npm - devrites - Versions diffs - 5.5.0 → 5.6.0 - Mend

devrites 5.5.0 → 5.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (281) hide show

package/pack/generated/pi/skills/rite-review/reference/performance-checklist.md ADDED Viewed

@@ -0,0 +1,80 @@
+# Performance checklist (baseline for the perf reviewer)
+The minimum baseline `devrites-performance-reviewer` checks against, in feature scope. It
+is a checklist, not a mandate: flag what the diff touches or what a measurement
+flags, never a project-wide sweep. The philosophy lives in
+[`standards/performance.md`](../../devrites-lib/reference/standards/performance.md) (measure first). This file is the
+concrete what-to-look-for.
+## Core Web Vitals targets
+| Metric | Good | Needs work | Poor |
+|---|---|---|---|
+| LCP: Largest Contentful Paint | ≤ 2.5s | ≤ 4.0s | > 4.0s |
+| INP: Interaction to Next Paint | ≤ 200ms | ≤ 500ms | > 500ms |
+| CLS: Cumulative Layout Shift | ≤ 0.1 | ≤ 0.25 | > 0.25 |
+A CWV value only counts when it carries a source: `Field (CrUX)`, `Lab (Lighthouse)`, or
+`Trace (DevTools)`. No source → it's a Source-mode hypothesis, not a measurement.
+## Frontend (only when the feature is UI-facing)
+Identify the framework first; apply only its idioms.
+- **Images:** modern format (WebP/AVIF); responsive `srcset`/`sizes`; explicit
+  `width`/`height` to reserve space (CLS); below-the-fold `loading="lazy"`; the LCP image
+  gets `fetchpriority="high"` and is **not** lazy-loaded.
+- **JavaScript:** initial bundle stays small (≈200KB gzipped is the usual line); code-split
+  routes and heavy features; no blocking script in `<head>` without `defer`/`async`; break
+  long tasks (>50ms) so the main thread stays free (the main INP lever); `memo`/`useMemo`/
+  `useCallback` only where profiling shows a win, not wrapped over everything.
+- **CSS:** critical CSS not render-blocking; no per-render CSS-in-JS runtime cost in prod.
+- **Fonts:** 2-3 families max; WOFF2; self-hosted where possible; preload the LCP font;
+  `font-display: swap`; subset with `unicode-range`.
+- **Rendering:** no layout thrashing (batch reads, then writes); animate `transform`/
+  `opacity` only; virtualize long lists; `content-visibility: auto` for off-screen sections;
+  don't break bfcache (no `unload` handler, no `Cache-Control: no-store` on HTML).
+## Backend (every feature, UI or not)
+- No N+1 queries; eager-load / join / batch instead.
+- New queries have the indexes they need for their filter/sort columns.
+- List endpoints paginate: never an unbounded `SELECT *`.
+- Per-request work that doesn't change per call is cached or hoisted.
+- Responses compressed (gzip/brotli); bulk operations instead of a loop of single calls.
+## Network
+- Static assets cached with a long `max-age` + content hashing.
+- Known origins `preconnect`-ed; no unnecessary redirects; HTTP/2 or HTTP/3 where available.
+## AI-codegen perf smells (fold into the area above, not a separate finding category)
+- State duplicated instead of lifted; effects with over-broad deps that re-run needlessly.
+- Sequential `await`s where `Promise.all` / parallel fetch fits.
+- Over-fetching "just in case"; redundant calls a dedup would collapse.
+- Defensive memoization wrapping cheap components: cost with no benefit.
+## Modern APIs to consider (one-liners: reach for these, don't gate on them)
+`scheduler.yield()` to keep input responsive in long loops · Speculation Rules for
+prefetch/prerender · View Transitions on SPA navigation · Long Animation Frames (LoAF) for
+production INP attribution · `fetchpriority` on critical non-image resources.
+## Measurement commands (name these in Source mode; don't run installs in review)
+```bash
+# Lighthouse (lab)
+npx lighthouse <url> --output json --output-path ./report.json
+# or via the Chrome DevTools MCP CLI, no install:
+npx -p chrome-devtools-mcp chrome-devtools lighthouse_audit --output-format=json > report.json
+# Bundle size
+npx vite-bundle-visualizer        # Vite
+npx webpack-bundle-analyzer stats.json   # webpack
+# Field data: CrUX / PageSpeed Insights (real users, p75) — needs an API key
+```
+Field is what real users experienced; lab is one synthetic run. Don't present one as the
+other.

package/pack/generated/pi/skills/rite-review/reference/performance-review.md ADDED Viewed

@@ -0,0 +1,14 @@
+# Performance review (feature-scoped)
+Apply only when a stated budget or visible regression risk makes performance relevant.
+The canonical measurement, pitfall, optimization, and scope rules live in
+[`performance.md`](../../devrites-lib/reference/standards/performance.md); apply every
+one before filing a performance finding.
+The agent runs **Source mode** (static scan, findings tagged `potential` + the verify
+command) or **Measured mode** (real CWV numbers → a source-labeled scorecard). Baseline
+checks + measurement commands: [`performance-checklist.md`](performance-checklist.md).
+## Labels
+A perf issue that breaches a stated budget is **Important** or **Critical**; a
+speculative micro-optimization is a **Suggestion** at most.

package/pack/generated/pi/skills/rite-review/reference/security-review.md ADDED Viewed

@@ -0,0 +1,42 @@
+# Security review (feature-scoped)
+Apply when the feature involves user input, auth/authz, data storage, external
+integrations, secrets, or permissions. Delegates to `devrites-audit security`.
+## OWASP-Top-10-oriented checks
+This is the **single-sourced OWASP-web checklist** both `/rite-review` and the
+`devrites-security-auditor` agent apply (trust-boundary + the OWASP **LLM** Top 10 live in
+[`standards/security.md`](../../devrites-lib/reference/standards/security.md)). Keep the enumeration here; don't restate it.
+- **Injection:** parameterized queries; no string-built SQL/shell/HTML; validate &
+  encode at boundaries.
+- **Broken access control:** every sensitive action checks authz server-side; no
+  trusting client-supplied IDs/roles/tenant; no IDOR, cross-tenant read/write/cache/search,
+  confused-deputy path, or privilege change without re-authorization.
+- **Auth / session:** secure session handling; no credentials in code/logs; correct
+  password/token handling.
+- **Sensitive data:** PII/secrets not logged or returned; encryption where required;
+  least data exposed.
+- **SSRF / external calls:** validate/allowlist outbound URLs; timeouts; don't reflect
+  untrusted input into requests.
+- **Misconfiguration:** safe defaults; debug off; CORS scoped; security headers as the
+  project uses them.
+- **Files / request integrity:** resolved paths remain below the allowed root across
+  traversal/encoding/symlink/archive cases; state-changing browser requests use the
+  framework's forgery protection; CORS is not treated as CSRF defense.
+- **Vulnerable dependencies:** new/updated deps audited; no known-vuln versions added.
+- **Integrity / deserialization:** safe non-executable parsing with type/size/depth limits;
+  untrusted data cannot instantiate executable objects.
+## Trust boundary
+Apply the three-tier discipline (untrusted → boundary → trusted) per the canonical rule
+in [`standards/security.md`](../../devrites-lib/reference/standards/security.md#trust-boundary-three-tiers). A value
+that skips the boundary tier is a finding.
+## Rules
+- Findings labeled Critical/Important/Suggestion. A real auth/data-exposure issue is
+  **Critical** → NO-GO until fixed.
+- Secrets management: never commit secrets; use the project's secret mechanism.
+- Don't expand into a project-wide security audit: feature scope. Record out-of-scope
+  risks as follow-ups.

package/pack/generated/pi/skills/rite-seal/SKILL.md ADDED Viewed

@@ -0,0 +1,75 @@
+---
+name: rite-seal
+description: Decide GO/NO-GO for an active feature; /rite-ship owns commit, push, tag, and close.
+argument-hint: "[feature-slug] [--full]"
+user-invocable: true
+---
+# /rite-seal: GO / NO-GO
+Verify final candidate in `seal.md`; `/rite-ship` owns authorized irreversible
+actions and close-out.
+## Authority
+Read [`core.md`](../devrites-lib/reference/standards/core.md) plus only
+final-diff-relevant standards: agents, code-review, testing, browser-proof-checklist,
+security, principles, documentation, observability, deprecation, and
+definition-of-done.
+Load [`final-evidence.md`](reference/final-evidence.md) and
+[`go-no-go.md`](reference/go-no-go.md) for proof and verdict safety.
+Follow the shared
+[`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md) for
+the reviewed digest and artifact bindings.
+The host runs/reconciles named read-only reviewers; engine checks invariants.
+**Standard** is default; **Full** broadens conditional axes per
+[`devrites-lib/reference/orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md).
+## Gate
+| State | Verdict |
+|---|---|
+| Acceptance proven, deterministic checks pass, no unresolved drift or human gate, `Critical == 0`, `Important == 0` | **GO** |
+| Same, but `Important > 0` | Ask `Important findings remain. Proceed to seal? [y/N]`; default **N** |
+| `Critical > 0` | **NO-GO** |
+| Any acceptance criterion, resolved prohibition, or declared key link lacks proof | **NO-GO** |
+| Evidence is stale, or native diff review plus the exact test analyst finds weakened tests | **NO-GO: Critical** |
+| Any exact required reviewer account is missing or silent | **NO-GO** |
+| Any deferred finding (`touched-files.md` `## Review trail`, `eng-review.md` `## Deferred findings`) lacks a `review.md` verdict | **NO-GO** |
+| Any `gate: validating` question remains open | **NO-GO** |
+| Material UI acceptance lacks or fails required browser proof | **NO-GO** |
+| Unresolved drift, unsafe migration/removal, or unapproved principle violation remains | **NO-GO** |
+A judgment-only criterion needs the human eye; AFK records a validating question
+and stops.
+## Workflow
+Follow [`reference/phase-contract.md`](reference/phase-contract.md)
+([`risk-and-rollback.md`](reference/risk-and-rollback.md),
+[`seal-template.md`](reference/seal-template.md),
+[`anti-patterns.md`](reference/anti-patterns.md)):
+1. read workspace and final diff;
+2. recheck the canonical candidate/bindings and approved repository/CI proof;
+3. admit valid Spec/Code accounts; dispatch remaining required exact roles under
+   `../devrites-lib/reference/parallel-dispatch.md` on the same frozen candidate;
+4. reconcile their read-only verdicts against source and immutable evidence;
+5. draft GO/NO-GO `seal.md` with acceptance, tests, decisions, and seven accounts;
+6. write exactly one candidate binding, then run
+   `devrites-engine check seal <slug>` for structure and identity, never semantics.
+Corrections return through affected Prove/Review before restarting Seal under
+[evidence validity](../devrites-lib/reference/candidate-integrity.md#evidence-validity).
+Only repository scripts/CI authorize commands; never guess.
+## On GO
+Set `state.md` `Next step: /rite-ship` and stop. A GO is a verdict, not
+authorization to perform an irreversible action.
+## Output
+Use [`reference/output.md`](reference/output.md).

package/pack/generated/pi/skills/rite-seal/reference/anti-patterns.md ADDED Viewed

@@ -0,0 +1,29 @@
+# rite-seal: anti-patterns
+Load this when standing the final GO/NO-GO decision, or when tempted to round
+NO-GO up to GO. (The irreversible push/tag/deploy and its type-GO gate now live in
+`/rite-ship`: see that skill's anti-patterns for the type-GO discipline.)
+Pack-wide rationalizations + red flags (incl. user-wants-it-bypass-gate):
+see [standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-patterns.md).
+## Phase-specific rationalizations
+| Excuse | Rebuttal |
+|---|---|
+| "All Important findings are minor; just GO." | `Important > 0` triggers an interactive y/N: do not bypass the prompt, present it. |
+| "User clearly wants this to ship." | Ship is evidence-driven, not consent-driven. A Critical finding outranks "the user said go". |
+| "Drift is small; resolve it inline and seal." | Unresolved drift = NO-GO, no exceptions. Route through `/rite-plan` to repair, then seal. |
+| "Reviewer findings overlap; average them away." | Surface disagreements explicitly. Averaging hides where the reviewers disagree. |
+| "Carry the old reviewer verdicts though the diff changed." | If the diff changed since `/rite-review`, re-run the Spec + Code axes: don't carry stale verdicts forward. |
+| "The wright was confident in a material decision. GO without independent review." | Confidence is not independent evidence. Ask the exact `devrites-doubt-reviewer` to test a boundary / data-model / auth / public-API / migration claim, reconcile its result against source, and record the verdict in `decisions.md`; unresolved irreversible risk is NO-GO. |
+## Red Flags
+- About to write `Verdict: GO` while any `Critical` finding is open.
+- Writing `Next step` as anything other than `/rite-ship` after a GO verdict.
+- Reviewer subagents spawned with the author's reasoning attached (defeats the fresh-context point).
+- `seal.md` written before walking *every* acceptance criterion one by one.
+- A NO-GO rounded up to GO "to be agreeable".
+- Unresolved drift, unresolved questions, or pending tasks, and you're sealing anyway.
+- A stood irreversible-risk decision (auth / public-API / migration) has no recorded independent `devrites-doubt` verdict, and you are sealing GO anyway.

package/pack/generated/pi/skills/rite-seal/reference/final-evidence.md ADDED Viewed

@@ -0,0 +1,41 @@
+# Final evidence check
+Map spec promises to valid observed proof.
+## Acceptance
+For each AC/REQ/scenario/key link, exact `devrites-proof-runner` maps immutable
+results and exact `devrites-spec-reviewer` checks implementation and proof
+against its meaning. Bug fixes require original-symptom proof; self-report,
+inspection alone, and generic "tests pass" do not count.
+Apply [`testing.md`'s positive, discriminating proof](../../devrites-lib/reference/standards/testing.md#positive-discriminating-proof),
+including invalid-result exclusions and static/textual criterion boundaries.
+Unproven behavior: NO-GO.
+## Cross-check
+Require built slices, resolved or accepted findings, no drift/open validating
+question, required UI/boundary proof, and an exact doubt verdict per stood decision.
+Reconcile the final diff with the spec applicability map. Every triggered topology,
+data, integration, security, and delivery owner needs its relevant observed failure/
+recovery evidence or an evidence-backed dismissal; a generic green suite cannot close it.
+## Candidate binding and test integrity
+Run `devrites-engine check candidate <slug>` and require its digest to match the
+single evidence/review bindings and browser binding when present. Diff tests,
+dispatch exact `devrites-test-analyst`; apply
+[evidence validity](../../devrites-lib/reference/candidate-integrity.md#evidence-validity)
+to approved proof, then require unchanged digest/sources. Deleted/skipped/focused/
+weakened/tautological tests are Critical.
+After recording verdicts in `seal.md`, run:
+```bash
+devrites-engine check seal "<slug>"
+```
+This checks structure and exact candidate bindings, never acceptance, test
+quality, doubt, or review. Apply [`testing.md`'s safe perturbation](../../devrites-lib/reference/standards/testing.md#safe-perturbation)
+for its mandatory critical/regression cases and any additional project/test-plan requirement.

package/pack/generated/pi/skills/rite-seal/reference/go-no-go.md ADDED Viewed

@@ -0,0 +1,29 @@
+# GO / NO-GO
+[`../SKILL.md`](../SKILL.md) owns gates. Draft native acceptance, test, doubt,
+and seven reviewer accounts in `seal.md`; then run
+`devrites-engine check seal <slug>` for structure/freshness.
+## NO-GO
+NO-GO on unproven acceptance/prohibitions/key links, red repository checks,
+stale proof, drift/open validating questions, Critical code/security, unsafe
+rollback, or an unapproved principle violation. Also block:
+- missing/adverse exact proof, spec, or test verdict;
+- deleted/skipped/focused/tautological/weakened tests;
+- missing/silent required review or invalid conditional account;
+- a stood decision without reconciled exact doubt verdict;
+- opted-in mutation missing/below threshold (otherwise optional).
+## GO
+GO needs fresh acceptance, green proof, resolved drift/human gates, acceptable
+security/data/rollback risk, every account, and no Critical.
+When only Important findings remain, ask:
+```text
+Important findings remain. Proceed to seal? [y/N]
+```
+Default NO-GO. `y` accepts named Important risks only, never Critical/missing proof.

package/pack/generated/pi/skills/rite-seal/reference/output.md ADDED Viewed

@@ -0,0 +1,5 @@
+# rite-seal output
+Use the shared [GO or NO-GO reply contract](../../devrites-lib/reference/reply-contract.md).
+Do not imply anything shipped. `/rite-seal` decides; `/rite-ship` executes.

package/pack/generated/pi/skills/rite-seal/reference/phase-contract.md ADDED Viewed

@@ -0,0 +1,47 @@
+# rite-seal phase contract
+1. **Read.** Resolve the explicit slug or `.devrites/ACTIVE`, require its
+   `state.md`, then read required workspace artifacts, conditional
+   browser/design/devex evidence, and final diff.
+2. **Recheck identity and real proof.** Run
+   `devrites-engine check candidate <slug>` and require its exact digest to match
+   the single evidence/review bindings and the browser binding when present.
+   Apply `spec-grammar.md`'s Native grammar re-read checklist and
+   [evidence validity](../../devrites-lib/reference/candidate-integrity.md#evidence-validity).
+   Run required `test-plan.md` commands unless valid observed proof already satisfies
+   them under that contract. Rerun the
+   candidate check afterward and require the identical digest and no source
+   mutation. Capture command, cwd, exit, decisive output, and identity.
+   Missing/red/mismatched blocks; unavailable is `cannot_verify`, never pass.
+3. **Judge acceptance.** Dispatch exact `devrites-proof-runner` on immutable
+   proof; admit valid same-candidate `devrites-spec-reviewer` evidence from Review
+   or dispatch that exact reviewer. Reconcile every
+   AC/REQ/scenario/key link by ID and meaning; missing/stale/self-attested/mismatched is NO-GO.
+4. **Judge tests.** Diff baseline/candidate tests for deletion, skip/focus,
+   tautology, or weakening; dispatch exact `devrites-test-analyst`. Missing or
+   adverse account, or green tests not asserting mapped behavior, is Critical.
+5. **Resolve gates.** Open blocking/escalating/validating questions and drift
+   block. Each stood decision needs a reconciled exact `devrites-doubt-reviewer` verdict.
+   Every deferred finding (`touched-files.md` `## Review trail`, `eng-review.md`
+   `## Deferred findings`) needs its `review.md` verdict; a row without one blocks.
+6. **Risk and native review.** Apply [`risk-and-rollback.md`](risk-and-rollback.md)
+   and the [`review roster`](../../devrites-lib/reference/parallel-dispatch.md) on
+   the candidate. Admit each result through
+   [`result admission`](../../devrites-lib/reference/standards/agents.md#result-admission).
+   `## Reviewer Accounts` preserves all seven; gap/missing/malformed blocks;
+   conditional `Not-applicable` names why.
+7. **Route corrections.** Reconcile cited findings/disagreements, but do not
+   edit the candidate or manifest in Seal. Route an accepted correction through
+   one bounded wright, update the manifest, run affected Prove, complete a fresh
+   Review under evidence validity, then restart Seal on the new digest.
+8. **Draft/check.** Write `seal.md` from
+   [`seal-template.md`](seal-template.md) with the GO/NO-GO rationale, acceptance map,
+   test-analysis account, stood-decision verdicts, all seven reviewer accounts,
+   and exactly one `Candidate SHA-256: <64 lowercase hex>` line. Then run:
+   ```bash
+   devrites-engine check seal "<slug>"
+   ```
+   Structure/bindings only: blocks exit `3`, invalid state `2`. GO sets
+   `Next step: /rite-ship`; NO-GO names the fix. No commit/push/tag/publish/deploy/close.
+Apply [`anti-patterns.md`](anti-patterns.md); never average away disagreement.

package/pack/generated/pi/skills/rite-seal/reference/risk-and-rollback.md ADDED Viewed

@@ -0,0 +1,56 @@
+# Risk & rollback
+Before GO, know how to undo the change and what could go wrong in production.
+## Risk scan
+Rank risks; for each, note likelihood × impact and any mitigation:
+- **Topology/ownership**: affected roots/deployables, shared contracts/state/resources,
+  dependency cycles, and intermediate deployment combinations.
+- **Data**: schema changes, migration/backfill interruption, concurrent/duplicate writes,
+  tenant/retention boundaries, destructive operations, and invariant reconciliation.
+- **Security**: new trust boundaries, auth/authz changes, secret handling, new deps.
+- **Compatibility**: API contract changes, breaking changes for existing clients,
+  feature interactions.
+- **Integration/operational**: timeouts/unknown outcomes, retry/idempotency, duplicate/order,
+  partial/invalid responses, provider/queue/cache outage, config/env, and rate limits.
+- **Delivery**: schema/config/application/worker/flag order, environment mismatch,
+  monitoring gap, exposure stages, and time to detect/recover.
+- **UX**: changed flows users rely on; unverified UI.
+## Rollback plan (required for risky changes)
+For each risky step, state how to back it out:
+- **Migrations**: is there a reversible `down` / a documented manual revert? Is data
+  loss possible on rollback? If rollback is unsafe, is bounded forward recovery rehearsed?
+- **Feature flag**: can it be disabled without a deploy?
+- **Revert boundary**: can the change be `git revert`-ed cleanly, or does it entangle
+  with other work?
+- **Data**: is there a backup / a way to restore prior state?
+- **External/async effects**: can an unknown outcome be reconciled without duplicating it;
+  who drains/replays/quarantines work and repairs partial state?
+- **Configuration/deployables**: what order restores compatible versions and values at
+  every root/environment?
+## Blocking rules
+- A **destructive or data-migration change with no rollback plan** is a **NO-GO**.
+- A data change with unknown invariant/tenant impact, no interruption/retry proof, or no
+  rollback/forward-recovery rehearsal is **NO-GO**.
+- A new/changed external or asynchronous boundary with blind retry, silent partial success,
+  or no outage/backlog recovery and monitoring is **NO-GO**.
+- Unsafe intermediate deployment order, unvalidated required configuration, or no watched
+  rollout signal/owner is **NO-GO** for live exposure.
+- Record the chosen rollback path in `seal.md` → "Risks / Rollback".
+## Fresh-context availability
+A required review must run in a fresh spawned agent:
+- If the named role is unavailable, record the roster skip reason and keep seal
+  **NO-GO**.
+- Never run the reviewer in the root context or log root work as a dispatched review.
+- AFK never auto-accepts a missing reviewer.
+- Security or irreversible-risk scope remains NO-GO while independent review is
+  unavailable.
+## Destructive operations
+Confirm any destructive step with the user before shipping. Verify backups exist where
+relevant. Never treat an irreversible action as routine.

package/pack/generated/pi/skills/rite-seal/reference/seal-template.md ADDED Viewed

@@ -0,0 +1,27 @@
+# `seal.md` template
+```md
+# Seal: <Feature>
+Verdict: GO / NO-GO
+Candidate SHA-256: <64 lowercase hex>
+## Acceptance Criteria
+- <AC>: <evidence>
+## Verification Evidence
+<proof>
+## Reviewer Accounts
+- devrites-spec-reviewer: <outcome>
+- devrites-code-reviewer: <outcome>
+- devrites-test-analyst: <outcome>
+- devrites-frontend-reviewer: <outcome>
+- devrites-security-auditor: <outcome>
+- devrites-performance-reviewer: <outcome>
+- devrites-devex-reviewer: <outcome>
+## Risks / Rollback
+<risks/recovery>
+## Stood Decisions
+<doubt verdict per stood decision>
+## Blockers / Follow-ups
+<blockers/follow-ups>
+## Final Decision
+<verdict/reason>
+```

package/pack/generated/pi/skills/rite-ship/SKILL.md ADDED Viewed

@@ -0,0 +1,88 @@
+---
+name: rite-ship
+description: Commit, push, tag, archive, or close a sealed feature after /rite-seal GO. Use for repository mutation; not for GO/NO-GO readiness.
+argument-hint: "[feature-slug]"
+user-invocable: true
+---
+# /rite-ship: ship + close the task
+`/rite-seal` decides; `/rite-ship` mutates Git and closes. Read the active workspace;
+if absent, route to `/rite-spec <feature>`. Ship only with current **GO** in `seal.md`.
+## Rules consulted (read on demand from `.pi/skills/devrites-lib/reference/standards/`)
+**Step 0:** Read `core.md`, then pull as needed:
+- `git-workflow.md`: Conventional Commits, atomicity, never-commit list.
+- `afk-hitl.md`: AFK pause rules for irreversible actions (the type-GO gate itself: [`git-ship.md`](reference/git-ship.md), [`rollout.md`](reference/rollout.md)).
+- `definition-of-done.md`: acceptance, evidence, drift, rollback, docs.
+- [`release/ship-checklist.md`](../devrites-lib/reference/standards/release/ship-checklist.md): final pass/fail sweep.
+## Operating rules
+- **GO is prerequisite.** No current `seal.md` GO → stop at `/rite-seal`.
+- **Ship is candidate-read-only.** Follow
+  [`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md).
+  Ship must not change any candidate path or `touched-files.md`; it may write only
+  workspace `ship.md`, `state.md`, and archive bookkeeping. Project/manifest mutation
+  returns through Prove → Review → Seal.
+- **Bindings stay exact.** Rerun candidate/Seal checks; require the digest bound in
+  evidence, optional browser evidence, review, and seal. Any mismatch stops.
+- **Fresh approval.** Disclose the exact Git attempt; literal `GO` authorizes it once.
+  Change/retry means re-prompt. Native approval remains separate/authoritative.
+- **Archive, never delete,** every audit `.md`.
+## Workflow
+1. **Orient.** Snapshot; read seal, state, spec, touched files, evidence, and any UI
+   brief. Confirm GO/closed digest, then run:
+   ```bash
+   devrites-engine check candidate <slug>
+   devrites-engine check seal <slug>
+   ```
+   Nonzero/mismatch stops; never reinterpret it.
+1a. **Health (advisory).** Apply `/rite-doctor` read-only; surface WARN/FAIL without
+   repair. If ACTIVE is flagged, confirm the slug.
+2. **Prepare the exact Git candidate.** Follow
+   [`git-ship.md`](reference/git-ship.md): refuse out-of-manifest staged work; stage
+   exact manifest paths only after Seal GO; compare NUL-delimited staged state/path
+   sets, require identical index/worktree bytes, and rerun candidate/Seal checks.
+   From the verified index, build the exact project-conformant message/trailers,
+   branch, tag/PR, commands, and skips.
+2a. **Credential guard (HIGH blocks).** Scan staged blobs and any PR body. HIGH stops
+   and requires rotation/redaction; MEDIUM needs confirmation recorded in `ship.md`;
+   LOW is FYI.
+   ```bash
+   devrites-engine secret-scan --staged
+   ```
+   Scan a PR body with `devrites-engine secret-scan --stdin` only through non-logging
+   process stdin, then close it—never command/argv/env/heredoc/log/temp file. If that
+   channel is unavailable, stop. **rc=3 → STOP:** no type-GO/commit/push/archive.
+2b. **Reconcile residuals before type-GO.** Scan `strategy.md` deferrals,
+   `decisions.md` FYIs/revisit triggers, unresolved `review.md` non-blocking/if-minor/
+   FYI findings, and `seal.md` follow-ups. Deduplicate only rows with identical
+   obligation + disposition, preserving every source pointer. Each residual appears
+   once in the pending `ship.md` table as `tracked` (durable path/ID) or `no-action`
+   (prior decision or explicit human acceptance + reason/revisit). Type-GO never
+   implies `no-action`. Missing/vague/conflicting disposition blocks; `none` requires
+   empty sources.
+3. **Type-GO.** Render [`git-ship.md`](reference/git-ship.md)'s prompt and wait.
+   Literal `GO` proceeds once; anything else records cancellation in `ship.md` and
+   stops. Any command/scope/branch/message/tag/PR change or retry needs a fresh prompt;
+   native approval is still required.
+4. On GO, commit; verify committed state/path set and exact candidate digest; then push →
+   tag/PR as applicable via `git-ship.md`. Capture SHA(s), branch, tag/PR URL. Mismatch
+   stops before push/tag; retry needs fresh approval.
+4a. **PR only:** render [`git-ship.md`](reference/git-ship.md#pull-request-body)'s
+   structured body; omit empty sections.
+5. Re-scan the four residual sources; any new/missing/changed item blocks archive.
+   Write [the template](reference/ship-template.md) with shipment metadata and the
+   unchanged pre-GO reconciliation.
+6. **Close.** Set `state.md` phase `done`; follow
+   [`close-out.md`](reference/close-out.md) and run `devrites-engine state close <slug>`
+   to move `.devrites/work/<slug>` → `.devrites/archive/<slug>` and clear `ACTIVE`
+   only if it names this slug; preserve another active feature's cursor.
+   Preserve every `.md`; stable hierarchical instructions need no active-workspace sync.
+   Report the recorded `Next step` verbatim — the exact `/rite-spec <parent>-<n> "<objective>"`
+   when a continuation sequence remains — so the next increment starts from one line,
+   never from chat memory.
+> **Mid-flight discipline.** No seal GO, skipped type-GO, out-of-manifest stage, or
+> deleted workspace. Stop and use [`anti-patterns`](reference/anti-patterns.md).

package/pack/generated/pi/skills/rite-ship/reference/anti-patterns.md ADDED Viewed

@@ -0,0 +1,28 @@
+# rite-ship: anti-patterns
+Load this before any irreversible action: `git commit`, `push`, `tag`, publish, deploy,
+or when tempted to skip the close-out.
+Pack-wide rationalizations + red flags: see
+[standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-patterns.md).
+## Phase-specific rationalizations
+| Excuse | Rebuttal |
+|---|---|
+| "Seal said GO, so I can just push." | A GO verdict is a decision, not authorization. **Render the type-GO prompt every time** and wait for the literal `GO`. |
+| "I'll push the tag now; type-GO is a formality." | Type-GO is the last safety net before an irreversible action. Always render it: even under auto-trigger. |
+| "`git add -A` is faster than listing touched files." | Stage only what's in `touched-files.md`. `-A` sweeps secrets, scratch files, and out-of-scope edits into the ship. |
+| "The evidence is probably still good." | Recheck the canonical candidate digest and every artifact binding. Any mismatch stops. |
+| "The ledger/DESIGN/ADR update is just ship bookkeeping." | Those are candidate paths. Route the change through Polish, affected Prove, Review, and Seal; Ship is read-only. |
+| "Delete the workspace, the feature's done." | Closing **archives** the workspace (`.devrites/archive/<slug>/`); it never deletes the audit trail. |
+## Red Flags
+- About to run `git push` / `git tag` without rendering the type-GO prompt.
+- Shipping without a `GO` verdict recorded in `seal.md`.
+- Staging files not listed in `touched-files.md`, or any secret / `.env`.
+- Changing a candidate path or the manifest after Seal.
+- Pushing or tagging before the committed NUL-delimited state/path and digest checks pass.
+- `rm`-ing `.devrites/work/<slug>/` instead of archiving it.
+- Marking the feature `done` but leaving `.devrites/ACTIVE` pointing at it.

package/pack/generated/pi/skills/rite-ship/reference/close-out.md ADDED Viewed

@@ -0,0 +1,68 @@
+# Close-out: archive the workspace, free the active slot
+Closing a feature means it stops being the *active* work, not that its record is
+deleted. DevRites keeps the audit trail; it just moves out of the live path.
+## What close-out does
+1. **Mark done.** Set `state.md` → `Phase: done`, `Status: done`, and a `Next step`.
+   When this workspace's `decisions.md` records an unfinished
+   [continuation sequence](../../rite-plan/reference/slicing.md#continuation-workspaces),
+   that step is the **exact** next command — `/rite-spec <parent>-<n> "<objective>"` —
+   and the ship reply prints the same line. Otherwise it stays
+   `/rite-spec <next feature>`. Nothing spawns the continuation automatically:
+   the recorded command is the handoff, so the human starts each increment knowingly.
+2. **Archive.** Run the deterministic script:
+   ```bash
+   devrites-engine state close <slug>
+   ```
+   It moves `.devrites/work/<slug>/` → `.devrites/archive/<slug>/` (every `.md`
+   intact) and clears `.devrites/ACTIVE` **only if** ACTIVE still points at `<slug>`.
+   It refuses to clobber an existing `.devrites/archive/<slug>/` (exit 5).
+3. **Confirm the observed post-state.** The archive exists with its audit records
+   intact and the live workspace is absent. If ACTIVE named this slug, verify it is
+   empty; if it named another feature, verify that value remains unchanged. Only an
+   empty cursor permits the claim "no active feature".
+Any nonzero exit stops close-out. Archive collision (exit 5) never authorizes overwrite.
+If clearing ACTIVE fails, the engine attempts to move the archive back; that rollback
+can also fail. Inspect the actual live path, archive and cursor before reporting or
+retrying. Record the command/error and observed locations; never claim restored state
+from an attempted rollback or repeat a move against an unverified destination.
+## Sequence predecessors
+A deferred-ship sequence leaves earlier milestones sealed and unarchived in
+`.devrites/work/`. The release ship's disclosed plan may close them
+(`devrites-engine state close '<slug>'` per predecessor) after the release commit
+lands; each close is safe because `ACTIVE` names the release workspace. Closing is
+bookkeeping only: the release commit already carries their bytes, and their audit
+records move intact.
+## Why archive, not delete
+- The `.md` files (`spec`, `decisions`, `assumptions`, `evidence`, `seal`, `ship`, …)
+  are the project's record of *why* the feature is the way it is. A future
+  `/rite-zoom-out` or incident review reads them.
+- Deleting them would make the workflow's own "evidence over confidence" rule a lie.
+## Re-opening an archived feature
+Before restoring an archive, verify its identity, released cursor form and declared
+workspace schema, that the live destination is absent, and that ACTIVE is empty or
+already names this slug. A collision or another active feature stops restoration;
+do not replace its workspace or cursor. Supported released cursor forms remain valid:
+age or encoding alone never requires normalization (see
+[workspace-artifact-schema.md](../../devrites-lib/reference/workspace-artifact-schema.md)).
+An unsupported declared schema stops restoration: record the observed version,
+installed engine's recovery diagnostic and pending normalization owner. Do not guess
+a repair or claim `/rite-upgrade` migrates archives; archived/done work is its no-op.
+After an authorized restoration, verify the actual paths and cursor and preserve the
+audit records. Reconcile the resumed scope through `/rite-converge`; changes return to
+the applicable earlier lifecycle stage. Historical proof/GO remains historical: a new
+candidate requires fresh Prove → Polish → Review → Seal bindings before Ship. Restoring files
+does not reactivate an old GO.
+Cross-feature review is user-invoked through `/rite-learn`; close-out does not
+mine, score, nudge, or write a retrospective ledger.