devrites 5.5.0 → 5.7.0

package/pack/generated/pi/skills/rite-vet/SKILL.md

@@ -0,0 +1,193 @@
+---
+name: rite-vet
+description: Review a defined engineering plan before code. Use for plan vetting or lock-in; not for implementation review or final readiness sealing.
+argument-hint: "[slug] [--cross-model] [--full]"
+user-invocable: true
+---
+
+# /rite-vet: review the plan before build
+
+Vet every plan's scope, architecture, quality, proof, performance, failures and writer
+safety. Fold cited technical findings; design Build tests. Temper owns product;
+Vet owns implementation; current `$ARGUMENTS` (`--full`) feeds the depth triggers in
+`reference/depth.md`; profiles never remove the exact plan-reviewer gate
+([orchestration-profiles.md](../devrites-lib/reference/orchestration-profiles.md)).
+
+## Rules
+
+Read the active standard from: `principles.md`, `patterns.md`, `coding-style.md`,
+`testing.md`, `spec-grammar.md`, `performance.md`, `error-handling.md`,
+`development-workflow.md`, `afk-hitl.md`, `one-shot-actions.md`,
+`developer-experience.md`, `elicitation.md`, and `definition-of-done.md`. Load
+repository topology, data integrity, and integration reliability only when
+triggered. Before classifying any Reslice, read `.pi/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+When a
+plan declares a root-authored executable workflow file, read
+`workflow-artifacts.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+## Invariants
+
+- Review implementation, not ambition. Challenge creep, complexity, proof, and
+  risk without changing accepted product scope.
+- Root owns decisions/writes/readiness; reviewers judge without route policy.
+  Cite findings/confidence; suppress
+  unverified or confidence ≤4 findings under `review-axes.md`.
+  Lens arrows in `eng-lenses.md` are heuristics; band findings only under the
+  four `review-axes.md` names.
+- Auth, migration, public API, and data-model changes use maximum caution and the
+  irreversible-risk stop. Project principles never become trade-offs.
+- **Governance-protected paths** (`.devrites/**`, pack skill/agent trees,
+  `NOTICE.md` generator regions, CI/hook config named in repo docs) require explicit
+  human approval before plan slices may edit them. A slice touching a protected path
+  without approval → Vet **NEEDS CLARIFICATION**.
+- Use the lowest axis band; never average or round thin to ready. Search before
+  asking and resolve reversible technical choices. Ask only human-owned choices.
+- Preserve a valid technical return cursor. Agent-owned `NEEDS REPLAN` returns
+  internally to its caller, not to the human; on a direct invocation there is
+  no caller, so Vet becomes it — save a return cursor
+  (`return_phase`/`return_next_action`) naming this Vet pass as the caller and
+  invoke `/rite-plan` repair inline under the same fingerprint caps. An
+  agent-owned verdict with budget remaining is never a user-facing command.
+- **Recovery recheck is bounded and batched.** A valid cursor plus open
+  fingerprints enters Recovery recheck; it does not start another Full Vet or
+  repeat unaffected axes/reviewers. One dispatch covers every open fingerprint
+  of the fold — each checked individually — with a mandatory correction-created
+  regression audit.
+<!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"plan declares root-authored executable workflow file","action":"emit exact admission; stale/missing authority uses PLAN_VET_REPAIR","return":"Vet READY cursor or exact technical replan"} -->
+## Workflow
+
+0. **Orient.** Read core. Resolve active slug, require state, and read plan,
+   tasks, spec, decision coverage, optional strategy/design brief, decisions,
+   assumptions, and state. Require approved Plan and `Decision coverage: CLEAR`;
+   otherwise stop for Define or Clarify. Use code intelligence for placement,
+   blast radius, and reuse.
+1. **Select depth.** Apply `reference/depth.md` exactly; never skip. Every initial
+   pass records an engineering verdict and test-plan coverage. A valid Recovery
+   recheck retains prior depth and enters 1b.
+1a. **Independent initial pass.** Freeze candidate and dispatch the exact fresh
+   read-only plan reviewer — plus developer-experience reviewer for developer
+   surfaces and the current strategy reviewer after significant Temper — in
+   parallel under `../devrites-lib/reference/parallel-dispatch.md`; they are
+   independent read-only passes on one frozen candidate. Missing
+   required account blocks.
+1b. **Recovery recheck.** Require valid return cursor, accepted prior finding,
+   exact fingerprint/reproduction, repaired candidate identity, changed
+   paths/criteria, affected drift/evidence, and the recorded delta self-check.
+   Freeze that packet and dispatch each exact owning reviewer once,
+   fresh/read-only, limited to it — all its open fingerprints in that dispatch.
+   Do not rerun broad inventory or unaffected reviewers. Close the prior
+   fingerprint only with discriminating evidence plus an explicit
+   correction-created regression verdict on the touched invariants (acyclic
+   deps, traceability, contract proof, sizing) and every region depending on a
+   changed clause — enumerate dependents via the dep graph and traceability
+   refs, not only patched sites. Otherwise record one no-progress outcome. A
+   different Critical/Important invariant needs exact evidence and a new
+   fingerprint; a Suggestion, Nit, or FYI cannot keep recovery open. Reviewer
+   `Late:` rows on unchanged clauses follow the canonical
+   [late-finding rule](../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve):
+   Critical with a failure path → new fingerprint; otherwise `eng-review.md`
+   `## Deferred findings` (mechanism rows become one proof row at step 6). A packet
+   marked `convergence_pressure` accepts an explicit, bounded declared
+   residual/limitation folded into the contract text as closure for a finding
+   marked as a refinement of an already-pinned clause; the recheck may re-raise
+   it only by naming a concrete failure path the declaration omits. A
+   `new_failure_mode` finding is never residual-eligible. A fold whose
+   findings are all Suggestion-or-lower rechecks mechanically at the
+   materialization gate — anchors applied, mirrors consistent, invariants
+   pass — without a dispatched reviewer; sub-Important findings already
+   cannot keep recovery open. Reconcile
+   shared artifact/readiness gates, then enter step 8 or the next repair.
+   Do not fall through to steps 2–7. Retain evidenced unchanged coverage; changed
+   global contract/uncertain impact requires full applicable review. Reopen historical
+   findings only for affected invariants/dependencies.
+2. **Challenge scope.** Apply review-axes §0 and search accepted decisions.
+   Harden to the smallest contract-complete plan, using marked topology action.
+   Then verify bidirectional ID-and-meaning traceability across spec/plan/
+   tasks/test-plan/traceability, acceptance, terms, principles, anti-slop,
+   and conventions; every slice and test-plan row maps to a live requirement
+   and vice versa. Critical gaps and
+   unexcepted principle breaches block; record the challenge result in `eng-review.md`
+   §2 (Scope challenge) after recheck.
+3. **Preflight Build entry.** Under `reference/artifacts.md`, verify exact
+   command/cwd/tool/version/prerequisite; output filters must preserve upstream
+   failure. Verify dependencies from authoritative source plus nearest manifest.
+   Run parser-sensitive syntax only in isolated fixtures. Remeasure mutable facts;
+   live evidence wins, conflict marks stale, and unmeasurable conflict is a gap.
+   Record complete SHA-256 provenance. Every behavioral mapping names a positive
+   discriminating assertion and decisive signal, never only exit zero.
+
+   For each consumptive action, bind every `reference/artifacts.md` Consumptive
+   action gates column; every fingerprint identifies one actionable seam; aliasing multiple
+   emit sites is a gap. Preflight observes but need not make future behavior pass.
+4. **Audit readiness.** Goal-backward map every requirement, criterion, NFR,
+   interaction, edge/prohibition, and decision row to one slice and executable
+   proof. Verify UX/spec/architecture alignment, contracts, dependency order,
+   slice independence/wiring, prerequisites, failure/observability/rollback, and
+   ownership. The plan's `Shared contract proof` names one reused boundary
+   artifact plus two consuming tests for every changed API/event/schema/provider-
+   consumer seam, or an explicit no-impact statement. Missing, one-sided,
+   duplicated-contract, vague, or non-consuming proof fails closed.
+
+   Technical gaps are `NEEDS REPLAN` and Plan repair — each finding marks
+   itself `new_failure_mode` or names the already-pinned clause/fingerprint
+   it refines, making alias-detection and `convergence_pressure` eligibility
+   mechanical — and carries `kind: contract | mechanism`
+   (`review-axes.md` § Finding kind). Only `contract` findings open a Plan
+   repair; a `mechanism` finding is closed by one `test-plan.md` proof row
+   at step 6 and leaves readiness intact when nothing else is open.
+   Product/risk gaps are
+   `NEEDS CLARIFICATION` and Clarify. Neither becomes a Build qid.
+5. **Review axes.** Apply `review-axes.md` through `eng-lenses.md`. Fold verified
+   behavior-preserving technical findings; walk only human-owned decisions.
+   Profile gate ceiling and Reslice marked action remain authoritative.
+6. **Write outputs.** Produce every artifact in `reference/artifacts.md`. After
+   editing intent/decision/assumption/question owners, re-scan affected coverage,
+   assumptions, uncertainty, and gates. Keep state non-READY. Every scenario and
+   criterion needs positive, discriminating proof; every slice must be one-pass
+   implementable; developer plans need a predicted scorecard. Durable commands
+   are portable repository commands, not host wrappers.
+7. **Narrow recheck after edits.** Dispatch the exact plan reviewer once per
+   fold — one dispatch covering every open fingerprint, preserving
+   per correction/fingerprint accounting (each checked individually with its
+   accepted findings, changed paths/criteria, new identity, and recorded delta
+   self-check); it must return an explicit correction-created regression
+   verdict over touched invariants plus every dependent of each changed clause
+   (dep-graph and traceability lookup), not only fingerprint closure. Within one correction, no broad
+   third loop. If it changes plan, fold again. A closed input plus a distinct Critical/Important invariant returns
+   that new fingerprint as progress. Then close matrix and rerun ID/meaning audit.
+8. **Build readback and readiness.** Add a cited five-line readback to
+   `eng-review.md` (artifacts.md §7 rows 1–5): outcome/ACs; IN/OUT/must-NOT; UI direction and architecture/
+   critical flow; slice order/first slice; decisive proof/action-time gates. No implementer should need to invent product, architecture, or proof.
+   Contradiction, ownerlessness, or material ambiguity blocks via Clarify or Plan.
+
+   Write exactly one `Implementation readiness: READY`, `NEEDS CLARIFICATION`,
+   or `NEEDS REPLAN`. Root sets READY after every account, checklist,
+   preflight, and sweep is green. Write phase/next step and emit one
+   `Readiness inputs SHA-256` with
+   `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
+   must pass. Technical failure records reproduction, not qid. Human gap awaits
+   Clarify. Optional cross-model follows `reference/cross-model.md`.
+
+   With READY, no pending remediation, and a valid technical return cursor,
+   restore and consume the return cursor instead of defaulting to Build. Preserve
+   it through admitted remediation. Only a real stop reaches the human.
+9. **Stop at the Vet boundary.** Show Build readback, scope verdict, lowest axis,
+   closed gaps, preflight, action checkpoints, and critical failures. Recommend
+   Build only when READY.
+
+> Do not replace interactive review with artifacts, change acceptance through
+> hardening, score without source evidence, or ignore unexplained complexity.
+
+## Phase exit
+
+**Complete when:** `eng-review.md` records exactly one readiness verdict, readiness
+binding SHA-256 passes, and every required reviewer account is admitted.
+
+**Failing case:** READY written while a required reviewer returned `Outcome: gap` →
+not complete; restore NEEDS REPLAN or dispatch missing reviewer.

package/pack/generated/pi/skills/rite-vet/reference/anti-patterns.md

@@ -0,0 +1,43 @@
+# /rite-vet: anti-patterns
+
+Read [universal anti-patterns](../../devrites-lib/reference/standards/anti-patterns.md).
+
+Authority: `.pi/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+## Phase rationalizations
+
+| Excuse | Rebuttal |
+|---|---|
+| "I'll write all the findings into `eng-review.md` and let the user read it." | Fold verified behavior-preserving findings together and recheck affected closure. Ask human-owned choices with recommendations and await answers. Recording alone resolves nothing; never silently change acceptance or mark unresolved choices READY. |
+| "The plan doesn't handle X: flag it." (without checking) | Quote the line first. If you can't quote where the plan handles X, you also can't be sure it doesn't: force confidence ≤4 and suppress. The "field/case doesn't exist" finding is the most common false positive; the verification gate exists to kill it. |
+| "It's an obvious fix. I'll just edit the plan." | Vet hardens verified plans; topology uses the marked action. |
+| "This dimension is thin but the others are strong: net it's fine." | The gate is the **floor**, not the average. A plan `broken` on test-coverage does not pass because it's `strong` on architecture. |
+| "I can see it's adequate. I'll note the band, the evidence is obvious." | Cite quoted evidence **before** the band; never score first and rationalize later. |
+| "8+ files but it all needs to change: proceed." | Apply `review-axes.md` §0: justify complexity against the smallest contract-complete alternative; fold technical reductions through the marked action. File count does not justify design or require a pause. Ask only for changed scope, behavior, or risk policy. |
+| "There's no test for this, but the user can add one later." | Coverage is designed **now**, before the code, so the build writes tests alongside it. A deferred test is a test that misses the boundary cases writing-it-now would expose. Regressions are non-negotiable. Critical, no question. |
+| "Performance looks fine." | "Looks fine" is not a measurement. A perf finding is "measure X against budget Y" or it's nothing: don't recommend speculative tuning, and don't wave past an N+1 you can quote. |
+| "Cross-model agrees, so apply it." | Consensus is a signal, not proof or approval. Verify the finding against source, then use the same technical-hardening or human-owned decision route; model agreement never authorizes a scope, acceptance, or policy change. |
+
+## Reslice classifier rationalizations
+
+**RSLICE-VET-001** — Slice/topology growth alone does not stop; fewer slices do not prove scope reduction; remediation does not grow product.
+
+## Red flags
+- `eng-review.md` / `test-plan.md` written but `plan.md` / `tasks.md` **not** hardened: the build
+  follows the plan, so the review changed nothing.
+- A finding raised with confidence ≥7 but **no quoted source line**, that defeats the verification gate.
+- Acceptance/product-behavior growth auto-applied in AFK, or an orthogonal human-owned gate that did not pause.
+- A failure-mode table with rows but no verdict column filled: a "no test + no handling + silent" row not marked Critical.
+- Repeating an exhausted causal failure under the shared no-progress rule in
+  [`afk-hitl.md`](../../devrites-lib/reference/standards/afk-hitl.md), or stopping a
+  distinct cause solely because the total review round exceeds three.
+- The reviewer / cross-model being handed the author's reasoning as independent
+  evidence (defeats the fresh-context point).
+- The skill writing code, implementing a slice, or running the build. That's `/rite-build`. Vet reviews and hardens the plan; it never implements.
+- Re-litigating the **spec's** scope/ambition, that was `/rite-temper`. Vet challenges *implementation* scope only.

package/pack/generated/pi/skills/rite-vet/reference/artifacts.md

@@ -0,0 +1,202 @@
+# `eng-review.md` + `test-plan.md` templates + fold-back rules
+
+`eng-review.md` records review; `test-plan.md` drives Build. Fold accepted findings
+into `plan.md`/`tasks.md`; prose alone never changes Build.
+
+Authority: `.pi/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+## `eng-review.md`: the record
+
+Write/update `.devrites/work/<slug>/eng-review.md`; never clobber.
+
+```markdown
+# Eng review: <slug>
+Vetted: <iso>   Cross-model: ran (codex) | off
+Implementation readiness: <READY | NEEDS CLARIFICATION | NEEDS REPLAN>
+(`NEEDS REPLAN` is the eng-review field value; `NEEDS_REPLAN` with an underscore
+is the autocomplete/reply-contract routing token — do not conflate.)
+Readiness inputs SHA-256: <64 lowercase hex>
+
+## 1. Depth
+light | full (<trigger that escalated it>)     # every plan is vetted — light or full, never skipped (see depth.md)
+
+## 2. Scope challenge
+- Existing reuse: <findings adopted by the plan>
+- Minimum diff: <accepted | trimmed n; list in NOT-in-scope>
+- Complexity: ok | smell (<n files, m new services) → asked → <reduce|proceed, why>
+- Built-in / completeness / distribution: <flags, with source citations>
+
+## 2a. Build-entry preflight
+| Gate | Command + cwd | Tool/version | Prerequisite owner | Full provenance inputs | Fixture/smoke | Verdict |
+|---|---|---|---|---|---|---|
+| <test/browser/package> | <command · cwd> | <version> | <owner + item> | <tool/manifest/lockfile/config SHA-256> | <what ran> | pass/fail/blocked |
+
+## 2b. Implementation readiness
+| Surface | Requirement/decision | Boundary/wiring | Slice | Proof | Verdict |
+|---|---|---|---|---|---|
+| <journey/data/interface/ops> | <REQ/AC + coverage row> | <contract + key link> | <SLICE-###> | <test-plan row> | ready/gap |
+
+Inventory/currentness: <pass/gaps> · slice order/independence: <pass/gaps> ·
+UX/spec/architecture: <pass/n-a/gaps> · operations/rollout/rollback: <pass/n-a/gaps>
+
+Shared contract proof: <pass | gap: missing/one-sided/duplicated-contract/vague/non-consuming>
+One-shot evidence completeness: <n/a | pass: action + retained artifact + bounds/sanitization + injective boundary map + per-seam/collision/cleanup fixtures | gap: exact missing proof>
+
+## 3. Axis findings (floor-gated)
+| Axis | Floor band | Findings (sev · confidence) |
+|---|---|---|
+| Architecture | strong/adequate/thin/broken | Critical (9) … |
+| Plan code-quality | … | … |
+| Test-coverage design | … | see test-plan.md |
+| Performance | … | … |
+Suppressed (confidence ≤4, unverified): <count — one line each>
+
+## 4. Failure modes
+| New codepath/boundary | Realistic failure | Partial/unknown effect | Recovery owner/path | Proof? | Silent? | Verdict |
+|---|---|---|---|---|---|---|
+| <path> | timeout / duplicate / race / stale | <state/effect> | <owner/action> | y/n | y/n | ok / **CRITICAL gap** |
+
+## 5. Dependency safety
+<declared order is safe | exact dependency/order correction>
+
+## 6. Native reviewer accounts
+- `devrites-plan-reviewer`: <findings + resolution | evidence-based No-findings>
+- `devrites-strategy-reviewer`: <current Temper verdict | Not-applicable: low-stakes skip>
+- `devrites-devex-reviewer`: <findings + resolution | No-findings | Not-applicable: no developer surface>
+- Recheck: <not-needed | one narrow recheck and result>
+- Cross-model (if --cross-model): <overlap / unique findings — informational until approved>
+- Final: floor = <band>; unresolved → <none | blocking qid>
+
+## 7. Completion summary
+- Outcome: <one sentence; REQ/AC refs>
+- Boundaries: <IN/OUT/must-NOT refs>
+- Design/flow: <UI/n-a; chosen seams/why; happy/error refs>
+- Delivery: <slice order + first>
+- Proof/gates: <test-plan rows; justified action-time gates>
+- Review: scope <accepted/reduced>; architecture <n>; quality <n>; coverage <x/y>,
+  gaps <n>, Critical regressions <n>; failure modes <n>, Critical gaps <n>.
+- Entry/records: preflight <pass/fail/blocked>; checkpoints <none/list>;
+  NOT-in-scope + existing written; plan <hardened | n Guard deltas>.
+```
+
+## `test-plan.md`: the build-readable coverage target
+
+Write/update `.devrites/work/<slug>/test-plan.md`. `/rite-build`'s slice-wright
+writes tests from it; `/rite-prove` walks it against `evidence.md`. Specify
+*what/where* to test, not implementation.
+
+```markdown
+# Test plan: <slug>
+From /rite-vet on <iso>. Runner + conventions: <detected framework + command>.
+
+## Build-entry preflight
+| Gate | Command | Cwd | Expected | Prerequisites | Provenance to recapture |
+|---|---|---|---|---|---|
+| <test/browser/package> | <exact command> | <path> | <exit/output> | <service/browser/credential owner> | <tool version + full SHA-256s> |
+
+Link any disposable parser fixture. Preflight values are planning evidence, not post-build proof;
+Prove recaptures the observed command, candidate identity, and result.
+
+Commands in this durable artifact are portable repository commands: no RTK or local shell
+aliases, user-specific absolute paths, or temporary proof trees. Evidence records
+the command actually executed.
+
+## Consumptive action gates
+| Action | Why one-shot/consumptive | Retained artifact | Bounds + sanitization | Boundary map + collision proof | Terminal-path fixtures | Cleanup survival | Retry authority |
+|---|---|---|---|---|---|---|---|
+| <exact approved action or n/a> | <one attempt/quota/state/evidence deletion> | <durable operator-controlled path/schema> | <size/cardinality + known/unknown/malformed handling> | <every emit seam -> stable boundary ID; per-seam injection + alias mutant rejected> | <success/known/unknown/hostile> | <assertion> | <none/fresh human authorization> |
+
+Every behavioral row names a positive, discriminating assertion and the decisive output it
+produces. A command or expected exit zero alone is not a behavioral assertion; static gates
+prove only their named static criterion.
+
+## Coverage diagram
+<the ASCII code-paths + user-flows diagram from review-axes.md, with COVERAGE / GAPS / REGRESSIONS line>
+
+## Per-gap test requirements
+| ID | Path / flow | Test file (match conventions) | Asserts (input → expected) | Kind | Slice | Priority |
+|---|---|---|---|---|---|---|
+| T1 | <path> | <path/to.test> | <empty list → 200 + []> | unit / E2E / eval | <slice> | P1 / **Regression-Critical** |
+
+## Interaction inventory (UI slices — every element + flow gets an asserting test)
+Enumerate every interactive element and user flow the feature exposes; one row each, none
+skipped. Level per `testing.md` "Completeness": elements/fields → unit/component, critical
+journeys → one E2E (never one-per-field). `/rite-build` must cover every row; `/rite-prove`
+fails any row with no passing result — an unverified element is a NO-GO, like an unproven criterion.
+```markdown
+| Element / flow | Kind (field/checkbox/select/radio/toggle/button/link/flow) | Level | Test file | Asserts (action → expected) |
+|---|---|---|---|---|
+| email field | field | unit | <form.test> | invalid → error; valid → accepted |
+| login | flow ★★★ | E2E | <login.e2e> | submit → dashboard |
+```
+
+Omit the whole section only for a slice with **no** interactive surface (pure backend/logic).
+
+## Acceptance → test map
+
+- <spec acceptance criterion> → <T1, T3>   # every criterion maps to ≥1 test
+
+For every row in `plan.md`'s `Shared contract proof`, the per-gap requirements name both
+provider- and consumer-side asserting tests and state how each consumes the same canonical
+artifact. Reference the plan row; do not reproduce its contract table here.
+
+## Parallelization table (in `eng-review.md` §5 when there's an opportunity)
+
+```markdown
+| Step / workstream | Modules touched (dir-level) | Depends on |
+|---|---|---|
+| API endpoints | controllers/, serializers/ | — |
+| Worker | jobs/, lib/queue/ | API endpoints |
+
+Lanes:  A: API → Worker (sequential, shared lib/)   ·   B: migration (independent)
+Order:  launch A + B in parallel worktrees → merge → C
+Conflicts: Lanes A and B both touch models/ — sequential or coordinate.
+```
+
+## Fold-back: the part the build follows
+
+Vet hardens the plan. Use the marked action before fold-back.
+
+- **Write directly into `plan.md` / `tasks.md`** (single canonical writer: you, not the reviewer):
+  - `plan.md` §Scope boundaries ← "NOT in scope" items.
+  - `plan.md` §Architecture decisions ← reuse-over-rebuild calls + named failure scenarios.
+  - `plan.md` §Applicability and system ownership ← corrected topology/data/integration
+    routing and each triggered standard's feature-specific output.
+  - `plan.md` §Dependency graph / §Implementation order ← any dependency or ordering fix
+    (e.g. refactor-before-feature split).
+  - `plan.md` §Complexity & deviations gate ← any deviation the §0 challenge surfaced + its justification.
+  - `tasks.md` slices ← added test requirements (point at `test-plan.md`), added error-handling /
+    failure-mode coverage, tightened slice scope, a split of a refactor+behavior slice into two.
+    Adjust a slice's `Gate:` upward when vet reveals higher stakes (e.g. an unflagged migration).
+  - Re-run the `plan.md` Readiness gate after edits; it must still pass.
+- **Reslice:** marked action only; no local predicate.
+- **`decisions.md`:** one ADR per material call: `context · decision · why-not-the-alternative ·
+  what-would-change-it`.
+- **`assumptions.md`:** every "we'll probably need X" demoted to an explicit assumption-to-verify,
+  never smuggled into scope as a fact.
+
+## Write discipline
+
+- **Single canonical writer.** The skill writes review/test-plan and edits plan/tasks;
+  `devrites-plan-reviewer` is **read-only** and returns findings + bands.
+- **No silent scope.** Growing acceptance without a decision, or dropping a criterion
+  without the Guard, is a defect.
+- Put `eng-review.md` + `test-plan.md` between `tasks.md` and `state.md`. Build/Prove
+  read test-plan as coverage; Review/Seal may consult eng-review for scope/failures.
+- Finish `test-plan.md`, fold-back, and rechecks first. Changes to `brief.md`, `spec.md`,
+  `decisions.md`, `assumptions.md`, or `questions.md` require revalidating the
+  affected decision-coverage rows, assumption audit, residual uncertainty, and closed gates.
+  Partial/Missing, an unowned material assumption, or an open blocking/escalating question routes
+  `/rite-clarify`/HITL. Re-read affected rows with current evidence; repeat the exact
+  plan-reviewer and applicable strategy/DevEx after edits. Root writes READY only after
+  the checklist. Normal readiness rejects missing/stale bindings; empty tables,
+  placeholders, non-passing preflight rows, or an
+  acceptance criterion with no meaningful test mapping remain native review blockers.
+  After the final recheck, emit the binding with `devrites-engine check readiness
+  --emit-binding <slug>` and replace its one exact line. Never refresh it without Vet.

package/pack/generated/pi/skills/rite-vet/reference/cross-model.md

@@ -0,0 +1,19 @@
+# `--cross-model`: explicit outside integration
+
+This optional pass runs only when the user supplies `--cross-model` and a
+different-model plugin, MCP server, or other native integration is explicitly
+connected. DevRites does not discover aliases, invent a fallback model, or wrap
+availability.
+
+Give the integration the same immutable `spec.md`, `plan.md`, and `tasks.md`
+candidate, without author reasoning. Ask for evidence-backed findings on
+boundaries, scope/reuse, proof design, performance, reversibility, and failure
+modes. The integration must remain read-only.
+
+If no explicit integration is connected, record `requested but not configured`
+and continue with the native `devrites-plan-reviewer`; absence is neither a pass
+nor a blocker.
+
+Verify every returned finding against the project before accepting it. Record
+only the integration used and accepted evidence in `eng-review.md`; do not
+maintain availability aliases or outside-review telemetry.

package/pack/generated/pi/skills/rite-vet/reference/depth.md

@@ -0,0 +1,59 @@
+# Depth calibration: always vet, scale the rigor (never skip)
+
+`/rite-vet` runs on **every** plan. Simple reversible work gets a **light pass**;
+big/risky work gets a **full pass**, never a skip. Standalone Vet and Autocomplete
+use these same depth rules.
+
+A four-section deep-dive on a one-file reversible plan is wasteful; rubber-stamping a
+migration-touching plan is dangerous. Match the effort to the stakes, but **always** leave a
+recorded engineering verdict and a coverage plan.
+
+Authority: `.pi/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+## Full pass when ANY trips
+- **Irreversible-risk contact:** the plan touches anything on the `afk-hitl.md` irreversible-risk
+  list: destructive data migration, auth/authz boundary, public-API break, external-service
+  contract, filesystem destruction outside the workspace.
+- **Data model:** new/changed entities, relationships, or persistence shape.
+- **Cross-module blast radius:** the impact (from a code-intelligence index if available (see
+  `../../devrites-lib/reference/standards/tooling.md`) or an honest estimate) crosses
+  module/service boundaries or has many dependents.
+- **Complexity:** `plan.md` touches **>8 files** or adds **>2 new services/modules/classes**.
+- **Multi-slice / multi-day work**, new dependency/pattern/design system. Slice count alone never creates a human pause.
+- **The user asked**, or `--full`.
+
+Full pass = §0 scope challenge + all four axes (each walked finding-by-finding) + the failure-mode
+table + dependency-safety review + the reviewer loop. See [`review-axes.md`](review-axes.md).
+
+## Light pass otherwise (the default for simple plans: still never a skip)
+When none of the full-pass triggers fire, run the **light pass**: a fast but real engineering
+check that still leaves a verdict and a coverage plan. In a handful of lines:
+- **§0 scope challenge, in brief:** confirm minimum diff + reuse (one line each); if a complexity
+  smell or missed reuse appears, escalate that to the full treatment.
+- **One-line scan per axis** (architecture / plan code-quality / test-coverage / performance):
+  "No issues" is a valid result, but you must look and say so per axis, not assume.
+- **Always** produce the acceptance→test map + any regression-Criticals in `test-plan.md`. This is
+  the part that makes "a correct engineering plan for *everything*" real. It never downgrades,
+  light or full.
+- Write the short `eng-review.md` (`Depth: light`) and harden `tasks.md` with the test requirements.
+
+A light-pass finding that turns out to be real **escalates that axis to full treatment** (walk it
+with the human, confidence-banded). Light means *less ceremony*, never *less honesty*.
+
+## In `/rite-autocomplete`
+Autocomplete runs `/rite-vet` after `/rite-define` on **every** feature: light or full per the
+triggers above, **never skipped**. Under the AFK gate ceiling:
+- **Auto-apply (no pause):** hardening findings: added test requirements, error-handling /
+  failure-mode coverage, tightened scope, reuse-over-rebuild, dependency-order fixes
+  (these never grow acceptance). Record the rationale in `decisions.md`.
+- **Topology findings:** marked action; slice count alone never pauses.
+- **Stops:** human-owned irreversible-risk findings pause. Technical recovery follows
+  [the canonical retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve),
+  with no depth-specific round limit; no-progress exhaustion blocks, never grants readiness.
+- **Cross-model** is off by default; it runs only if `--cross-model` was explicitly armed.

package/pack/generated/pi/skills/rite-vet/reference/eng-lenses.md

@@ -0,0 +1,48 @@
+# Senior-engineer lenses: how to *see* the findings
+
+These are not extra checklist items. They are the instincts an experienced staff engineer
+applies while reading a plan: the pattern recognition that separates "read the plan" from
+"caught the landmine". Apply them across all four axes in [`review-axes.md`](review-axes.md):
+each lens turns a vague unease into a concrete, quotable finding.
+
+## The lenses
+
+1. **Boring by default.** A team gets a few innovation tokens; everything else should be proven
+   technology. When the plan introduces something novel (a new datastore, a hand-rolled queue, a
+   bespoke pattern), ask whether this is a wise token to spend or whether a boring built-in does
+   it. → Architecture / Scope axes.
+2. **Blast radius.** For every decision: what's the worst case, and how many systems / callers /
+   users does it touch? A change with wide blast radius and no rollback is a different risk class
+   than a leaf change. → Architecture / Reversibility.
+3. **Reversibility preference.** Prefer the choice that's cheap to undo (feature flag, additive
+   migration, incremental rollout) over the one that's right only if you're right the first time.
+   Make the cost of being wrong low. → Architecture / Reversibility.
+4. **Incremental over revolutionary.** Strangler-fig, not big-bang rewrite; refactor first, then
+   change behavior: never both in one slice. If the plan does a structural rewrite and a behavior
+   change together, split them. → Plan code-quality / slice shape.
+5. **Systems over heroes.** Design for a tired engineer at 3am, not your sharpest engineer on
+   their best day. A plan that only works if every step is done perfectly is fragile. Favor
+   guard rails, explicit errors, and obvious failure paths. → Code-quality / Failure modes.
+6. **Essential vs accidental complexity.** Before anything the plan adds, ask Brooks's question:
+   is this solving a real problem, or one we created? Accidental complexity is the cheapest thing
+   to cut. → Scope / Code-quality.
+7. **Make the change easy, then make the easy change.** If a slice is hard because the surrounding
+   structure fights it, the first move is a (separate, behavior-preserving) refactor: call it out
+   so the plan sequences it before the feature work, not tangled into it. → Plan code-quality.
+8. **Failure is information.** Every new codepath fails *somehow* in production: timeout, nil,
+   race, stale data, partial write. The plan should name the failure and decide: test it, handle
+   it, or accept it loudly (never silently). → Failure-mode coverage.
+9. **DX is product quality.** Slow CI, painful local dev, untestable seams → worse software over
+   time. If the plan makes the code harder to test or run locally, that's a real finding, not a nit.
+   → Test-coverage / Code-quality.
+10. **Trust boundary discipline.** Every untrusted input crosses an explicit validation + authz
+    boundary before it reaches trusted core logic. A plan that lets a value skip the boundary is a
+    security finding even pre-code. → Architecture / Security seam.
+
+## Using them
+- A lens is a *prompt*, not a verdict. It turns "something's off here" into a finding you can
+  quote and band. If a lens fires, follow it to the specific plan line, then run it through the
+  confidence + verification gate.
+- Don't recite the lenses in the output: recite the *findings* they produced.
+- When a plan is genuinely clean against a lens, that's worth one line of evidence ("Reversibility:
+  additive migration + flag: strong"), not silence; it shows the lens was applied.