devrites 5.13.1 → 5.14.1

package/bin/devrites.mjs

@@ -62,7 +62,7 @@ Common flags:
   --dry-run             Show the plan, change nothing
   --force               Overwrite existing non-DevRites files
   --no-codex            Skip Codex support files (.agents, .codex, AGENTS.md)
-  --no-omp              Skip OMP support files (.omp/skills, .omp/agents)
+  --no-omp              Skip OMP support files (.omp/skills, .omp/agents, .omp/commands)
   --no-pi               Skip pi support files (.pi/skills, .pi/agents, .pi/prompts)
   --no-devin            Skip Devin CLI support files (.devin/skills, .devin/agents)
   --short-aliases=all   Also install /define /build /prove /seal

package/docs/adr/0031-overhaul-agents-keep-every-tool.md

@@ -0,0 +1,52 @@
+# ADR-0031: `/overhaul` ships its own agents that keep every tool
+
+- **Status:** Accepted
+- **Date:** 2026-09-25
+
+## Context
+
+The explicit-only `/overhaul` skill dispatched its eight roles (recon, frontend
+engineer, backend engineer, boundary, craft, specialist, implementer, verifier) as
+generic subagents told to read `skills/overhaul/roles/<role>.md`. Registered agents
+give each role a named dispatch target on every host, carry the role contract as the
+agent's own instructions, and let a host pick a model per role.
+
+The DevRites lifecycle keeps one writer: ADR-0010, ADR-0015, ADR-0017, ADR-0018 and
+ADR-0019 make `devrites-slice-wright` the only writable specialist. Every `/overhaul`
+role also writes, because each one records a receipt and evidence in the run area,
+and the implementer edits approved target paths. `/overhaul` has its own approval
+gate, path contracts, snapshot fingerprints and admission tool
+(`devrites-engine overhaul`), independent of the lifecycle.
+
+## Decision
+
+- The pack ships `pack/.claude/agents/overhaul-{recon,frontend-engineer,
+  backend-engineer,boundary,craft,specialist,implementer,verifier}.md`. They are
+  dispatched only by `/overhaul`, and their composition line names `/overhaul` as the
+  caller.
+- These agents keep every tool: no `tools:` allowlist and no `permissionMode:`
+  override, so Claude Code applies the user's own permission mode. Codex gives them
+  `default_permissions = ":workspace"`; omp, pi and Devin give them the full write
+  tool set. Host permission prompts stay authoritative and are never bypassed.
+- Read-only behavior for reviewer roles stays an instruction in the agent body. The
+  coordinator detects writes by comparing snapshot fingerprints around every wave and
+  admits patches only when the observed changed paths equal the approved contract.
+- The role files are removed; each agent file is the single source of its role.
+- `validate-agent-composition.py` accepts `overhaul-*` agents as write-capable when
+  they state their mode. The lifecycle's one-writer rule is unchanged for every
+  `devrites-*` agent.
+
+## Consequences
+
+- The ADR-0010/0015/0017/0018/0019 writer clauses now read "one writer among
+  `devrites-*` specialists"; they do not govern `/overhaul`.
+- Eight more agents are installed, updated and removed with the pack. The installer
+  keeps an existing unmanaged `.claude/agents/overhaul-*.md`, and `/overhaul` stops
+  with `BLOCKED_ENVIRONMENT` when a required agent is missing (for example with
+  `--no-agents`).
+- Instruction-level read-only modes give weaker isolation than host allowlists. The
+  user chose full tool access; fingerprints and path-contract admission remain the
+  enforcement.
+
+Verified by `scripts/validate-agent-composition.py`, `tests/codex-agent-generation-test.sh`
+and the host generators' `overhaul-*` branches.

package/docs/adr/0032-single-lint-gate-and-cached-pr-tests.md

@@ -0,0 +1,60 @@
+# ADR-0032: One engine lint gate, and PR tests that reuse main's results
+
+- **Status:** Accepted
+- **Date:** 2026-09-25
+
+## Context
+
+ADR-0006 wired `staticcheck` and `govulncheck` into CI. Since then `gosec` and
+`golangci-lint` were added the same way, as separate `go install` builds and
+separate passes. Each pass loaded and type-checked the engine again. After a
+Go toolchain or analyzer bump, the engine job compiled all four tools from
+source (85s) before it analyzed anything.
+
+The Go cache setup also cost time without helping much:
+
+- Every run saved a new ~600 MB snapshot, including PR runs.
+- `setup-go`'s built-in cache froze its first snapshot until `go.mod` changed.
+- The shell shards restored a linux/arm64 key that no job saved, so every
+  shard compiled the engine from nothing.
+- `-count=1` on every platform ran every package on every PR, even when the
+  change touched none of them.
+
+## Decision
+
+- **One lint run.** `engine/.golangci.yml` enables gofmt, govet, staticcheck
+  (standalone default checks), gosec (same per-call `#nosec` policy, source
+  files only), errcheck, and ineffassign. CI runs it through
+  `golangci-lint-action` (a prebuilt binary). `make lint` runs the same config.
+  govulncheck stays a separate step because it is a database lookup, not a
+  linter.
+- **One engine test matrix.** `engine-test` runs the suite on linux amd64,
+  linux arm64, macOS (all `-race`), and Windows. Linux amd64 also runs a
+  shuffled, uncached pass to catch order dependence on every PR.
+- **Pushes to main run every test.** On main, `go clean -testcache` runs
+  first, so every test executes. The results are saved with the cache.
+- **PRs reuse main's results.** A PR runs `go test` without `-count=1`. The go
+  command re-runs any package whose code, dependencies, testdata, or read env
+  vars changed.
+- **Only main saves caches.** Each OS/arch/job gets its own key, suffixed with
+  the run ID. Before saving, entries the run did not touch are trimmed. PRs
+  restore the newest main snapshot.
+
+## Alternatives considered
+
+| Option | Why not |
+|--------|---------|
+| Keep four standalone analyzers | Four builds and four package loads for the same findings. |
+| `-count=1` on PRs too | Re-runs packages the PR cannot affect. Windows alone spent ~70s. |
+| Cache test results on PRs, skip them on main | Main would never run the full suite. |
+| Save caches from PRs as well | Pays the upload on every push. Lets a PR seed the cache main builds from. |
+
+## Consequences
+
+- Warm engine jobs skip analyzer builds entirely. Unchanged engine packages
+  cost nothing on PRs.
+- The go command does not track external programs a test runs (for example
+  `git`) as cache inputs. On PRs, a result that depends only on such a program
+  can come from the cache. Main still runs everything.
+- `tests/validation-governance-test.sh` keeps `make quality` and CI pinned to
+  the same golangci-lint and govulncheck versions.

package/docs/adr/0033-rite-fast-own-agents.md

@@ -0,0 +1,45 @@
+# ADR-0033: `/rite-fast` ships its own agents and its own writer
+
+- **Status:** Accepted
+- **Date:** 2026-09-26
+
+## Context
+
+Mid-size work had two routes. `/rite-quick` covers one small reversible change. The
+full lifecycle adds strategy review, a vetted plan, and review plus proof after every
+slice. Users asked for a lane in between: one spec-and-plan step with clarifying
+questions, up to ten slices built with no gate between them, one completeness check
+with gap fixes, then review, polish, and proof.
+
+The lifecycle agents are shaped for per-slice gates and engine workspace artifacts
+(`state.md`, `tasks.md`, `touched-files.md`, readiness bindings). `devrites-slice-wright`
+runs writer-safe proof on every slice, which is the step the fast lane removes.
+ADR-0010, ADR-0015, ADR-0017, ADR-0018 and ADR-0019 keep one writer among `devrites-*`
+specialists; ADR-0031 already scoped that rule for `/overhaul`.
+
+## Decision
+
+- `/rite-fast` is an explicit-only skill (`disable-model-invocation: true`). It stands
+  outside the engine lifecycle: its record is `spec.md`, `plan.md`, and `evidence.md`
+  under `.devrites/work/<slug>/`, with no `state.md`, no `.devrites/ACTIVE`, and no
+  seal. No engine change is needed.
+- The pack ships four agents that only `/rite-fast` dispatches: `fast-planner`,
+  `fast-checker`, and `fast-critic` (read-only, `permissionMode: plan`), and
+  `fast-builder` (write-capable in the exact paths of its contract,
+  `permissionMode: acceptEdits`). `fast-builder` runs no test suite; the skill runs one
+  check after all slices and proof last.
+- `validate-agent-composition.py` accepts `fast-builder` as write-capable when it states
+  that mode. Codex gives it `default_permissions = ":workspace"`; omp, pi, and Devin give
+  it the write tool set. The other `fast-*` agents stay read-only on every host.
+
+## Consequences
+
+- The one-writer clauses of the lifecycle ADRs govern `devrites-*` specialists only;
+  `/overhaul` (ADR-0031) and `/rite-fast` each own one more writer.
+- A `/rite-fast` run is not visible to `/rite-status`, `orient`, `next`, or `handoff`.
+  It resumes from its own `plan.md` ledger.
+- Four more agents are installed, updated, and removed with the pack. `/rite-fast`
+  stops when they are missing and no fresh context is available.
+
+Verified by `scripts/validate-agent-composition.py`, `tests/rite-fast-contract-test.sh`,
+and the host generators' `fast-builder` branches.

package/docs/adr/README.md

@@ -47,11 +47,11 @@ architecture; per-feature `decisions.md` files stay scoped to that feature.
 | ADR | Title | Status | Guard test |
 |-----|-------|--------|-----------|
 | [0001](0001-go-engine-as-control-plane.md) | Go engine as deterministic control plane | Accepted in part; all-state-transition/derivation scope superseded by 0024 | none |
-| [0002](0002-dual-host-harness.md) | Dual-host harness (Claude + Codex) | Accepted | `tests/parity_*_test.go` |
+| [0002](0002-dual-host-harness.md) | Dual-host harness (Claude + Codex) | Accepted | `engine/tests/parity_*_test.go` |
 | [0003](0003-gate-model-hitl-pause.md) | Gates block as HITL pause, never crash | Accepted | `engine/tests/adr_0003_gate_exit_code_test.go` |
 | [0004](0004-state-schema-phases-sections.md) | Phase-relative section completeness | Accepted | `engine/tests/adr_0004_required_by_phase_test.go`, `engine/internal/state/state_test.go` |
 | [0005](0005-hooks-as-engine-subcommands.md) | Hooks are engine subcommands, not shell scripts | Accepted; active hook clause superseded by 0018 | historical |
-| [0006](0006-clock-seam-and-engine-ci-gates.md) | Clock seam + Go static-analysis CI gates | Accepted in part; next-qid seam/guard superseded by 0024, CI clauses retained | historical |
+| [0006](0006-clock-seam-and-engine-ci-gates.md) | Clock seam + Go static-analysis CI gates | Accepted in part; next-qid seam/guard superseded by 0024, CI analyzer wiring superseded by 0032 | historical |
 | [0007](0007-canonical-live-workspace-filenames.md) | Canonical live workspace filenames | Accepted; unsupported alias/migration clauses superseded by 0022 | `engine/internal/state/state_test.go`, `engine/internal/lib/cursor_compat_test.go` |
 | [0008](0008-sanctioned-engine-network-boundary.md) | Sanctioned engine network boundary | Accepted in part; engine network allowance superseded by 0024 | `engine/tests/meta_test.go` |
 | [0009](0009-prebuild-decision-coverage-and-readiness.md) | Pre-build decision coverage and implementation readiness | Accepted; semantic engine-gate implementation superseded by 0022 | historical |
@@ -75,3 +75,6 @@ architecture; per-feature `decisions.md` files stay scoped to that feature.
 | [0027](0027-content-bound-build-readiness.md) | Content-bound build readiness | Accepted; AC ID map amended 2026-09-04 | `engine/tests/adr_0027_readiness_binding_test.go`, `engine/internal/state/acceptance_test.go` |
 | [0028](0028-self-contained-engine-update.md) | Self-contained engine update | Accepted | `engine/internal/install/install_test.go`, `engine/internal/release/release_test.go`, `engine/tests/meta_test.go` |
 | [0029](0029-v5-workspace-schema-and-native-migration.md) | v5 workspace schema and native migration | Accepted | `engine/internal/state/workspaceschema_test.go`, `engine/tests/parity_resolve_test.go`, `engine/tests/parity_closeout_test.go` |
+| [0031](0031-overhaul-agents-keep-every-tool.md) | `/overhaul` ships its own agents that keep every tool | Accepted; scopes the one-writer clauses of 0010/0015/0017/0018/0019 to `devrites-*` specialists | `scripts/validate-agent-composition.py`, `tests/codex-agent-generation-test.sh` |
+| [0032](0032-single-lint-gate-and-cached-pr-tests.md) | One engine lint gate, and PR tests that reuse main's results | Accepted | `tests/validation-governance-test.sh` |
+| [0033](0033-rite-fast-own-agents.md) | `/rite-fast` ships its own agents and its own writer | Accepted; adds `fast-builder` as a writer outside the `devrites-*` one-writer rule | `scripts/validate-agent-composition.py`, `tests/rite-fast-contract-test.sh` |

package/docs/architecture.md

@@ -30,7 +30,7 @@ cursor readers, traceability rules, and phase-relative completeness model, see
    irreversible git ladder and **closes** the task by archiving the workspace
    and clearing `ACTIVE`. Separate steps let users audit the release decision
    before any irreversible action.
-2. **Public utility and on-ramp skills**: `rite-adopt`, `rite-quick`,
+2. **Public utility and on-ramp skills**: `rite-adopt`, `rite-quick`, `rite-fast`,
    `rite-frame`, `rite-status`, `rite-doctor`, `rite-upgrade`, `rite-learn`, `rite-explain`,
    `rite-customize`, `rite-zoom-out`, `rite-prototype`, `rite-handoff`,
    `rite-pressure-test`, `rite-pov`, `rite-dogfood`, `rite-pr-feedback`,
@@ -389,8 +389,8 @@ contract.
 
 ## Design choices at a glance
 
-- **Surface**: 32 public `rite-*` skills (45 total), plus the thin `/rite`
-  menu and the standalone `overhaul` skill: 34 public and 11 internal. The lifecycle
+- **Surface**: 33 public `rite-*` skills (46 total), plus the thin `/rite`
+  menu and the standalone `overhaul` skill: 35 public and 11 internal. The lifecycle
   includes mandatory adaptive Clarify, optional Temper, mandatory Vet, and
   Converge recovery; Seal **decides** and Ship **executes + closes**. Ten
   `devrites-*` specialist skills are model-invoked; `devrites-lib` is the
@@ -412,7 +412,10 @@ contract.
 - **Design**: `devrites-frontend-craft` + a four-phase `/rite-polish` orchestrator (code + backend always; UI normalize + polish when UI is in scope).
 - **Agents**: 17 fresh-context roles at flat depth one: 16 read-only leaves and
   one wright. Dispatch uses the exact named project role; if it cannot spawn,
-  the workflow stops for HITL.
+  the workflow stops for HITL. `/overhaul` adds eight `overhaul-*` agents
+  that only it dispatches and that keep every tool (ADR-0031). `/rite-fast`
+  adds four `fast-*` agents: three read-only roles and `fast-builder`, its own
+  writer (ADR-0033).
 - **Review**: **feature-scoped** multi-axis review with severity labels and
   fresh-context agents at the seal.
 - **Scope**: clarify → seal (decide) → ship (read-only preflight → type-GO →

package/docs/command-map.md

@@ -16,7 +16,7 @@ installer; DevRites is not distributed as a Claude or Codex plugin.
 The `devrites-` prefix avoids collisions with bundled Claude Code skill names
 such as `prototype`, `handoff`, `triage`, and `diagnose`. The prefix does not
 mean that a skill is internal; each `SKILL.md` uses `user-invocable:` to set
-visibility. Public utilities use the `rite-*` prefix: `rite-quick`,
+visibility. Public utilities use the `rite-*` prefix: `rite-quick`, `rite-fast`,
 `rite-frame`, `rite-adopt`, `rite-learn`, `rite-doctor`, `rite-customize`,
 `rite-zoom-out`, `rite-prototype`, `rite-handoff`, `rite-pressure-test`,
 `rite-autocomplete`, `rite-explain`, `rite-pov`, `rite-dogfood`,
@@ -106,6 +106,7 @@ See [`cli.md`](cli.md).
 | [`/rite-ship`](../pack/.claude/skills/rite-ship/SKILL.md) | ship | `[slug]` | Starts with a read-only Seal/candidate check and exact plan disclosure, then requires fresh literal `GO`. Only then may it collapse checkpoints, stage exact candidate paths, validate staged scope/bytes/bindings/secrets, commit and reverify, perform optional separately approved push/tag/PR actions, and archive/close. | `seal.md` + candidate + Git index | `ship.md`, `state.md`, archive |
 | [`/rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | (orchestrator) | `[idea] [--ship\|--yolo] [--max-slices N] [--full] [--cross-model]` | Full lifecycle (spec → clarify → … → seal → ship). Spec + clarify form the one interactive window; AFK/checkpoint mode arms only after decision coverage is CLEAR. Pauses for irreversible risk, escalating, unanswered blocking with no recommended option, human-only access, or remaining NO-GO — not recommended-option blocking questions, temper expand, validating gates, `--max-slices`, or default resource caps. Objective red checks use bounded technical recovery. Default stops at Seal GO; `--ship` (`--yolo`) reaches Ship preflight but still requires fresh literal `GO` and native approval; `--full` selects the Full profile and `--cross-model` arms Vet's second opinion. | idea + workspace | whole workspace (drives every phase) |
 | [`/rite-quick`](../pack/.claude/skills/rite-quick/SKILL.md) | (express) | `<change>` | Express lane for a **small, reversible, unambiguous** change: one-line contract → TDD build → scoped prove → review-lite → ship, no full artifact tree. **Significance gate first**: auth / migration / public-API / destructive / multi-slice / ambiguous → escalates to `/rite-spec`. Triggers: "quick fix", "small change", "tiny tweak", "just do X". | the change + codebase | code + commit (optional `brief.md` / `evidence.md`) |
+| [`/rite-fast`](../pack/.claude/skills/rite-fast/SKILL.md) | (fast lane) | `<task \| slug>` | **Explicit-only** shortened lane for mid-size work: one SHAPE step (`fast-planner` drafts spec + ≤10 slices, root asks ≤5 ranked questions, 10 when risk is flagged, user approves) → BUILD with `fast-builder` and **no per-slice gate** → one CHECK (`fast-checker` completeness pass, ≤2 gap-fix rounds) → REFINE (`fast-critic` review + polish) → PROVE on the final tree. Outside the engine lifecycle: no `state.md`, no `ACTIVE`, no seal; commits only on confirmation. | the task + codebase | `spec.md`, `plan.md`, `evidence.md` under `.devrites/work/<slug>/` + code |
 | [`/rite-frame`](../pack/.claude/skills/rite-frame/SKILL.md) | lens | `[ask \| diff]` | Pre-flight + self-audit lens for ad-hoc work the lifecycle gates never see: **FRAME** turns an imperative ask into a falsifiable success criterion + verify command before code; **AUDIT** checks a raw diff against the four LLM coding failure modes (silent assumption / overcomplication / out-of-scope edit / unverifiable goal). Top of `/rite-quick` or before a plain "just do X". | the ask / a raw diff | success criterion + verify command (inline) |
 | [`/rite-adopt`](../pack/.claude/skills/rite-adopt/SKILL.md) | onboard | `[path or area to adopt] [+ what you want to build next]` | Reverse-derive the existing baseline and next objective; propose any durable project guidance in the nearest native instruction file. | codebase + project instructions | workspace spec/state artifacts + optional guidance proposal |
 | [`/rite-status`](../pack/.claude/skills/rite-status/SKILL.md) | status | `[slug]` | Active feature: phase, run mode, status, persisted next action, evidence, questions, drift, risks, and handoff readiness. | direct workspace ledger/artifacts | none |
@@ -122,7 +123,7 @@ See [`cli.md`](cli.md).
 | [`/rite-watch-pr`](../pack/.claude/skills/rite-watch-pr/SKILL.md) | utility | `[PR number\|PR URL\|blank for current branch]` | Observe one GitHub PR/CI/review snapshot, classify one next action, and stop. Safe for capability-admitted native schedules/events; never mutates code, Git, checks, threads, or PR state. | PR/check/review metadata + bounded failed-log excerpts | none |
 | [`/rite-pressure-test`](../pack/.claude/skills/rite-pressure-test/SKILL.md) | utility | `[idea]` | Pressure-test a rough idea: 3 to 5 genuinely different options → converge on one with trade-off + hinge. | spec / surrounding code | `decisions.md` (optional) |
 | [`/rite-doctor`](../pack/.claude/skills/rite-doctor/SKILL.md) | diagnostic | none | Diagnose the DevRites binary, pack, schema, and native host permission/profile configuration. | install + host config | none |
-| [`/overhaul`](../pack/.claude/skills/overhaul/SKILL.md) | standalone | `[full \| pr <n\|url> \| branch <head> --base <base> \| audit <scope> \| apply <run-id> --plan <rev> \| status <run-id> \| resume <run-id>]` | Explicit-only, outside the lifecycle. Concurrent frontend and backend engineering review plus boundary, craft and specialist roles (skill-local role files dispatched as fresh contexts); one verified plan; stops for the user's approval of the exact plan revision; then test-first repairs, independent verification, measurement and evidence-backed scoring, cycling inside the approved envelope. `audit` never repairs. Never commits, pushes, stashes or touches the index. | target repository (read-only until approval) | run area outside the repository (JSON records, HTML/Markdown views, evidence); approved target paths only after approval |
+| [`/overhaul`](../pack/.claude/skills/overhaul/SKILL.md) | standalone | `[full \| pr <n\|url> \| branch <head> --base <base> \| audit <scope> \| apply <run-id> --plan <rev> \| status <run-id> \| resume <run-id>] [--isolate]` | Explicit-only, outside the lifecycle. Concurrent frontend and backend engineering review plus boundary, craft and specialist roles (its own `overhaul-*` agents, which keep every tool); one verified plan; stops for the user's approval of the exact plan revision; then test-first repairs, independent verification, measurement and evidence-backed scoring, cycling inside the approved envelope. `audit` never repairs. Never commits, pushes, stashes or touches the index. | target repository (read-only until approval) | git-ignored run area `.devrites/overhaul/<run-id>/` (JSON records, HTML/Markdown views opened in the browser at each stop, evidence); approved target paths only after approval |
 
 `/rite use <slug>` and `/rite guide` are inline router operations owned by
 `/rite`, not separate skills. There is no `/rite-use` or `/rite-guide` shortcut.

package/docs/engine/commands.md

@@ -145,7 +145,7 @@ network. The skill documents the record schemas and when to call each tool.
 
 | Tool | Forms | Exit codes |
 | --- | --- | --- |
-| `records` | `digest <file>`, `stage <run>`, `publish <run>`, `validate <run>` | 0 ok; 1 violations (listed as `VIOLATION:` lines); 2 usage or I/O |
+| `records` | `init <repo> <run-id>`, `digest <file>`, `stage <run>`, `publish <run>`, `validate <run>` | 0 ok; 1 violations (listed as `VIOLATION:` lines); 2 usage or I/O |
 | `admit` | `receipt <run> <receipt.json> [--observed <file>]`, `anchor <tree> <proposals.json>` | 0 admissible; 1 rejected; 2 usage or I/O; 3 duplicate or late receipt |
 | `snapshot` | `capture <repo> <out>`, `fingerprint <repo>`, `verify <repo> <out> [--agent-paths <file>]`, `state <repo> <out.json>`, `delta <before.json> <repo>` | 0 ok; 1 index changed or changes outside agent paths; 2 refusal, usage or I/O |
 | `score` | `--rubric <r> --results <s> --gates <g> [--out <file>]`, `compare --rubric <r> --baseline <a> --candidate <b>` | 0 computed; 2 invalid input (nothing counts as scored) |
@@ -156,6 +156,16 @@ network. The skill documents the record schemas and when to call each tool.
 `diff.autoRefreshIndex=false` and no external diff drivers, so `.git/index`
 stays byte-identical. Secret-pattern files and files holding private key material
 are hashed only: never copied into the snapshot tree and never included in its patches.
+Clean tracked files are hashed but not copied, because git already holds them;
+only dirty and untracked files are copied. A snapshot may live outside the
+repository or inside its `.devrites/overhaul/` run area, which every snapshot
+command leaves out of the repository state. `records init` creates
+`<repo>/.devrites/overhaul/<run-id>/` (mode 0700) and, when git does not already
+ignore it, adds `/.devrites/overhaul/` to the local `.git/info/exclude`, never to
+the shared `.gitignore`.
+`admit receipt` checks the attempt in the open staged generation (`g<N>.tmp` whose
+`.base` is `CURRENT`) when one exists, otherwise in `CURRENT`, so a phase can record
+many dispatches and admissions before one publish.
 
 ## Output and exit contracts
 

package/docs/flow.md

@@ -381,7 +381,7 @@ separately by `disable-model-invocation`.
 
 ```mermaid
 flowchart TB
-    subgraph Public["Public (user-invocable: true): 34 skills"]
+    subgraph Public["Public (user-invocable: true): 35 skills"]
         direction TB
         R1[/rite/]
         R2[/rite-spec/]
@@ -401,6 +401,7 @@ flowchart TB
         R10[/rite-status/]
         R11[/rite-resolve/]
         RQ[/rite-quick/]
+        RFA[/rite-fast/]
         RF[/rite-frame/]
         RA[/rite-adopt/]
         RL[/rite-learn/]
@@ -435,7 +436,7 @@ flowchart TB
 
     classDef pub fill:#064e3b,stroke:#34d399,color:#ecfdf5
     classDef int fill:#1f2937,stroke:#9ca3af,color:#f9fafb
-    class R1,R2,RCL,RT,R3,RV,R4,R5,RC,R6,R7,R8,R9,R12,R13,R10,R11,RQ,RF,RA,RL,RD,RU,RE,RCU,RDO,RPOV,RPF,IPT,D1,D2,D3 pub
+    class R1,R2,RCL,RT,R3,RV,R4,R5,RC,R6,R7,R8,R9,R12,R13,R10,R11,RQ,RFA,RF,RA,RL,RD,RU,RE,RCU,RDO,RPOV,RPF,IPT,D1,D2,D3 pub
     class I1,I2,I3,I4,I5,I6,I7,I8,I9,I10,I11 int
 ```
 

package/docs/orchestration.md

@@ -49,7 +49,12 @@ Claude project settings use `permissions.defaultMode: plan`; its slice-wright
 profile uses `permissionMode: acceptEdits`. Codex uses a workspace-capable root
 because children cannot elevate above the parent permission ceiling. Its exact
 slice-wright uses `default_permissions = ":workspace"` and the other 16
-specialists use `default_permissions = ":read-only"`.
+specialists use `default_permissions = ":read-only"`. The eight `overhaul-*` agents of the
+explicit `/overhaul` skill sit outside this split: Claude gives them every tool and
+Codex gives them `:workspace` ([ADR-0031](adr/0031-overhaul-agents-keep-every-tool.md)).
+The four `fast-*` agents of `/rite-fast` also sit outside it: `fast-builder` uses
+`acceptEdits` on Claude and `:workspace` on Codex, and the other three are
+read-only ([ADR-0033](adr/0033-rite-fast-own-agents.md)).
 
 If the exact role is unavailable, the root stops instead of substituting a
 generic agent or doing specialist/writer work inline.

package/docs/quick-reference.md

@@ -3,7 +3,8 @@
 Executive fast path: **Spec → Build → Prove**. `/rite-spec` writes the
 contract, `/rite-build` implements one slice, `/rite-prove` binds evidence.
 Adaptive Clarify/Vet still run; they ask nothing when the contract is already
-complete. Use `/rite-quick` for a small reversible change.
+complete. Use `/rite-quick` for a small reversible change and `/rite-fast` for
+mid-size work that does not need a gate after every slice.
 
 Install DevRites with `npx devrites ...`. Normal installs from package and
 release candidates consume pre-generated project-local Claude Code and Codex

package/docs/skills.md

@@ -1,6 +1,6 @@
-# All 45 skills
+# All 46 skills
 
-The pack contains 45 skills: the `rite` menu, 32 user-invocable `rite-*`
+The pack contains 46 skills: the `rite` menu, 33 user-invocable `rite-*`
 workflow and utility skills, the standalone `overhaul` skill,
 10 model-invoked `devrites-*` specialists, and the internal `devrites-lib` library. `devrites-lib` is not a command. It holds shared
 references and the few explicit script exceptions.
@@ -19,8 +19,9 @@ guidance block in `AGENTS.md`.
 The root and reviewers never write source. Claude enforces the root boundary in
 plan mode. Codex uses a workspace-capable root so its sole write-capable
 slice-wright can execute, while all other specialists remain read-only. On
-Devin, `allowed-tools` gives only `devrites-slice-wright` `edit`, `write`, and
-`exec`; a missing required profile stops for HITL instead of substituting a
+Devin, `allowed-tools` gives `edit`, `write`, and `exec` only to
+`devrites-slice-wright` among lifecycle roles (plus `fast-builder` for
+`/rite-fast`); a missing required profile stops for HITL instead of substituting a
 generic profile. The
 installed `devrites-engine` owns strict candidate identity, deterministic checks,
 exact proof/review/seal bindings,
@@ -42,7 +43,7 @@ contract when a rite names parallel reviewers.
 ## Naming convention
 
 `rite-*` is the namespace for lifecycle and utility commands. Its utilities are
-`rite-quick`, `rite-frame`, `rite-adopt`, `rite-learn`, `rite-customize`,
+`rite-quick`, `rite-fast`, `rite-frame`, `rite-adopt`, `rite-learn`, `rite-customize`,
 `rite-explain`, `rite-pov`, `rite-dogfood`, `rite-pr-feedback`, `rite-watch-pr`, `rite-doctor`,
 `rite-upgrade`, `rite-prototype`, `rite-handoff`, `rite-zoom-out`, and
 `rite-pressure-test`.
@@ -145,6 +146,7 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 | Skill | What It Does | Use When |
 |---|---|---|
 | [`rite-quick`](../pack/.claude/skills/rite-quick/SKILL.md) | Express lane for a **small, reversible, unambiguous** change: one-line contract → TDD build → scoped prove → review-lite → ship, collapsing the full lifecycle into one pass. Significance gate first: auth / migration / public-API / destructive / multi-slice / ambiguous **escalates to `/rite-spec`**. | "quick fix", "small change", "tiny tweak", "just do X" on a low-risk change. |
+| [`rite-fast`](../pack/.claude/skills/rite-fast/SKILL.md) | Shortened lane: one spec-and-plan step with ranked clarifying questions (more when risk is flagged), up to ten vertical slices built by `fast-builder` without per-slice gates, one `fast-checker` completeness pass with gap fixes, one `fast-critic` review and polish pass, then proof on the final tree. Own `fast-*` agents; outside the engine lifecycle. | Explicit-only: `/rite-fast <task>` for mid-size work that does not need a gate after every slice. |
 | [`rite-frame`](../pack/.claude/skills/rite-frame/SKILL.md) | Pre-flight + self-audit lens for ad-hoc work the lifecycle gates never see: FRAME converts an imperative ask into a falsifiable success criterion + verify command before code; AUDIT checks a raw diff against the four LLM coding failure modes (silent assumption / overcomplication / out-of-scope edit / unverifiable goal). | Top of `/rite-quick`, before a plain "just do X" edit, or to self-review a raw diff. |
 | [`rite-adopt`](../pack/.claude/skills/rite-adopt/SKILL.md) | Bring an EXISTING codebase under DevRites: reverse-derive a baseline `spec.md` of current behavior, placement, and architecture; optionally propose one reviewed scoped-instruction update; then hand off to the lifecycle. | "adopt this project", "onboard this codebase", "we already have code", "reverse-engineer a spec from the existing app". |
 
@@ -246,7 +248,7 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 
 | Skill | What It Does | Use When |
 |---|---|---|
-| [`overhaul`](../pack/.claude/skills/overhaul/SKILL.md) | Audits a whole project, a PR or a branch comparison with separate frontend and backend engineering reviewers running concurrently, plus boundary, craft and specialist roles; reconciles verified findings into one plan and stops for the user's explicit approval of that exact plan revision. After approval it repairs test-first, verifies independently, measures, and keeps cycling inside the approved plan until the evidence-backed scores (global and per-lane 9.7, domains 9.0) and every hard gate pass or an honest blocker remains. It lives outside the DevRites lifecycle: no `.devrites/` workspace and no `/rite-*` phase; its records, admission, snapshot, scoring, benchmark and view tools are `devrites-engine overhaul` commands. Completion evidence is a run area outside the repository with canonical JSON records, a local HTML review and report, and a reviewable local patch; it never commits. | Explicit-only: `/overhaul`, `/overhaul full`, `/overhaul pr <n>`, `/overhaul branch <head> --base <base>`, `/overhaul audit …` (assessment only). |
+| [`overhaul`](../pack/.claude/skills/overhaul/SKILL.md) | Audits a whole project, a PR or a branch comparison with separate frontend and backend engineering reviewers running concurrently, plus boundary, craft and specialist roles; reconciles verified findings into one plan and stops for the user's explicit approval of that exact plan revision. After approval it repairs test-first, verifies independently, measures, and keeps cycling inside the approved plan until the evidence-backed scores (global and per-lane 9.7, domains 9.0) and every hard gate pass or an honest blocker remains. It lives outside the DevRites lifecycle: no `.devrites/` workspace and no `/rite-*` phase; its records, admission, snapshot, scoring, benchmark and view tools are `devrites-engine overhaul` commands. Completion evidence is a git-ignored run area, `.devrites/overhaul/<run-id>/`, with canonical JSON records, a local HTML review and report that open in the browser at each stop, and a reviewable local patch; it never commits. Target code runs in place by default; `--isolate` runs it only in a sandboxed copy. | Explicit-only: `/overhaul`, `/overhaul full`, `/overhaul pr <n>`, `/overhaul branch <head> --base <base>`, `/overhaul audit …` (assessment only). |
 
 ### Foundation: engineering rules
 
@@ -259,7 +261,12 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 ## Fresh-context agents
 
 DevRites ships 17 role profiles at depth one. Both hosts have 16 read-only
-leaves and one source/test writer role. Four read-only work roles handle
+leaves and one source/test writer role. The explicit `/overhaul` skill ships eight
+more agents, `overhaul-*`, that only it dispatches and that keep every tool
+([ADR-0031](adr/0031-overhaul-agents-keep-every-tool.md)). `/rite-fast` adds four
+`fast-*` agents that only it dispatches: three read-only roles and `fast-builder`,
+its own writer ([ADR-0033](adr/0033-rite-fast-own-agents.md)). The counts here cover
+the lifecycle roles. Four read-only work roles handle
 bounded evidence, planning, proof, and compatibility while the root keeps
 authority:
 
@@ -299,7 +306,8 @@ Seal fan-out diagram: [`flow.md` § /rite-seal fan-out](flow.md#4-rite-seal-fan-
 
 ## Executor agent: fresh-context writer
 
-The catalog has one writer role. Claude and Codex run it with one exact
+The lifecycle catalog has one writer role (`/rite-fast` keeps its own
+`fast-builder`, ADR-0033). Claude and Codex run it with one exact
 path-bounded slice or accepted correction; every other agent remains read-only.
 
 | Agent | Purpose |

package/docs/usage.md

@@ -2,8 +2,8 @@
 
 These examples cover the common DevRites workflows. Start a new feature with
 `/rite-spec` and bring an existing codebase in with `/rite-adopt`.
-`/rite-quick` and `/rite-frame` handle bounded work outside the full feature
-lifecycle. Workspace phases first read the active workspace from
+`/rite-quick`, `/rite-fast`, and `/rite-frame` handle bounded work outside the full
+feature lifecycle. Workspace phases first read the active workspace from
 `.devrites/ACTIVE` and `.devrites/work/<slug>/`. If none exists, they report the
 command that can create or select one. `/rite-upgrade [slug]` is the
 compatibility audit for an older active workspace that cannot resume.

package/engine/.golangci.yml

@@ -1,16 +1,54 @@
-# golangci-lint v2 — curated complement to the existing strict gates
-# (staticcheck, govulncheck, gosec). Enables only checkers that add findings
-# staticcheck does not produce; see the engine job in ci.yml and `make lint`.
+# golangci-lint v2: the engine's single static-analysis gate. One run loads
+# and type-checks the packages once and shares that work across every linter,
+# instead of separate gofmt/go vet/staticcheck/gosec passes. CI (engine job) and
+# `make lint` both run this file. govulncheck stays separate: it is a
+# vulnerability database lookup, not a linter.
 version: "2"
 
+run:
+  # Never rewrite go.mod/go.sum during analysis.
+  modules-download-mode: readonly
+
 linters:
   default: none
   enable:
+    # go vet analyzers (the default vet set).
+    - govet
+    # staticcheck (gosimple and stylecheck are merged into it in v2).
+    - staticcheck
+    # Security analysis. No rule-class exclusions: every G204/G304/G702/G703
+    # site carries a per-call `// #nosec GXXX -- <justification>` instead, so a
+    # genuinely new injection or traversal sink fails the gate.
+    - gosec
     # Unchecked error returns: staticcheck does not flag ignored errors.
     - errcheck
     # Assignments never read: distinct from staticcheck's unused analysis.
     - ineffassign
   settings:
+    staticcheck:
+      # Standalone staticcheck's default set. Quickfix (QF) suggestions are
+      # editor refactors, not defects, so they stay out of the gate.
+      checks:
+        - all
+        - -ST1000
+        - -ST1003
+        - -ST1016
+        - -ST1020
+        - -ST1021
+        - -ST1022
+        - -ST1023
+        - -QF*
+    gosec:
+      # G602 (slice bounds) misfires on length-guarded indexes under
+      # golangci-lint's shared SSA build, and Go bounds-checks at runtime.
+      excludes:
+        - G602
+      # Permission expectations for what the engine writes: 0644 files,
+      # 0755 dirs and binaries.
+      config:
+        G301: "0755"
+        G302: "0755"
+        G306: "0644"
     errcheck:
       # The engine's CLI boundary reports via exit paths, not error returns;
       # writes to the operator's stdout/stderr streams fail only on closed
@@ -22,6 +60,20 @@ linters:
         - (*bytes.Buffer).WriteByte
         - (*strings.Builder).WriteByte
         - (*strings.Builder).WriteString
+  exclusions:
+    rules:
+      # Tests read fixtures and spawn the engine by design; gosec gates
+      # shipped code only (standalone gosec's default).
+      - path: _test\.go
+        linters: [gosec]
+
+issues:
+  # Report every finding; the defaults (50 per linter, 3 identical) can hide
+  # real issues behind a truncated list.
+  max-issues-per-linter: 0
+  max-same-issues: 0
 
+# Formatting is part of the same run: an unformatted file fails the gate.
 formatters:
-  default: none
+  enable:
+    - gofmt

package/engine/AGENTS.md

@@ -17,8 +17,8 @@ completeness.
   coverage quality. They may require that a canonical `AC-###` ID declared in
   `spec.md` also appears as a literal substring in `tasks.md` and
   `test-plan.md` when those artifacts are required.
-- Local full gate: `make quality` (`gofmt`, `go vet`, `staticcheck`,
-  `govulncheck`, `gosec`, `golangci-lint`, `osv-scanner`,
-  `go test -race -shuffle=on -count=1`).
+- Local full gate: `make quality` (`golangci-lint` with gofmt, go vet,
+  staticcheck, gosec, errcheck, ineffassign; then `govulncheck`,
+  `osv-scanner`, `go test -race -shuffle=on -count=1`).
 
 See [`../CONTEXT.md`](../CONTEXT.md) and [`../docs/adr/README.md`](../docs/adr/README.md).

package/engine/Makefile

@@ -1,28 +1,20 @@
 BINARY  := devrites
 DIST    := dist
-GOFILES := $(shell find . -name '*.go' -not -path './$(DIST)/*')
 # darwin/amd64 kept for Intel Macs; the five targets the release matrix ships.
 PLATFORMS := darwin/arm64 darwin/amd64 linux/amd64 linux/arm64 windows/amd64
 
-.PHONY: build fmt-check test test-race vet quality staticcheck govulncheck gosec lint cover crosscompile clean
+.PHONY: build test test-race vet quality govulncheck lint cover crosscompile clean
 
-STATICCHECK_VERSION := 2026.1
-GOVULNCHECK_VERSION := v1.6.0
-GOSEC_VERSION := v2.28.0
-GOLANGCI_VERSION := v2.13.2
-OSV_SCANNER_VERSION := v2.5.1
-STATICCHECK := go run honnef.co/go/tools/cmd/staticcheck@$(STATICCHECK_VERSION)
+GOVULNCHECK_VERSION := v1.8.0
+GOLANGCI_VERSION := v2.14.0
+OSV_SCANNER_VERSION := v2.6.0
 GOVULNCHECK := go run golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION)
-GOSEC := go run github.com/securego/gosec/v2/cmd/gosec@$(GOSEC_VERSION)
 GOLANGCI := go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_VERSION)
 OSV_SCANNER := go run github.com/google/osv-scanner/v2/cmd/osv-scanner@$(OSV_SCANNER_VERSION)
 
 build:
 	CGO_ENABLED=0 go build -o $(BINARY) .
 
-fmt-check:
-	@test -z "$$(gofmt -l $(GOFILES))" || (echo "gofmt required:"; gofmt -l $(GOFILES); exit 1)
-
 test:
 	go test -shuffle=on ./...
 
@@ -35,21 +27,13 @@ vet:
 
 # quality is the full local gate. Mirror it in CI so a green `make quality`
 # means a green pipeline (the date-sensitive parity golden aside; see ADR-0006).
-quality: fmt-check vet staticcheck govulncheck gosec lint osv test-race
-
-staticcheck:
-	$(STATICCHECK) ./...
+quality: lint govulncheck osv test-race
 
 govulncheck:
 	$(GOVULNCHECK) ./...
 
-# No rule-class exclusions: G204/G304/G702/G703 sites carry per-call
-# `// #nosec GXXX -- <justification>` annotations in the source, so a genuinely
-# new injection or traversal sink fails this target.
-gosec:
-	$(GOSEC) -conf .gosec.json ./...
-
-# Curated complement to staticcheck (errcheck + ineffassign; .golangci.yml).
+# gofmt, go vet, staticcheck, gosec, errcheck and ineffassign in one run
+# (.golangci.yml).
 lint:
 	$(GOLANGCI) run ./...
 

package/engine/go.mod

@@ -2,4 +2,4 @@ module github.com/devrites/devrites
 
 go 1.26
 
-toolchain go1.26.7
+toolchain go1.27.1

package/engine/internal/devritespaths/paths.go

@@ -21,6 +21,7 @@ const (
 	ClaudeAgentsTarget    = ".claude/agents"
 	CodexAgentsTarget     = ".codex/agents"
 	OmpAgentsTarget       = ".omp/agents"
+	OmpCommandsTarget     = ".omp/commands"
 	PiAgentsTarget        = ".pi/agents"
 	DevinAgentsTarget     = ".devin/agents"
 	PiPromptsTarget       = ".pi/prompts"
@@ -64,6 +65,7 @@ func WorkspaceOverrideChecked(root, slug string) (string, error) {
 		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: resolve DevRites root %q: %w", root, err)
 	}
 	sameRoot := path == resolvedRoot
+	// #nosec G703 -- read-only Stat of a path resolved and proven inside root above
 	if pathInfo, pathErr := os.Stat(path); pathErr == nil {
 		if rootInfo, rootErr := os.Stat(resolvedRoot); rootErr == nil {
 			sameRoot = os.SameFile(pathInfo, rootInfo)

package/engine/internal/hostpack/hostpack.go

@@ -22,6 +22,7 @@ const (
 	ClaudeAgentsTarget    = devritespaths.ClaudeAgentsTarget
 	CodexAgentsTarget     = devritespaths.CodexAgentsTarget
 	OmpAgentsTarget       = devritespaths.OmpAgentsTarget
+	OmpCommandsTarget     = devritespaths.OmpCommandsTarget
 	PiAgentsTarget        = devritespaths.PiAgentsTarget
 	DevinAgentsTarget     = devritespaths.DevinAgentsTarget
 	PiPromptsTarget       = devritespaths.PiPromptsTarget
@@ -181,6 +182,7 @@ func RequiredPayload(withCodex, withOmp, withPi, withDevin bool) []string {
 		required = append(required,
 			"omp/skills",
 			"omp/agents",
+			"omp/commands",
 			"omp/.omp-plugin/plugin.json",
 		)
 	}
@@ -219,7 +221,10 @@ func InstallTrees(withSkills, withAgents, withCodex, withOmp, withPi, withDevin
 			trees = append(trees, Tree{PayloadPrefix: "codex/skills", TargetPrefix: CodexSkillsTarget})
 		}
 		if withOmp {
-			trees = append(trees, Tree{PayloadPrefix: "omp/skills", TargetPrefix: OmpSkillsTarget})
+			trees = append(trees,
+				Tree{PayloadPrefix: "omp/skills", TargetPrefix: OmpSkillsTarget},
+				Tree{PayloadPrefix: "omp/commands", TargetPrefix: OmpCommandsTarget},
+			)
 		}
 		if withPi {
 			trees = append(trees,