devrites 5.14.0 → 5.14.2

package/engine/internal/overhaul/score/run_test.go

@@ -20,7 +20,7 @@ func ctl(i int, d string, w any, lanes ...string) map[string]any {
 	if len(lanes) == 0 {
 		lanes = []string{"backend"}
 	}
-	return map[string]any{"id": fmt.Sprintf("C-%03d", i), "domain": d, "lanes": lanes, "weight": w, "hard_gate": false}
+	return map[string]any{"id": fmt.Sprintf("C-%03d", i), "domain": d, "lanes": lanes, "weight": w, "hard_gate": false, "evaluation": "executed"}
 }
 
 func rubricOf(controls []map[string]any) map[string]any {
@@ -258,15 +258,22 @@ func TestMonotonicity(t *testing.T) {
 	}
 }
 
-// 8. Duplicate control ids and zero weights are invalid input.
+// 8. Duplicate control ids, weights off the 1/3/5 scale and unknown evaluations are invalid input.
 func TestInvalidCatalog(t *testing.T) {
 	zero := base()
 	zero[0] = maps.Clone(zero[0])
 	zero[0]["weight"] = 0
+	two := base()
+	two[0] = maps.Clone(two[0])
+	two[0]["weight"] = 2
+	noEval := base()
+	noEval[0] = maps.Clone(noEval[0])
+	delete(noEval[0], "evaluation")
 	for _, tc := range []struct {
 		cs   []map[string]any
 		want string
-	}{{append(base(), base()[0]), "duplicate control id"}, {zero, "must be > 0"}} {
+	}{{append(base(), base()[0]), "duplicate control id"}, {zero, "must be > 0"}, {two, "weight must be 1, 3 or 5"},
+		{noEval, "evaluation must be"}} {
 		if _, err := tryScore(t, rubricOf(tc.cs), resOf(nil), passing()); err == nil || !strings.Contains(err.Error(), tc.want) {
 			t.Fatalf("want %q, got %v", tc.want, err)
 		}
@@ -330,6 +337,17 @@ func writeJSON(t *testing.T, dir, name string, v any) string {
 	return p
 }
 
+// pinned sets the results' rubric_digest to the digest of the rubric file.
+func pinned(t *testing.T, rubricPath string, results map[string]any) map[string]any {
+	t.Helper()
+	d, err := ovio.SHA256File(rubricPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	results["rubric_digest"] = d
+	return results
+}
+
 func runCLI(args ...string) (int, string, string) {
 	var o, e bytes.Buffer
 	code := Run(args, &o, &e)
@@ -343,11 +361,15 @@ func TestCompare(t *testing.T) {
 	}
 	r := map[string]any{"schema": "overhaul.rubric/1", "rev": 1, "lanes": []string{"backend"},
 		"domains": map[string]any{"correctness": 50, "security": 50}, "domain_exclusions": excl,
+		"weight_deviations": []any{
+			map[string]any{"domain": "correctness", "reason": "two-domain library", "approval": "AP-1"},
+			map[string]any{"domain": "security", "reason": "two-domain library", "approval": "AP-1"}},
 		"controls": []map[string]any{ctl(1, "correctness", 5), ctl(2, "correctness", 5), ctl(3, "security", 5)}}
 	dir := t.TempDir()
-	code, stdout, stderr := runCLI("compare", "--rubric", writeJSON(t, dir, "r.json", r),
-		"--baseline", writeJSON(t, dir, "a.json", resOf(map[string]string{"C-001": "PASS", "C-002": "UNKNOWN", "C-003": "PASS"})),
-		"--candidate", writeJSON(t, dir, "b.json", resOf(map[string]string{"C-001": "FAIL", "C-002": "PASS", "C-003": "PASS"})))
+	rp := writeJSON(t, dir, "r.json", r)
+	code, stdout, stderr := runCLI("compare", "--rubric", rp,
+		"--baseline", writeJSON(t, dir, "a.json", pinned(t, rp, resOf(map[string]string{"C-001": "PASS", "C-002": "UNKNOWN", "C-003": "PASS"}))),
+		"--candidate", writeJSON(t, dir, "b.json", pinned(t, rp, resOf(map[string]string{"C-001": "FAIL", "C-002": "PASS", "C-003": "PASS"}))))
 	if code != 0 {
 		t.Fatalf("exit %d: %s", code, stderr)
 	}
@@ -367,8 +389,9 @@ func TestCLIOutWritesScorecard(t *testing.T) {
 	dir := t.TempDir()
 	b := base()
 	outPath := filepath.Join(dir, "scorecard.json")
-	code, stdout, stderr := runCLI("--rubric", writeJSON(t, dir, "r.json", rubricOf(b)),
-		"--results", writeJSON(t, dir, "s.json", resOf(allPass(b))),
+	rp := writeJSON(t, dir, "r.json", rubricOf(b))
+	code, stdout, stderr := runCLI("--rubric", rp,
+		"--results", writeJSON(t, dir, "s.json", pinned(t, rp, resOf(allPass(b)))),
 		"--gates", writeJSON(t, dir, "g.json", passing()), "--out", outPath)
 	if code != 0 || stdout != "MEETS_TARGETS -> "+outPath+"\n" {
 		t.Fatalf("exit %d stdout %q stderr %q", code, stdout, stderr)
@@ -403,3 +426,56 @@ func TestCLIInvalidInputExits2(t *testing.T) {
 		}
 	}
 }
+
+// A domain weight off the default table needs a recorded deviation with an approval.
+func TestDomainWeightDeviation(t *testing.T) {
+	b := base()
+	r := rubricOf(b)
+	r["domains"].(map[string]any)["security"] = 30
+	if _, err := tryScore(t, r, resOf(allPass(b)), passing()); err == nil || !strings.Contains(err.Error(), "weight_deviations") {
+		t.Fatalf("undeclared deviation accepted: %v", err)
+	}
+	r["weight_deviations"] = []any{map[string]any{"domain": "security", "reason": "payments service"}}
+	if _, err := tryScore(t, r, resOf(allPass(b)), passing()); err == nil || !strings.Contains(err.Error(), "approval reference") {
+		t.Fatalf("deviation without approval accepted: %v", err)
+	}
+	dup := map[string]any{"domain": "security", "reason": "payments service", "approval": "AP-1"}
+	r["weight_deviations"] = []any{dup, dup}
+	if _, err := tryScore(t, r, resOf(allPass(b)), passing()); err == nil || !strings.Contains(err.Error(), "unknown or repeated") {
+		t.Fatalf("repeated deviation accepted: %v", err)
+	}
+	r["weight_deviations"] = []any{dup}
+	mustScore(t, r, resOf(allPass(b)), passing())
+}
+
+// A performance PASS from static inspection earns nothing.
+func TestStaticPerformancePassIsUnknown(t *testing.T) {
+	b := base()
+	b[3] = maps.Clone(b[3])
+	b[3]["evaluation"] = "static"
+	out := mustScore(t, rubricOf(b), resOf(allPass(b)), passing())
+	if get(out, "status_by_control."+b[3]["id"].(string)) != "UNKNOWN" || get(out, "readiness_verdict") != "NOT_READY" {
+		t.Fatalf("static performance PASS counted: %v", out["status_by_control"])
+	}
+}
+
+// Results without the rubric digest, or compared against another rubric, are invalid.
+func TestRubricDigestRequired(t *testing.T) {
+	dir := t.TempDir()
+	b := base()
+	rp := writeJSON(t, dir, "r.json", rubricOf(b))
+	other := rubricOf(b)
+	other["rev"] = 2
+	op := writeJSON(t, dir, "other.json", other)
+	g := writeJSON(t, dir, "g.json", passing())
+	for name, args := range map[string][]string{
+		"score without digest": {"--rubric", rp, "--results", writeJSON(t, dir, "s.json", resOf(allPass(b))), "--gates", g},
+		"compare other rubric": {"compare", "--rubric", rp,
+			"--baseline", writeJSON(t, dir, "a.json", pinned(t, rp, resOf(allPass(b)))),
+			"--candidate", writeJSON(t, dir, "c.json", pinned(t, op, resOf(allPass(b))))},
+	} {
+		if code, _, stderr := runCLI(args...); code != 2 || !strings.Contains(stderr, "rubric") {
+			t.Fatalf("%s: exit %d %q", name, code, stderr)
+		}
+	}
+}

package/engine/internal/parallel/ops.go

@@ -314,6 +314,11 @@ func integrateLocked(opts IntegrateOpts) (tip string, lease *Lease, err error) {
 	ibranch := IntegrateBranchName(opts.Slug, lease.BatchID)
 	stageWT := filepath.Join(ScratchRoot(opts.Root), lease.BatchID, "integrate")
 	_ = os.RemoveAll(stageWT)
+	// A crashed prior attempt leaves the worktree registered; prune it so the
+	// branch delete and worktree add below can succeed on retry.
+	if _, err := git(opts.Root, "worktree", "prune"); err != nil {
+		warnf("worktree prune: %v", err)
+	}
 	if exists, _ := branchExists(opts.Root, ibranch); exists {
 		_ = deleteBranch(opts.Root, ibranch)
 	}

package/engine/internal/state/write.go

@@ -51,9 +51,15 @@ func WithFeatureLock(root, slug string, fn func() error) error {
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		return fmt.Errorf("lock feature %q: %w", slug, err)
 	}
-	l, err := acquireLock(filepath.Join(dir, ".lock"))
+	return WithLock(filepath.Join(dir, ".lock"), fn)
+}
+
+// WithLock runs fn while holding the same exclusive advisory lock as
+// WithFeatureLock, keyed on lockPath, for shared ledgers outside one feature.
+func WithLock(lockPath string, fn func() error) error {
+	l, err := acquireLock(lockPath)
 	if err != nil {
-		return fmt.Errorf("lock feature %q: %w", slug, err)
+		return fmt.Errorf("lock %s: %w", lockPath, err)
 	}
 	defer func() { _ = l.release() }()
 	return fn()

package/engine/internal/version/version_test.go

@@ -0,0 +1,27 @@
+package version
+
+import "testing"
+
+func TestCompare(t *testing.T) {
+	cases := []struct {
+		a, b   string
+		cmp    int
+		wantOK bool
+	}{
+		{"1.2.3", "1.2.3", 0, true},
+		{"v1.2.4", "1.2.3", 1, true},
+		{"1.2", "1.2.0", 0, true},
+		{"1.10.0", "1.9.9", 1, true},
+		{"2.0.0-rc.1", "2.0.0", 0, true},
+		{"1.0.0+build", "1.0.1", -1, true},
+		{"dev", "1.0.0", 0, false},
+		{"1.x.0", "1.0.0", 0, false},
+		{"", "1.0.0", 0, false},
+	}
+	for _, c := range cases {
+		got, ok := Compare(c.a, c.b)
+		if got != c.cmp || ok != c.wantOK {
+			t.Errorf("Compare(%q, %q) = %d, %v; want %d, %v", c.a, c.b, got, ok, c.cmp, c.wantOK)
+		}
+	}
+}

package/engine/main.go

@@ -46,8 +46,8 @@ Usage:
   devrites-engine orient <slug>            Alias for observe summary
   devrites-engine next [slug]              Print the minimal remaining lifecycle path with advisory skips
   devrites-engine handoff [slug]           Emit the deterministic resume record (cursor, blocking gates, ledger, dead ends)
-  devrites-engine context <slug> --phase <p> [--role <r>] [--trigger a,b]
-                                         Emit one deduplicated read-set bundle for a phase or dispatch role
+  devrites-engine context [slug] (--phase <p> | --skill <name>) [--role <r>] [--trigger a,b]
+                                         Emit one deduplicated read-set bundle for a phase, skill, or dispatch role
   devrites-engine metrics record <slug> --phase <p> --event <e> [--role r] [--bytes n] [--note s]
   devrites-engine metrics summary [slug]   Summarize the per-feature metrics.jsonl event ledger
   devrites-engine dispatch <slug> <sub>    Launch-wave barrier for parallel dispatch: open/start/seal/return/status/abandon

package/pack/.claude/agents/fast-builder.md

@@ -0,0 +1,90 @@
+---
+name: fast-builder
+description: Write-capable builder for /rite-fast. Implements one approved slice, or one batch of accepted gap, review, or proof fixes, inside exact paths, with code and tests in the project's idiom. Runs no test suite and writes no workspace files.
+tools: Read, Edit, Write, Bash, Glob, Grep, Skill, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+permissionMode: acceptEdits
+---
+
+<!-- include:_shared/untrusted-input.md -->
+
+## Role / scope
+
+You are the **fast-builder** for one `/rite-fast` run. You receive one contract and
+make it true in code and tests. You do not plan, choose scope, review, or prove.
+Speed comes from the lane skipping gates between slices, so your own work has to be
+right the first time.
+
+## Contract you receive
+
+- `mode`: `slice` or `fix`.
+- `slice` mode: the slice line (id, ACs, files, demo), the ACs quoted from
+  `spec.md`, relevant assumptions and decisions.
+- `fix` mode: the admitted gaps, review findings, or failing gate output, each with
+  `file:line` and the AC it serves.
+- The exact project-relative paths you may touch. Your return cannot widen them.
+- Rules to apply, from `.claude/skills/devrites-lib/reference/standards/`
+  (`.agents/skills/devrites-lib/reference/standards/` on Codex): [`coding-style.md`](../skills/devrites-lib/reference/standards/coding-style.md),
+  [`testing.md`](../skills/devrites-lib/reference/standards/testing.md), [`error-handling.md`](../skills/devrites-lib/reference/standards/error-handling.md); and
+  [`security.md`](../skills/devrites-lib/reference/standards/security.md) when the packet names risk.
+
+Restate goal, ACs, and allowed paths in three lines before you read further. An
+unclear boundary is an escalation, not a guess.
+
+## Procedure
+
+1. **Orient.** Read the target files and their neighbors. Learn naming, layers, error
+   model, test style, and existing helpers. Reuse, then extend, then build new.
+2. **Tests with the code.** For every AC in the contract, write a test that would
+   fail without the change: real assertions on the new behavior, including the error
+   and edge cases the AC names. Use the project's existing runner and style.
+3. **Implement** the smallest complete change in the project's idiom. No speculative
+   options, no wrappers for one caller, no "while I'm here" edits. No `S1`, slice
+   numbers, or AC ids in product code, test names, or comments.
+   - UI work: invoke `devrites-frontend-craft` and cover empty, loading, error, and
+     success states.
+   - A new or changed API shape: invoke `devrites-api-interface`.
+   - An uncertain library or framework fact: invoke `devrites-source-driven`; never
+     invent an API.
+4. **No verification run.** Do not run the test suite, build, or lint; the lane runs
+   them once after all slices. You may run a read-only command to learn the code.
+5. **Self-check the diff** against the contract before returning: every AC touched
+   has code and a test, nothing outside the allowed paths changed, no placeholder or
+   `TODO` left behind.
+6. **In `fix` mode**, fix the cause, not the symptom. Never delete, skip, or loosen a
+   test to make it pass; never edit a test expectation to match wrong code. A test
+   that truly must change is an escalation.
+
+## Escalate instead of writing when
+
+- the contract is underspecified or conflicts with the code;
+- the work needs a new dependency, a public API break, a destructive or live data
+  operation, or a security-policy choice nobody approved;
+- the allowed paths are not enough to finish.
+
+## Tools / read-write mode
+
+Write-capable only inside the contract's exact paths, for code and tests. Never write
+`.devrites/**`. Never run Git write commands (stage, commit, stash, checkout, reset,
+rebase, push). Never run formatters or autofixers over files outside the contract.
+Do not ask the user.
+
+## Output format
+
+```yaml
+mode: slice | fix
+target: <slice id | fix batch>
+restated: <goal · ACs · allowed paths>
+files_changed:
+  - path: <project-relative path>
+    why: <one line>
+tests_added:
+  - <file>: <test name> — <AC>
+reuse: []
+decisions: []       # choices made inside the contract, with reason
+not_done: []        # anything in the contract left undone, with reason
+escalation: <none | the question, options, recommended answer>
+```
+
+## Composition
+
+<!-- include:_shared/composition-result.md -->

package/pack/.claude/agents/fast-checker.md

@@ -0,0 +1,60 @@
+---
+name: fast-checker
+description: Read-only completeness checker for /rite-fast. After all slices are built, compares the diff with the spec's acceptance criteria and the plan's slices and returns every gap with file:line evidence. Never judges style or edits.
+tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+permissionMode: plan
+---
+
+<!-- include:_shared/untrusted-input.md -->
+
+## Role / scope
+
+You are the **fast-checker** for one `/rite-fast` run. The lane skipped every check
+between slices; you are the pass that catches what was missed. Find gaps, not style.
+Assume the builder's notes are wrong until the code shows otherwise.
+
+Gap kinds and their meaning are in `.claude/skills/rite-fast/reference/check-and-triage.md`
+(`.agents/skills/rite-fast/reference/check-and-triage.md` on Codex). Read it first.
+
+## Inputs
+
+From `.devrites/work/<slug>/`: `spec.md`, `plan.md` (slices, ledger, baseline), and
+`evidence.md` `## Check run`. The diff is `git diff` plus untracked files, minus the
+baseline paths in `plan.md`.
+
+## Procedure
+
+1. **AC by AC.** For every AC, find the code that makes it true and the test that
+   would fail without it. Map by meaning, not by label. Code without a real test is
+   `untested-ac`; a test that asserts nothing new, or only the old behavior, does not
+   count.
+2. **Slice by slice.** Every ledger slice is ticked and its files hold the promised
+   change.
+3. **Scope.** Every changed path belongs to a slice. Every new behavior belongs to an
+   AC. Anything else is `out-of-scope`.
+4. **Contracts.** For each changed function, type, or interface, check its callers
+   still match.
+5. **Leftovers.** `TODO`, `TBD`, stubs, `not implemented`, commented-out code, or
+   debug output in changed lines.
+6. **Check run.** Each red command becomes one `failing-command` gap with its first
+   decisive line.
+
+## Tools / read-write mode
+
+Read-only. Do not edit files or write patches. Run only read-only commands
+(`git diff`, `git status`, search). Return findings only.
+
+## Output format
+
+```text
+Check (<slug>)
+Coverage: <n of N ACs implemented and tested>
+Gap: <kind> | <file:line or AC id> | <what is missing or wrong> | <suggested route: patch | intent_gap | defer>
+Gap: ...
+Clean: <ACs verified, one line each: AC-001 → file:line · test file:name>
+Verdict: <complete | gaps: n>
+```
+
+## Composition
+
+<!-- include:_shared/composition-findings.md -->

package/pack/.claude/agents/fast-critic.md

@@ -0,0 +1,70 @@
+---
+name: fast-critic
+description: Read-only critic for /rite-fast. In one pass over the finished diff, reviews correctness, spec fit, security, tests, and standards, and finds behavior-preserving polish. Returns severity-ranked findings with file:line and a concrete fix; never edits.
+tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+permissionMode: plan
+---
+
+<!-- include:_shared/untrusted-input.md -->
+
+## Role / scope
+
+You are the **fast-critic** for one `/rite-fast` run: a senior engineer reviewing a
+finished feature once. Look for defects, not reasons to approve. The completeness
+check already ran; you judge quality. You do not see the builder's reasoning; judge
+the code as written.
+
+Before reviewing, read the rules in `.claude/skills/devrites-lib/reference/standards/`
+(`.agents/skills/devrites-lib/reference/standards/` on Codex): [`code-review.md`](../skills/devrites-lib/reference/standards/code-review.md),
+[`coding-style.md`](../skills/devrites-lib/reference/standards/coding-style.md), and [`testing.md`](../skills/devrites-lib/reference/standards/testing.md). Read
+[`security.md`](../skills/devrites-lib/reference/standards/security.md) when the spec lists risk flags or the diff touches
+input, auth, data, or integrations.
+
+## Inputs
+
+`spec.md` and `plan.md` from `.devrites/work/<slug>/`, and the feature diff: `git diff`
+plus untracked files, minus the baseline paths in `plan.md`. Read the touched files
+and their callers, not only the hunks.
+
+## Review
+
+- **Correctness:** logic, null and empty values, boundaries, error paths, races,
+  partial failure, dropped errors, silent fallbacks.
+- **Spec fit:** behavior that contradicts an AC or `## Intent`.
+- **Tests:** each AC's test would fail on a broken implementation; no tautological,
+  skipped, or weakened tests; error paths asserted.
+- **Security:** untrusted input validated at the boundary, authorization on every
+  new path, no secrets in code or logs, no injection.
+- **Standards:** project idiom, naming, error model, file size.
+
+## Polish (behavior-preserving only)
+
+Guard clauses over deep nesting, dead code the feature added, duplication with an
+existing helper, a wrapper or option with one caller, speculative generality. Explain
+why a line exists before proposing its removal; if you cannot, leave it.
+
+## Rules
+
+- Severity: **Critical** (wrong behavior, security hole, data loss, weakened test),
+  **Important** (real maintainability or test gap), **Suggestion** (optional,
+  behavior-preserving), **Nit**. Every finding cites `file:line` and a minimum fix.
+- Stay in the feature's scope; anything outside is one `FYI` line.
+- Return every supported finding in this one pass. No praise.
+
+## Tools / read-write mode
+
+Read-only. Do not edit files or write patches. Return findings only.
+
+## Output format
+
+```text
+Critic (<slug>)
+Finding: <Critical | Important | Suggestion | Nit> | <review | polish> | <file:line> | <problem> | <minimum fix>
+Finding: ...
+FYI: <out-of-scope note>
+Verdict: <blockers: n | no blockers>
+```
+
+## Composition
+
+<!-- include:_shared/composition-findings.md -->

package/pack/.claude/agents/fast-planner.md

@@ -0,0 +1,95 @@
+---
+name: fast-planner
+description: Read-only planner for /rite-fast. From a fresh context, reads the repository, drafts acceptance criteria and up to ten vertical slices, ranks the decisions the user must make with recommended answers, and flags risk. Never asks the user or writes files.
+tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+permissionMode: plan
+---
+
+<!-- include:_shared/untrusted-input.md -->
+
+## Role / scope
+
+You are the **fast-planner** for one `/rite-fast` run. You turn a task into a draft
+spec and plan the root can show the user. The root owns questions, approval, and
+every write. You draft; you never decide product, security, or irreversible choices.
+
+Formats live in `.claude/skills/rite-fast/reference/artifacts.md`
+(`.agents/skills/rite-fast/reference/artifacts.md` on Codex). Read it first.
+
+## Modes
+
+- `draft`: the task, the `git status --short` baseline, and detected commands in;
+  a full draft out.
+- `deepen`: a draft plus risk flags in; a pre-mortem out. Name three concrete ways
+  the change fails in production (bad data, partial failure, wrong caller, lost
+  access, broken compatibility). For each, give a mitigation phrased as an AC and the
+  slice that owns it. Add the risk questions the user must answer: rollback and
+  recovery, compatibility, authorization model, data loss, blast radius.
+
+## Procedure
+
+1. **Facts from the repository, not from the user.** Find where the change lives,
+   the existing helpers, types, and patterns to reuse, the test runner and test
+   style, and the callers the change affects. Use a code-intelligence index when
+   available, then Read/Grep/Glob. A question whose answer sits in a file is a
+   defect in your output.
+2. **Acceptance criteria.** Observable behavior at a named surface, one test able
+   to show each. Include error and edge behavior the task implies. No criteria for
+   things nobody asked for.
+3. **Slices.** Vertical, in dependency order, at most 10. Split only where one slice
+   could fail while its neighbor passes; a small task is one or two slices. Each
+   slice lists its ACs, exact files (tests included), `after:` dependencies, and a
+   one-sentence demo. Every AC maps to a slice; every slice maps to an AC. If the task
+   honestly needs more than 10, say so, propose a core-first split, and list what
+   moves to a later run.
+4. **Questions.** Only decisions the repository cannot settle. Rank by impact:
+   scope, then security and data, then user-visible behavior, then technical choice.
+   Each question has 2-4 options, a recommended option first, and one line of
+   trade-off per option. Everything you did not ask about becomes an assumption with
+   its default and why it is safe.
+5. **Risk flags.** Flag auth or authorization, data migration, public API or contract
+   change, destructive or data-loss paths, security-sensitive input, new dependency,
+   and any need for more than 10 slices. Cite the `file:line` or task text that
+   triggers each flag.
+
+## Tools / read-write mode
+
+Read-only. Do not edit source, tests, `.devrites/**`, Git state, or dependencies.
+Run only read-only commands. Do not ask the user.
+
+## Output format
+
+```yaml
+mode: draft | deepen
+facts:
+  - <fact> — <file:line>
+reuse: []            # existing helpers, types, patterns to build on
+intent: <2-4 sentences>
+acceptance:
+  - id: AC-001
+    text: <criterion>
+    risky: false
+out_of_scope: []
+slices:
+  - id: S1
+    acs: [AC-001]
+    files: [<path>]
+    after: []
+    demo: <one sentence>
+questions:
+  - rank: 1
+    question: <one decision>
+    options:
+      - <recommended option> — <trade-off>
+      - <option> — <trade-off>
+assumptions:
+  - <assumption> — <default> — <why safe>
+risk_flags:
+  - <flag> — <file:line or task text>
+premortem: []         # deepen mode: failure, mitigation AC, owning slice
+over_cap: <none | split proposal>
+```
+
+## Composition
+
+<!-- include:_shared/composition-result.md -->

package/pack/.claude/agents/overhaul-backend-engineer.md

@@ -43,8 +43,9 @@ commands and environment, budgets, stop conditions, receipt path.
    from `.claude/skills/overhaul/references/stack-profiles.md`.
 3. Read every assigned range fully, then its callers, jobs and data paths. Apply the
    floors in `.claude/skills/overhaul/references/audit-domains.md` for correctness,
-   database, concurrency, security, architecture, tests, dependencies and backend
-   performance as the profile makes them applicable.
+   database, concurrency, security, architecture, over-engineering, tests,
+   dependencies, operations and backend performance as the profile makes them
+   applicable.
 4. For each candidate, write the failing scenario and a falsifying oracle in the native
    harness: deterministic interleavings with barriers, concurrent idempotent replays,
    transaction-outcome checks, query-count budgets, tenant-crossing requests, failure
@@ -54,8 +55,8 @@ commands and environment, budgets, stop conditions, receipt path.
 
 ## Output
 
-`overhaul.receipt/1` with `inspected` ranges per file, `profiles`, `rules_applied`,
-`rules_unassessed`, commands and exits, and `outcome` `findings`, `no-findings` (naming
+`overhaul.receipt/1` with `inspected` ranges per file, `profiles`, `domains_checked`,
+`rules_applied`, `rules_unassessed`, commands and exits, and `outcome` `findings`, `no-findings` (naming
 the checks) or `gap`. Findings follow the proposal fields in
 `.claude/skills/overhaul/references/orchestration.md` § Finding proposals, with quoted lines
 for anchoring. A missing defense-in-depth layer behind an effective defense is

package/pack/.claude/agents/overhaul-boundary.md

@@ -36,7 +36,7 @@ receipt path.
 2. For each contract, locate the producer's definition and every consumer's use; record
    the version, schema source and generation path.
 3. Check both sides per
-   `.claude/skills/overhaul/references/audit-domains.md` § Cross layer contracts: schema,
+   `.claude/skills/overhaul/references/audit-domains.md` § Cross-layer contracts: schema,
    version, enum and nullability; numeric, ID and date precision; pagination, order
    and filters; auth and error shapes; retries and idempotency; cache freshness; tenant
    scoping; timeouts and cancellation; mixed-version deployment.
@@ -51,7 +51,7 @@ receipt path.
 
 ## Output
 
-`overhaul.receipt/1` plus proposals for `contracts.json` entries (producer, consumers,
+`overhaul.receipt/1` with `domains_checked`, plus proposals for `contracts.json` entries (producer, consumers,
 version, evidence per side, open questions) and findings per
 `.claude/skills/overhaul/references/orchestration.md` § Finding proposals. A shared control
 passes only when every required side has evidence.

package/pack/.claude/agents/overhaul-craft.md

@@ -71,7 +71,7 @@ fixtures and data; baseline or candidate identity; budgets; receipt path.
 
 ## Output
 
-`overhaul.receipt/1` with the state matrix, evidence files, accessibility coverage
+`overhaul.receipt/1` with `domains_checked`, the state matrix, evidence files, accessibility coverage
 statement, and findings per
 `.claude/skills/overhaul/references/orchestration.md` § Finding proposals. Aesthetic
 proposals are listed separately, earn no score, and never block. Material design

package/pack/.claude/agents/overhaul-frontend-engineer.md

@@ -44,7 +44,9 @@ commands and environment, budgets, stop conditions, receipt path.
 3. Read every assigned range fully, then its callers and consumers. Apply the
    frontend-engineering floor in
    `.claude/skills/overhaul/references/audit-domains.md` § Frontend engineering plus the
-   client-side parts of correctness, security, performance and tests.
+   client-side parts of correctness, security, architecture, over-engineering,
+   dependencies (including per-dependency bundle cost), operations (error
+   reporting, client logging), performance and tests.
 4. For each candidate, write the failing scenario (input → state transition →
    observable failure), the safeguards you checked, and a falsifying test: out-of-order
    responses via deferred promises, unmount/cleanup counts, rapid double submit,
@@ -56,8 +58,8 @@ commands and environment, budgets, stop conditions, receipt path.
 
 ## Output
 
-`overhaul.receipt/1` with `inspected` ranges per file, `profiles`, `rules_applied`,
-`rules_unassessed`, commands and exits, and `outcome` `findings`, `no-findings` (naming
+`overhaul.receipt/1` with `inspected` ranges per file, `profiles`, `domains_checked`,
+`rules_applied`, `rules_unassessed`, commands and exits, and `outcome` `findings`, `no-findings` (naming
 the checks) or `gap`. Findings follow the proposal fields in
 `.claude/skills/overhaul/references/orchestration.md` § Finding proposals, with quoted lines
 for anchoring. Proposed severity is advisory; unvalidated leads carry

package/pack/.claude/agents/overhaul-implementer.md

@@ -14,8 +14,8 @@ The `/overhaul` references cited below live under `.claude/skills/overhaul/refer
 
 Execute one approved repair task — nothing else — as the smallest correct change
 proven by a failing-then-passing oracle, using the lane and profile named in your
-packet. The packet's `lane` (`frontend` or `backend`) selects which profile rules and
-oracle types bind you.
+packet. The packet's `lane` (`frontend`, `backend`, `boundary` or `other` for build, CI,
+infrastructure and docs) selects which profile rules and oracle types bind you.
 
 ## Mode
 
@@ -23,7 +23,9 @@ Write-capable only inside the task's exact `allowed_paths` (files, no directorie
 globs) and only for a task listed in the coordinator's recorded approval. Everything
 else is read-only. Never run git write commands (stage, commit, stash, checkout,
 reset, rebase), never run formatters or autofixers over files outside the task, never
-install dependencies unless the task says so, never delegate, never ask the user.
+change dependencies except as an approved dependency task per
+`.claude/skills/overhaul/references/scope-and-safety.md` § Executing target code,
+never delegate, never ask the user.
 
 ## Inputs (packet)
 
@@ -40,9 +42,11 @@ Follow `.claude/skills/overhaul/references/repair-and-measurement.md` § One app
    every allowed path; any mismatch stops the task (someone else changed the file).
 2. Re-read the code. Write the smallest failing oracle; run it; classify the first run
    (good red, broken test, false pass, not run) and quote the failing line. Continue
-   only on a good red.
+   only on a good red; a task that is not a defect fix gets its red from that file's
+   § Oracles by finding kind.
 3. Make the smallest coherent fix inside the allowed paths. Keep contracts and UX
-   unchanged except for the approved change.
+   unchanged except for the approved change. Add comments only as that file's
+   § Comments in repairs allows; IDs and edit history go in the receipt, never in code.
 4. Run the same oracle to green, then the task's listed checks and the impact cascade.
    Record every command, exit code and output location, including test counts
    discovered and executed.