devrites 5.14.3 → 6.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "5.14.3",
+  "version": "6.0.0",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, pi, and Devin CLI",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",
@@ -31,14 +31,15 @@
   "files": [
     "bin/",
     "engine/",
-    "!engine/devrites-engine",
-    "!engine/devrites-engine.exe",
+    "!engine/tests/",
+    "!engine/testdata/",
     "pack/",
     "scripts/build-host-artifacts.sh",
     "scripts/codex-generate.sh",
     "scripts/omp-generate.sh",
     "scripts/pi-generate.sh",
     "scripts/devin-generate.sh",
+    "scripts/expand-includes.py",
     "scripts/install-lib.sh",
     "install.sh",
     "uninstall.sh",
@@ -60,7 +61,6 @@
   },
   "scripts": {
     "prepare": "husky || true",
-    "prepack": "bash scripts/build-host-artifacts.sh",
     "commitlint": "commitlint --edit",
     "validate": "bash scripts/validate.sh",
     "test": "node scripts/run-tests.mjs",
@@ -86,6 +86,7 @@
     "semantic-release": "^25.0.9"
   },
   "overrides": {
+    "@semantic-release/commit-analyzer": "14.0.0-beta.4",
     "@semantic-release/release-notes-generator": "15.0.0-beta.3",
     "@semantic-release/npm": {
       "npm": "11.20.0"

package/scripts/build-host-artifacts.sh

@@ -23,6 +23,21 @@ OUT_ROOT="${DEVRITES_HOST_ARTIFACT_DIR:-$ROOT/pack/generated}"
   exit 1
 }
 
+command -v python3 >/dev/null 2>&1 || {
+  echo "build-host-artifacts: python3 is required" >&2
+  exit 1
+}
+[ -f "$ROOT/scripts/expand-includes.py" ] || {
+  echo "build-host-artifacts: missing $ROOT/scripts/expand-includes.py" >&2
+  exit 1
+}
+
+_out_parent="$(dirname "$OUT_ROOT")"
+[ "$OUT_ROOT" = . ] || { mkdir -p "$_out_parent" 2>/dev/null && [ -d "$_out_parent" ] && [ -w "$_out_parent" ]; } || {
+  echo "build-host-artifacts: output parent of $OUT_ROOT is not a writable directory (DEVRITES_HOST_ARTIFACT_DIR)" >&2
+  exit 1
+}
+
 TMP_GEN_DIR="$(mktemp -d)"
 cleanup() { rm -rf "$TMP_GEN_DIR"; }
 trap cleanup EXIT

package/scripts/codex-generate.sh

@@ -104,7 +104,7 @@ This project has DevRites installed for both Claude Code and Codex.
 - In DevRites guidance, **invoke** means run a skill inline in the current context; **dispatch** means start a fresh agent with `spawn_agent`, wait for it, and reconcile its result.
 - Dispatch every exact named `devrites-<role>` required by the active workflow in a fresh subagent thread, wait for it, and reconcile its result. If that role is unavailable, stop for HITL; never skip it, never substitute a generic/default child, and never execute the specialist role in the root context.
 - The root uses the workspace-capable `devrites-orchestrator` profile because Codex children cannot elevate above the parent permission ceiling. This permission is for native writer dispatch and exact path-bounded executable workflow artifacts under the active `.devrites/work/<slug>/`; the root must never edit product source or tests itself.
-- Every generated specialist is hook-free. `devrites-slice-wright` alone uses `default_permissions = ":workspace"`; every other specialist uses `default_permissions = ":read-only"`. Exact paths are instruction-enforced: put the project-relative paths in the task, wait for the wright, compare its file list and `git diff --name-only` with that contract, and reject any extra path. Never bypass the wright, widen its contract, or edit source in the root; the root must never recreate an engine dispatch bridge.
+- Every generated specialist is hook-free. Among the lifecycle `devrites-*` specialists, `devrites-slice-wright` alone uses `default_permissions = ":workspace"` and every other specialist in that family uses `default_permissions = ":read-only"`. The shipped profiles are the full role-to-permission map; `/rite-doctor` step 3 checks them. Exact paths are instruction-enforced: put the project-relative paths in the task, wait for the wright, compare its file list and `git diff --name-only` with that contract, and reject any extra path. Never bypass the wright, widen its contract, or edit source in the root; the root must never recreate an engine dispatch bridge.
 - The explicit `/overhaul` skill ships its own `overhaul-*` agents outside the DevRites lifecycle. They use `default_permissions = ":workspace"`, are dispatched only by that skill, and follow its own approval gate and path contracts instead of the lifecycle writer rules above.
 - The explicit `/rite-fast` skill ships its own `fast-*` agents. Only `fast-builder` uses `default_permissions = ":workspace"`; `fast-planner`, `fast-checker`, and `fast-critic` stay `:read-only`. `/rite-fast` dispatches them itself and applies its own exact-path contracts.
 - A seal GO, AFK mode, or autocomplete flag never authorizes an irreversible action. Disclose the exact commit/push/tag/PR plan and obtain fresh explicit user approval for that attempt; any changed or retried plan needs fresh approval. Native host permission and sandbox prompts remain authoritative and cannot be inferred or bypassed.

package/scripts/devin-generate.sh

@@ -206,7 +206,7 @@ This project has DevRites installed for Devin CLI.
 - Before using any DevRites workflow skill, read `.devin/skills/devrites-lib/reference/standards/core.md`. Load other `.devin/skills/devrites-lib/reference/standards/*.md` files when the skill or rule index asks for them.
 - DevRites specialist agents live in `.devin/agents` as custom subagent profiles offered to `run_subagent`. If a required `devrites-<role>` profile is not among the offered profiles, stop for HITL - never skip the role, never substitute `subagent_general`, `subagent_explore`, or another generic profile, never inline the specialist prompt, and never execute the specialist role in the root context.
 - In DevRites guidance, **invoke** means run a skill inline in the current context; **dispatch** means start a fresh agent with `run_subagent` using the exact `profile` name, wait for it with `read_subagent`, and reconcile its result.
-- Only `devrites-slice-wright` may edit source or tests; every other specialist is read-only by `allowed-tools`. Exact paths are instruction-enforced: put the project-relative paths in the task, wait for the wright, compare its file list and `git diff --name-only` with that contract, and reject any extra path.
+- Among the lifecycle `devrites-*` specialists, only `devrites-slice-wright` may edit source or tests; every other specialist in that family is read-only by `allowed-tools`. The shipped profiles are the full role-to-permission map; `/rite-doctor` step 3 checks them. Exact paths are instruction-enforced: put the project-relative paths in the task, wait for the wright, compare its file list and `git diff --name-only` with that contract, and reject any extra path.
 - The explicit `/overhaul` skill ships its own `overhaul-*` agents outside the DevRites lifecycle. They carry the full write tool set, are dispatched only by that skill, and follow its own approval gate and path contracts instead of the lifecycle writer rules above.
 - The explicit `/rite-fast` skill ships its own `fast-*` agents. Only `fast-builder` carries write tools; `fast-planner`, `fast-checker`, and `fast-critic` stay read-only. `/rite-fast` dispatches them itself and applies its own exact-path contracts.
 - Custom profiles do not inherit interactive tool grants, and background subagents auto-deny unapproved tools. Dispatch the write-capable wright in the foreground, or make sure its `edit`, `write`, and `exec` tools are approved first. Specialists cannot use `ask_user_question`; the root relays user questions and answers through the task text and returned result.

package/scripts/expand-includes.py

@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+"""Expand <!-- include:REL/PATH.md --> markers in-place under a directory.
+
+Paths resolve relative to the file containing the marker. Used by
+build-host-artifacts.sh on a scratch copy of pack/.claude so every host
+receives identical expanded text while canonical sources deduplicate
+shared blocks into pack/.claude/**/_shared/.
+"""
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+
+MARKER = re.compile(r"<!--\s*include:([^\s>]+)\s*-->")
+
+
+def expand_file(path: Path, errors: list[str]) -> str:
+    text = path.read_text(encoding="utf-8")
+
+    def repl(m: re.Match) -> str:
+        target = (path.parent / m.group(1)).resolve()
+        if not target.is_file():
+            errors.append(f"{path}: include not found: {m.group(1)}")
+            return m.group(0)
+        return target.read_text(encoding="utf-8").rstrip("\n")
+
+    return MARKER.sub(repl, text)
+
+
+def main() -> int:
+    root = Path(sys.argv[1])
+    errors: list[str] = []
+    for f in sorted(root.rglob("*.md")):
+        if "include:" not in f.read_text(encoding="utf-8"):
+            continue
+        new = expand_file(f, errors)
+        if new != f.read_text(encoding="utf-8"):
+            f.write_text(new, encoding="utf-8")
+    for e in errors:
+        print(e, file=sys.stderr)
+    return 1 if errors else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/scripts/install-lib.sh

@@ -100,13 +100,27 @@ dr_verify_checksum() {
   [ "$_dr_got" = "$_dr_want" ]
 }
 
+# Runs a command for at most $1 seconds with output discarded; a timeout is a failure.
+dr_run_bounded() {
+  _dr_limit="$1"; shift
+  "$@" >/dev/null 2>&1 </dev/null &
+  _dr_job=$!
+  { trap 'kill "$_dr_nap"; exit 0' TERM; sleep "$_dr_limit" & _dr_nap=$!; wait "$_dr_nap" && kill "$_dr_job"; } >/dev/null 2>&1 </dev/null &
+  _dr_watch=$!
+  wait "$_dr_job" 2>/dev/null
+  _dr_rc=$?
+  kill "$_dr_watch" >/dev/null 2>&1
+  wait "$_dr_watch" 2>/dev/null
+  return "$_dr_rc"
+}
+
 dr_download_engine() {
   _dr_source_dir="$1"
   _dr_repo="$2"
-  _dr_out="$3"
-  dr_valid_repo "$_dr_repo" || { DR_ACQUIRE_FAILURE="repository name validation failed"; rm -f "$_dr_out" "$_dr_out.sha256"; return 1; }
+  _dr_engine_out="$3"
+  dr_valid_repo "$_dr_repo" || { DR_ACQUIRE_FAILURE="repository name validation failed"; rm -f "$_dr_engine_out" "$_dr_engine_out.sha256"; return 1; }
   _dr_tag="$(dr_release_tag "$_dr_source_dir")"
-  [ -n "$_dr_tag" ] || { DR_ACQUIRE_FAILURE="release tag validation failed"; rm -f "$_dr_out" "$_dr_out.sha256"; return 1; }
+  [ -n "$_dr_tag" ] || { DR_ACQUIRE_FAILURE="release tag validation failed"; rm -f "$_dr_engine_out" "$_dr_engine_out.sha256"; return 1; }
   _dr_os="$(uname -s 2>/dev/null | tr '[:upper:]' '[:lower:]')"
   _dr_arch="$(uname -m 2>/dev/null)"
   case "$_dr_arch" in
@@ -121,10 +135,12 @@ dr_download_engine() {
 
   _dr_asset="devrites-$_dr_os-$_dr_arch"
   _dr_url="https://github.com/$_dr_repo/releases/download/$_dr_tag/$_dr_asset"
-  dr_bounded_download "$_dr_url" "$_dr_out" 67108864 || { DR_ACQUIRE_FAILURE="release $_dr_tag asset $_dr_asset: ${DR_DOWNLOAD_FAILURE:-download} failed"; return 1; }
-  dr_bounded_download "$_dr_url.sha256" "$_dr_out.sha256" 4096 || { DR_ACQUIRE_FAILURE="release $_dr_tag asset $_dr_asset.sha256: ${DR_DOWNLOAD_FAILURE:-download} failed"; rm -f "$_dr_out"; return 1; }
-  dr_verify_checksum "$_dr_out" "$_dr_out.sha256" "$_dr_asset" || { DR_ACQUIRE_FAILURE="release $_dr_tag asset $_dr_asset: checksum failed"; rm -f "$_dr_out" "$_dr_out.sha256"; return 1; }
-  chmod +x "$_dr_out" || { DR_ACQUIRE_FAILURE="release $_dr_tag asset $_dr_asset: executable preparation failed"; rm -f "$_dr_out" "$_dr_out.sha256"; return 1; }
+  dr_bounded_download "$_dr_url" "$_dr_engine_out" 67108864 || { DR_ACQUIRE_FAILURE="release $_dr_tag asset $_dr_asset: ${DR_DOWNLOAD_FAILURE:-download} failed"; return 1; }
+  dr_bounded_download "$_dr_url.sha256" "$_dr_engine_out.sha256" 4096 || { DR_ACQUIRE_FAILURE="release $_dr_tag asset $_dr_asset.sha256: ${DR_DOWNLOAD_FAILURE:-download} failed"; rm -f "$_dr_engine_out"; return 1; }
+  dr_verify_checksum "$_dr_engine_out" "$_dr_engine_out.sha256" "$_dr_asset" || { DR_ACQUIRE_FAILURE="release $_dr_tag asset $_dr_asset: checksum failed"; rm -f "$_dr_engine_out" "$_dr_engine_out.sha256"; return 1; }
+  _dr_signer="$_dr_repo/.github/workflows/ci.yml@refs/heads/main"
+  command -v gh >/dev/null 2>&1 && dr_run_bounded "${DR_ATTEST_TIMEOUT:-120}" gh attestation verify "$_dr_engine_out" --repo "$_dr_repo" --signer-workflow "$_dr_signer" || { DR_ACQUIRE_FAILURE="release $_dr_tag asset $_dr_asset: attestation verification failed (gh must be installed and authenticated)"; rm -f "$_dr_engine_out" "$_dr_engine_out.sha256"; return 1; }
+  chmod +x "$_dr_engine_out" || { DR_ACQUIRE_FAILURE="release $_dr_tag asset $_dr_asset: executable preparation failed"; rm -f "$_dr_engine_out" "$_dr_engine_out.sha256"; return 1; }
 }
 
 dr_build_engine() {
@@ -210,6 +226,25 @@ dr_acquire_engine() {
   return 1
 }
 
+# True when $1 holds every file the engine requires from a host payload: the
+# union of hostpack.RequiredPayload for all hosts plus each host's standards.
+dr_payload_complete() {
+  _dr_p="$1"
+  for _dr_rel in \
+    claude/skills claude/agents claude/workflows claude/settings.json \
+    codex/skills codex/agents codex/AGENTS.md codex/config.toml \
+    omp/skills omp/agents omp/commands omp/.omp-plugin/plugin.json \
+    pi/skills pi/agents pi/prompts pi/AGENTS.md \
+    devin/skills devin/agents devin/AGENTS.md \
+    claude/skills/devrites-lib/reference/standards/agents.md \
+    codex/skills/devrites-lib/reference/standards/agents.md \
+    omp/skills/devrites-lib/reference/standards/agents.md \
+    pi/skills/devrites-lib/reference/standards/agents.md \
+    devin/skills/devrites-lib/reference/standards/agents.md; do
+    [ -e "$_dr_p/$_dr_rel" ] || return 1
+  done
+}
+
 dr_cleanup_engine() {
   [ -z "${DR_ENGINE_TMP:-}" ] || rm -rf "$DR_ENGINE_TMP"
   DR_ENGINE_TMP=""

package/scripts/omp-generate.sh

@@ -66,6 +66,15 @@ gen_omp_skill_file() {
   gen_omp_markdown_file "$1" "$2"
 }
 
+# Strip one pair of outer double quotes from an already-quoted YAML scalar and
+# undo its \\ and \" escapes, so the generators can re-quote it exactly once.
+omp_yaml_unquote() {
+  case "$1" in
+  \"*\") local _v="${1#\"}"; printf '%s' "${_v%\"}" | sed 's/\\\(["\\]\)/\1/g' ;;
+  *) printf '%s' "$1" ;;
+  esac
+}
+
 omp_yaml_escape() {
   printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'
 }
@@ -171,6 +180,7 @@ gen_omp_agent() {
   local _name _desc _tools_raw _tools _skills _desc_tmp _desc_omp _body_tmp _body_omp
   _name="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^name:[[:space:]]*/{sub(/^name:[[:space:]]*/, ""); print; exit}' "$_src")"
   _desc="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^description:[[:space:]]*/{sub(/^description:[[:space:]]*/, ""); print; exit}' "$_src")"
+  _desc="$(omp_yaml_unquote "$_desc")"
   _tools_raw="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^tools:[[:space:]]*/{sub(/^tools:[[:space:]]*/, ""); print; exit}' "$_src")"
   # Claude `skills:` preloads map to omp `autoloadSkills` (list or inline CSV).
   _skills="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^skills:/{sk=1; sub(/^skills:[[:space:]]*/, ""); if ($0 != "") print; next} sk && /^[[:space:]]*-[[:space:]]*/{sub(/^[[:space:]]*-[[:space:]]*/, ""); print; next} {sk=0}' "$_src" | paste -sd, - | sed 's/,/, /g')"
@@ -221,6 +231,7 @@ gen_omp_command_stub() {
   local _skill_md="$1" _name="$2" _out="$3"
   local _desc _hint
   _desc="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^description:[[:space:]]*/{sub(/^description:[[:space:]]*/, ""); print; exit}' "$_skill_md")"
+  _desc="$(omp_yaml_unquote "$_desc")"
   _hint="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^argument-hint:[[:space:]]*/{sub(/^argument-hint:[[:space:]]*/, ""); print; exit}' "$_skill_md")"
   [ -n "$_desc" ] || _desc="DevRites $_name."
   mkdir -p "$(dirname "$_out")"

package/scripts/pi-generate.sh

@@ -63,6 +63,15 @@ gen_pi_skill_file() {
   gen_pi_markdown_file "$1" "$2"
 }
 
+# Strip one pair of outer double quotes from an already-quoted YAML scalar and
+# undo its \\ and \" escapes, so the generators can re-quote it exactly once.
+pi_yaml_unquote() {
+  case "$1" in
+  \"*\") local _v="${1#\"}"; printf '%s' "${_v%\"}" | sed 's/\\\(["\\]\)/\1/g' ;;
+  *) printf '%s' "$1" ;;
+  esac
+}
+
 pi_yaml_escape() {
   printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'
 }
@@ -173,6 +182,7 @@ gen_pi_agent() {
   local _name _desc _tools_raw _tools _skills _desc_tmp _desc_pi _body_tmp _body_pi
   _name="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^name:[[:space:]]*/{sub(/^name:[[:space:]]*/, ""); print; exit}' "$_src")"
   _desc="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^description:[[:space:]]*/{sub(/^description:[[:space:]]*/, ""); print; exit}' "$_src")"
+  _desc="$(pi_yaml_unquote "$_desc")"
   _tools_raw="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^tools:[[:space:]]*/{sub(/^tools:[[:space:]]*/, ""); print; exit}' "$_src")"
   _skills="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^skills:[[:space:]]*$/{list=1; next} list && /^[[:space:]]*-[[:space:]]*/{sub(/^[[:space:]]*-[[:space:]]*/, ""); print; next} list{exit}' "$_src" | tr '\n' ' ' | sed 's/ $//; s/ /, /g')"
   [ -n "$_name" ] || _name="$(basename "$_src" .md)"
@@ -208,6 +218,7 @@ gen_pi_prompt_stub() {
   local _skill_md="$1" _name="$2" _out="$3"
   local _desc _hint
   _desc="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^description:[[:space:]]*/{sub(/^description:[[:space:]]*/, ""); print; exit}' "$_skill_md")"
+  _desc="$(pi_yaml_unquote "$_desc")"
   _hint="$(awk 'NR==1 && $0=="---"{fm=1; next} fm && $0=="---"{exit} fm && /^argument-hint:[[:space:]]*/{sub(/^argument-hint:[[:space:]]*/, ""); print; exit}' "$_skill_md")"
   [ -n "$_desc" ] || _desc="DevRites $_name."
   mkdir -p "$(dirname "$_out")"
@@ -240,7 +251,7 @@ This project has DevRites installed for pi.
 - In DevRites guidance, **invoke** means run a skill inline in the current context; **dispatch** means start a fresh agent with `subagent({ agent, task })` (or `runs.run`/`runs.all` in a `workflowScript`), wait for it, and reconcile its result.
 - An asynchronous launch receipt is not a reviewer result or completion. Keep the returned native run/workflow handle and use the public management/status/completion API exposed by the installed tool schema to wait for and collect its terminal result. Reconcile that result before `devrites-engine dispatch ... return`; never re-dispatch to retrieve output. Host configuration may force asynchronous execution even with `async: false`.
 - Routine native result collection uses the exposed public tool; it does not require a bespoke workflow capture helper, private transcripts, or source excavation. Preserve confidentiality and any one-shot limits. Failed, malformed, or unavailable terminal results remain `gap`, never a passed review.
-- Only `devrites-slice-wright` may edit source or tests; every other specialist is read-only by tool allowlist. Exact paths are instruction-enforced: put the project-relative paths in the task, wait for the wright, compare its file list and `git diff --name-only` with that contract, and reject any extra path.
+- Among the lifecycle `devrites-*` specialists, only `devrites-slice-wright` may edit source or tests; every other specialist in that family is read-only by tool allowlist. The shipped profiles are the full role-to-permission map; `/rite-doctor` step 3 checks them. Exact paths are instruction-enforced: put the project-relative paths in the task, wait for the wright, compare its file list and `git diff --name-only` with that contract, and reject any extra path.
 - The explicit `/overhaul` skill ships its own `overhaul-*` agents outside the DevRites lifecycle. They carry the full write tool set, are dispatched only by that skill, and follow its own approval gate and path contracts instead of the lifecycle writer rules above.
 - The explicit `/rite-fast` skill ships its own `fast-*` agents. Only `fast-builder` carries write tools; `fast-planner`, `fast-checker`, and `fast-critic` stay read-only. `/rite-fast` dispatches them itself and applies its own exact-path contracts.
 - DevRites runtime helpers run through the installed `devrites-engine` binary.

package/update.sh

@@ -37,8 +37,7 @@ trap 'exit 1' HUP INT TERM
 dr_acquire_engine "$SELF_DIR" update "$DEVRITES_REPO" || { echo "error: could not acquire a version-compatible devrites-engine${DR_ACQUIRE_FAILURE:+ ($DR_ACQUIRE_FAILURE)}." >&2; exit 1; }
 ENGINE="$DR_ENGINE_PATH"
 PAYLOAD="${DEVRITES_HOST_ARTIFACT_DIR:-$SELF_DIR/pack/generated}"
-if [ ! -d "$PAYLOAD/claude/skills" ] || [ ! -d "$PAYLOAD/codex/skills" ] || [ ! -f "$PAYLOAD/codex/config.toml" ] ||
-  [ ! -d "$PAYLOAD/devin/skills" ] || [ ! -d "$PAYLOAD/devin/agents" ] || [ ! -f "$PAYLOAD/devin/AGENTS.md" ]; then
+if ! dr_payload_complete "$PAYLOAD"; then
   BUILDER="$SELF_DIR/scripts/build-host-artifacts.sh"
   [ -f "$BUILDER" ] || { echo "error: generated update payload missing at $PAYLOAD and builder missing at $BUILDER" >&2; exit 1; }
   DEVRITES_HOST_ARTIFACT_DIR="$PAYLOAD" bash "$BUILDER" >/dev/null || { echo "error: could not generate update payload at $PAYLOAD" >&2; exit 1; }

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/README.md

@@ -1,7 +0,0 @@
----
-slug: auth-tokens
-title: Signed auth tokens
-phase: build
----
-
-Rotate to signed, short-lived auth tokens with refresh rotation.

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/architecture.md

@@ -1,3 +0,0 @@
-# Architecture
-
-Use signed tokens.

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/assumptions.md

@@ -1,3 +0,0 @@
-# Assumptions
-
-None.

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/brief.md

@@ -1,3 +0,0 @@
-# Brief
-
-Signed auth tokens.

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/decision-coverage.md

@@ -1,3 +0,0 @@
-# Decision coverage
-
-CLEAR.

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/decisions.md

@@ -1,4 +0,0 @@
-# Decisions
-
-- HS256 over RS256 for v1 — single service, shared secret.
-- Refresh tokens stored hashed, never in plaintext.

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/eng-review.md

@@ -1,3 +0,0 @@
-# Engineering review
-
-READY.

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/gates.md

@@ -1,4 +0,0 @@
-# Gates
-
-- [x] G1: fixture outcome
-  EVIDENCE: fixture attestation

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/plan.md

@@ -1,5 +0,0 @@
-# Plan
-
-1. Token minting service.
-2. Verification middleware.
-3. Refresh rotation with a revocation list.

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/questions.md

@@ -1,3 +0,0 @@
-# Questions
-
-None.

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/spec.md

@@ -1,6 +0,0 @@
-# Spec
-
-Issue short-lived signed tokens (JWT, 15-minute TTL) with refresh rotation.
-
-- In scope: token mint, verify, refresh.
-- Out of scope: the session-management UI.

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/state.md

@@ -1,8 +0,0 @@
-- Phase: build
-- Status: running
-- Schema: 4
-
-# Status
-
-Minting and verification middleware have landed. Refresh rotation is in
-progress; the task breakdown still needs filling in.

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/tasks.md

@@ -1 +0,0 @@
-# Tasks

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/test-plan.md

@@ -1,3 +0,0 @@
-# Test plan
-
-Run token tests.

package/engine/testdata/fixtures/basic/devrites-root/work/auth-tokens/traceability.md

@@ -1,3 +0,0 @@
-# Traceability
-
-Requirements map to tasks.

package/engine/testdata/fixtures/basic/devrites-root/work/search-ranking/README.md

@@ -1,7 +0,0 @@
----
-slug: search-ranking
-title: Search ranking tweaks
-phase: spec
----
-
-Blend recency and relevance in the search ranking function.

package/engine/testdata/fixtures/basic/devrites-root/work/search-ranking/assumptions.md

@@ -1,3 +0,0 @@
-# Assumptions
-
-None.

package/engine/testdata/fixtures/basic/devrites-root/work/search-ranking/brief.md

@@ -1,3 +0,0 @@
-# Brief
-
-Search ranking.

package/engine/testdata/fixtures/basic/devrites-root/work/search-ranking/decisions.md

@@ -1,3 +0,0 @@
-# Decisions
-
-None.

package/engine/testdata/fixtures/basic/devrites-root/work/search-ranking/questions.md

@@ -1,3 +0,0 @@
-# Questions
-
-None.

package/engine/testdata/fixtures/basic/devrites-root/work/search-ranking/spec.md

@@ -1,6 +0,0 @@
-# Spec
-
-Blend recency and relevance when ordering search results.
-
-- In scope: the ranking function only.
-- Out of scope: the indexing pipeline.

package/engine/testdata/fixtures/basic/devrites-root/work/search-ranking/state.md

@@ -1,3 +0,0 @@
-- Phase: spec
-- Status: running
-- Schema: 4

package/engine/testdata/golden/TestParityCloseOut/active_pointed_elsewhere.golden

@@ -1,2 +0,0 @@
-exit 0
-state close: archived feat-y -> archive/feat-y (ACTIVE pointed elsewhere: left as-is)

package/engine/testdata/golden/TestParityCloseOut/active_slug_cleared.golden

@@ -1,2 +0,0 @@
-exit 0
-state close: archived feat-x -> archive/feat-x and cleared ACTIVE

package/engine/testdata/golden/TestParityCloseOut/archive_clobber.golden

@@ -1 +0,0 @@
-exit 5

package/engine/testdata/golden/TestParityCloseOut/missing_slug.golden

@@ -1 +0,0 @@
-exit 4

package/engine/testdata/golden/TestParityCloseOut/missing_workspace.golden

@@ -1 +0,0 @@
-exit 4

package/engine/testdata/golden/TestParityLearnings/add.golden

@@ -1,2 +0,0 @@
-exit 0
-learnings: recorded.

package/engine/testdata/golden/TestParityLearnings/list.golden

@@ -1,5 +0,0 @@
-exit 0
-# DevRites learnings ledger
-
-- [2026-01-01] (note · feat-x) prefer explicit error handling
-- [2026-01-02] (bug · feat-y) the linter false-positive recurs

package/engine/testdata/golden/TestParityLearnings/mine-no-archive.golden

@@ -1,2 +0,0 @@
-exit 0
-learnings: no archive at no-such-archive: nothing to mine.

package/engine/testdata/golden/TestParityLearnings/mine.golden

@@ -1,5 +0,0 @@
-exit 0
-learnings: repeated finding/decision phrases across archived features (count >= 2):
-   3×  recurring finding: stale cache after deploy times on
-   2×  second dead end: retry backoff exceeded attempts
-(review these: a stable recurring class is a candidate for a project rule or a ledger entry.)

package/engine/testdata/golden/TestParityLearnings/nudge.golden

@@ -1,2 +0,0 @@
-exit 0
-learnings: a pattern recurs 3x across shipped features ("recurring finding: stale cache after deploy time…"): review + maybe promote it to a rule with /rite-learn (Claude) / $rite-learn (Codex).

package/engine/testdata/golden/TestParityLearnings/unknown.golden

@@ -1 +0,0 @@
-exit 2

package/engine/testdata/golden/TestParityPackageExistence/ghost-workspace.golden

@@ -1 +0,0 @@
-exit 2

package/engine/testdata/golden/TestParityPackageExistence/no-manifest.golden

@@ -1 +0,0 @@
-exit 0

package/engine/testdata/golden/TestParityPackageExistence/not-git.golden

@@ -1 +0,0 @@
-exit 0

package/engine/testdata/golden/TestParityPackageExistence/undeclared.golden

@@ -1 +0,0 @@
-exit 3

package/engine/testdata/golden/TestParityPreamble/afk/a.golden

@@ -1,14 +0,0 @@
-exit 0
-## a
-### state.md
-- Phase: prove
-
-### artifacts present
-
-### run mode
-  AFK (sentinel present)
-    max-slices: 3
-    escalate: true
-
-### questions
-  (no questions.md yet)

package/engine/testdata/golden/TestParityPreamble/hitl/active.golden

@@ -1,18 +0,0 @@
-exit 0
-## full
-### state.md
-- Phase: build
-- Status: running
-- Next step: implement slice 3
-
-### artifacts present
-  ✓ spec.md
-  ✓ plan.md
-  ✓ tasks.md
-  ✓ questions.md
-
-### run mode
-  HITL (no sentinel)
-
-### questions
-  open: 2 blocking, 0 validating, 1 advisory, 0 escalating

package/engine/testdata/golden/TestParityPreamble/hitl/bare.golden

@@ -1,10 +0,0 @@
-exit 0
-## bare
-
-### artifacts present
-
-### run mode
-  HITL (no sentinel)
-
-### questions
-  (no questions.md yet)

package/engine/testdata/golden/TestParityPreamble/hitl/full.golden

@@ -1,18 +0,0 @@
-exit 0
-## full
-### state.md
-- Phase: build
-- Status: running
-- Next step: implement slice 3
-
-### artifacts present
-  ✓ spec.md
-  ✓ plan.md
-  ✓ tasks.md
-  ✓ questions.md
-
-### run mode
-  HITL (no sentinel)
-
-### questions
-  open: 2 blocking, 0 validating, 1 advisory, 0 escalating

package/engine/testdata/golden/TestParityPreamble/hitl/ghost.golden

@@ -1,2 +0,0 @@
-exit 0
-No active workspace. Run /rite-spec (Claude) / $rite-spec (Codex) <feature> to start.

package/engine/testdata/golden/TestParityPreamble/hitl/nonl.golden

@@ -1,11 +0,0 @@
-exit 0
-## nonl
-### state.md
-- Phase: spec
-### artifacts present
-
-### run mode
-  HITL (no sentinel)
-
-### questions
-  (no questions.md yet)

package/engine/testdata/golden/TestParityPreamble/hitl/openend.golden

@@ -1,13 +0,0 @@
-exit 0
-## openend
-### state.md
-- Phase: spec
-
-### artifacts present
-  ✓ questions.md
-
-### run mode
-  HITL (no sentinel)
-
-### questions
-  open: 0 blocking, 0 validating, 0 advisory, 1 escalating

package/engine/testdata/golden/TestParityProgress/arg=allbuilt.golden

@@ -1,4 +0,0 @@
-exit 0
-── rite-build ─────────
-Slices 2/2  ██████████  ✅ ALL BUILT
-Flow   spec ✓ clarify ✓ define ✓ plan ✓ build ◉ prove ○ polish ○ review ○ seal ○ ship ○

package/engine/testdata/golden/TestParityProgress/arg=done.golden

@@ -1,3 +0,0 @@
-exit 0
-── rite-done ─────────
-Flow   spec ✓ clarify ✓ define ✓ plan ✓ build ✓ prove ✓ polish ✓ review ✓ seal ✓ ship ✓

package/engine/testdata/golden/TestParityProgress/arg=ghost.golden

@@ -1 +0,0 @@
-exit 0

package/engine/testdata/golden/TestParityProgress/arg=mid.golden

@@ -1,4 +0,0 @@
-exit 0
-── rite-build ─────────
-Slice 2/3  ███████░░░  detail ✓
-Flow   spec ✓ clarify ✓ temper ✓ define ✓ plan ✓ vet ✓ build ◉ prove ○ polish ○ review ○ seal ○ ship ○

package/engine/testdata/golden/TestParityProgress/arg=nophase.golden

@@ -1,3 +0,0 @@
-exit 0
-── rite-spec ─────────
-Flow   spec ◉ clarify ○ define ○ plan ○ build ○ prove ○ polish ○ review ○ seal ○ ship ○