(devrites-engine check readiness *)",
       "Bash(devrites-engine check seal *)",
+      "Bash(devrites-engine check diff-scope *)",
       "Bash(devrites-engine check task-graph *)",
       "Bash(devrites-engine check path-disjoint *)",
       "Bash(devrites-engine check indexes *)",
       "Bash(devrites-engine check skill-trust *)",
+      "Bash(devrites-engine check slice *)",
+      "Bash(devrites-engine check regression *)",
+      "Bash(devrites-engine check windows *)",
+      "Bash(devrites-engine check dup *)",
+      "Bash(devrites-engine check drift *)",
       "Bash(devrites-engine orient *)",
+      "Bash(devrites-engine next *)",
+      "Bash(devrites-engine handoff *)",
+      "Bash(devrites-engine context *)",
+      "Bash(devrites-engine metrics *)",
+      "Bash(devrites-engine dispatch *)",
+      "Bash(devrites-engine claim *)",
+      "Bash(devrites-engine note *)",
       "Bash(devrites-engine observe *)",
+      "Bash(devrites-engine detect *)",
+      "Bash(devrites-engine migrate *)",
       "Bash(devrites-engine parallel status *)",
       "Bash(devrites-engine parallel select *)",
       "Bash(devrites-engine parallel create *)",
@@ -25,8 +40,30 @@
       "Bash(devrites-engine state resolve *)",
       "Bash(devrites-engine state merge-manifest *)",
       "Bash(devrites-engine state close *)",
-      "Bash(devrites-engine secret-scan --staged)",
-      "Bash(devrites-engine secret-scan --stdin)",
+      "Bash(devrites-engine gates scaffold *)",
+      "Bash(devrites-engine gates status *)",
+      "Bash(devrites-engine gates run *)",
+      "Bash(devrites-engine gates reverify *)",
+      "Bash(devrites-engine gates lint *)",
+      "Bash(devrites-engine gates attest *)",
+      "Bash(devrites-engine gates abandon *)",
+      "mcp__codegraph__*",
+      "mcp__codebase-memory-mcp__*",
+      "mcp__codebase-memory__*",
+      "mcp__code-review-graph__*",
+      "mcp__graphify__*",
+      "Bash(codegraph *)",
+      "Bash(graphify *)",
+      "Bash(git status *)",
+      "Bash(git diff *)",
+      "Bash(git log *)",
+      "Bash(git show *)",
+      "Bash(git rev-parse *)",
+      "Bash(git merge-base *)",
+      "Edit(.devrites/**)",
+      "Write(.devrites/**)",
+      "Bash(devrites-engine secret-scan)",
+      "Bash(devrites-engine secret-scan *)",
       "Bash(devrites-engine open-visual *)",
       "Bash(devrites-engine version)"
     ]

package/pack/generated/claude/skills/devrites-api-interface/SKILL.md

@@ -3,6 +3,8 @@ name: devrites-api-interface
 description: Shape stable API, type, module, or frontend/backend contracts before implementation. Use when a slice crosses a boundary; not for internal helpers.
 user-invocable: false
 ---
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"deprecation":["devrites-lib/reference/standards/deprecation.md"],"security":["devrites-lib/reference/standards/security.md","rite-review/reference/security-review.md"]},"workspace":["spec.md","plan.md","tasks.md","state.md","decisions.md"]} -->
+> Read-set manifest: `devrites-engine context [slug] --skill devrites-api-interface` bundles every file named below into one deduplicated read.
 
 # devrites-api-interface: contract before implementation
 

package/pack/generated/claude/skills/devrites-audit/SKILL.md

@@ -4,6 +4,8 @@ description: Audit one feature read-only for security, performance, or simplific
 argument-hint: "<security | perf | simplify>"
 user-invocable: false
 ---
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/parallel-dispatch.md","devrites-lib/reference/standards/agents.md"],"triggers":{"audit-coverage":["devrites-lib/reference/standards/audit-coverage.md"],"architecture-health":["devrites-lib/reference/standards/architecture-health.md"]},"workspace":["spec.md","plan.md","tasks.md","touched-files.md","evidence.md","state.md","decisions.md"],"workspaceByRole":{"performance-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md"],"security-auditor":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md"],"simplifier-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md"]}} -->
+> Read-set manifest: `devrites-engine context [slug] --skill devrites-audit` bundles every file named below into one deduplicated read.
 
 # devrites-audit: read-only audit dispatch
 
@@ -21,6 +23,13 @@ decides how to use the report; this skill never edits.
 If no axis is supplied, infer only when intent is unambiguous; otherwise the root asks
 the human before dispatch.
 
+When scope is a surface larger than the feature diff — subsystem, protocol surface,
+repo sweep — apply [`audit-coverage.md`](../devrites-lib/reference/standards/audit-coverage.md)
+(trigger `audit-coverage`). When the audit calls for a whole-codebase structural
+score and a code index is present, apply
+[`architecture-health.md`](../devrites-lib/reference/standards/architecture-health.md)
+(trigger `architecture-health`).
+
 ## Gather and dispatch
 
 1. Resolve `.devrites/ACTIVE`; require `spec.md` and `touched-files.md`.

package/pack/generated/claude/skills/devrites-browser-proof/SKILL.md

@@ -3,6 +3,8 @@ name: devrites-browser-proof
 description: Observe and prove working UI behavior in a real browser with screenshots, interactions, network evidence, and Core Web Vitals. Use for browser proof or performance after the page works.
 user-invocable: false
 ---
+<!-- loads: {"always":["devrites-browser-proof/reference/browser-performance.md","devrites-browser-proof/reference/visual-verdict.md","devrites-frontend-craft/reference/quality-standards.md"],"triggers":{"security":["devrites-lib/reference/standards/security.md"],"devex":["devrites-lib/reference/standards/developer-experience.md"]}} -->
+> Read-set manifest: `devrites-engine context [slug] --skill devrites-browser-proof` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # devrites-browser-proof: runtime evidence for UI
 

package/pack/generated/claude/skills/devrites-debug-recovery/SKILL.md

@@ -4,6 +4,8 @@ description: Fix application test, build, CI, runtime, browser, or 500 failures
 argument-hint: "[<slug>]"
 user-invocable: false
 ---
+<!-- loads: {"always":["devrites-lib/reference/standards/code-navigation.md","devrites-debug-recovery/reference/build-the-loop.md","devrites-debug-recovery/reference/cleanup-and-classify.md","devrites-debug-recovery/reference/hypotheses.md","devrites-debug-recovery/reference/instrumentation.md","devrites-debug-recovery/reference/regression-test.md","devrites-debug-recovery/reference/trace.md","devrites-lib/reference/standards/debug-recovery.md"],"triggers":{"one-shot":["devrites-lib/reference/standards/one-shot-actions.md"],"security":["devrites-lib/reference/standards/security.md"],"workspace":["devrites-lib/reference/standards/workflow-artifacts.md"]}} -->
+> Read-set manifest: `devrites-engine context [slug] --skill devrites-debug-recovery` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # devrites-debug-recovery: fix the root cause, not the symptom