devrites 5.5.0 → 5.6.0

package/pack/generated/pi/skills/rite-build/reference/checkpoint.md

@@ -0,0 +1,44 @@
+# Checkpoint: proven slices land as local WIP commits
+
+A slice's source never stays uncommitted after its gates are green: at RECORD
+the orchestrator commits the proven slice as a local `WIP`, so the working
+tree stays clean and the work survives a crash or compaction.
+
+## The checkpoint commit: orchestrator, at RECORD, after gates are green
+A checkpoint records a **proven** slice only after its gates are green. Stage the exact
+slice-owned candidate paths from the manifest, passing each literal path separately.
+Never stage `touched-files.md`, a directory, glob, unrelated path, or user change.
+Verify the staged set, then commit locally with a `[devrites-context]` body:
+
+```bash
+git commit -m "WIP(<slug>): <slice>" -m "$(cat <<'BODY'
+[devrites-context]
+decisions: <one-line delta this slice added to decisions.md>
+remaining: <pending slices — count or names>
+dead-ends: <approaches ruled out this slice, if any>
+BODY
+)"
+```
+
+When host reconciliation already landed the isolated transfer commit, nothing
+is staged and the step no-ops. **Local-only:** never push a checkpoint or let
+scratch work trigger CI.
+
+## Restore
+After a crash, a fresh session may read the last `WIP(<slug>)` body as crash context.
+Authoritative state remains in `.devrites/`: validate the body against that workspace;
+never reconstruct or advance state from the commit body. Reload per
+[`context-hygiene.md`](../../devrites-lib/reference/standards/context-hygiene.md)
+(`.devrites/ACTIVE`, `state.md`, `questions.md`, `decisions.md`, `test-plan.md`/`evidence.md`).
+
+## Collapse at ship
+WIP commits are scratch and never reach shared history. `/rite-ship` folds them into the
+one atomic feature commit before the Conventional-Commit ladder: see the collapse step in
+[git-ship.md](../../rite-ship/reference/git-ship.md). Result: one clean commit, bisect
+stays green.
+
+## Autocomplete
+Checkpoints are unconditional; `/rite-autocomplete` needs no sentinel arming.
+Each wright returns after one slice; HITL stops, while explicit `.devrites/AFK`
+lets the controlling Build root chain another green slice only under its cap
+and pause rules.

package/pack/generated/pi/skills/rite-build/reference/frontend-trigger.md

@@ -0,0 +1,39 @@
+# Frontend trigger
+
+A slice is **frontend/UI** if it touches or plans to touch any of:
+
+- React / TSX / JSX; Vue, Svelte, Astro, Angular;
+- Rails Slim / Haml / ERB views; any server-rendered template;
+- CSS, SCSS, Tailwind, design tokens, theme files;
+- components, forms, layout, navigation, dashboard, landing/marketing page;
+- UI copy, empty states, error states, onboarding, settings;
+- screenshots, mockups, visual direction;
+- browser behavior, responsive behavior, accessibility, frontend performance.
+
+## When triggered
+- `/rite-spec` applies **`devrites-ux-shape`** (spec step 3a) to write the feature-level
+  **`design-brief.md`** before any code: design direction, key states, interaction model,
+  optional Figma/image visual-direction probe.
+- `/rite-build` applies **`devrites-frontend-craft`** to the vetted `design-brief.md`
+  (register, system, states, anti-AI-slop). If missing or materially changed, shape it
+  and return through `/rite-vet` before code.
+- `/rite-prove` applies **`devrites-browser-proof`** (proof ladder + evidence schema).
+- `/rite-polish` runs the full **normalize + polish** workflow.
+- `/rite-review` and `/rite-seal` include frontend UX / a11y / responsive / design-
+  system checks.
+
+## Fullstack (UI slice that also needs backend)
+If the slice spans both layers, it's both a frontend **and** a backend slice. Define the
+**API/data contract first** (`devrites-api-interface`), build it as one **vertical slice**
+(DB → service → API → UI), apply the engineering rules to the backend and
+`devrites-frontend-craft` to the UI, map each contract error to a real UI state, and
+**prove both layers** (contract tests + browser proof). See
+`devrites-frontend-craft/reference/fullstack.md`.
+
+## When NOT triggered
+Pure backend/data/CLI/infra slices skip craft and browser proof, but still get tests
+and evidence. If unsure whether a slice is "UI enough", treat copy/empty/error states
+and any rendered output as UI.
+
+Mark `Frontend craft required: yes/no` and `Browser proof required: yes/no` on the
+slice in `tasks.md` so the trigger is explicit, not rediscovered each cycle.

package/pack/generated/pi/skills/rite-build/reference/one-slice-cycle.md

@@ -0,0 +1,50 @@
+# One-slice cycle
+
+One wright dispatch builds one thin, proven slice. HITL stops; only explicit
+`.devrites/AFK` lets the controlling root chain another pending slice under the
+green-proof, cap, and pause rules. Each wright returns after exactly one slice.
+This serial cycle is the default `/rite-build`. Opt-in fan-out: [`parallel-batch.md`](parallel-batch.md) (`--parallel N`).
+
+## The cycle
+
+The orchestrator (`/rite-build`) gates and records; the **wright** writes. See
+[`wright-dispatch.md`](wright-dispatch.md).
+
+```text
+SELECT    → orchestrator: restate slice goal + acceptance + scope boundary; HITL gate (pause pre-code)
+(SHAPE)   → orchestrator: missing UI design-brief.md → shape it, then /rite-vet before dispatch
+DISPATCH  → hand the slice contract to devrites-slice-wright (fresh context). Inside the wright:
+   ORIENT    → load only the files this slice touches; learn the project's idiom; reuse-first
+   (RED)     → if behavior change: write the failing test first
+   IMPLEMENT → smallest complete version; match conventions; devrites-frontend-craft for UI
+   VERIFY    → writer-safe tests/types/lint; return code + tests
+(DOUBT)   → orchestrator, on return: devrites-doubt each non-trivial decision the wright stood up
+            — dispatch the initial read-only reviews of distinct decisions in parallel
+            (independent claims, fresh contexts); wright fixes stay serial — writers share files
+PROVE     → root: required build/browser/E2E, then returned-diff/path review; fail-on-red
+RECORD    → orchestrator: after green verification, update state.md/evidence.md and
+            upsert the authoritative candidate manifest from the actual scoped diff
+(CHECKPOINT) → orchestrator: commit the proven slice local-only as WIP(<slug>)
+            with a [devrites-context] body → clean tree, survives a crash (checkpoint.md)
+NEXT      → HITL root reports and stops; AFK root may repeat only under afk-discipline.md
+```
+
+## Why the boundary matters
+
+Reviewable diffs, early drift signal, HITL decision point, no unproven pile-ups.
+
+## Restate the scope boundary
+
+Before coding, write what this slice will and will **not** touch. This is the contract
+you check yourself against: anything outside it is scope creep or a drift event.
+
+## When the slice can't be completed cleanly
+
+- Discovered the plan is wrong → **Spec Drift Guard** (record, classify;
+  sweep every remaining contract assumption, then one folded repair+vet inline;
+  ask only for product/policy/irreversible-risk).
+- Slice is bigger than one cycle → `/rite-plan reslice` inline when AC is
+  preserved; do not emit a human Fix.
+- Blocked on a failing dependency → record in `state.md`, `/rite-plan unblock`
+  inline when the reroute is technical.
+Never power through by guessing.

package/pack/generated/pi/skills/rite-build/reference/output.md

@@ -0,0 +1,33 @@
+# rite-build output
+
+**Slices remain:**
+
+```text
+Done: built slice <n> — <name>.
+Changed: <files>; state.md, touched-files.md, evidence.md
+Evidence: acceptance met; tests <cmd> → pass; browser <summary|n/a>; drift <none|handled>
+Open: <none|blockers|questions>
+Next: /rite-build
+Record: .devrites/work/<slug>/evidence.md
+↻ Hygiene: /clear between slices; /rite-handoff if away > a few hours
+```
+
+**All built:**
+
+```text
+Done: built slice <n> — <name>; all slices built.
+Changed: <files>; state.md, touched-files.md, evidence.md
+Evidence: acceptance met; tests <cmd> → pass; browser <summary|n/a>; drift <none|handled>
+Open: <none|blockers|questions>
+Next: /rite-prove
+Record: .devrites/work/<slug>/evidence.md
+↻ Hygiene: /clear before /rite-prove; /rite-handoff if away > a few hours
+```
+
+HITL returns after one green slice. Only explicit `.devrites/AFK` lets the
+controlling root chain another pending slice after green-proof, cap, and pause
+gates. Every `devrites-slice-wright` returns after exactly one slice.
+
+At all built, Build never enters `/rite-prove` automatically; a higher-level
+orchestrator may invoke it only under its own contract. Awaiting-human or
+stopped states use the shared reply contract.

package/pack/generated/pi/skills/rite-build/reference/parallel-batch.md

@@ -0,0 +1,205 @@
+# Parallel batch (`--parallel N`)
+
+Opt-in only. Default `/rite-build` stays [`one-slice-cycle.md`](one-slice-cycle.md).
+
+## Entry
+
+| Input | Behavior |
+| --- | --- |
+| omitted / `--parallel 1` | Serial one-slice |
+| `--parallel N` (**2≤N≤10**) | N is a **cap**, not a quota: run the largest eligible set ≤ N |
+| non-integer / `N≤0` / `N>10` | Hard refuse (no silent clamp) |
+| Autocomplete, no flag | Same path, cap from sentinel `max_parallel` else 10; serial only when ineligible |
+
+AFK caps `N`. Charge green siblings once after integrate; abort /
+integrate-failed → **0**. `parallel create` refuses while a lease exists.
+Reconcile retained repair-round artifacts by exact causal fingerprint before honoring a stored blocked status/verdict. Blocked status, round count, or distinct finding alone cannot stop cold resume: establish missing or stale review coverage under step 4; repair unless a stop condition remains evidenced.
+
+## Dynamic selection and re-batching
+
+Size each batch by what is runnable **now**, never by the requested number:
+
+```text
+N_eff = min(
+  cap                  -- --parallel N | sentinel max_parallel | 10 (autocomplete default)
+  eligible set         -- dependency-satisfied pending slices, pairwise path-disjoint
+  AFK headroom         -- remaining max_slices, max_agents, max_minutes, review queue
+  host capacity        -- concurrent worktree writers + the runtime isolation table
+)
+```
+
+Select **greedily in plan order**: walk pending slices whose `depends_on` are built and
+add each one while it stays pairwise disjoint with the selected set and the cap is not
+reached. Then `N_eff ≥ 2` → parallel batch; `N_eff = 1` → the serial one-slice cycle;
+nothing pending → Prove. A cap that cannot be filled is normal: take fewer.
+
+**Re-batch automatically.** After integrate + cleanup are green, re-read `state.md`,
+the pending slices (`observe slice`), and the updated tree, then recompute: integrated
+siblings leave the pending set and free their paths, and satisfied dependencies unlock
+new slices. Repeat until no pending slice remains. Under `.devrites/AFK` and
+`/rite-autocomplete` the repeat is part of the same run — a new batch is another
+`/rite-build --parallel` round inside it, not a new user invocation; HITL stops after
+each batch. A batch of three followed by one of four and then two is the expected shape.
+
+## Path-disjoint
+
+Exact project-relative source/test paths only. Normalize `\`→`/`. Reject `..`,
+duplicates, absolutes, `.devrites/**`. Empty pairwise intersection required.
+
+**SSOT:** `devrites-engine check path-disjoint [--root <dir>] [<json-file>|-]`
+(N≥2 only; pass `--root`). Input is `{"slices":[{"id":"SLICE-002","paths":["src/policy.rs","src/policy/mod.rs"]}]}`
+(or a top-level array) built from each candidate's `Files likely touched`.
+Exit `0` → fan-out; else force serial. Inspect-time
+overlap → sibling **gap** (a shared path is a contract defect). **Failing
+case:** two parallel wrights share a path and fan-out proceeds without that
+check.
+
+## Control vs workers
+
+Control owns `.devrites/work/<slug>/` (lease + bookkeeping).
+Workers: `.scratch/parallel-wt/<batch>/<slice>/` on
+`devrites/parallel/<slug>/<batch>/<slice>` @ base `B`. Wrights never write
+`.devrites/**`.
+
+Lease: `batch_id`, `created_at`, `base_sha`, `n`,
+`status` (`running|aborted|integrate-failed|complete`), `control_pid_or_session`,
+`slices[]` (`id`, `paths`, `worktree_path`, `branch`, `wright_status`,
+`transfer_commit`).
+
+## Lifecycle
+
+1. Orient/gate; parse the cap; compute `N_eff` and select the eligible set
+   ([Dynamic selection and re-batching](#dynamic-selection-and-re-batching)) —
+   candidates from `orient` `task_graph.slices` + built list, each candidate's
+   `Files likely touched` via `observe slice`, disjointness via `check path-disjoint`.
+2. Write lease; freeze `B=HEAD`; `parallel create` worktrees.
+3. Dispatch ≤10 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`).
+4. Inspect each returned path list, cumulative diff from `B`, transfer identity,
+   and required result fields against the immutable contract. Reject malformed,
+   stale, or out-of-scope work. Apply
+   [independent Build review](phase-contract.md#independent-build-review): first
+   full inventory, then bounded owning-role rechecks after repairs. Gap or
+   Critical/Important → `gap`; else approved proof → `green|red|gap`.
+   Reviewer fan-out for a batch is itself batched under
+   [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md#scale-limits)
+   (≈4 concurrent read-only reviewers, 8 only with disjoint paths), and `max_agents`
+   headroom bounds the batch size — one batch never assumes unbounded reviewers.
+5. Non-green siblings → **repair round** (below) in the same worktrees; lease
+   stays `running` — no abort while repair budget remains. A green sibling →
+   `parallel record-green`. No partial integrate. All green → integrate.
+   A recoverable RED blocks integration but does not cancel independent safe running siblings.
+   Expected test-first RED is not a terminal gate failure. Cancel only for a shared
+   invalid foundation, safety/access failure, resource boundary, or explicit stop;
+   preserve completed and in-progress recoverable work and classify each result.
+6. Integrate: each `transfer_commit` descends from `B` and diffs path-exact vs
+   `B`; squash-apply all in plan order into one `WIP(<slug>):` commit on the
+   staging branch (Ship collapses it). Conflict → reset to `B`,
+   `integrate-failed`; classify under repair rounds (siblings stay in place).
+7. Success: FF control to the squash commit — the batch lands as one local
+   commit, never pushed; union `touched-files.md`; update state/evidence;
+   AFK +1 per integrated sibling; optional `check candidate`.
+8. Cleanup runs only after `integrate` marks the lease `complete` — work
+   landed in control, so `parallel cleanup` removes worktrees/branches.
+   Blocked/human-stopped batches keep lease, worktrees, branches — nothing is
+   removed while the batch may resume. `parallel abort` + `cleanup --force`
+   abandons the batch — the explicit human discard path; the single
+   orchestrator-emitted use is the automatic re-batch under Repair rounds,
+   where it acts as the salvage step only (uncommitted allowlisted changes →
+   slice-branch commit; branches past `B` kept; a failed salvage keeps the
+   worktree) and prints retained refs for the record. `abort` marks the lease
+   only — never rewinds control: a moved HEAD is external work, reported not
+   reset. Never integrate a rejected transfer commit.
+
+## Repair rounds
+
+Repair rejected work in place; never discard/rebuild while budget remains.
+
+- Record each round as `build-parallel-<batch>-repair-<round>.json`: each
+  non-green sibling's status, verbatim findings, transfer_commit/null.
+- Use step 4's initial inventory or affected recheck as appropriate; never start
+  a correction from an early reviewer result while required accounts are pending.
+- Classify the complete inventory: **implementation defect** (review
+  Critical/Important on the diff, red wright/proof) → one repair-all wright in
+  the same worktree with the full inventory. **Durable-plan defect**
+  (falsified contract assumption, AC unchanged) →
+  [`spec-drift-guard.md`](spec-drift-guard.md): batch-sweep contract
+  assumptions, one folded `/rite-plan repair` + one `/rite-vet` recheck
+  inline, resume repair in the same worktrees under the amended contract;
+  never emit `Fix:`. **Frozen-lease scope defect** (correction needs
+  out-of-allowlist paths or re-slicing; lease allowlists are immutable) →
+  **automatic re-batch, no human gate**: `parallel cleanup --force` salvages
+  and records refs; `parallel create` starts from control `HEAD` under the
+  corrected decomposition. Give each new wright its salvaged
+  `devrites/parallel/<slug>/<old-batch>/<slice>` ref. If the inventory proves the accepted
+  approach unsound and no corrected decomposition exists, that is exhaustion
+  → blocked, preserve, STOP. **Reviewer stall/cancel or missing
+  verdict** → re-dispatch the reviewer, not the wright. **Product/policy/
+  irreversible** → stops for the human.
+- Dispatch one fresh repair-all `devrites-slice-wright` (cwd=worktree; step 3
+  rules) with the original contract + complete inventory +
+  "preserve what works; fix every finding; **then attack your own correction** —
+  probe the changed hunks for defects the fix itself introduced (adjacent cases of
+  the same rule, new observation/ordering windows, alias or boundary escapes) and
+  fold them in before returning; return a new `transfer_commit`". A correction whose
+  own diff is unexamined is not ready: a green writer gate plus an unexamined fix is
+  how the same defect family reappears one case deeper each round. Never reset
+  to `B` — that destroys the work under repair. The commit must still descend
+  from `B` and diff path-exact vs `B`.
+- Budget and exhaustion follow only
+  [the canonical retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve).
+  Record one failed invariant, mechanism, reproduction, correction, and decisive
+  recheck per fingerprint; never use an umbrella like "covering" or "review is red again".
+- A distinct post-repair Critical/Important gets a new fingerprint: refresh the
+  inventory and affected owning-role rechecks. It proves neither plan defect nor
+  exhaustion. Use plan path only if inventory proves the approach unsound.
+- Stop under the canonical retry/authority/resource conditions, or when evidence
+  proves the approach unsound and no in-scope corrected decomposition exists.
+- Exhaustion is not abort: record one technical blocker (`Status: blocked`;
+  `Next step: none — technical recovery exhausted; requires new evidence or changed failure conditions`), preserve
+  lease/worktrees/branches, STOP — same fingerprint stays blocked on
+  reinvoke; new evidence resumes repair in place. Human-owned decisions use
+  the drift-guard question and wait.
+
+## Engine verbs
+
+```text
+devrites-engine parallel create --root <repo> --slug <slug> --batch <id> --base <B> --json <file>|-
+devrites-engine parallel record-green --root <repo> --slug <slug> --slice <id> --commit <sha>
+devrites-engine parallel integrate --root <repo> --slug <slug> --apply-to-control
+devrites-engine parallel status --root <repo> --slug <slug>
+devrites-engine parallel lease-write|lease-read|lease-clear --root <repo> --slug <slug>
+# abandoning the batch is human discard only; a frozen-lease re-batch may emit
+# cleanup --force as its salvage step (see Repair rounds):
+#   parallel abort --root <repo> --slug <slug>
+#   parallel cleanup --root <repo> --slug <slug> --force   (salvages, prints retained refs)
+```
+
+`integrate` without `--apply-to-control` stages the squash commit, leaves the
+lease `running` and control at `B`; cleanup still refuses — the commit cannot
+be lost. `record-green` and `integrate` also accept an `integrate-failed`
+lease, so a failed integrate retries after repair. `--apply-to-control`
+refuses when control moved past `B` or holds uncommitted changes on slice
+paths — commit/stash and retry; the batch is untouched. Go is SSOT; never
+ad-hoc git/bash orchestration.
+
+## Runtime isolation
+
+Each parallel worktree must own isolated runtime resources. Before fan-out,
+assign per-slice env (document in the lease or worktree README):
+
+| Resource | Pattern |
+| --- | --- |
+| HTTP port | `PORT=<base+N>` or `DEVRITES_PARALLEL_PORT_<slice>` |
+| Compose | `COMPOSE_PROJECT_NAME=devrites-<slug>-<batch>-<slice>` |
+| SQLite/DB file | separate path under the worktree or `/tmp` |
+| Dev server | one process per worktree; never share a listener |
+
+Reusing the control worktree's running server, DB, or compose stack across
+siblings causes cross-slice pollution and flaky proof. Force serial if
+isolation cannot be established.
+
+## Host
+
+pi: N concurrent `subagent` wrights (`acceptEdits`, cwd=worktree). Codex: require
+host-explicit concurrent worktree writers + native reconcile; else force serial.
+Never two writers in one worktree; never root-emulated concurrency.

package/pack/generated/pi/skills/rite-build/reference/phase-contract.md

@@ -0,0 +1,87 @@
+# rite-build phase contract
+
+Apply [`one-slice-cycle.md`](one-slice-cycle.md) and
+[`candidate-integrity.md`](../../devrites-lib/reference/candidate-integrity.md).
+Opt-in `--parallel N` replaces steps 2–8 with [`parallel-batch.md`](parallel-batch.md);
+Spec Drift Guard still applies.
+
+1. **Gate.** Read core, `.devrites/ACTIVE`, then `devrites-engine orient <slug>`
+   and the Build read-next in
+   [`workspace-artifact-schema.md`](../../devrites-lib/reference/workspace-artifact-schema.md#read-next-by-phase):
+   the selected slice via `devrites-engine observe slice <slug> <SLICE-ID>`, not whole
+   `tasks.md`; over-budget or `bulk_files` artifacts are read by anchor only. Require
+   `Implementation readiness: READY`, current `Readiness inputs SHA-256`, exact
+   required accounts, ID/meaning traceability and green proof preflight.
+   Run `devrites-engine check readiness <slug>`; any miss/nonzero blocks.
+2. **Select.** Pick the lowest pending slice whose `depends_on` are all built, using
+   `orient` `task_graph.slices` plus the `state.md` built list — never by scanning
+   `tasks.md`; then `observe slice` it. Restate its goal, ACs, exclusions and exact paths. Include
+   applicable topology/data/integration invariants and failure/recovery/proof cases.
+   Verify relevant assumptions live; falsified acceptance/architecture/scope/proof
+   routes through Spec Drift Guard. Resolve human-owned/irreversible gates before
+   source work; AFK follows its ceiling. Vet-ready Workflow Artifacts use
+   [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md).
+3. **Dispatch.** Apply [`wright-dispatch.md`](wright-dispatch.md). Put the smallest
+   exact project-relative source/test path list directly in the task;
+   dispatch the exact `devrites-slice-wright` fresh. Root never writes product
+   paths; wright cannot widen scope; missing profile blocks.
+<!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"Build gate enters or resumes transaction","action":"invoke canonical operation table; reconcile exact result","return":"same slice/checkpoint cursor or Plan/Vet route"} -->
+4. **Inspect.** Wait; compare returned paths and `git diff --name-only` with the
+   contract. Reject stale/partial/malformed/out-of-scope work; preserve user work.
+   Restoration uses the bounded wright.
+5. **Review.** Apply [Independent Build review](#independent-build-review).
+   Missing verdicts, principle breaches and open Critical/Important block acceptance.
+6. **Prove.** Against the frozen pre-slice candidate inspect
+   test hunks for deletion, skipping/focus, tautology, or weaker expectations.
+   Use step 5's exact test-analyst account; missing/adverse criterion verdict is
+   Critical. Run only `test-plan.md` repository/CI commands, record output, recheck
+   `git diff --name-only`. Missing/weakened/red/source-mutating proof cannot pass.
+   Pre-existing/environment-specific claims need a predating same-command,
+   same-environment baseline; otherwise unresolved.
+
+   Technical failure uses `devrites-debug-recovery` and
+   [canonical recovery](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve).
+   Reapply host admission before correction; affected proof/evidence follows candidate
+   integrity. Human gates remain product/irreversible/access decisions.
+7. **Record green.** Upsert actual scoped `present`/`deleted` rows in `touched-files.md`;
+   update state, evidence and applicable UI/browser proof. Manifest stays mutable
+   until Polish. For a release milestone, after the last slice's rows run
+   `devrites-engine state merge-manifest <slug>` to fold the recorded
+   predecessor chain into the union manifest before Prove. Record stood
+   decisions/dead ends; refresh verified/falsified
+   assumptions. Propose reviewed durable project rules in the nearest guidance.
+8. **Account/reply.** Apply `afk-discipline.md`: charge
+   exactly once after each green built slice; never negative, stop at zero,
+   malformed budget fails closed. Reply names next pending slice or `/rite-prove`
+   only when all built; no decorative renderer/dispatch telemetry.
+
+One contract builds one slice: preserve TDD, exact paths and independent judgment.
+
+## Independent Build review
+
+After inspection, freeze full slice scope and cumulative baseline diff. Initial
+inventory: one full-diff `devrites-code-reviewer`, one `devrites-test-analyst`,
+and one exact `devrites-doubt-reviewer` per stood decision that meets
+`devrites-doubt` § When to use (boundary, data model, auth, public API, migration,
+user flow, assumption tests cannot prove); other stood decisions are recorded in
+`decisions.md` without dispatch. Dispatch fresh,
+read-only under [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md).
+Wait for every required account to become terminal; missing/gap needs a valid result.
+Fold supported in-scope Critical/Important findings by cause into one inventory.
+Dispatch one repair-all wright instructed to fix every finding, then attack its own
+correction for fix-introduced defects before returning; durable contract defects use Spec
+Drift Guard.
+Suggestion/Nit/FYI cannot prolong recovery.
+
+Rechecks use Vet's bounded pattern: each exact responsible reviewer checks
+all open findings owned by that role and affected dependency/regression closure
+in one fresh dispatch. Supply new candidate, inventory, correction diff, tests
+and unchanged-coverage evidence under candidate integrity; include newly triggered
+roles. A changed contract or uncertain impact requires the full inventory.
+Collect all required rechecks before another folded correction. Canonical recovery
+owns fingerprints/budget and the
+[late-finding rule](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve):
+a recheck's `Late:` rows on hunks unchanged since that role's previous pass go to
+`touched-files.md` `## Review trail` for `/rite-review`, not into another slice
+repair, unless Critical with a failure path. Evidenced scope coverage never
+guarantees no later defect; the feature-level Review and Seal gates still run.

package/pack/generated/pi/skills/rite-build/reference/spec-drift-guard.md

@@ -0,0 +1,84 @@
+# Spec Drift Guard (build phase)
+
+Canonical Spec Drift Guard, active in `/rite-build` and referenced by other
+phases. Never silently code against a known-wrong plan.
+
+## Drift has occurred when
+- the spec says X but the code makes X impossible/wrong;
+- the plan assumes a file/API/component/route/model/command that doesn't exist;
+- tests show the acceptance criteria are incomplete or wrong;
+- browser evidence shows the intended UX doesn't work as described;
+- an official doc contradicts the planned approach;
+- the design system / existing UX pattern contradicts the planned UI;
+- a missing user decision that affects product behavior surfaces.
+
+## Workflow
+```
+1. STOP coding.
+2. Record drift.md (assumed vs observed, when).
+3. Classify: requirement ambiguity | implementation-plan error | codebase reality
+   mismatch | design-system mismatch | test/evidence mismatch | external-doc mismatch
+   | user-decision required.
+4. Local repair that preserves behavior/scope/architecture/data/UX/security/migration?
+     YES, active-slice technical/tool failure → log it and use Build's bounded debug
+       recovery. Do not ask for retry authorization and do not re-plan unless the
+       durable remaining-work instructions are wrong.
+     YES, durable plan is wrong → run the batch sweep below, log every
+       violation, save the caller's return cursor, then invoke `/rite-plan repair` and `/rite-vet` inline
+       without a question — ONE folded repair for all open entries, ONE
+       recheck for every open fingerprint — and resume.
+     NO, product/policy/irreversible-risk decision → ask the user (format below).
+5. Never continue on a known-wrong durable plan. A repaired active-slice implementation
+   may continue only after bounded recovery, returned-diff review, and proof gates pass.
+```
+
+## Batch sweep (before repair)
+
+Repair durable-plan drift as a folded set:
+
+1. Trace the falsified assumption's full dependency/consumer closure and affected
+   frontier, including dependent future slices. Verify unchecked paths, symbols/APIs/
+   signatures, routes, commands, versions, and artifacts there against live source.
+   Reuse the wright inventory and unchanged evidence; deterministic existence checks
+   need no dispatch. Do not rescan unrelated slices. Broaden unknown closure or shared
+   contract changes until coverage is justified; retain every known gap.
+2. Record each violation as its own `drift.md` entry/fingerprint; one folded
+   repair + one batched recheck resolves the set.
+3. A recheck-surfaced gap is a new fingerprint with its own budget — loop
+   internally, never hand an intermediate command to the human. When
+   consecutive folded repairs keep landing on the same clause set, the
+   repair packet's `convergence_pressure` marking applies (see `/rite-plan`
+   repair): bounded declared residuals may close refinements of
+   already-pinned clauses; a newly surfaced failure mode is never
+   residual-eligible. A suspect seam's declare-limitation-or-continue choice
+   routes to `/rite-clarify` like any human-owned gate — it is not an
+   intermediate command.
+4. Nothing skips or defers silently: every entry ends resolved, human-escalated,
+   or fingerprint-exhausted. Execution-only gaps (tests, UX, evidence) get the
+   identical path when they surface.
+
+## User question format
+```
+I hit spec drift:
+- Spec/plan assumed: ...
+- Code/evidence shows: ...
+- Why it matters: ...
+
+Which direction should DevRites take?
+1. Keep the requirement, change architecture by ...
+2. Adjust the requirement to match existing behavior ...
+3. Split into a follow-up feature ...
+4. Custom: describe the intended behavior
+```
+
+Never turn an objective defect, environment repair, tool bug, or proof rerun into a
+human permission question. Re-plan only when the durable plan changed.
+
+## Inline return contract
+
+The detecting phase owns backtracking and the batch sweep. Save
+`return_phase`/`return_next_action`; consume nested Plan/Vet `STOP` internally, complete
+vetted acceptance-preserving remediation, then restore the cursor and failed step.
+Never hand the human an intermediate command. The shared three-attempt causal-fingerprint
+cap still applies: exhaustion produces one technical blocker, while a genuinely
+human-owned decision uses the question format below.

package/pack/generated/pi/skills/rite-build/reference/tdd.md

@@ -0,0 +1,27 @@
+# TDD / Prove-It pattern
+
+When a slice changes behavior, prove the change with a test that fails first, so you
+know the test can fail, and that your code is what makes it pass.
+
+## Red → Green → Refactor
+1. **Red:** write the smallest test that expresses the new behavior. Run it; watch it
+   fail for the *expected* reason (not a typo/import error).
+2. **Green:** write the minimum code to pass. Resist gold-plating.
+3. **Refactor:** clean up with the test as a safety net. Re-run; stay green.
+
+## Prove-It (when strict TDD doesn't fit)
+For code where a test-first flow is awkward (exploratory glue, config, some UI), still
+produce evidence:
+- Capture the current (wrong/absent) behavior: a failing assertion, a screenshot, a
+  log line.
+- Make the change.
+- Capture the new behavior the same way. The before/after pair *is* the proof.
+
+## Rules
+- Use the project's existing test framework and commands (per the discovery contract
+  `rite-prove/reference/test-command-discovery.md`). Don't introduce a new test runner
+  to prove a slice.
+- One behavior per test; name it for the behavior, not the function.
+- A green test you never saw fail proves nothing: always see red first.
+- Don't delete or weaken a failing test to "pass". If it's wrong, that may be drift.
+- Record the test command + result in `evidence.md`.