devrites 5.13.1 → 5.14.1

package/pack/generated/omp/skills/overhaul/references/stack-profiles.md

@@ -245,6 +245,58 @@ what a pass does not prove.
 | S-DB-02 | PostgreSQL (verify version) | `EXPLAIN ANALYZE` only in a disposable environment; `CREATE INDEX CONCURRENTLY` outside transactions with failed-build cleanup | Plan/timing captured on seeded data; migration dry run | Production plan |
 | S-BE-01 | Retried or duplicated requests with side effects | Idempotency key scoped to caller and operation, side effect and key recorded atomically, unknown outcomes handled | Replay the same request concurrently: one side effect | Cross-service exactly-once |
 | S-BE-02 | Transactions around read-modify-write | Isolation or locking prevents lost update and write skew | Deterministic interleaving with barriers loses no update | Distributed consistency |
+| S-ARCH-01 | Interfaces, abstract bases, factories, registries or options, any language | Each has more than one implementation, product or varied value, or a recorded reason (test seam in use, public API, plugin contract) | Population search finds a second implementation or non-default caller; inlining breaks a test or consumer | That inlining is worth its churn |
+| S-ARCH-02 | Dependency manifests, any ecosystem | Every direct dependency is imported, resolves on its registry, and is not duplicated by another dependency or the standard library at the installed versions | Removing it from a disposable copy breaks build, typecheck or tests | Transitive or runtime-only use via plugins or config |
+| S-ARCH-03 | Feature flags and config switches | Each flag has an owner and removal date; fully rolled-out flags are deleted with their dead branch; names are never reused | List flags constant across every environment or with no reader: empty | That remaining flags are needed |
+| S-GO-01 | Go request-scoped work doing I/O, goroutines or waits | The caller's `ctx` reaches every blocking call; no `context.Background()` below the entry point; every cancel func runs (vet `lostcancel`, `noctx`, `contextcheck`) | Cancel the parent mid-call: returns `ctx.Err()` within the deadline and the fake sees cancellation | Server-side cancellation |
+| S-GO-02 | Go goroutines (`go`, `errgroup`, `WaitGroup.Go`) | Each has a waiting owner and a stop signal; `wg.Add` before `go` (staticcheck SA2000) | `goleak.VerifyNone` after the error path, or a `testing/synctest` bubble (Go ≥ 1.25) ending with nothing blocked | Leaks on undriven paths |
+| S-GO-03 | Go HTTP clients and servers | No bare `http.DefaultClient`; timeout or deadline on every request; body closed and drained on every path; servers set `ReadHeaderTimeout` and body limits (`bodyclose`, gosec G107/G112/G114) | Hanging fake server fails within budget; N requests keep open connections flat | Retry correctness |
+| S-GO-04 | Go `sql.Rows`, statements, files | `defer Close()` right after the error check, `rows.Err()` after the loop, no `defer` in a loop body (staticcheck SA9001, `sqlclosecheck`, `rowserrcheck`) | `SetMaxOpenConns(1)` pool runs the path N+1 times without blocking | Isolation correctness |
+| S-GO-05 | Go error handling | Wrapped errors matched with `errors.Is`/`errors.As`, never `==` or type assertion; no typed nil returned as `error` (`errorlint`, vet `errorsas`) | Wrap the sentinel with `%w`: the caller's branch still fires | That errors are handled well |
+| S-GO-06 | Go decoding untrusted JSON or YAML that drives state or authorization | Unknown fields and trailing data rejected; no reliance on case-exact keys (encoding/json v1 matches keys case-insensitively) | `{"role":"user","ROLE":"admin"}` and an unknown field are rejected or leave the role unchanged | Parser differentials across services |
+| S-GO-07 | Go state shared across goroutines | Mutex, atomics or single owner; loop-variable capture only matters for `go < 1.22` in `go.mod` | `go test -race -count=20` on a concurrent test reports no race | Logical races |
+| S-GO-08 | Go `exec.Command` with a non-constant argument | No `sh -c` from strings; allowlisted values placed after `--` so none starts with `-` (gosec G204) | `--upload-pack=touch /tmp/x` or `; id` never reaches a flag position or a shell | The invoked binary |
+| S-PY-01 | Python `async def` on the event loop | No sync I/O, `time.sleep`, `requests`, sync DB drivers, `open()` or `subprocess`; blocking goes through `asyncio.to_thread` (Ruff ASYNC210/220/230/251) | Under `PYTHONASYNCIODEBUG=1` no slow-callback warnings; a heartbeat task keeps its cadence | Blocking inside C extensions |
+| S-PY-02 | Python tasks and cancellation | Tasks owned by a `TaskGroup` or stored reference (RUF006); `CancelledError` re-raised; timeouts via `asyncio.timeout()` | Cancel the parent mid-await: the child stops with no side effect after cancel | Cleanup inside `finally` |
+| S-PY-03 | Python defaults and handlers | No mutable or call-time defaults (B006, B008); no bare or broad `except` that swallows outside a boundary (BLE001, S110) | Call twice mutating the result: second call sees a fresh value; inject the dependency's failure: the caller sees an error | Error taxonomy |
+| S-PY-04 | Python deserializing or executing outside data | No `pickle` on untrusted data, `yaml.safe_load` only, no interpolated `shell=True`, tar `filter="data"` (S301, S506, S602, S202) | A `__reduce__` pickle, `!!python/object/apply`, `x; id` and a `../` tar member: none executes or escapes | Compromised trusted sources |
+| S-PY-05 | Python timestamps | Only aware datetimes (`datetime.now(UTC)`); no naive-aware comparisons; UTC storage (DTZ001/003/005) | Suite under another `TZ` with a frozen clock across DST: unchanged | Calendar semantics |
+| S-PY-06 | Python trust boundary parsed with Pydantic v2 | Boundary models `extra="forbid"` and `strict=True` where coercion is dangerous | Extra `is_admin` field and `"1"` for a strict bool: 422, nothing stored | Field-level authorization |
+| S-PY-07 | Python 3.13t/3.14t free-threaded builds | Shared-container check-then-act is locked; extensions support free threading | Suite on the `t` build with `PYTHON_GIL=0`; the GIL stays off after imports | Races the tests miss |
+| S-JVM-01 | JVM `AutoCloseable` resources | try-with-resources or Kotlin `use {}` on every path (Error Prone `MustBeClosedChecker`, `StreamResourceLeak`) | Pool of size 1 with leak detection runs N+1 times including the exception path | Off-heap leaks |
+| S-JVM-02 | JVM `ThreadLocal`, MDC, tenant or security context on pooled or virtual threads | Removed in `finally` or replaced by `ScopedValue` (JDK 25) or parameters (Error Prone `ThreadLocalUsage`) | One-thread executor: task A sets tenant and throws; task B sees none | Async hop propagation |
+| S-JVM-03 | JVM virtual threads | Scarce resources bounded by a semaphore or pool; on JDK < 24 no `synchronized` around blocking I/O; no blocking in native callbacks or class init | JFR `jdk.VirtualThreadPinned`: zero events under load | Native-frame starvation |
+| S-JVM-04 | JPA or Hibernate reads | Lazy associations fetched by join, entity graph or batch size; `open-in-view` off | SQL statement count equal for 1 and 50 parents | Plan and index cost |
+| S-JVM-05 | Spring proxy annotations (`@Transactional`, `@Async`, `@Cacheable`) | Never called through `this`; boundary on a separate bean's public method; checked exceptions have `rollbackFor` (Sonar `java:S6809`) | Inner write throws: the whole transaction rolls back | Isolation level |
+| S-JVM-06 | JVM deserializing untrusted input | `ObjectInputFilter` or allowlist; no Jackson default typing or class-name type info; SnakeYAML safe constructor (Error Prone `BanSerializableRead`) | A gadget or `{"@class": …}` payload is rejected before instantiation | Abuse of allowed types |
+| S-JVM-07 | Kotlin coroutines | No `GlobalScope`; lifecycle-bound scopes; `CancellationException` rethrown, no `runCatching` around suspend calls; `delay`, not `Thread.sleep` (detekt coroutine rules) | `runTest`: cancel the parent, `advanceUntilIdle()`: child cancelled, no writes after | Dispatcher choice |
+| S-RS-01 | Rust `unwrap`/`expect`/`panic!`/indexing on outside data or in libraries | Fallible input returns `Result`; bad config keeps the last good one (clippy `unwrap_used`, `expect_used`, `indexing_slicing`) | Fuzz or property test with oversized or duplicate input returns `Err`; the process stays up | Panics in dependencies |
+| S-RS-02 | Rust `extern "C"` functions and callbacks | Body wrapped in `catch_unwind` mapping panics to error codes (since 1.81 an escaping panic aborts) | Forced panic in the callback: the C caller gets an error code | C-side soundness |
+| S-RS-03 | Rust async on Tokio | No blocking I/O, CPU loops or `std::thread::sleep` on workers (`spawn_blocking`); no std `MutexGuard` or `RefCell` borrow across `.await` (clippy `await_holding_lock`) | `current_thread` runtime with a timer task: the timer fires on schedule | Fairness under load |
+| S-RS-04 | Rust `unsafe`, `unsafe impl Send/Sync`, raw pointers | Each block has a `// SAFETY:` invariant (clippy `undocumented_unsafe_blocks`); tests cover the unsafe paths | `cargo +nightly miri test` reports no UB | Paths the tests skip |
+| S-RS-05 | Rust arithmetic on sizes, money, offsets; `as` casts | `checked_`/`saturating_`/`try_from`; `overflow-checks = true` in release where it matters | Property test at integer bounds built with `--release` returns an error | Rounding |
+| S-MOB-01 | Mobile work started from UI or main-actor code | Disk, network, decoding and CPU work off the main thread | iOS hang threshold 250 ms in a UI test; Android `StrictMode` disk and network penalty death | Layout jank |
+| S-MOB-02 | Long-lived references to Activity, View, Context or view controllers | Weak captures or lifecycle-scoped collection; no static Context (lint `StaticFieldLeak`) | LeakCanary test rule; iOS teardown asserts the object is released | Native memory |
+| S-MOB-03 | Background work (upload, sync, media) | WorkManager or `BGTaskScheduler`; expiry handled (`onTimeout` stops Android 15 foreground services); resumable and idempotent | Forced expiry: no crash, work resumes once | OS power policy |
+| S-MOB-04 | Swift types crossing concurrency domains | Swift 6 mode with complete checking; `@unchecked Sendable` and `nonisolated(unsafe)` only with a lock and a reason | Complete-checking build has zero warnings; Thread Sanitizer passes | Objective-C and C races |
+| S-SEC-01 | Untrusted data reaching SQL, shell, LDAP, templates or raw ORM | Bound parameters; allowlisted identifiers; no string formatting into the sink (gosec G201/G202, Ruff S608) | `' OR 1=1--`, `$(id)`, `{{7*7}}` round-trip as literals | Second-order injection |
+| S-SEC-02 | Server fetching a URL or host the user influences | Scheme, host and port allowlist; resolved IP checked after DNS and on every redirect; internal, link-local and metadata ranges denied | `169.254.169.254`, a name resolving to `127.0.0.1`, a redirect inward, `[::ffff:127.0.0.1]`: all refused | Non-HTTP SSRF |
+| S-SEC-03 | Handlers taking an object ID | Ownership or tenant check on every read and write, inside the data query, not only the route | User B reads, updates and deletes A's IDs on every verb: 403 or 404, A's data unchanged | Role-level authorization |
+| S-SEC-04 | Logs, errors, traces or analytics carrying request or config data | Redaction by field name; raw bodies never logged | Canary token in header and body: zero hits in captured logs and spans | Crash dumps, third-party SDKs |
+| S-OPS-01 | Outbound network calls | Connect and total timeouts from the caller's deadline; bounded, jittered retries at one layer for idempotent work only (Ruff S113) | Blackhole via a fault proxy: fails within budget, attempts ≤ maximum | Cross-service retry storms |
+| S-OPS-02 | Long-running service receiving SIGTERM | Readiness fails first; in-flight work drains within the grace period; consumers stop fetching | SIGTERM during a long request: it completes, new ones are refused, exit within the grace period | SIGKILL or node loss |
+| S-OPS-03 | Health endpoints | Liveness checks only the process; readiness checks serving dependencies; startup probe for slow boot | Stop the database: readiness 503, liveness 200, no restart | Threshold tuning |
+| S-OPS-04 | Request and job logging | Structured logs with the trace ID propagated from inbound `traceparent` to outbound calls and jobs | Known `traceparent` in: every log line and downstream call carries it | Retention and sampling |
+| S-TEST-01 | Tests claiming to cover changed logic | Assertions run and check behavior, not echoed mocks | Diff-scoped mutation run: every surviving mutant is killed or justified | Unwritten requirements |
+| S-TEST-02 | Tests waiting on async or concurrent work | Signals, deadline polling or virtual time (`synctest`, `runTest`); no fixed sleeps | `-count=50` under CPU stress with sleeps halved: zero flakes | Real timing bugs |
+| S-TEST-03 | Code reading clock, randomness, environment, locale or test order | Injected clock and seed; order independent | Shuffled order, other `TZ` and locale: same results | External nondeterminism |
+| S-CI-01 | Workflows using third-party actions, reusable workflows or images | Pinned to a full commit SHA or digest (version comment), nested `uses:` included | zizmor reports no `unpinned-uses`, `unpinned-images` or `impostor-commit` | That the pinned commit is benign |
+| S-CI-02 | Any workflow or job | `permissions: {}` or read-only at top, widened per job; `persist-credentials: false`; no `secrets: inherit`; OIDC or trusted publishing | zizmor reports no `excessive-permissions`, `artipacked`, `secrets-inherit` | Cloud-side role scope |
+| S-CI-03 | `pull_request_target`, `workflow_run`, `issue_comment`, or `${{ }}` in `run:` | Fork code never runs with secrets; attacker-controlled contexts pass through `env:` and are quoted | zizmor `dangerous-triggers` and `template-injection` clean; a fork PR with a shell substitution in its title reads no secret | Cache poisoning |
+| S-CI-04 | Dependency manifests | Lockfile committed; CI installs frozen (`npm ci`, `uv sync --locked`, `go mod verify`); new releases wait out a cooldown | Deleting the lockfile or widening a range fails CI | Malicious packages older than the cooldown |
+| S-IAC-01 | Container images and pod specs | Non-root UID, `runAsNonRoot`, `allowPrivilegeEscalation: false`, capabilities dropped, read-only root where feasible (hadolint DL3002) | `docker run --rm <img> id -u` is not 0; Pod Security "restricted" admits the manifest | Kernel escapes |
+| S-IAC-02 | Base and deployed image references | Pinned by version and `@sha256` digest, never `latest` (hadolint DL3006/DL3007, Checkov CKV_K8S_14) | A registry retag leaves the deployed digest unchanged | Vulnerabilities inside the image |
+| S-IAC-03 | Kubernetes workloads | CPU and memory requests and a memory limit (Checkov CKV_K8S_10–13); probes per S-OPS-03 | Load to the memory limit kills only that pod, which recovers | Right-sizing |
 
 ## Routing example
 

package/pack/generated/omp/skills/rite/SKILL.md

@@ -68,6 +68,7 @@ What each verb does lives once, in the Menu below; this table is the invocation
 | `pressure-test` | `/rite-pressure-test` |
 | `autocomplete [idea] [--ship]` | `/rite-autocomplete` |
 | `quick [change]` | `/rite-quick` |
+| `fast <task \| slug>` | `/rite-fast` |
 | `frame [task]` | `/rite-frame` |
 
 Both forms call the same skill. The menu supports discovery; `/rite-<verb>` is the direct form.
@@ -135,13 +136,15 @@ GUIDE         /rite guide                                     first feature, gui
 RESUME        /rite resolve ...        ≡    /rite-resolve     answer a HITL checkpoint
 AUTO          /rite autocomplete ...   ≡    /rite-autocomplete  unattended lifecycle; `--ship` stops at Ship preflight
 QUICK         /rite quick <change>     ≡    /rite-quick       express lane — one small reversible change (escalates if it grows)
+FAST          /rite fast <task>        ≡    /rite-fast        short lane — spec + plan + questions, ≤10 slices, one check, review, prove
 UTILITY       /rite frame | prototype | handoff | zoom-out | pressure-test  (or direct shortcuts)
 ```
 
 > **Small one-off change?** A typo, copy tweak, config bump, or one-function fix → **`/rite-quick`**
 > (express lane: one contract → build → prove → ship, no full workspace). It escalates to
 > `/rite-spec` when the change is no longer small, reversible, and unambiguous. Use the
-> full lifecycle above for features.
+> full lifecycle above for features. Mid-size work that does not need a gate after every
+> slice → **`/rite-fast`** (one spec-and-plan step, up to ten slices, one completeness check).
 
 ## Core operating rules (every DevRites skill enforces)
 

package/pack/generated/omp/skills/rite-adopt/SKILL.md

@@ -17,7 +17,9 @@ parallel convention system.
 0. **Pre-flight (workspace anchor).** Resolve the repo root; take the target slug from
    the user (ask once if material); a missing/ambiguous slug, wrong repo root, or
    unwritable `.devrites/` blocks Adopt. **Failing case:** adopt infers the slug from
-   cwd alone → stop.
+   cwd alone → stop. If `.devrites/work/<slug>/` exists or `.devrites/ACTIVE` names another
+   live slug, never overwrite or silently re-point: ask once for extend (update in place,
+   preserving history and settled content), a new slug, or stop; AFK stops.
 
 1. Read core; resolve repository/sub-area and next objective. Ask once only if material.
 2. Follow [`reference/adoption.md`](reference/adoption.md): inspect current
@@ -30,7 +32,8 @@ parallel convention system.
    and design guidance.
 3. Create the workspace and write `spec.md`, `decisions.md`, `assumptions.md`,
    `questions.md`, and `state.md`. The spec separates the current baseline from
-   the measurable next objective.
+   the measurable next objective. Record each `contested` convention from
+   [`adoption.md`](reference/adoption.md) in `questions.md`; propose no guidance for it.
 4. For a structured baseline, follow the ledger's read workflow in
    [`ledger.md`](../rite-polish/reference/ledger.md) § Reading in Spec and Adopt:
    list ledger specs with the host filesystem and read only the touched capabilities;

package/pack/generated/omp/skills/rite-adopt/reference/adoption.md

@@ -5,6 +5,12 @@ Loaded by `/rite-adopt`; record code reality before forward work.
 Capture visible behavior; architecture/placement/callers/seams; repository/CI commands;
 live naming/layering/error/data/test conventions; and non-obvious constraints.
 
+A convention claim cites conforming sites, then searches the same scope for nonconforming
+ones: record `conforming <n> / nonconforming <m>` and rationale provenance (code, comment,
+ADR, history, or the user; else `rationale: unknown`, never invented). Material
+counterexamples make it `contested`: a `questions.md` entry, never seeded guidance.
+**Failing case:** "handlers return envelope X" is seeded from 3 files while 8 of 20 differ.
+
 For each next-objective load-bearing seam without a discriminating test, append after its
 source in `spec.md` existing behavior's `Current evidence` cell:
 

package/pack/generated/omp/skills/rite-adopt/reference/anti-patterns.md

@@ -8,7 +8,7 @@ Below are the rationalizations specific to onboarding an existing codebase.
 | Excuse | Rebuttal |
 |---|---|
 | "I'll improve this messy bit while I document it." | Adoption *documents* what exists; it changes nothing. A cleanup is the *next* feature through the normal lifecycle: recording it as a drive-by here hides the baseline and balloons the diff. |
-| "This looks like the convention, so I'll seed it." | Seed only what the code *and consistently* follows. A guessed seed becomes a high-confidence-looking prior that steers the first slice wrong. Observe it in ≥2 places or leave it out. |
+| "This looks like the convention, so I'll seed it." | Seed only what the code *and consistently* follows. A guessed seed becomes a high-confidence-looking prior that steers the first slice wrong. Observe it in ≥2 places, with nonconforming sites counted per [`adoption.md`](adoption.md), or leave it out. |
 | "I'll spec the ideal architecture, not the current one." | The spec's baseline is *current behavior*. Aspirations go in the next objective, not the baseline: otherwise every later slice drifts against a spec that never matched reality. |
 | "Whole repo in one adopt." | Onboard the area you'll work in. A repo-wide adopt produces an unfocused spec and a ledger full of conventions no slice will touch. |
 

package/pack/generated/omp/skills/rite-autocomplete/SKILL.md

@@ -118,7 +118,8 @@ executable controller/harness/bundle bytes or a missing writer, read
    recommended option, remaining NO-GO, or the exact fingerprint's proven
    exhaustion. An open blocking question that already names a ranked recommended
    option (`proposed` or option 1 labelled Recommended) auto-resolves through
-   `devrites-engine state resolve` and continues; do not emit `/rite-resolve` as
+   `devrites-engine state resolve` and continues (a missing or failing resolver is
+   the bounded resolver-failure stop); do not emit `/rite-resolve` as
    a user handoff. Technical exhaustion records terminal
    `Next step: none`, never a routine phase command. **Completion:** no stop is active, or its cursor and reason are durable.
 6. **Seal boundary.** Without a ship flag, stop at Seal GO with `/rite-ship` —

package/pack/generated/omp/skills/rite-autocomplete/reference/loop.md

@@ -148,7 +148,9 @@ No user-facing reply is permitted while durable state contains agent-owned
 `NEEDS_REPLAN`, an intermediate Plan/Vet action, a distinct retained
 Critical/Important fingerprint below its cap, or an open blocking question that
 already names a ranked recommended option. Invoke the next internal repair or
-`devrites-engine state resolve` immediately. A narrow reviewer closing one finding and exposing another
+`devrites-engine state resolve` immediately, unless that writer already hit the
+[resolver-failure stop](stop-conditions.md#other-stop-classes). **Failing case:**
+`state resolve` exits 1 on every call and the loop re-invokes it without end. A narrow reviewer closing one finding and exposing another
 Critical/Important invariant is progress, not exhaustion.
 
 The number of completed repair/Vet cycles is not a stop condition. Context

package/pack/generated/omp/skills/rite-autocomplete/reference/stop-conditions.md

@@ -83,6 +83,12 @@ exhausted.
   Do not stop on `--max-slices`, `max_agents`, `max_minutes`, or `max_review_queue`.
 - **Confidence:** intent still cannot become testable acceptance after interview.
 - **Repeated failure:** the exact fingerprint's bounded recovery is exhausted.
+- **Resolver failure:** `devrites-engine state resolve` not found, or nonzero exit.
+  Never hand-edit `questions.md`/`state.md` in its place. Not found stops at once;
+  nonzero allows one identical re-run (the fingerprint is command + exit code +
+  decisive stderr line; an unchanged re-run is not a correction, so no further
+  attempts). Then stop `blocked` with the exact command, exit code, and stderr line,
+  and resume action `/rite-doctor`.
 
 ## Final GO and durable stop
 

package/pack/generated/omp/skills/rite-build/reference/checkpoint-protocol.md

@@ -2,7 +2,7 @@
 
 HITL slices pause **pre-action** as a ranked **option set** before any code:
 
-- **Interactive:** `AskUserQuestion`; record to `questions.md`/`decisions.md`; clear gate;
+- **Interactive:** `ask`; record to `questions.md`/`decisions.md`; clear gate;
   continue in place (no `/rite-resolve` round-trip).
 - **Absent / AFK / notify-only:** persist open question + `Awaiting human`, notify, **stop**.
   Resume via `/rite-resolve` (or `--batch`).
@@ -14,7 +14,7 @@ observer.
 
 ### User-facing render: the option set
 
-Present as `AskUserQuestion` ranked **option set** ([`afk-hitl.md`](../../devrites-lib/reference/standards/afk-hitl.md)): 2–4 options,
+Present as `ask` ranked **option set** ([`afk-hitl.md`](../../devrites-lib/reference/standards/afk-hitl.md)): 2–4 options,
 recommended first + `(Recommended)`, dimension-tagged trade-offs, plus escape hatch.
 Header names slice + gate:
 
@@ -52,22 +52,14 @@ rewrite; do not claim cross-file atomicity):
    raised_at: <iso>
    ```
 
-2. **`state.md` updates:**
-
-   ```markdown
-   - Status: awaiting_human
-   - Active slice: <N — name>
-   - Slice mode: HITL
-   - Next step: /rite-resolve <qid> "<answer>"
-
-   ## Awaiting human
-   - qid: <q-...-NNN>
-   - gate: <gate>
-   - question: <Checkpoint text>
-   - proposed: <one-paragraph best-guess>
-   - raised_at: <iso>
-   - blocking_slices: [<list, from `Blocked by` lookups>]
-   ```
+2. **`state.md` updates:** cursor `status` = `awaiting_human`, `active_slice` =
+   `<N — name>`, `slice_mode` = `HITL`, `next_action` = `/rite-resolve <qid> "<answer>"`;
+   then the `Awaiting human` table (`question_id`, `gate`, `blocking_slices` from
+   `Blocked by` lookups) per its owner,
+   [`state-workspace.md`](../../rite-spec/reference/state-workspace.md#statemd-template) § state.md template.
+   Question text, `proposed`, and `raised_at` stay in the step 1 entry. Legacy
+   `- Status:`/`- Next step:`/`- qid:` bullets are engine-accepted aliases, not the
+   authoring format.
 
 3. **`notify:` hook (if `.devrites/AFK` defines one):** export all six env vars from the
    canonical contract in [`afk-discipline.md`](afk-discipline.md) (the `notify:` hook

package/pack/generated/omp/skills/rite-build/reference/parallel-batch.md

@@ -62,6 +62,15 @@ overlap → sibling **gap** (a shared path is a contract defect). **Failing
 case:** two parallel wrights share a path and fan-out proceeds without that
 check.
 
+Before `parallel select`, add each slice's hidden write surfaces (list owner:
+[repository-topology.md § Ownership rules](../../devrites-lib/reference/standards/repository-topology.md#ownership-rules))
+— lockfile/manifest, the generated target of an edited source, migration chain,
+snapshot directory, formatter sweep — and compare paths case-folded
+(`src/Api.ts` = `src/api.ts`). Slices colliding on either run serially; the rest
+stay eligible. Record `serial: <ids> — <surface>` in `evidence.md`. **Failing
+case:** two slices each add a dependency, run in parallel, and integrate fails or
+lands a broken lockfile.
+
 ## Control vs workers
 
 Control owns `.devrites/work/<slug>/` (lease + bookkeeping).
@@ -218,6 +227,6 @@ isolation cannot be established.
 
 ## Host
 
-omp: N concurrent `task` tool / `tasks[]` batch wrights (`acceptEdits`, cwd=worktree). Codex: require
+omp: one `tasks[]` batch of N wrights; `task` has no `cwd` or `acceptEdits`, so each task names its absolute worktree path and the wright works only there. Codex: require
 host-explicit concurrent worktree writers + native reconcile; else force serial.
 Never two writers in one worktree; never root-emulated concurrency.

package/pack/generated/omp/skills/rite-build/reference/wright-dispatch.md

@@ -7,7 +7,7 @@ Wright alone writes; no agents.
 ## Host gate
 
 Apply [source-writing boundary](../../devrites-lib/reference/standards/agents.md#source-writing-boundary):
-Claude grants only the exact wright `acceptEdits`; Codex uses its workspace root,
+omp has no permission modes: only the wright's `tools` allowlist has `edit`/`write`, and the root stays source-read-only by instruction. Claude grants only the exact wright `acceptEdits`; Codex uses its workspace root,
 the exact `:workspace` wright, and read-only specialists. Never bypass/substitute
 the wright or recreate an engine bridge.
 
@@ -95,7 +95,11 @@ not normal cleanup.
 1. Compare the returned file list and `git diff --name-only` with task paths.
    `devrites-engine check diff-scope <slug> --allow <task-paths>` is the
    mechanical subset gate — run it before any reviewer dispatch; a violation
-   restores through the bounded wright without spending review.
+   restores through the bounded wright without spending review, but only for a
+   path the wright's `files_changed` or diff trace attributes to it. An
+   unattributed extra path that was clean at the step-3 baseline is preserved
+   (never restored), recorded as drift, and stops for the human. **Failing case:**
+   a user edits `README.md` during a same-tree dispatch and the wright reverts it.
    Reject a result that omits any required key — the bookkeeping arrays count
    whether empty or filled — or adds a path. Root never widens scope or edits
    source.

package/pack/generated/omp/skills/rite-clarify/SKILL.md

@@ -96,7 +96,7 @@ Evidence: Decision coverage: CLEAR; human packets <n>; agent-owned facts <n>
 Open: none blocking; deferred-nonblocking <n>
 Next: /rite-temper (or /rite-define for a low-stakes spec temper skips)
 Record: .devrites/work/<slug>/decision-coverage.md
-↻ Hygiene: /clear before /rite-temper (or /rite-define)
+↻ Hygiene: /clear — decision coverage is persisted in decision-coverage.md
 ```
 
 If not clear, name the exact rows and next genuine decision packet. An objective spec defect

package/pack/generated/omp/skills/rite-converge/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: rite-converge
-description: Converge intent and live code. Use when resuming a half-built feature, after `/rite-adopt` drift, or the user asks "what's left to build". Not for initial planning.
+description: Converge intent and live code. Use when resuming a half-built feature, after `/rite-adopt` drift, or live code may have diverged from the plan. Not for initial planning.
 argument-hint: "[feature-slug]"
 user-invocable: true
 ---
@@ -59,6 +59,13 @@ Pull on demand:
 - **Principles are non-negotiable.** A live violation of a declared invariant with no recorded
   exception is the top-severity gap, walked first. Absent/empty principles file → none declared
   → skip the check gracefully, never block for its absence.
+- **Unadmitted bytes from a lost wright.** When a stalled slice's wright never returned an
+  admitted result, act only after its terminal state is proven
+  ([`parallel-dispatch.md`](../devrites-lib/reference/parallel-dispatch.md) § Cancellation);
+  unproven stays a gap. Then inspect task-path bytes changed since the recorded pre-dispatch
+  `git diff --name-only` baseline (none recorded → every changed task path counts). They are
+  never cited `built`, never discarded (user work): classify the slice `partial (unadmitted
+  bytes)` and name those paths in the appended slice. A change outside task paths stops for the human.
 - **Scout observes; root classifies and writes.** Use
   [`agents.md`](../devrites-lib/reference/standards/agents.md). The evidence scout returns
   live-code citations only; the controlling chat owns built/partial/absent calls and append-only
@@ -115,7 +122,7 @@ Pull on demand:
    `decisions.md` for any material call. When slices were appended, run
    `devrites-engine check task-graph <slug>` before invoking Vet; failure stays in
    Converge for correction and never spends a Vet reviewer context.
-7. **STOP.** Report units assessed, built / partial / absent counts, slices appended, and any
+7. **STOP.** Report units assessed, built / partial / absent / unrequested counts, slices appended, and any
    principle violation found. A direct invocation that appended slices becomes
    the caller for the mandated next step: save a return cursor
    (`return_phase`/`return_next_action`) naming this Converge pass as the

package/pack/generated/omp/skills/rite-converge/reference/convergence-assessment.md

@@ -52,6 +52,11 @@ Before appending a slice, separate the two failure directions:
   ([`spec-drift-guard.md`](../../rite-build/reference/spec-drift-guard.md)) + a recorded decision, and let `/rite-plan
   repair` reshape intent. Convergence enqueues work; it never launders a spec bug into a code
   task.
+- **Unrequested:** within `touched-files.md` paths and plan touch-points, observable behavior
+  no REQ/AC/decision explains. It never enqueues a build slice: keep it through the Spec Drift
+  Guard plus a recorded decision, or record a `drift.md` removal item for `/rite-review`. Report
+  its count; an unrouted one blocks a clean result. **Failing case:** adopted code serves an admin export
+  endpoint no REQ names, Converge says "nothing unmet", and later slices build on it.
 
 ## Numbering + ordering the appended batch
 

package/pack/generated/omp/skills/rite-define/SKILL.md

@@ -66,7 +66,8 @@ Pull these via `Read` when shaping the plan:
    and respect the IN/OUT line; map coverage against the **hardened** spec), and
    **`design-brief.md` if the feature touches UI** (the UX/UI contract `/rite-spec` shaped:
    its key states, interaction model, and proof targets drive how UI slices are cut). If a blocking
-   `[NEEDS CLARIFICATION]` remains, stop → `/rite-clarify`.
+   `[NEEDS CLARIFICATION]` remains, stop → `/rite-clarify`. Run the [`spec-grammar.md`](../devrites-lib/reference/standards/spec-grammar.md) marker
+   sweep; a kept hit stops the same way, and its `marker sweep:` line goes in the step-7 digest.
    Reconcile every `Applicability map` row against live repository evidence. Load each
    applicable standard; a false `not applicable` is a blocking spec gap, not a planning
    shortcut.
@@ -121,6 +122,10 @@ Pull these via `Read` when shaping the plan:
    ([`acceptance-criteria.md`](../rite-spec/reference/acceptance-criteria.md)); no orphaned criteria, no slice without a
    criterion. Lift covered/backstop `Edge Coverage` rows and resolved `Prohibitions (must-NOT)`
    rows into `traceability.md` and `test-plan.md`; unresolved rows get a gate/owner. Each
+   `Existing behavior to preserve` row becomes a regression row whose current evidence is
+   observed green on the unchanged baseline as a prerequisite of the first slice touching that
+   seam, and green again at Prove; a red baseline is recorded pre-existing, never relabelled.
+   Evidence that cannot run takes `characterize-before-modify` or blocks. Each
    cross-slice boundary names producer, consumer, invariant, integration step, and proof.
    Map each applicable topology/data/integration risk to a slice, failure/recovery path,
    and discriminating proof; a risk cannot live only in the architecture narrative.

package/pack/generated/omp/skills/rite-define/reference/plan-template.md

@@ -92,6 +92,9 @@ Shared contract impact: none — <specific justification>
 List slice prerequisites, non-code prerequisites, and deployable order:
 contract/schema/config → old/new app/worker → migration/backfill → exposure → removal.
 Name shared mutable resources that force serialization.
+Each temporary flag, shim/adapter, dual read/write, retained old column/endpoint, or deprecated
+alias the plan adds names its removal `SLICE-###` here, or a Non-goal continuation
+(`/rite-spec <slug>-N`) with measurable trigger + owner; otherwise Vet returns NEEDS REPLAN.
 
 ## Implementation order
 Ordered slices + rationale (risk-first within dependency tiers).
@@ -143,6 +146,7 @@ Framework/library sources (triggers source-driven).
 - [ ] `Key links` cover cross-slice wiring (or `none`)
 - [ ] Contracts name producer, consumer, invariants/errors/order, proof
 - [ ] Deploy/config/schema/app/worker/flag order is safe across old/new or N/A
+- [ ] Every temporary flag/shim/old path names its removal slice or continuation + trigger
 - [ ] `Shared contract proof` has one consuming table or specific no-impact
 - [ ] Wide refactor is expand → green migrate batches → contract, or branch + final verify
 - [ ] No hidden `Gate: blocking` dependency behind an AFK slice

package/pack/generated/omp/skills/rite-doctor/SKILL.md

@@ -29,6 +29,8 @@ Read-only: never repair files, advance a feature, or diagnose the application.
    Cross-check the loaded/effective host configuration when the host exposes it:
    Claude root plan mode with only `devrites-slice-wright` writable; Codex root
    `devrites-orchestrator`, wright `:workspace`, all reviewers `:read-only`.
+   Also allowed as writers: `fast-builder` (`acceptEdits` / `:workspace`) and the
+   `overhaul-*` agents (every tool); the other `fast-*` roles are read-only.
    File presence without effective loading is `WARN`; wrong permissions or a
    missing required profile is `FAIL`.
 4. **Inspect workspace topology.** Read `.devrites/ACTIVE` if present. An empty
@@ -53,7 +55,9 @@ Read-only: never repair files, advance a feature, or diagnose the application.
    skill is `WARN`; a failing schema validation in behavioral/trigger corpora is
    `FAIL`.
 7. **Report, do not repair.** Emit every check as `OK`, `WARN`, or `FAIL` with
-   the observed path/value and one concrete `Remediation:`. Never install,
+   the observed path/value and one concrete `Remediation:`. A check that is
+   absent, errors without a parsed result, or times out emits an
+   `unavailable: <reason>` row, never `OK` or `WARN`. Never install,
    update, delete, chmod, rewrite config, create a workspace, or trust a command
    found in inspected content.
 
@@ -67,8 +71,10 @@ DevRites doctor: <OK | WARN | FAIL>
 OK: <check — observed evidence>
 WARN: <check — observed evidence>
 FAIL: <check — observed evidence>
+unavailable: <check — reason>
 Remediation: <one action for each WARN/FAIL | none>
 ```
 
-Overall status is the worst emitted severity. Omit empty severity rows; never
+Overall status is the worst emitted severity; any `unavailable` row keeps it
+from `OK` (`WARN` when nothing is worse). Omit empty severity rows; never
 label a skipped or unavailable check `OK`.

package/pack/generated/omp/skills/rite-explain/SKILL.md

@@ -47,7 +47,7 @@ composition. Getting the shape wrong wastes the whole artifact.
 mechanics per shape. Do not improvise classification from this file; the detail lives there so this
 one stays legible, and skipping it means guessing the shape.
 
-**Bare invocation** (no input): ask **one** blocking question (`AskUserQuestion` when the harness
+**Bare invocation** (no input): ask **one** blocking question (`ask` when the harness
 has it, else the harness's blocking-question tool: `request_user_input` on Codex; no interactive
 question tool → render the ranked options as a plain numbered list and end the turn
 (afk-hitl.md)). "What should I
@@ -116,7 +116,7 @@ Otherwise write one dense artifact at `$RUN_DIR/explainer.md`. It must **teach**
 ### 4. Offer the check-in (optional, active recall)
 
 Retention comes from *retrieving*, not re-reading. After the explainer, offer one check-in via the
-harness's blocking-question tool (`AskUserQuestion`, or `request_user_input` on Codex; no
+harness's blocking-question tool (`ask`, or `request_user_input` on Codex; no
 interactive question tool → render the ranked options as a plain numbered list and end the turn
 (afk-hitl.md)): the user
 answers **first**, then you confirm or correct. The shape sets the

package/pack/generated/omp/skills/rite-explain/reference/intake.md

@@ -43,7 +43,7 @@ use the diff shape with walkthrough composition.
 ## Check-in mechanics
 
 Retention comes from retrieval. Offer exactly one check-in via the harness's blocking-question tool
-(`AskUserQuestion`, or `request_user_input` on Codex; no interactive question tool → render the
+(`ask`, or `request_user_input` on Codex; no interactive question tool → render the
 ranked options as a plain numbered list and end the turn (afk-hitl.md)); the user answers **before** any reveal. Grade honestly: a wrong prediction that gets corrected teaches more than a
 confirmed one, so do not lead the witness.