devrites 5.5.0 → 5.7.0

package/pack/generated/pi/skills/rite-prove/SKILL.md

@@ -0,0 +1,120 @@
+---
+name: rite-prove
+description: Prove a completed feature with tests and the full test suite, build/typecheck/lint, end-to-end/browser evidence, screenshots, commands, and outputs for seal. Not for single-slice proof.
+argument-hint: "[feature-slug]"
+user-invocable: true
+---
+
+# /rite-prove: prove the completed feature
+
+Prove the assembled feature once. No workspace: use `/verify` or `/run`;
+pending tasks: stop for `/rite-build`.
+Never assert unobserved passes. After Polish/Review edits, repeat affected
+criteria/dependencies and bind under
+[evidence validity](../devrites-lib/reference/candidate-integrity.md#evidence-validity).
+Initial full feature proof and required mutable observations still run.
+
+## Rules
+
+Read the applicable standards: `testing.md`, `test-proof-checklist.md`,
+`browser-proof-checklist.md` for UI, `spec-grammar.md`, `performance.md`,
+`observability.md`, topology/data/integration rules named by the plan,
+`developer-experience.md`, `definition-of-done.md`, `one-shot-actions.md`, and
+`workflow-artifacts.md`. Developer surfaces require an observed flow, measured
+TTHW, and exact signal-bearing errors; never assert DX.
+
+- Each claim needs an executed positive, discriminating assertion and decisive
+  signal; green commands alone are unproven.
+- Follow [`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md). Prove owns proof binding, not candidate
+  grammar/hashing. Spec Drift Guard owns revealed contract drift.
+- Root runs vetted gates/browser and records immutable evidence; proof runner
+  validates it. Only the bounded wright fixes product source/tests.
+- **Prove remains the controlling caller** during technical backtracking. Save
+  its cursor; run Plan repair, Recovery Vet, remediation, and re-proof inline;
+  consume nested boundaries; resume the failed rung. Recovery exhausts after
+  three no-progress attempts on the exact same fingerprint. Closing one or exposing a distinct
+  Critical/Important invariant is progress, not a reason to hand work off.
+<!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"Prove consumes installed Workflow Artifact or CLEANED rerun","action":"VERIFY_EXISTING or admitted proof path ending PROVE_AND_RETURN","return":"saved Prove cursor; stop before real action"} -->
+## Released-workspace refresh
+
+Only an admitted `/rite-upgrade` assessment proving a released-format candidate
+defect enters. Require legacy touched-file scope, live diff, tasks, and traceability agree unambiguously
+on every candidate path/state. Missing or
+ambiguous scope stops; never guess from Git. Preserve unrelated manifest content
+and refresh only the strict manifest from observed bytes.
+
+Discard old passes. Run all current approved real proof from scratch. Establish
+pre-proof and post-proof engine digest with `devrites-engine check candidate
+<slug>` and require equality, then write one fresh exact binding in evidence and
+browser evidence. Current failure blocks; Upgrade does not authorize source or
+test changes.
+
+## Workflow
+
+1. **Orient.** Read core, resolve active slug, require `state.md`, and read its
+   cursor. On blocked Prove cold resume, reconcile retained consumptive evidence
+   and no-progress corrections before accepting terminal none; a distinct
+   fingerprint below cap resumes offline triage without another real action.
+2. **Freeze scope.** Read spec, tasks, state, test plan, and full diff. Require
+   every slice built. Missing `test-plan.md` returns to Vet inline (Prove stays the controlling
+   caller) and resumes here; it never authorizes ad hoc proof.
+3. **Approve commands.** If absent, use
+   [test-command-discovery](reference/test-command-discovery.md) over repository
+   manifests/CI. Discovery is evidence only: `test-plan.md` is the sole approved runtime
+   command list. A newly found command must return to the current Vet contract,
+   refresh readiness, then resume without user handoff.
+4. **Execute a frozen candidate.** Run `devrites-engine check candidate <slug>` and retain its digest.
+   The root runs only commands declared by `test-plan.md`, with exact approved
+   command, cwd, prerequisites, exit, and sanitized
+   decisive output. Run relevant suite plus build/typecheck/lint. Recheck the
+   candidate and require identical digest/no source mutation. Reject substituted
+   commands, malformed manifests, zero-test/skipped/filtered behavioral claims,
+   exit-status-only claims, and source drift. Static gates prove only their named
+   static criterion.
+5. **Gate consumptive actions.** Immediately before execution, apply
+   `one-shot-actions.md`: current retained identity, bounds/sanitization,
+   injective boundary map, per-seam fault fixtures, collision mutant, terminal
+   fixtures, and cleanup-survival proof must be green. Missing/stale/disposable-
+   only evidence returns to Vet without spending an attempt. Record the admitted artifact identity before execution.
+   After failure, retained evidence is the
+   reproduction; never rerun for diagnosis. Spent authorization blocks another
+   action, but when action budget is zero it does not exhaust a newly identified
+   offline fingerprint.
+6. **Prove UI when applicable.** Use design brief/references, browser harness,
+   allowed scratch path, [proof ladder](reference/proof-ladder.md), and
+   [browser proof](reference/browser-proof.md): routes, viewports, opened and
+   described screenshots, console/network, interaction, target comparisons, and
+   every required state. Material mismatch fails.
+7. **Independent validation.** Fresh read-only `devrites-proof-runner` and
+   `devrites-spec-reviewer` judge the same candidate/commands/evidence/acceptance map.
+   Neither runs commands; reject missing/stale, invented-ID, label-only or self-attested reports.
+8. **Map proof.** Reconcile verdicts under [acceptance-proof.md](reference/acceptance-proof.md).
+   Every criterion/scenario/interaction/key link needs discriminating evidence or a
+   blocker, including critical-path, observability, developer and wiring branches.
+9. **Recover red.** Use [failure triage](reference/failure-triage.md) and Debug
+   Recovery. Reconcile reproduction; send accepted in-scope source/test correction
+   to the sole wright; update actual manifest; rerun affected proof, both candidate
+   checks, and fresh proof runner. Recheck affected acceptance with the exact spec
+   reviewer; reconcile both validators under evidence validity. Scope growth blocks.
+
+   Agent-owned durable-plan errors run Spec Drift Guard, Plan, and Vet inline,
+   preserving Prove as origin. Consumptive failures use retained fixtures, repair,
+   and Vet, then stop for fresh GO after changed conditions. Ambiguous retained
+   evidence does not prove that no safe future acquisition design exists: treat
+   an in-scope discriminator as diagnostic-amplification Plan gap, repair its
+   finite map/collision proof, narrow-Vet, then seek fresh GO before one evidence
+   attempt. Never guess the runtime fix or reuse old GO.
+10. **Record.** Root updates `evidence.md`, optional `browser-evidence.md`,
+    traceability, and state, with exactly one observed candidate binding.
+
+> Do not claim an unobserved pass, skip browser proof, or proceed with pending
+> slices. Load `reference/anti-patterns.md` when tempted to do so.
+
+## Phase exit
+
+**Complete when:** every criterion in `acceptance-proof.md` has discriminating
+evidence bound to the current candidate digest, both independent validators admit
+accounts, and `state.md` records Prove complete with no open `cannot_verify` rows.
+
+**Failing case:** narrative "all tests passed" without `evidence.md` binding and
+proof-runner admission → phase not complete; Seal blocks.

package/pack/generated/pi/skills/rite-prove/reference/acceptance-proof.md

@@ -0,0 +1,88 @@
+# Acceptance proof
+
+Map each `spec.md` criterion to `test | command | browser | judgment` evidence
+and one-line reason. Run `spec-grammar.md`'s Native grammar re-read on the saved
+spec before mapping; reopen after corrections. No parser/script may replace it.
+
+Every structured WHEN/THEN scenario needs a passing asserting test. When
+`test-plan.md` exists, every acceptance/gap requirement, interactive element, and
+user flow needs a passing result. Missing coverage blocks.
+
+Apply [`testing.md`'s positive, discriminating proof](../../devrites-lib/reference/standards/testing.md#positive-discriminating-proof),
+including invalid-result exclusions and static/textual criterion boundaries.
+Unsupported behavioral claims are `cannot_verify` and block proof.
+
+## Silent-failure probe
+
+When tests pass but error paths, dropped results, or partial success could hide
+failure, require at least one **discriminating** check that would fail if the silent
+path regressed (assert the failure surface, not only the happy path).
+
+**Failing case:** handler returns success while logging or swallowing internally; the
+suite stays green → map `cannot_verify` unless a test asserts the user-visible or
+contract failure outcome.
+
+## Backstop disposition
+
+A `backstop` passes only on its spec-named independent held-out,
+property/metamorphic, or direct behavioral check plus discriminating observed
+output. Presence, test names without results, author judgment, or an expectation
+copied from the same implementation logic fails.
+
+Undefined/unavailable signal: `cannot_verify`, evidence
+`insufficient_spec: <missing fact or evidence surface>`, then Spec Drift; never
+judgment or pass.
+
+## Applicable system-risk proof
+
+Reconcile `spec.md`'s applicability map with the final diff. For each triggered owner:
+
+- `repository-topology.md`: prove commands ran at every affected root and both provider
+  and consumer used the same canonical contract; identify generated/vendor sources.
+- `data-integrity.md`: prove declared invariants plus relevant duplicate/retry,
+  concurrency, interruption/resume, old/new coexistence, tenant isolation, and
+  rollback/forward-recovery cases with recorded scale/counts.
+- `integration-reliability.md`: prove relevant invalid/partial response, auth failure,
+  timeout/unknown outcome, rate limit/outage, duplicate/order, poison/backlog, cache/partition,
+  degradation, and recovery behavior.
+
+An evidence-backed dismissal is valid for an irrelevant case. An applicable case with no
+executable proof surface is `cannot_verify`; do not infer it from an implementation review
+or a mock that cannot produce the risk.
+
+## Critical-path assertion strength
+
+For regression-Critical, irreversible, and data-loss paths, require
+[`testing.md`'s safe perturbation](../../devrites-lib/reference/standards/testing.md#safe-perturbation).
+Missing evidence is `cannot_verify`; a green test on broken code is unproven.
+Pure transforms also get a round-trip or
+metamorphic property check when applicable.
+
+## Runtime observability branch
+
+For endpoints, jobs, consumers, integrations, user flows, or new error paths,
+trigger failure and observe the required log/metric/trace per `observability.md`;
+record it. Skip pure internal, docs, config, and type-only changes.
+
+## Developer-facing branch
+
+For public API/CLI/SDK/webhook/config/error/onboarding, execute the real entry on
+clean state, measure time-to-hello-world, and capture verbatim failure output.
+Browser-capture docs/quickstarts when applicable. Write the scorecard to
+`devex.md` and headline evidence to `evidence.md`.
+
+## Wiring branch
+
+Exercise/follow every key `plan.md` link in the assembled feature; record each as
+`EVID-###`, or record none declared. An unwired link blocks.
+
+For every critical link, apply safe perturbation to the load-bearing input/link and observe the
+promised surface fail. Existence/registration/spy-call evidence is insufficient when a
+different path can coincidentally produce the expected result.
+
+## Baseline and environment claims
+
+Classify a failure as pre-existing or environment-specific only with a dated
+before-candidate result for the same command, working directory, prerequisites, and
+material environment. Otherwise record it as an unresolved candidate result. For time/local
+behavior, bind the instant, time zone, locale, and relevant old/new configuration.

package/pack/generated/pi/skills/rite-prove/reference/anti-patterns.md

@@ -0,0 +1,25 @@
+# rite-prove: anti-patterns
+
+Load this when standing a non-trivial proof decision, or when tempted to
+report a pass you didn't observe, skip a rung of the browser-proof ladder,
+or proceed without all slices built.
+
+Pack-wide rationalizations + red flags (incl. observed-but-not-recorded):
+see [standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-patterns.md).
+
+## Phase-specific rationalizations
+
+| Excuse | Rebuttal |
+|---|---|
+| "Tests passed during build; that's enough." | Build = per-slice sanity check. Prove = whole-feature suite + build/typecheck/lint + browser. |
+| "Browser proof is overkill for this UI change." | If it's UI and a browser can run, the ladder applies. If you can't, document which rung and why. |
+| "Failure is in pre-existing code, not in this feature." | Still surfaces as a blocker. Feature scope = fix in scope or record + halt. |
+| "Some slices are still pending but the rest can be proved." | No: `/rite-prove` runs once, when every slice is built. Otherwise you're proving a partial system. |
+
+## Red Flags
+
+- Reporting "pass" for a command you didn't run.
+- Skipping browser-proof rungs 1-3 because rung 4 (project E2E) was easier.
+- An acceptance criterion left "unproven" without a corresponding blocker note.
+- Tests recorded green but the diff shows the test file wasn't touched (stale run).
+- About to write `evidence.md` without command + output.

package/pack/generated/pi/skills/rite-prove/reference/browser-proof.md

@@ -0,0 +1,51 @@
+# Browser proof: evidence schema
+
+What `browser-evidence.md` must capture for a UI slice. Delegates to
+`devrites-browser-proof`; this is the record contract.
+
+```markdown
+# Browser Evidence
+
+## Browser evidence
+| Evidence ID | Route | State/input | Viewport | Compared with | Tooling | Result | Related IDs | Limitation |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| EVID-003 | <route> | empty/keyboard | 375 | brief Proof targets + target reference 1 | playwright-mcp | <observed result> | AC-002, SLICE-002 | <none / exact gap> |
+
+## Visual Verdict
+| State | Result | Notes |
+| --- | --- | --- |
+| default | PASS / FAIL | <what is visible> |
+| loading | PASS / FAIL | <what is visible> |
+| error | PASS / FAIL | <what is visible> |
+
+## Comparison deltas
+| State / viewport | Target | Material delta observed | Disposition | Result |
+| --- | --- | --- | --- | --- |
+| empty / 375 | design-brief.md + R1 | <hierarchy/layout/spacing/type/behavior difference> | fixed + re-rendered / accepted with reason | PASS / FAIL |
+
+## Run notes
+- Screenshots: <path(s)> — opened and described above.
+- Console: <errors/warnings, or "clean">.
+- Network: <failures, or "no failures">.
+- Interaction path: <clicks/inputs performed and result>.
+- Accessibility: <focus order / labels / contrast spot-check>.
+- Responsive: <what changed across viewports; any breakage>.
+```
+
+## Rules
+- Open every screenshot path and describe it: never assert from the filename.
+- Read `design-brief.md` + `references.md` first. Compare fidelity only with references
+  classified **target**; check constraints as rules and never pixel-match inspiration.
+- Render every proof target named by the brief/slice using the canonical viewport
+  set and state coverage in [quality-standards.md](../../devrites-frontend-craft/reference/quality-standards.md).
+  Apply [capture admissibility](../../devrites-lib/reference/standards/browser-proof-checklist.md)
+  before assigning a visual verdict; invalid captures leave proof `cannot_verify`.
+- Compare structure before decoration: hierarchy/layout → responsive/state behavior →
+  type/spacing/color → polish. Record each material delta, fix it, and re-render. A visual
+  PASS requires zero unresolved material deltas; an accepted departure needs its reason in
+  the design brief's build-time refinements.
+- A clean console + no layout shift are part of the evidence, not extras.
+- If no browser can run, write the manual verification steps a human would follow and
+  mark the slice's browser proof as **pending (manual)**.
+- Every browser evidence row uses `EVID-###` and names the related `AC-###` and
+  `SLICE-###`; `/rite-prove` mirrors the evidence ID in `traceability.md`.

package/pack/generated/pi/skills/rite-prove/reference/failure-triage.md

@@ -0,0 +1,43 @@
+# Failure triage
+
+When a test/build/runtime/browser check fails, triage before fixing. Delegates the deep
+loop to `devrites-debug-recovery`.
+
+## Triage ladder
+1. **Reproduce:** for a repeatable command, run it again and capture the exact
+   error (quote it). For a consumptive action under
+   [`one-shot-actions.md`](../../devrites-lib/reference/standards/one-shot-actions.md),
+   never rerun it: use the retained bounded artifact as the reproduction input.
+2. **Classify** the failure:
+   - test is right, code is wrong → fix the code (in scope).
+   - test is wrong/outdated → that may be **spec drift** (acceptance criteria wrong).
+   - environment/setup (missing dep, wrong node/ruby) → fix it when agent-owned;
+     record a blocker only for human/access ownership, scope overflow, or exhausted
+     fingerprint recovery.
+   - flaky (passes on re-run, timing/order) → note it; don't paper over with retries.
+   - external dependency down → record blocker; don't fake the result.
+3. **Isolate:** minimize to the smallest failing case; bisect the diff if needed.
+   If consumptive evidence maps to multiple causal seams, this is a
+   diagnostic-amplification plan gap: design and Vet an injective boundary
+   discriminator offline instead of guessing a runtime correction or declaring
+   the cleaned-away past state terminal.
+4. **Fix within scope:** the current slice/feature only. If the fix reaches outside
+   scope, stop and record a blocker in `state.md` (then `/rite-plan unblock`).
+5. **Re-run** the same command when it is repeatable; confirm green and record both
+   attempts in `evidence.md`. A consumptive action needs re-vetted evidence
+   completeness and any fresh authorization before a new attempt. Its spent
+   action authorization does not stop offline recovery: a retained new fingerprint
+   enters caller-owned diagnosis, correction, fixtures, and narrow Vet immediately.
+   A separately authorized diagnostic-amplification attempt may acquire the missing
+   discriminator after its evidence design passes Vet; it is not a blind rerun.
+
+## Rules
+- Quote the real error text; don't paraphrase it away.
+- Don't loosen/delete a failing assertion to get green: investigate whether it's drift.
+- Don't add blanket retries/sleeps to hide flakiness.
+- Three no-progress attempts on the exact same causal fingerprint consume the
+  shared recovery cap. A recheck that closes the reproduction is progress; a
+  different evidenced Critical/Important invariant gets its own fingerprint.
+  Preserve the reproduction and dead ends, then stop once as a technical blocker.
+  Ask only when the remaining decision is human-owned.
+- A failure you can't fix in scope is a recorded **blocker**, not a silent skip.

package/pack/generated/pi/skills/rite-prove/reference/proof-ladder.md

@@ -0,0 +1,28 @@
+# Proof ladder
+
+Prefer real runtime evidence. For UI/browser work, try tools top-down and record which
+rung you used. Detect, don't install: browser tooling setup is the user's call.
+
+1. **Playwright MCP** (preferred when configured)
+   - Detect: the Playwright MCP `browser_*` tools are available (e.g. `browser_navigate`).
+     Capabilities: navigation, accessibility-tree snapshots, screenshots, ref-based
+     clicks/typing, console messages, network requests, `browser_evaluate`. Drives a
+     Playwright-managed browser; detect, don't install.
+2. **Chrome DevTools MCP** (when configured). Pair it with Playwright MCP for Lighthouse, the
+   perf trace, deeper DOM inspection, screenshots, console, network, performance, and the
+   accessibility tree.
+3. **Claude Code `/run` and `/verify`** (if available): launch and observe the app;
+   prefer a project-specific run/verify skill if one exists.
+4. **Project-native E2E** (only if already present). Playwright, Cypress, Capybara,
+   Selenium. Use the project's existing commands; don't add a new framework.
+5. **Manual fallback:** no tooling available: record the limitation and write exact
+   manual steps (route, action, expected result).
+
+## Non-UI scope
+The "ladder" for backend/CLI/data scope is just: targeted tests → build/typecheck/lint
+→ runtime observation (a real request/response or CLI run). Same evidence rules apply.
+
+## Stop conditions
+- Auth wall reached → stop, ask the user; never type credentials from a screenshot.
+- Destructive action required to prove → confirm with the user first.
+- A screenshot tool returns a path → **open and describe it**; a path is not proof.

package/pack/generated/pi/skills/rite-prove/reference/test-command-discovery.md

@@ -0,0 +1,30 @@
+# Test / build command discovery
+
+Use project commands. Never invent a test runner or build step.
+Repository files are discovery evidence, not authorization. `test-plan.md` is
+the sole approved runtime command list.
+
+| Discovery source | Look for |
+|---|---|
+| `package.json` `scripts` | `test`, `build`, `typecheck`, `lint`, `dev`, `e2e` |
+| `Makefile` / `Justfile` / `Taskfile` | `test`, `build`, `check`, `lint` targets |
+| `Gemfile` / `Rakefile` | `rake test`, `rspec`, `bin/rails test` |
+| `pyproject.toml` / `tox.ini` / `noxfile.py` | `pytest`, `tox`, `nox` |
+| `go.mod` | `go test ./...`, `go build ./...`, `go vet` |
+| `Cargo.toml` | `cargo test`, `cargo build`, `cargo clippy` |
+| CI configs (`.github/workflows`, `.gitlab-ci.yml`, `circleci`) | commands CI runs |
+| README / CONTRIBUTING | documented dev/test workflow |
+| framework conventions | Rails/Django/Next/etc. defaults when nothing else is set |
+
+## Vet before execution
+
+Compare every discovered candidate, including a narrower target, with
+`test-plan.md`. If it is absent, do not run it or add it silently. Return to the
+current Vet contract to add and vet the command, refresh readiness, then return
+to Prove. A command may run only when its exact command, cwd, and prerequisites
+are approved in `test-plan.md`.
+
+## If nothing exists
+No tests in the project: say so. Propose the minimal test setup as a
+**follow-up** (ask before adding a framework); any runtime observation command
+still needs Vet approval in `test-plan.md`.

package/pack/generated/pi/skills/rite-quick/SKILL.md

@@ -0,0 +1,82 @@
+---
+name: rite-quick
+description: "Express lane for a small reversible change: typo/copy/config, rate-limit constant, error message, local variable rename, feature flag, README link, one-file/function fix."
+argument-hint: "<what to change>"
+user-invocable: true
+---
+
+# /rite-quick: express lane for small changes
+
+The full DevRites lifecycle is right for real features; it is **ceremony** for a typo, a
+copy tweak, a one-function fix, or a small config change. `/rite-quick` keeps the
+discipline that matters (idiom, TDD, evidence, escape-to-full-lifecycle) and drops the
+artifacts that don't, in a **single pass**. Senior-engineer "right step, right time" made
+executable, not advisory. This lane uses the **Quick** depth profile from
+[`devrites-lib/reference/orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md).
+
+## The significance gate (the whole safety story)
+
+**Run this first. If ANY of these holds, STOP and route to `/rite-spec`. Do NOT use the
+express lane:**
+- Touches **auth / authz**, a **data migration**, a **public API contract**, or any
+  **destructive / data-loss** path in the irreversible-risk list. See `../devrites-lib/reference/standards/afk-hitl.md`.
+- Spans **more than one vertical slice**, or more than a couple of files of real logic.
+- **Ambiguous scope:** you'd have to guess what "done" means, or the ask hides a design
+  decision (data model, new dependency, second design system).
+- Security-sensitive input handling, or a measurable performance-critical path.
+- Would **break a declared project principle** (`.devrites/principles.md`) with no recorded,
+  human-approved exception: the express lane never relaxes a project gate; a needed exception is
+  a deliberate human decision, so route it to `/rite-spec`.
+
+If none hold, the change is small + reversible + unambiguous → proceed. **When in doubt,
+escalate**: the cost of the full lifecycle on a small change is minutes; the cost of the
+express lane on a risky one is the failure mode the lifecycle exists to prevent.
+
+## Rules consulted (read on demand from `.pi/skills/devrites-lib/reference/standards/`)
+Load this lane's conditional standards when needed:
+- `coding-style.md`: naming, guard clauses, reuse-first.
+- `testing.md`: TDD, **completeness** (every touched behavior/element asserted) +
+  **assertion strength** (no tautological tests; see it fail first), scaled to the change.
+- `error-handling.md` / `security.md`: only if the change touches input/errors.
+- `principles.md`: when `.devrites/principles.md` exists; a change that breaks an invariant is a gate, not a quick fix.
+- `definition-of-done.md`: standing Done bar: acceptance mapped, fresh proof, no open hard gates, scoped edits, rollback/docs where needed.
+
+
+## Workflow
+0. **Orient.** Read `core.md`. If a `.devrites/` workspace is active, read its
+   `state.md` directly; `/rite-quick` does **not** require
+   a workspace and does **not** create the full tree.
+1. **Significance gate** (above). Fail → STOP, tell the user to run `/rite-spec <feature>`.
+2. **One-line contract.** Restate in 1-3 lines: the change, its **acceptance** (how you'll
+   know it works), and the **scope boundary** (what you will NOT touch). This is the entire
+   "spec + plan" for a quick change: keep it in the chat; optionally drop a `brief.md` +
+   `evidence.md` under an unused `.devrites/work/<slug>/` (no `state.md`; not a workspace
+   cursor) if the user wants a record. This is the
+   `/rite-frame` FRAME move: if the acceptance won't reduce to a check that could be *false*,
+   the ask is ambiguous → escalate per the significance gate. Its AUDIT pass is the diff
+   self-review in step 5.
+3. **Build with TDD.** Failing test first when behavior changes (see it fail for the right
+   reason) → smallest complete change in the **project's idiom** (reuse before you write,
+   anti-AI-slop) → cover every touched behavior / interactive element with a **real**
+   assertion. UI → check the states + a browser glance.
+4. **Prove (scoped).** Run the **targeted** tests + typecheck / lint for what changed (not
+   the whole suite) → green. Record the command + output. A tautological test that can't
+   fail is not proof.
+5. **Review-lite + ship.** Self-review the diff for correctness, scope, and idiom. If
+   `.devrites/principles.md` exists, confirm that no declared invariant is broken. This is
+   `/rite-frame`'s AUDIT pass: one pass, no subagent fan-out. Show the diff, then on the user's confirm commit it
+   (Conventional Commits, atomic), or hand to `/rite-ship` only when the change belongs to the active
+   feature's candidate; otherwise commit standalone. **Never push
+   without the user asking.**
+
+## Escalation (mid-flight): the Spec Drift Guard still applies
+If the "small" change turns out to be not small: a second slice appears, a real design
+decision surfaces, scope grows past the boundary, or you hit an irreversible-risk item:
+**STOP, say so, and route to `/rite-spec` / `/rite-define`**. Don't quietly grow a quick
+fix into an unreviewed feature; that's the exact drift the lifecycle guards against.
+
+If the quick boundary does not hold or an escalation remains, use `Stopped / blocked`
+and route to the full lifecycle; do not render `Done`.
+
+**DO NOT** use this lane to dodge the gate: the express lane is for changes that are
+genuinely small, not for shipping risky work faster.

package/pack/generated/pi/skills/rite-resolve/SKILL.md

@@ -0,0 +1,95 @@
+---
+name: rite-resolve
+description: User-invoked resume verb for answering, dropping, or batch-resolving open `questions.md` gates.
+argument-hint: "<qid> \"<answer>\"  |  --drop <qid> [\"<reason>\"]  |  --batch <path-to-file>"
+user-invocable: true
+disable-model-invocation: true
+---
+
+# /rite-resolve: answer the human gate
+
+`/rite-resolve` resumes an **async** human gate: a checkpoint that already paused and
+**stopped the session** (an AFK blocking/escalating/irreversible queue, or a HITL pause
+left unanswered), plus `--batch`. When `/rite-build` asks a question **inline**
+via `AskUserQuestion` and the human is present, that pick resolves the gate **in place** through
+the `devrites-engine state resolve` writer. You don't type `/rite-resolve` for it. For the async case this
+skill takes the human's answer (or `--drop` / `--batch`), writes it to `questions.md`, updates
+`state.md` (clears `Awaiting human`, sets `Status: running`), and recommends the next command.
+
+It has one verb, one source of truth (`questions.md`), and one cursor (`state.md`). The
+full AFK / HITL contract lives in
+[`afk-hitl.md`](../devrites-lib/reference/standards/afk-hitl.md).
+
+## Rules consulted (read on demand from `.pi/skills/devrites-lib/reference/standards/`)
+
+Pull these via `Read` when shaping the resolve:
+
+- `afk-hitl.md`: gate taxonomy, `questions.md` schema, AFK exception rules.
+- `documentation.md`: record decisions and rationale where the answer changes scope.
+
+## Operating rules
+
+- **Requires an active workspace.** Read `.devrites/ACTIVE` first; if empty, **STOP** and
+  tell the user to run `/rite-spec <feature>` first. If the slug has no `questions.md`,
+  report the missing required artifact and stop.
+- **One mutation per call.** A single qid (or `--batch` file) per invocation; never
+  silently coalesce multiple human decisions into one log entry.
+- **Never overwrite an answered question.** If the qid's `status` is `answered` or
+  `dropped`, refuse with the existing answer; ask the user to open a new qid that
+  references the old one (the file is the audit trail).
+- **If the answer materially changes scope, architecture, or acceptance**, route it
+  through the Spec Drift Guard (`/rite-plan repair`) **after** writing the answer: do
+  not modify `spec.md` / `plan.md` inside this skill.
+- **The script is the source of truth.** Always invoke
+  `devrites-engine state resolve`. It keeps `questions.md` + `state.md` consistent and emits the
+  next-action recommendation. The one `state.md` field this skill may write by hand is the
+  unblocked slice's `Slice mode` (step 4, the named exception); everything else goes through
+  the script, never by hand.
+- **Human gates are for human-only decisions, not the agent's work.** A `questions.md` entry the
+  human must answer is a genuine decision (a scope / design / risk call only the human can make),
+  not a task the agent can do. If a question is really agent-doable ("should I write the
+  test?", "go implement X"), do not record a human answer that returns the agent's work to it:
+  flag the mis-tag and route it to the right skill (`/rite-build`, `/rite-plan unblock`,
+  `devrites-debug-recovery`). The human resolves decisions; the agent does the work.
+
+## Workflow
+
+0. **Read `.pi/skills/devrites-lib/reference/standards/core.md`** (operating rules + persistence discipline) before
+   touching the workspace.
+   Then read the explicit or active workspace's `state.md` directly.
+1. **Parse arguments.** `$ARGUMENTS` is one of:
+   - `<qid> "<answer>"`: answer the single open question.
+   - `--drop <qid>` (optional `"<reason>"`): mark the question `dropped`; record
+     the reason inline.
+   - `--batch <path-to-file>`: bulk resolve, one entry per qid (see
+     [`reference/answer-protocol.md`](reference/answer-protocol.md) for the batch
+     format).
+2. **Load context.** Read `state.md`, `questions.md`, and the relevant slice from
+   `tasks.md`. Confirm the qid is `status: open`. If `state.md` `Status` is not
+   `awaiting_human` and the question's `gate` is `blocking`, surface the inconsistency
+   before proceeding (don't auto-repair: flag it).
+3. **Apply explicit consent.** Supplying `<qid> "<answer>"`, `--drop`, or `--batch` is the
+   user's explicit consent for this local workspace mutation. Echo the qid, answer/drop,
+   and slice being unblocked, then continue immediately; do not ask the user to confirm the
+   command they just typed.
+4. **Mutate.** Run `devrites-engine state resolve` with those arguments. It:
+   - flips the qid's `status` to `answered` / `dropped` and stamps `answered_at` + `answer`;
+   - if the qid is in `state.md`'s `Awaiting human` block (single-question pause), clears
+     that block and sets `Status: running`;
+   - appends a `Log` line to `state.md`.
+
+   On resume, also clear or update the unblocked slice's `Slice mode` in `state.md`: if
+   the answer lets the slice proceed, drop the pause-time `Slice mode` so `/rite-build`
+   re-derives it on the next selection; if the answer re-shapes how the slice should be
+   built, set `Slice mode` to match.
+5. **Post-resolve hand-off.** If the answer changes product behavior or acceptance →
+   recommend `/rite-plan repair`. Otherwise → recommend the slice's natural next action
+   (typically `/rite-build` for the slice that was awaiting).
+   **Completion:** the resolved state contains exactly one next command.
+6. **STOP.** This skill does not run `/rite-build` itself: the user re-enters the
+   workflow explicitly.
+
+> **Mid-flight discipline.** Don't edit `spec.md` / `plan.md` to "incorporate" the
+> answer. That's `/rite-plan repair`. Don't silently retry a build after the answer
+> lands: the user types the next command. Don't merge two open questions into one
+> answered entry: each question is independently auditable.