devrites 5.13.0 → 5.14.0

package/pack/generated/pi/skills/rite-resolve/reference/answer-protocol.md

@@ -51,7 +51,7 @@ q-2026-05-28-002: clinician sign-off required at runtime, not at plan time
 - Order matters only for `state.md` clearance: the script processes top-to-bottom and
   flushes `Awaiting human` after each match.
 - Errors abort the batch at the first failing line so partial state is small and
-  diagnosable. (Re-run after fixing the offending line; already-applied lines refuse to
+  diagnosable. Report the failing line, exit code, and the qids already applied. (Re-run after fixing the offending line; already-applied lines refuse to
   re-apply because their `status` is no longer `open`.)
 
 ## Never overwrite

package/pack/generated/pi/skills/rite-review/SKILL.md

@@ -87,7 +87,8 @@ Pull these via `Read` when the diff demands them:
    what the spec asked but breaks project conventions (Spec pass, Code-review fail).
    Separate contexts prevent one axis from masking the other. This is the initial
    full pass; a correction uses step 7's bounded recheck:
-   - Freeze that closed digest and give the same digest to **two** read-only reviewers in
+   - Freeze that closed digest and give the same digest to the **two** axis reviewers (three when
+     [engineering lanes](../devrites-lib/reference/parallel-dispatch.md) split the code axis) in
      parallel, each with its own narrow brief and no
      cross-pollination — and evaluate the frontend (step 4), security (step 5),
      and performance (step 6) dispatch conditions from this same diff now,
@@ -104,6 +105,8 @@ Pull these via `Read` when the diff demands them:
        checks. Apply canonical anti-slop and silent-failure lenses; inspect each hunk
        for unrequested deletion. Unexcepted `.devrites/principles.md` violations are
        Critical. Distinguish binding standards from judgment-only baseline smells."
+       Route it through [parallel-dispatch.md § Engineering lanes](../devrites-lib/reference/parallel-dispatch.md#engineering-lanes):
+       a frontend+backend diff gets two lane reviewers in this cohort.
    - **Do NOT merge or re-rank** their findings. Present them under separate
      `## Spec` and `## Code review` sub-sections in `review.md`. Surface contradictions
      between the axes explicitly (e.g. "Spec axis says complete, Code-review axis says

package/pack/generated/pi/skills/rite-review/reference/performance-checklist.md

@@ -37,6 +37,11 @@ Identify the framework first; apply only its idioms.
   handlers, but preserve sensitive-data cache policy: `Cache-Control: no-store`
   eligibility varies by browser and conditions. Never remove a security control
   for a performance score; test account-switch and restored-page behavior.
+- **CLS attribution:** name the initiator (content inserted above, late
+  validation message, font swap), not only the shifted element, and exercise the
+  post-load state; a navigation-only run misses it. A CLS change is layout stability,
+  never reported as speed or latency. **Failing case:** space reserved on the shifted
+  card while the banner inserted above still causes the shift.
 
 ## Backend (every feature, UI or not)
 
@@ -62,7 +67,10 @@ Identify the framework first; apply only its idioms.
 ## AI-codegen perf smells (fold into the area above, not a separate finding category)
 
 - State duplicated instead of lifted; effects with over-broad deps that re-run needlessly.
-- Sequential `await`s where `Promise.all` / parallel fetch fits.
+- Sequential `await`s where `Promise.all` / parallel fetch fits, only after
+  authorization: a reorder never starts a private fetch before the auth check.
+  **Failing case:** after a "waterfall fix" an unauthenticated request reaches the
+  private fetch → Critical.
 - Over-fetching "just in case"; redundant calls a dedup would collapse.
 - Defensive memoization wrapping cheap components: cost with no benefit.
 

package/pack/generated/pi/skills/rite-seal/SKILL.md

@@ -5,7 +5,7 @@ argument-hint: "[feature-slug] [--full]"
 user-invocable: true
 ---
 
-<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/candidate-integrity.md","devrites-lib/reference/orchestration-profiles.md","devrites-lib/reference/parallel-dispatch.md","devrites-lib/reference/standards/verification-methods.md","rite-seal/reference/phase-contract.md","rite-seal/reference/final-evidence.md","rite-seal/reference/go-no-go.md","rite-seal/reference/risk-and-rollback.md","rite-seal/reference/seal-template.md","rite-seal/reference/output.md","rite-seal/reference/anti-patterns.md"],"triggers":{"agents":["devrites-lib/reference/standards/agents.md"],"browser":["devrites-lib/reference/standards/browser-proof-checklist.md"],"code-review":["devrites-lib/reference/standards/code-review.md"],"deprecation":["devrites-lib/reference/standards/deprecation.md"],"documentation":["devrites-lib/reference/standards/documentation.md"],"dod":["devrites-lib/reference/standards/definition-of-done.md"],"observability":["devrites-lib/reference/standards/observability.md"],"principles":["devrites-lib/reference/standards/principles.md"],"security":["devrites-lib/reference/standards/security.md"],"testing":["devrites-lib/reference/standards/testing.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","evidence.md","touched-files.md","review.md","seal.md"],"workspaceByRole":{"code-reviewer":["spec.md","plan.md","tasks.md","test-plan.md","architecture.md","decisions.md","state.md","evidence.md","touched-files.md","review.md"],"devex-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"doubt-reviewer":["spec.md","plan.md","tasks.md","state.md","decisions.md","review.md"],"frontend-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"performance-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"proof-runner":["spec.md","test-plan.md","tasks.md","evidence.md","state.md"],"security-auditor":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"simplifier-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","review.md"],"spec-reviewer":["brief.md","spec.md","decision-coverage.md","questions.md","decisions.md","assumptions.md","state.md","review.md"],"test-analyst":["spec.md","tasks.md","test-plan.md","state.md","evidence.md","review.md"]}} -->
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/candidate-integrity.md","devrites-lib/reference/orchestration-profiles.md","devrites-lib/reference/parallel-dispatch.md","devrites-lib/reference/standards/verification-methods.md","rite-seal/reference/phase-contract.md","rite-seal/reference/final-evidence.md","rite-seal/reference/go-no-go.md","rite-seal/reference/risk-and-rollback.md","rite-seal/reference/seal-template.md","rite-seal/reference/output.md","rite-seal/reference/anti-patterns.md"],"triggers":{"agents":["devrites-lib/reference/standards/agents.md"],"browser":["devrites-lib/reference/standards/browser-proof-checklist.md"],"code-review":["devrites-lib/reference/standards/code-review.md"],"deprecation":["devrites-lib/reference/standards/deprecation.md"],"documentation":["devrites-lib/reference/standards/documentation.md"],"dod":["devrites-lib/reference/standards/definition-of-done.md"],"observability":["devrites-lib/reference/standards/observability.md"],"principles":["devrites-lib/reference/standards/principles.md"],"security":["devrites-lib/reference/standards/security.md"],"testing":["devrites-lib/reference/standards/testing.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","evidence.md","touched-files.md","review.md","seal.md"],"workspaceByRole":{"code-reviewer":["spec.md","plan.md","tasks.md","test-plan.md","architecture.md","decisions.md","state.md","evidence.md","touched-files.md","review.md"],"devex-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"doubt-reviewer":["spec.md","plan.md","tasks.md","state.md","decisions.md","review.md"],"frontend-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"performance-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"proof-runner":["spec.md","test-plan.md","tasks.md","gates.md","evidence.md","state.md"],"security-auditor":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"simplifier-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","review.md"],"spec-reviewer":["brief.md","spec.md","decision-coverage.md","questions.md","decisions.md","assumptions.md","state.md","review.md"],"test-analyst":["spec.md","tasks.md","test-plan.md","state.md","evidence.md","review.md"]}} -->
 > Read-set manifest: `devrites-engine context <slug> --phase seal` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
@@ -62,9 +62,11 @@ Follow [`reference/phase-contract.md`](reference/phase-contract.md)
 1. read workspace and final diff;
 2. recheck the canonical candidate/bindings and approved repository/CI proof;
 3. admit valid Spec/Code accounts; dispatch remaining required exact roles under
-   `../devrites-lib/reference/parallel-dispatch.md` on the same frozen candidate;
+   `../devrites-lib/reference/parallel-dispatch.md` on the same frozen candidate,
+   code review through its § Engineering lanes;
 4. reconcile their read-only verdicts against source and immutable evidence;
-5. draft GO/NO-GO `seal.md` with acceptance, tests, decisions, and seven accounts;
+5. draft GO/NO-GO `seal.md` with acceptance, tests, decisions, and seven accounts
+   (each engineering lane its own account);
 6. write exactly one candidate binding, then run
    `devrites-engine check seal <slug>` for structure and identity, never semantics,
    and, when that check reports a stale readiness-input binding, run

package/pack/generated/pi/skills/rite-seal/reference/anti-patterns.md

@@ -12,7 +12,7 @@ see [standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-pat
 | Excuse | Rebuttal |
 |---|---|
 | "All Important findings are minor; just GO." | `Important > 0` triggers an interactive y/N: do not bypass the prompt, present it. |
-| "User clearly wants this to ship." | Ship is evidence-driven, not consent-driven. A Critical finding outranks "the user said go". |
+| "User clearly wants this to ship." | Ship is evidence-driven, not consent-driven. With a Critical open the verdict stays NO-GO and `seal.md` records the user's override request; the user may accept named Important risks at the y/N prompt, but no request turns an open Critical or failed gate into GO. |
 | "Drift is small; resolve it inline and seal." | Unresolved drift = NO-GO, no exceptions. Route through `/rite-plan` to repair, then seal. |
 | "Reviewer findings overlap; average them away." | Surface disagreements explicitly. Averaging hides where the reviewers disagree. |
 | "Carry the old reviewer verdicts though the diff changed." | If the diff changed since `/rite-review`, re-run the Spec + Code axes: don't carry stale verdicts forward. |

package/pack/generated/pi/skills/rite-seal/reference/phase-contract.md

@@ -28,7 +28,7 @@
    and the [`review roster`](../../devrites-lib/reference/parallel-dispatch.md) on
    the candidate. Admit each result through
    [`result admission`](../../devrites-lib/reference/standards/agents.md#result-admission).
-   `## Reviewer Accounts` preserves all seven; gap/missing/malformed blocks;
+   `## Reviewer Accounts` preserves all seven roles, each engineering lane as its own account; gap/missing/malformed blocks;
    conditional `Not-applicable` names why.
 7. **Route corrections.** Reconcile cited findings/disagreements, but do not
    edit the candidate or manifest in Seal. Route an accepted correction through

package/pack/generated/pi/skills/rite-spec/SKILL.md

@@ -51,7 +51,12 @@ load a routed standard to discover required behavior, not to prescribe implement
    else echo "greenfield or already onboarded → continue spec"; fi
    ```
 1. **Understand the request** (`$ARGUMENTS`). State outcome and underlying
-   problem in one sentence. **Completion:** it includes both.
+   problem in one sentence. List each distinct explicit ask under `brief.md` `## Asks`,
+   quoted from the user's own words or a cited issue/PRD, never the invocation (`spec this`).
+   Readiness maps every ask to REQ/AC, a reasoned Non-goal, or a blocking question; an ask
+   with two readings that change acceptance is a question, never a silent pick.
+   **Completion:** it includes both, and every ask is listed. **Failing case:** "CSV export
+   and an email digest" yields a CSV-only spec; the digest is neither Non-goal nor question.
 1a. **Dedupe.** Search local issues/PRDs, work, and archive. On a close match ask
    extend/adopt/new, then record the choice; otherwise continue silently.
    A recorded [feature-sequence continuation](../rite-plan/reference/slicing.md#continuation-workspaces)
@@ -138,15 +143,18 @@ load a routed standard to discover required behavior, not to prescribe implement
    complete-block preservation rule.
    `tasks.md` deliberately does not exist yet; cross-artifact traceability starts in
    `/rite-define`. Any grammar or delta failure blocks. The interruption forecast must be resolved, owned, or a justified
-   action-time gate. Then write `Spec gate: passed <iso>`.
+   action-time gate. Run the [`spec-grammar.md`](../devrites-lib/reference/standards/spec-grammar.md) marker sweep; a kept hit blocks. Then write
+   `Spec gate: passed <iso>` with its `marker sweep:` line.
 6a. **Existing-spec delta.** For a pre-existing slug/workspace, compare old/new
    spec and questions, then show `Acceptance delta` (added/removed/reworded IDs)
    and `Open-question delta` (opened/resolved/reworded IDs), using `none` for
    empty categories. Show before proceeding; new workspaces skip.
 6b. **Review-before-code digest.** Before planning, render the compact human review:
    `Intent` (one sentence), `Done means` (top acceptance/scenario IDs), `Scope/risk` (what is in/out
-   plus the hard gates), and `Build exactly this?` (yes → next phase; no → revise now). The digest
-   is a view over `spec.md`, not a new artifact. **Stop** after the digest.
+   plus the hard gates), `Assumed:` (each `assumptions.md` id, one line, or `none`), and
+   `Build exactly this?` (yes → next phase; no → revise now). A "no" on one `Assumed:` line
+   reopens only that line as a human decision under step 4. The digest
+   is a view over `spec.md` and `assumptions.md`, not a new artifact. **Stop** after the digest.
 
 > **Mid-flight discipline.** Do not skip investigation, gap resolution, or placement
 > decisions. See [`anti-patterns`](reference/anti-patterns.md).

package/pack/generated/pi/skills/rite-spec/reference/spec-template.md

@@ -4,7 +4,7 @@ Contract WHAT users get, WHY, success, and scope. HOW belongs in `plan.md`,
 topology in `architecture.md`/`flows.md`, coverage in `traceability.md`.
 
 Use `[NEEDS CLARIFICATION: <question>]` (blocking stops `/rite-clarify`); before readiness
-every surviving marker converts to a gated `Q-###` open question ([`spec-grammar.md`](../../devrites-lib/reference/standards/spec-grammar.md) §
+every surviving marker converts to a gated `q-YYYY-MM-DD-NNN` open question (released `Q-###` kept) ([`spec-grammar.md`](../../devrites-lib/reference/standards/spec-grammar.md) §
 Unresolved-question markers — fail closed). Stable `REQ-001`/`AC-001` IDs; link, never
 duplicate, source artifacts; over-budget requires `Budget override: <reason>`.
 
@@ -135,10 +135,12 @@ status routes Define/Vet/Build/Prove to the named standard without copying it he
 ## Open questions
 | Question ID | Gate | Question | Impact |
 | --- | --- | --- | --- |
-| Q-001 | blocking | [NEEDS CLARIFICATION: <question>] | AC-001 |
+| q-YYYY-MM-DD-NNN | blocking | <question text, no marker> | AC-001 |
 
 ## Readiness gate
 - [ ] No blocking clarification or open `blocking`/`escalating` question; REQ/AC IDs are valid and ACs independently provable.
+- [ ] `marker sweep:` recorded with zero kept hits (spec-grammar § Unresolved-question markers).
+- [ ] Every verbatim ask in `brief.md` `## Asks` maps to REQ/AC, a reasoned Non-goal, or a blocking question.
 - [ ] Stakeholder conflicts/priority rules, constraints, and invariants are explicit;
       implementation preferences are not disguised as requirements.
 - [ ] Existing affected behavior maps to preserving REQ/AC + current evidence, or uses the exact justified greenfield `none`.

package/pack/generated/pi/skills/rite-spec/reference/state-workspace.md

@@ -219,6 +219,9 @@ command.
 ## Success definition
 <One sentence that says what "done" means.>
 
+## Asks
+- "<the user's words, verbatim>" → <REQ/AC-ID | Non-goal: reason | q-YYYY-MM-DD-NNN>
+
 ## Route
 Size: <small | standard | large>
 Profile: <quick | standard | full>

package/pack/generated/pi/skills/rite-status/SKILL.md

@@ -36,7 +36,11 @@ If `state.md` is unreadable/malformed: report a gap with the defect and stop —
    a human; list `gate: escalating` entries separately under **Escalating:**
    with their `route:` specialist tag (do not mix with synchronous blockers);
 7. unresolved drift and material risks;
-8. handoff readiness.
+8. handoff readiness;
+9. tree state: `HEAD`, the `git status --short` path count, and dirty paths absent from
+   `touched-files.md` (unrecorded); when `handoff.md` records `Tree at write`, whether HEAD
+   and count still match it. Unrecorded paths or a mismatch go under `Open:` as
+   reconcile-before-any-writer-command; status never records them itself.
 
 A workspace is handoff-ready when it records one next action, all unresolved
 questions, non-obvious decisions, load-bearing assumptions, current drift
@@ -45,7 +49,10 @@ recommend `/rite-handoff` before the lifecycle command.
 `devrites-engine handoff [slug]` emits the deterministic resume record (cursor,
 `awaiting_human`, blocking question gates, ledger reduction, dead ends,
 read-next order) — cite it for items 3–6 and the handoff-readiness verdict
-rather than re-deriving them. When `metrics.jsonl` exists,
+rather than re-deriving them. If that command is not found or exits nonzero,
+report items 3–6 and `Handoff:` as `unavailable: <command> <not found | exit N>` —
+never re-derive them from other files, never leave them blank — and set `Next:`
+to `/rite-doctor`. When `metrics.jsonl` exists,
 `devrites-engine metrics summary <slug>` rolls up dispatch/return counts and
 bundle bytes per phase — cite it for dispatch accounting rather than
 re-counting the ledger.
@@ -61,6 +68,7 @@ Phase: <phase>; slice: <slice|n/a>; mode: <HITL|AFK>; status: <status>
 Evidence: <fresh/proven summary | gaps>
 Open: <questions/drift/blockers | none>
 Escalating: <qid route:tag … | none>
-Handoff: <ready | missing durable context>
+Handoff: <ready | missing durable context | unavailable: <reason>>
+Tree: HEAD <sha>; dirty <n>; unrecorded <paths | none>; record <matches | differs | none>
 Next: <single persisted command>
 ```

package/pack/generated/pi/skills/rite-upgrade/SKILL.md

@@ -62,7 +62,13 @@ references, and only current phase contracts needed for the observed gap.
    `bulk_files`), and
    hashes of completed-slice fields, candidate gate artifacts, existing answers/decisions,
    and protected history. Inventory every path that could change; absence is evidence,
-   never permission to synthesize history. For a post-Build workspace, also retain the
+   never permission to synthesize history. **Rerun after a mid-run stop:** frozen hashes die
+   with the stopped run, so never re-baseline over bytes its owners may have changed. The
+   durable baseline is `HEAD`: a workspace path that differs from it is recorded
+   `pre-changed` with its diff, not frozen as clean, and step 5 accepts it only as an
+   admitted path of this run's assessment, else `gap`. An untracked workspace has no durable
+   baseline: if its `state.md` cursor shows an owner's HITL/blocked stop, stop for the human
+   to confirm the current bytes as baseline before step 2. For a post-Build workspace, also retain the
    exact result of `devrites-engine check candidate <slug>`; at or after Seal retain the
    exact result of `devrites-engine check seal <slug>`.
 2. **Assess from fresh context.** Dispatch exact `devrites-upgrade-planner` with the named

package/pack/generated/pi/skills/rite-vet/SKILL.md

@@ -5,7 +5,7 @@ argument-hint: "[slug] [--cross-model] [--full]"
 user-invocable: true
 ---
 
-<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/orchestration-profiles.md","devrites-lib/reference/parallel-dispatch.md","devrites-lib/reference/standards/gates.md","rite-vet/reference/review-axes.md","rite-vet/reference/artifacts.md","rite-vet/reference/depth.md","rite-vet/reference/eng-lenses.md","rite-vet/reference/anti-patterns.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"applicability":["devrites-lib/reference/standards/repository-topology.md","devrites-lib/reference/standards/data-integrity.md","devrites-lib/reference/standards/integration-reliability.md"],"assumption-delta":["devrites-lib/reference/standards/assumption-checkpoints.md"],"cross-model":["rite-vet/reference/cross-model.md"],"devex":["devrites-lib/reference/standards/developer-experience.md"],"dod":["devrites-lib/reference/standards/definition-of-done.md"],"elicitation":["devrites-lib/reference/standards/elicitation.md"],"errors":["devrites-lib/reference/standards/error-handling.md"],"grammar":["devrites-lib/reference/standards/spec-grammar.md"],"one-shot":["devrites-lib/reference/standards/one-shot-actions.md"],"performance":["devrites-lib/reference/standards/performance.md"],"principles":["devrites-lib/reference/standards/principles.md"],"reslice":["devrites-lib/reference/standards/acceptance-preserving-reslice.md"],"testing":["devrites-lib/reference/standards/testing.md"],"workflow":["devrites-lib/reference/standards/development-workflow.md"],"workflow-artifacts":["devrites-lib/reference/standards/workflow-artifacts.md"],"yagni":["devrites-lib/reference/standards/patterns.md","devrites-lib/reference/standards/coding-style.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md"],"workspaceByRole":{"devex-reviewer":["spec.md","plan.md","tasks.md","state.md"],"plan-reviewer":["spec.md","plan.md","tasks.md","test-plan.md","decision-coverage.md","architecture.md","decisions.md","state.md"],"strategy-reviewer":["brief.md","spec.md","plan.md","decisions.md","decision-coverage.md","state.md"]}} -->
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/orchestration-profiles.md","devrites-lib/reference/parallel-dispatch.md","devrites-lib/reference/standards/gates.md","rite-vet/reference/review-axes.md","rite-vet/reference/artifacts.md","rite-vet/reference/depth.md","rite-vet/reference/eng-lenses.md","rite-vet/reference/anti-patterns.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"applicability":["devrites-lib/reference/standards/repository-topology.md","devrites-lib/reference/standards/data-integrity.md","devrites-lib/reference/standards/integration-reliability.md"],"assumption-delta":["devrites-lib/reference/standards/assumption-checkpoints.md"],"cross-model":["rite-vet/reference/cross-model.md"],"devex":["devrites-lib/reference/standards/developer-experience.md"],"dod":["devrites-lib/reference/standards/definition-of-done.md"],"elicitation":["devrites-lib/reference/standards/elicitation.md"],"errors":["devrites-lib/reference/standards/error-handling.md"],"grammar":["devrites-lib/reference/standards/spec-grammar.md"],"one-shot":["devrites-lib/reference/standards/one-shot-actions.md"],"performance":["devrites-lib/reference/standards/performance.md"],"principles":["devrites-lib/reference/standards/principles.md"],"reslice":["devrites-lib/reference/standards/acceptance-preserving-reslice.md"],"testing":["devrites-lib/reference/standards/testing.md"],"workflow":["devrites-lib/reference/standards/development-workflow.md"],"workflow-artifacts":["devrites-lib/reference/standards/workflow-artifacts.md"],"yagni":["devrites-lib/reference/standards/patterns.md","devrites-lib/reference/standards/coding-style.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md"],"workspaceByRole":{"devex-reviewer":["spec.md","plan.md","tasks.md","state.md"],"plan-reviewer":["spec.md","plan.md","tasks.md","test-plan.md","decision-coverage.md","architecture.md","decisions.md","state.md"],"strategy-reviewer":["brief.md","spec.md","plan.md","decisions.md","decision-coverage.md","strategy.md","state.md"]}} -->
 > Read-set manifest: `devrites-engine context <slug> --phase vet` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
@@ -188,7 +188,9 @@ plan declares a root-authored executable workflow file, read
 
    Write exactly one `Implementation readiness: READY`, `NEEDS CLARIFICATION`,
    or `NEEDS REPLAN`. Root sets READY after every account, checklist,
-   preflight, and sweep is green. Write phase/next step and emit one
+   preflight, and sweep is green, including the
+   [`spec-grammar.md`](../devrites-lib/reference/standards/spec-grammar.md) marker sweep whose
+   `marker sweep:` line is recorded in `eng-review.md`; a kept hit blocks READY. Write phase/next step and emit one
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
    must pass. Record the per-input drift baseline alongside it:

package/pack/generated/pi/skills/rite-zoom-out/SKILL.md

@@ -69,3 +69,8 @@ Record: not applicable (paths printed only)
 ```
 
 Print the path of any decisions/ADR files referenced so the user can open them.
+
+**Empty or not found.** When the argument resolves to no symbol, file, or area, or maps zero
+modules, never print `Done: mapped` or `modules 0`: print `Done: not mapped — <argument> not
+found` with the searches run (index and file search), `Open:` the nearest candidates or
+`none`, and `Next:` a corrected argument.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "5.13.0",
+  "version": "5.14.0",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, pi, and Devin CLI",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",
@@ -73,21 +73,24 @@
     "release:dry": "semantic-release --dry-run --no-ci"
   },
   "devDependencies": {
-    "@commitlint/cli": "^21.0.2",
-    "@commitlint/config-conventional": "^21.0.2",
-    "@semantic-release/changelog": "^6.0.3",
+    "@commitlint/cli": "^21.2.3",
+    "@commitlint/config-conventional": "^21.2.3",
+    "@semantic-release/changelog": "^7.0.0",
+    "@semantic-release/commit-analyzer": "14.0.0-beta.4",
     "@semantic-release/exec": "^7.1.0",
-    "@semantic-release/git": "^10.0.1",
-    "@semantic-release/npm": "^13.1.5",
-    "conventional-changelog-conventionalcommits": "^9.3.1",
+    "@semantic-release/git": "^11.0.1",
+    "@semantic-release/npm": "^13.2.0",
+    "@semantic-release/release-notes-generator": "15.0.0-beta.3",
+    "conventional-changelog-conventionalcommits": "^10.4.0",
     "husky": "^9.1.7",
-    "semantic-release": "^25.0.5"
+    "semantic-release": "^25.0.9"
   },
   "overrides": {
+    "@semantic-release/release-notes-generator": "15.0.0-beta.3",
     "@semantic-release/npm": {
-      "npm": "11.19.1"
+      "npm": "11.20.0"
     },
-    "fast-uri": "3.1.6",
+    "fast-uri": "3.1.8",
     "js-yaml": "4.3.2"
   }
 }

package/scripts/build-host-artifacts.sh

@@ -185,11 +185,16 @@ gen_codex_agents_bridge "$OUT_ROOT/codex/AGENTS.md"
 gen_codex_config_toml "$OUT_ROOT/codex/config.toml"
 
 # omp artifacts are generated host-native mirrors (Markdown agents, no TOML).
-mkdir -p "$OUT_ROOT/omp/skills" "$OUT_ROOT/omp/agents"
+mkdir -p "$OUT_ROOT/omp/skills" "$OUT_ROOT/omp/agents" "$OUT_ROOT/omp/commands"
 while IFS= read -r d; do
   name="$(basename "$d")"
   [ "$name" = ".impeccable" ] && continue
   render_omp_skill_tree "$d" "$OUT_ROOT/omp/skills/$name"
+  case "$name" in
+  rite | rite-*)
+    gen_omp_command_stub "$d/SKILL.md" "$name" "$OUT_ROOT/omp/commands/$name.md"
+    ;;
+  esac
 done < <(find "$PACK_SRC/skills" -mindepth 1 -maxdepth 1 -type d)
 
 while IFS= read -r f; do
@@ -247,8 +252,8 @@ This directory is generated by `scripts/build-host-artifacts.sh`.
 - `claude/` contains Claude Code-native skills, agents, read-only workflow adapters, and settings.
 - `codex/` contains Codex-native skill mirrors, custom-agent TOML, the
   read-only-root permission profile, and AGENTS bridge content.
-- `omp/` contains omp-native skill mirrors, Markdown agents, and
-  `.omp-plugin/plugin.json`.
+- `omp/` contains omp-native skill mirrors, Markdown agents, command stubs
+  preserving the `/rite*` commands, and `.omp-plugin/plugin.json`.
 - `pi/` contains pi-native skill mirrors, pi-subagents Markdown agents,
   prompt templates preserving the `/rite*` commands, and an `AGENTS.md`
   bridge block.

package/scripts/codex-generate.sh

@@ -55,7 +55,7 @@ gen_codex_agent() {
   [ -n "$_name" ] || _name="$(basename "$_src" .md)"
   [ -n "$_desc" ] || _desc="DevRites custom agent."
   _permissions=":read-only"
-  [ "$_name" = "devrites-slice-wright" ] && _permissions=":workspace"
+  case "$_name" in devrites-slice-wright | overhaul-*) _permissions=":workspace" ;; esac
   _desc_tmp="$TMP_GEN_DIR/codex-agent-desc-$(basename "$_src").txt"
   _desc_codex="$TMP_GEN_DIR/codex-agent-desc-$(basename "$_src").codex.txt"
   printf '%s' "$_desc" > "$_desc_tmp"
@@ -105,6 +105,7 @@ This project has DevRites installed for both Claude Code and Codex.
 - Dispatch every exact named `devrites-<role>` required by the active workflow in a fresh subagent thread, wait for it, and reconcile its result. If that role is unavailable, stop for HITL; never skip it, never substitute a generic/default child, and never execute the specialist role in the root context.
 - The root uses the workspace-capable `devrites-orchestrator` profile because Codex children cannot elevate above the parent permission ceiling. This permission is for native writer dispatch and exact path-bounded executable workflow artifacts under the active `.devrites/work/<slug>/`; the root must never edit product source or tests itself.
 - Every generated specialist is hook-free. `devrites-slice-wright` alone uses `default_permissions = ":workspace"`; every other specialist uses `default_permissions = ":read-only"`. Exact paths are instruction-enforced: put the project-relative paths in the task, wait for the wright, compare its file list and `git diff --name-only` with that contract, and reject any extra path. Never bypass the wright, widen its contract, or edit source in the root; the root must never recreate an engine dispatch bridge.
+- The explicit `/overhaul` skill ships its own `overhaul-*` agents outside the DevRites lifecycle. They use `default_permissions = ":workspace"`, are dispatched only by that skill, and follow its own approval gate and path contracts instead of the lifecycle writer rules above.
 - A seal GO, AFK mode, or autocomplete flag never authorizes an irreversible action. Disclose the exact commit/push/tag/PR plan and obtain fresh explicit user approval for that attempt; any changed or retried plan needs fresh approval. Native host permission and sandbox prompts remain authoritative and cannot be inferred or bypassed.
 
 ## Workflow contract

package/scripts/devin-generate.sh

@@ -103,7 +103,7 @@ _devin_map_tools() {
   local _raw="$1" _name="$2"
   local _tok _mapped _out="" _sep=""
   if [ -z "$_raw" ]; then
-    if [ "$_name" = "devrites-slice-wright" ]; then
+    if [[ "$_name" == devrites-slice-wright || "$_name" == overhaul-* ]]; then
       printf '%s' "read, edit, write, exec, grep, glob, skill"
     else
       printf '%s' "read, grep, glob, exec"
@@ -130,7 +130,7 @@ _devin_map_tools() {
     _sep=", "
   done < <(printf '%s\n' "$_raw" | tr ',' '\n')
   if [ -z "$_out" ]; then
-    if [ "$_name" = "devrites-slice-wright" ]; then
+    if [[ "$_name" == devrites-slice-wright || "$_name" == overhaul-* ]]; then
       _out="read, edit, write, exec, grep, glob, skill"
     else
       _out="read, grep, glob, exec"
@@ -149,7 +149,7 @@ _devin_csv_has() {
 # Generate a Devin custom subagent profile from a Claude Code markdown agent.
 # Devin loads project profiles from .devin/agents/*.md (YAML frontmatter +
 # body). The allowed-tools allowlist carries the Claude permission boundary:
-# only devrites-slice-wright gets write/edit; reviewers stay read-only.
+# only devrites-slice-wright and the /overhaul agents (overhaul-*) get write/edit; reviewers stay read-only.
 # Claude's permissionMode has no Devin equivalent and is dropped. A canonical
 # `skills:` block grants the agent the `skill` tool so it can invoke that
 # skill inline (Devin has no agent-level skills preload field).
@@ -207,6 +207,7 @@ This project has DevRites installed for Devin CLI.
 - DevRites specialist agents live in `.devin/agents` as custom subagent profiles offered to `run_subagent`. If a required `devrites-<role>` profile is not among the offered profiles, stop for HITL - never skip the role, never substitute `subagent_general`, `subagent_explore`, or another generic profile, never inline the specialist prompt, and never execute the specialist role in the root context.
 - In DevRites guidance, **invoke** means run a skill inline in the current context; **dispatch** means start a fresh agent with `run_subagent` using the exact `profile` name, wait for it with `read_subagent`, and reconcile its result.
 - Only `devrites-slice-wright` may edit source or tests; every other specialist is read-only by `allowed-tools`. Exact paths are instruction-enforced: put the project-relative paths in the task, wait for the wright, compare its file list and `git diff --name-only` with that contract, and reject any extra path.
+- The explicit `/overhaul` skill ships its own `overhaul-*` agents outside the DevRites lifecycle. They carry the full write tool set, are dispatched only by that skill, and follow its own approval gate and path contracts instead of the lifecycle writer rules above.
 - Custom profiles do not inherit interactive tool grants, and background subagents auto-deny unapproved tools. Dispatch the write-capable wright in the foreground, or make sure its `edit`, `write`, and `exec` tools are approved first. Specialists cannot use `ask_user_question`; the root relays user questions and answers through the task text and returned result.
 - DevRites runtime helpers run through the installed `devrites-engine` binary.
 - Skills and agent profiles are loaded when a session starts. If they were installed while this session was open, restart the session or reopen the project before relying on them.

package/scripts/omp-generate.sh

@@ -5,7 +5,8 @@
 # TMP_GEN_DIR and then invoke the gen_* helpers below.
 
 # Rewrite canonical Claude (and leftover Codex) paths to installed omp paths.
-# Slash /rite invocations stay slash-form: omp discovers skills as /name.
+# Slash /rite invocations stay slash-form: omp exposes skills as /skill:<name>,
+# and gen_omp_command_stub keeps /rite* working through .omp/commands.
 # After paths are `.omp/skills/...`, drop Codex-only mirror asides.
 # Dispatch wording uses the `task` tool / `tasks[]` batch, not a fictional `agent` tool.
 gen_omp_markdown_file() {
@@ -44,7 +45,13 @@ gen_omp_markdown_file() {
     -e '/On Codex, use the/{N;s# On Codex, use the mirrors under\n`[^`]+`\.##;s# On Codex, use the\nmirrors under `[^`]+`\.##;s# On Codex, use the\nmirror under `[^`]+`\.##;}' \
     -e 's#Host mapping: Claude Code uses `Agent` \(`Task` is its legacy alias\); Codex uses#Host mapping: omp fresh-context dispatch uses the `task` tool (`tasks[]` batch); hosts use#g' \
     -e 's#`Agent` call#`task` call#g' \
-    -e 's#Claude: N concurrent Task wrights#omp: N concurrent `task` tool / `tasks[]` batch wrights#g' \
+    -e 's#Claude: N concurrent Task wrights \(`acceptEdits`, cwd=worktree\)\.#omp: one `tasks[]` batch of N wrights; `task` has no `cwd` or `acceptEdits`, so each task names its absolute worktree path and the wright works only there.#g' \
+    -e 's#^Claude grants only the exact wright `acceptEdits`;#omp has no permission modes: only the wright'"'"'s `tools` allowlist has `edit`/`write`, and the root stays source-read-only by instruction. Claude grants only the exact wright `acceptEdits`;#' \
+    -e 's#^Claude grants only wright `acceptEdits`;#omp: only the wright'"'"'s `tools` allowlist has `edit`/`write`; the root stays source-read-only by instruction. Claude grants only wright `acceptEdits`;#' \
+    -e 's#`AskUserQuestion`#`ask`#g' \
+    -e 's#Invoke it with Claude'"'"'s `Skill` tool or Codex'"'"'s$#Invoke it with#' \
+    -e 's#Use the `Skill` tool on Claude Code or$#Load it with#' \
+    -e 's#^([[:space:]]*)`\$(devrites-[a-z-]+)`( on Codex)?\.#\1`read skill://\2`.#' \
     -e 's#Task breakdown#Work-item breakdown#g' \
     -e 's#dispatch `devrites-source-driven`#invoke `devrites-source-driven`#g' \
     -e 's#Dispatch `devrites-source-driven`#Invoke `devrites-source-driven`#g' \
@@ -69,7 +76,7 @@ _omp_map_tools() {
   local _raw="$1" _name="$2"
   local _tok _mapped _out="" _sep=""
   if [ -z "$_raw" ]; then
-    if [ "$_name" = "devrites-slice-wright" ]; then
+    if [[ "$_name" == devrites-slice-wright || "$_name" == overhaul-* ]]; then
       printf '%s' "write, edit, bash, read, grep, glob"
     else
       printf '%s' "read, grep, glob, bash"
@@ -86,6 +93,7 @@ _omp_map_tools() {
       Write|write) _mapped="write" ;;
       Bash|bash) _mapped="bash" ;;
       Glob|glob) _mapped="glob" ;;
+      WebSearch|web_search) _mapped="web_search" ;;
       Grep|grep) _mapped="grep" ;;
       Skill|skill) continue ;;
       *) continue ;;
@@ -94,7 +102,7 @@ _omp_map_tools() {
     _sep=", "
   done < <(printf '%s\n' "$_raw" | tr ',' '\n')
   if [ -z "$_out" ]; then
-    if [ "$_name" = "devrites-slice-wright" ]; then
+    if [[ "$_name" == devrites-slice-wright || "$_name" == overhaul-* ]]; then
       _out="write, edit, bash, read, grep, glob"
     else
       _out="read, grep, glob, bash"
@@ -157,13 +165,15 @@ _omp_append_extension_tools() {
 # Generate an omp Markdown agent from a Claude Code markdown agent.
 # omp loads project/plugin agents from agents/*.md (YAML frontmatter + body).
 # The tools allowlist carries the Claude permission boundary: only
-# devrites-slice-wright gets write/edit; reviewers stay read-only.
+# devrites-slice-wright and the /overhaul agents (overhaul-*) get write/edit; reviewers stay read-only.
 gen_omp_agent() {
   local _src="$1" _out="$2"
-  local _name _desc _tools_raw _tools _desc_tmp _desc_omp _body_tmp _body_omp
+  local _name _desc _tools_raw _tools _skills _desc_tmp _desc_omp _body_tmp _body_omp
   _name="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^name:[[:space:]]*/{sub(/^name:[[:space:]]*/, ""); print; exit}' "$_src")"
   _desc="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^description:[[:space:]]*/{sub(/^description:[[:space:]]*/, ""); print; exit}' "$_src")"
   _tools_raw="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^tools:[[:space:]]*/{sub(/^tools:[[:space:]]*/, ""); print; exit}' "$_src")"
+  # Claude `skills:` preloads map to omp `autoloadSkills` (list or inline CSV).
+  _skills="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^skills:/{sk=1; sub(/^skills:[[:space:]]*/, ""); if ($0 != "") print; next} sk && /^[[:space:]]*-[[:space:]]*/{sub(/^[[:space:]]*-[[:space:]]*/, ""); print; next} {sk=0}' "$_src" | paste -sd, - | sed 's/,/, /g')"
   [ -n "$_name" ] || _name="$(basename "$_src" .md)"
   [ -n "$_desc" ] || _desc="DevRites custom agent."
   _tools="$(_omp_append_extension_tools "$(_omp_map_tools "$_tools_raw" "$_name")")"
@@ -179,6 +189,7 @@ gen_omp_agent() {
     printf 'name: %s\n' "$_name"
     printf 'description: "%s"\n' "$(omp_yaml_escape "$_desc")"
     printf 'tools: %s\n' "$_tools"
+    [ -n "$_skills" ] && printf 'autoloadSkills: %s\n' "$_skills"
     printf '%s\n' "---"
     _body_tmp="$TMP_GEN_DIR/omp-agent-body-$(basename "$_src").md"
     _body_omp="$TMP_GEN_DIR/omp-agent-body-$(basename "$_src").omp.md"
@@ -203,3 +214,25 @@ gen_omp_plugin_json() {
 }
 EOF
 }
+
+# omp exposes skills only as /skill:<name>; a .omp/commands stub keeps the
+# public /rite* form. omp substitutes $ARGUMENTS in command bodies.
+gen_omp_command_stub() {
+  local _skill_md="$1" _name="$2" _out="$3"
+  local _desc _hint
+  _desc="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^description:[[:space:]]*/{sub(/^description:[[:space:]]*/, ""); print; exit}' "$_skill_md")"
+  _hint="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^argument-hint:[[:space:]]*/{sub(/^argument-hint:[[:space:]]*/, ""); print; exit}' "$_skill_md")"
+  [ -n "$_desc" ] || _desc="DevRites $_name."
+  mkdir -p "$(dirname "$_out")"
+  {
+    printf '%s\n' "---"
+    printf 'description: "%s"\n' "$(omp_yaml_escape "$_desc")"
+    # An already double-quoted YAML scalar passes through verbatim.
+    case "$_hint" in
+    \"*\") printf 'argument-hint: %s\n' "$_hint" ;;
+    ?*) printf 'argument-hint: "%s"\n' "$(omp_yaml_escape "$_hint")" ;;
+    esac
+    printf '%s\n' "---"
+    printf 'Read and follow the DevRites skill `skill://%s` (`.omp/skills/%s/SKILL.md`). Apply it to these arguments, or to the current request when they are empty: $ARGUMENTS\n' "$_name" "$_name"
+  } >"$_out"
+}

package/scripts/pi-generate.sh

@@ -76,7 +76,7 @@ _pi_map_tools() {
   local _raw="$1" _name="$2"
   local _tok _mapped _out="" _sep=""
   if [ -z "$_raw" ]; then
-    if [ "$_name" = "devrites-slice-wright" ]; then
+    if [[ "$_name" == devrites-slice-wright || "$_name" == overhaul-* ]]; then
       printf '%s' "read, edit, write, bash, grep, find, ls"
     else
       printf '%s' "read, grep, find, ls, bash"
@@ -102,7 +102,7 @@ _pi_map_tools() {
     _sep=", "
   done < <(printf '%s\n' "$_raw" | tr ',' '\n')
   if [ -z "$_out" ]; then
-    if [ "$_name" = "devrites-slice-wright" ]; then
+    if [[ "$_name" == devrites-slice-wright || "$_name" == overhaul-* ]]; then
       _out="read, edit, write, bash, grep, find, ls"
     else
       _out="read, grep, find, ls, bash"
@@ -165,7 +165,7 @@ _pi_append_extension_tools() {
 # Generate a pi-subagents Markdown agent from a Claude Code markdown agent.
 # pi-subagents loads project agents from .pi/agents/**/*.md (YAML frontmatter +
 # body). The tools allowlist carries the Claude permission boundary: only
-# devrites-slice-wright gets write/edit; reviewers stay read-only.
+# devrites-slice-wright and the /overhaul agents (overhaul-*) get write/edit; reviewers stay read-only.
 # inheritProjectContext keeps AGENTS.md/CLAUDE.md visible, matching Claude
 # Code subagent semantics. A canonical `skills:` block list passes through.
 gen_pi_agent() {
@@ -214,7 +214,11 @@ gen_pi_prompt_stub() {
   {
     printf '%s\n' "---"
     printf 'description: "%s"\n' "$(pi_yaml_escape "$_desc")"
-    [ -n "$_hint" ] && printf 'argument-hint: "%s"\n' "$(pi_yaml_escape "$_hint")"
+    # An already double-quoted YAML scalar passes through verbatim.
+    case "$_hint" in
+    \"*\") printf 'argument-hint: %s\n' "$_hint" ;;
+    ?*) printf 'argument-hint: "%s"\n' "$(pi_yaml_escape "$_hint")" ;;
+    esac
     printf '%s\n' "---"
     printf 'Read and follow the DevRites skill at `.pi/skills/%s/SKILL.md`, applying it to: ${ARGUMENTS:-the current request}.\n' "$_name"
   } >"$_out"
@@ -235,6 +239,7 @@ This project has DevRites installed for pi.
 - DevRites specialist agents live in `.pi/agents` and are provided by the `pi-subagents` extension. Before dispatch, run `subagent({ action: "list" })`; if a required `devrites-<role>` is absent or not executable, stop for HITL — never skip it, substitute a generic child, or run the specialist role in the root context.
 - In DevRites guidance, **invoke** means run a skill inline in the current context; **dispatch** means start a fresh agent with `subagent({ agent, task })` (or `runs.run`/`runs.all` in a `workflowScript`), wait for it, and reconcile its result.
 - Only `devrites-slice-wright` may edit source or tests; every other specialist is read-only by tool allowlist. Exact paths are instruction-enforced: put the project-relative paths in the task, wait for the wright, compare its file list and `git diff --name-only` with that contract, and reject any extra path.
+- The explicit `/overhaul` skill ships its own `overhaul-*` agents outside the DevRites lifecycle. They carry the full write tool set, are dispatched only by that skill, and follow its own approval gate and path contracts instead of the lifecycle writer rules above.
 - DevRites runtime helpers run through the installed `devrites-engine` binary.
 - Installed `.pi/` content loads only after the project is trusted. If pi has not trusted this project, the skills, agents, and prompts above are not active.
 - A seal GO, AFK mode, or autocomplete flag never authorizes an irreversible action. Disclose the exact commit/push/tag/PR plan and obtain fresh explicit user approval for that attempt; any changed or retried plan needs fresh approval.

package/engine/.gosec.json

@@ -1,5 +0,0 @@
-{
-  "G301": "0755",
-  "G302": "0755",
-  "G306": "0644"
-}