devrites 6.0.3 → 6.1.0

package/pack/generated/codex/skills/devrites-lib/reference/parallel-dispatch.md

@@ -4,7 +4,7 @@ Host dispatch; DevRites governs.
 
 ## Roster
 
-Review: Spec/Code; Seal: all applicable roles.
+Review: Spec/Code plus triggered frontend/security/performance; Seal: all applicable roles.
 
 | Reviewer | Fires | Trigger |
 |---|---|---|
@@ -34,12 +34,13 @@ If the candidate diff has no matching surfaces, record
    unverified independence is a gap. Do not launch a probe agent per task;
    still validate each result's context and candidate.
 2. Build each reviewer's read-set once with
-   `devrites-engine context <slug> --phase <p> --role <role> --trigger <set>` and
+   `devrites-engine context --skills-root .agents/skills <slug> --phase <p> --role <role> --trigger <set>` and
    hand the bundle path as the packet's source list instead of a file roster.
    Build roles add `--slice <SLICE-ID>` (slice-scoped, slice-named bundle).
    Evaluate the skill's trigger conditions and pass each that fires — a role's
-   Trigger column maps to manifest names: `security-auditor` → `security`,
-   `frontend-reviewer` → `ui`/`frontend`, `performance-reviewer` → `performance`.
+   Trigger column maps to the phase manifest's names: `security-auditor` →
+   `security`; at Review, `frontend-reviewer` → `ui` and `performance-reviewer` →
+   `performance`. Seal declares neither; those roles load their own standards.
    The `agents` dispatch contract needs no flag: `--role` auto-fires it
    (`auto=[agents]` in the output). The command prints `unselected=[...]`; an
    omitted applicable trigger is a gap, not a shortcut.
@@ -97,7 +98,7 @@ in `review.md`/`seal.md`.
   the same wave (`dispatch open ... --role code-reviewer.frontend --role
   code-reviewer.backend`; distinct handles — the sealed wave's handles and start
   stamps are the concurrency receipt). Build each bundle with `devrites-engine
-  context <slug> --phase <p> --role code-reviewer --trigger <set> --out
+  context --skills-root .agents/skills <slug> --phase <p> --role code-reviewer --trigger <set> --out
   ctx/<p>-code-reviewer.<lane>.bundle.md`; the default name collides. Each packet
   names its lane, the lane's path set (the whole diff stays readable for context),
   the triggered profile ([`review/README.md`](standards/review/README.md)), and the

package/pack/generated/codex/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -136,9 +136,10 @@ every completed round (serial slice or parallel integrate)
 
 ## Unattended resource envelope
 
-AFK writer admission needs a bounded input queue, effective slice cap, and valid
-`max_agents`, `max_minutes`, and `max_review_queue`. Existing sentinels
-that declare writer admission but miss/malform these fail closed; cold resume keeps the
+Outside `$rite-autocomplete`, AFK writer admission needs a bounded input queue,
+effective slice cap, and valid `max_agents`, `max_minutes`, and `max_review_queue`.
+Existing sentinels that declare writer admission but miss/malform these fail closed
+(Autocomplete's sentinel omits them as unlimited; see below); cold resume keeps the
 state-owned slice counter. A leftover `expires_at` is ignored and never rewritten.
 Read-only watchers use equivalent native caps from [`loop-operations.md`](loop-operations.md).
 
@@ -304,7 +305,7 @@ Three shapes:
 ```
 $rite-resolve <qid> "<answer>"
 $rite-resolve --drop <qid> ["<reason>"]
-$rite-resolve --batch <path-to-yaml>
+$rite-resolve --batch <plain-text-file>
 ```
 
 `$rite-resolve` is the canonical writer for **async** resume: a gate that already paused and

package/pack/generated/codex/skills/devrites-lib/reference/standards/agents.md

@@ -41,7 +41,7 @@ Skills name exact fresh roles, omit native fields;
 hosts spawn/wait/deliver. Root MUST NOT advance/claim completion before admitting required results;
 running/orphaned/unavailable = `gap` — no root/generic substitute.
 Where a feature workspace exists, every fresh dispatch to a named `devrites-*`
-role — wave or solo — builds its read-set with `devrites-engine context <slug>
+role — wave or solo — builds its read-set with `devrites-engine context --skills-root .agents/skills <slug>
 --phase <p> --role <role>` and tracks the launch through `devrites-engine
 dispatch <slug> open|start|seal|return` (a solo dispatch is a wave of one;
 start/return auto-record metrics). Without a workspace the plain host dispatch

package/pack/generated/codex/skills/devrites-lib/reference/standards/ci-cd.md

@@ -46,7 +46,8 @@ Keep incomplete or risky behavior disabled behind a flag so deploy and release r
   gates precede exposure.
 - Feature flags separate exposure only when both states are tested, the off path preserves
   current behavior, and disabling the flag stops the risky effect. A flag cannot undo an
-  already destructive schema or data change.
+  already destructive schema or data change. Each flag names its removal trigger (full
+  rollout or kill); a flag past its trigger is dead code ([`deprecation.md`](deprecation.md)).
 
 ## Secrets
 

package/pack/generated/codex/skills/devrites-lib/reference/standards/code-review.md

@@ -33,7 +33,7 @@ If it does not, do not merge it.
    `devrites-engine check windows` flags the mechanical subset (suppressions,
    skip/focus, stubs, empty catch, deleted tests, stripped assertions) against
    `windows.md` waivers; loosened thresholds remain this sweep's judgment.
-3. **Correctness:** logic, edge cases, error paths, race conditions, wrong assumptions. For branching or boundary changes, run the [`edge-case trace`](edge-case-trace.md): relevant probe classes, fixed-set siblings, real wiring, negative intent, and deletion contracts with an evidence disposition.
+3. **Correctness:** logic, edge cases, error paths, race conditions, wrong assumptions. A join, match, upsert, or dedupe keyed on a mutable or non-unique attribute (email, name, title) instead of a stable ID is a finding ([`data-integrity.md`](data-integrity.md)). For branching or boundary changes, run the [`edge-case trace`](edge-case-trace.md): relevant probe classes, fixed-set siblings, real wiring, negative intent, and deletion contracts with an evidence disposition.
 4. **Readability:** names, function size, control flow, intent obvious without the author.
 5. **Architecture:** right seam, coupling/cohesion, fits existing patterns, no premature
    abstraction. Check how it fits the larger system as well as its local behavior.

package/pack/generated/codex/skills/devrites-lib/reference/standards/core.md

@@ -3,7 +3,7 @@
 > Applies when: always; every workspace rite reads it first.
 
 Each workspace rite reads core first. Its `loads:` manifest `always` set is its required
-read-set (`devrites-engine context <slug> --skill <name>` where a workspace exists, else
+read-set (`devrites-engine context --skills-root .agents/skills <slug> --skill <name>` where a workspace exists, else
 read the listed files); a trigger's files load when its named condition holds. Load any
 other rule file from `README.md` on demand.
 

package/pack/generated/codex/skills/devrites-lib/reference/standards/data-integrity.md

@@ -13,6 +13,10 @@ declared invariants.
 Name before planning implementation:
 
 - the authoritative owner of each fact and every writer;
+- the stable identity key of each record: joins, matches, upserts, and dedupes key on
+  an immutable unique ID, never on a mutable or non-unique attribute (email, name,
+  title, path); **failing case:** two accounts share an email, or a user changes it,
+  and the match merges or orphans their records;
 - uniqueness, referential, ordering, range, and lifecycle invariants;
 - tenant/subject partition keys and authorization boundary;
 - transaction boundary and externally visible commit point;

package/pack/generated/codex/skills/devrites-lib/reference/standards/developer-experience.md

@@ -77,6 +77,11 @@ touches:
   carries meaning by colour alone; a status only colour conveys is a finding.
 - **Docs accuracy:** examples are copy-pasteable and correct, the signature in the docs matches
   the code, and changed behavior updated its docs in the same change ([`documentation.md`](documentation.md)).
+- **Agent use:** a coding agent is now a common consumer. Can it complete the flow with no
+  human step: non-interactive flags or env for every prompt, machine-readable output and
+  distinct exit codes where scripts consume results, setup and auth that run headless, and
+  docs that give commands rather than "click here" UI steps? A step only a human can do is
+  friction; name it.
 
 ## Measure, don't assert
 

package/pack/generated/codex/skills/devrites-lib/reference/standards/loop-operations.md

@@ -38,6 +38,9 @@ Every unattended loop must name:
 2. **Objective:** one active workspace or one read-only external observation.
 3. **Cycle:** one documented skill invocation; no hidden command chain.
 4. **Evaluator:** the skill's existing readiness, proof, review, or watcher verdict.
+   A cycle may add proof but never loosens or retargets what judges it (a test, gate,
+   threshold, benchmark, or fixture) to pass; an unattended optimizer overfits whatever
+   it can touch. An objective with no verifiable evaluator is not loopable; it stays HITL.
 5. **Budget:** every applicable `.devrites/AFK` resource cap.
 6. **Checkpoint:** durable workspace/evidence update before the turn ends; a
    `devrites-engine check regression <slug> --update` ratchet after each durable

package/pack/generated/codex/skills/devrites-lib/reference/standards/performance.md

@@ -15,6 +15,8 @@ Measure first. An optimization without a measurement is a guess that adds comple
 ## Optimize responsibly
 - Fix the **measured** bottleneck, then **re-measure** to prove the win (before/after).
   An optimization that doesn't move the number is just added complexity: revert it.
+  A win counts only while behavior proof stays green on an unchanged workload; tuning
+  the benchmark, fixture, or workload to the candidate games the number and is a finding.
   Keep compact failed and neutral experiment notes in the existing evidence:
   hypothesis, change, comparable measurements, and keep/revert decision. Do not
   create a separate experiment framework or ledger.

package/pack/generated/codex/skills/devrites-lib/reference/standards/skill-authoring.md

@@ -220,12 +220,17 @@ human approval — owned by [`security.md`](security.md) § Prompt-injection and
 Behavior-shaping prose is code:
 
 1. Baseline without guidance; if it passes, add none.
-2. Run ≥5 fresh-context reps/variant; inspect every flagged run.
+2. Run ≥5 fresh-context reps/variant; inspect every flagged run, and ask that agent which
+   instruction or missing context led it there before editing guidance. The corpus holds a control
+   case that must always pass, past-failure cases, and boundary cases whose right answer is
+   stop, ask, or refuse.
 3. Divergent interpretations require rewrite, not averaging.
 4. Pin host/model/build, corpus, grader, and candidate digest or commit+path. Report tasks/trials,
    arms, same-build A/A noise before A/B, sanitized per-trial verdicts/metrics, invalid/null results,
    variance, process versus job outcome, and supported/unproved claims. Never capture raw transcripts;
    lost grading signal is `cannot_verify`.
+5. On each new model generation, re-run step 1 as an ablation: remove the guidance and rerun its
+   eval. Guidance the model no longer needs is a `$rite-learn` retirement candidate, not a keeper.
 
 CI validates only corpora/deterministic artifacts—never paid sessions or lexical claims.
 
@@ -234,6 +239,13 @@ CI validates only corpora/deterministic artifacts—never paid sessions or lexic
 Delete model-default no-ops. Prefer positive targets; reserve prohibitions for hard
 guards. Fill omitted decisions or mark a deliberate branch.
 
+- Instructions add no capability: replace "be careful" or "CRITICAL" with a check, tool,
+  or engine command the agent can run.
+- State both sides of a trade-off. A one-sided cost ("avoid escalating; it is expensive")
+  is overfit: the agent withholds, deflects, or skips the stop it needed.
+- A defensive line added for one model's failure names that failure, so ablation can
+  retire it when a later model no longer fails.
+
 ## Contribution preflight
 
 Record catalog search, owner gap, evals, host parity, and public/internal surface. Public

package/pack/generated/codex/skills/devrites-lib/reference/standards/testing.md

@@ -106,6 +106,11 @@ discriminates the required result.
   any divergence against the external spec — never by majority vote between
   reviewers, and never because the fixture is committed. A golden nobody re-derived
   is a rumor.
+- **A rewrite or port uses the old implementation as its oracle.** Run old and new on the
+  same inputs (the existing suite, a published conformance suite, recorded requests,
+  screenshots) and diff the results;
+  parity claimed only from tests written for the new code is unproven. **Failing case:** a
+  port passes its new unit tests while the old suite fails against it.
 
 ### Safe perturbation
 
@@ -174,6 +179,10 @@ test exercises; **D**escriptive **A**nd **M**eaningful **P**hrases beat **D**on'
 here. (Deliberately trades against production reuse-first: a fixture that makes the reader
 scroll away to understand the case costs more than the duplication saved.)
 
+Test data is synthetic. A generator or factory builds each named edge case (a user with
+1,000 tickets, an empty tenant); production records never enter tests, fixtures, or agent
+sandboxes ([`security.md`](security.md)).
+
 ## Test doubles: reach for the real thing first
 Prefer, in order: **real > fake > stub > mock**. Use the real collaborator when it's fast and
 deterministic; a **fake** (an in-memory implementation that honors the contract) when it isn't; a
@@ -209,6 +218,10 @@ Select cases from the accepted spec and applicable standards, not a generic coun
   authorization, extra fields, or side effects; run schema-driven fuzzers only against a
   disposable target under external-write approval. **Failing case:** a shared
   `createdAt: Date` compiles on both sides while the client receives a string.
+- A module or layer boundary the plan relies on ("only `clients/` imports the SDK") is
+  enforced by a structural test in the project's existing tooling (an import or
+  dependency rule), not by prose. Its failure message names the allowed route, so the
+  agent fixes the design instead of dodging the rule.
 - Compatibility/delivery work drives both feature-flag states and old/new caller or
   schema combinations. Migration-before-code and code-before-migration order each need a
   declared expected result.

package/pack/generated/codex/skills/devrites-lib/reference/workspace-artifact-schema.md

@@ -2,7 +2,9 @@
 
 Feature truth: `.devrites/work/<slug>/`, discovered by `state.md`; remnants/archives
 are inactive. Spec writes optional `README.md`. Use canonical filenames; both released
-cursor forms remain valid. `$rite-upgrade` audits without path/alias/format migration.
+cursor forms remain readable, but a cursor with no `schema` row needs
+`devrites-engine migrate <slug>` before the engine accepts it. `$rite-upgrade` audits
+without path/alias/format migration.
 
 ## Slug identity
 
@@ -27,7 +29,7 @@ accept safe legacy basenames. Ordinary phases never rename them.
 | vet/build/converge | plan artifacts plus `eng-review.md`, `test-plan.md`, `gates.md`; Build creates and maintains `touched-files.md` after its first green slice |
 | prove/polish/review | vetted plan artifacts plus `evidence.md`, `touched-files.md` |
 | seal/ship/done | proof artifacts plus `review.md`, `seal.md`; Ship writes `ship.md` |
-| conditional | `flows.md` when diagrams clarify; `visual/` HTML+`.outline.md` companions when a richer reviewable visual earns it (optional; never readiness-required); `design-brief.md` and `browser-evidence.md` for UI; `drift.md` for drift; `polish-report.md` for polish; `handoff.md` only when requested; `references.md` + `references/` when references exist; `investigation-map.md` for pressure-test; `dogfood.md` for dogfood; `windows.md` when the diff introduces deferral markers (waiver ledger for `check windows`); `packets/` for by-reference dispatch packets and admitted accounts (≤ 64 KiB each; older closed rounds may be deleted; never transcripts); `history/` for verbatim relocated checkpoint narrative (append-only, never a read-next); `readiness-inputs.json` as the advisory per-input drift baseline written by `check drift --record` after Vet's binding (never a gate input; regenerated, not hand-edited); `notes.md` for anchored notes bound to verbatim code quotes (engine-regraded; non-exact anchors block seal) |
+| conditional | `checklists/<domain>.md` per spec-covered domain (Spec writes; Define gates on it); `flows.md` when diagrams clarify; `visual/` HTML+`.outline.md` companions when a richer reviewable visual earns it (optional; never readiness-required); `design-brief.md` and `browser-evidence.md` for UI; `devex.md` when a developer-facing surface is in scope; `drift.md` for drift; `polish-report.md` for polish; `handoff.md` only when requested; `references.md` + `references/` when references exist; `investigation-map.md` for pressure-test; `dogfood.md` for dogfood; `windows.md` when the diff introduces deferral markers (waiver ledger for `check windows`); `packets/` for by-reference dispatch packets and admitted accounts (≤ 64 KiB each; older closed rounds may be deleted; never transcripts); `history/` for verbatim relocated checkpoint narrative (append-only, never a read-next); `readiness-inputs.json` as the advisory per-input drift baseline written by `check drift --record` after Vet's binding (never a gate input; regenerated, not hand-edited); `notes.md` for anchored notes bound to verbatim code quotes (engine-regraded; non-exact anchors block seal) |
 
 ## What each file owns
 
@@ -43,7 +45,7 @@ accept safe legacy basenames. Ordinary phases never rename them.
 | `visual/<name>.html` | optional portable human-viewable visualization; pair with sibling `.outline.md`; self-contained preferred | 400 lines (advisory; not gate-checked) |
 | `visual/<name>.outline.md` | required machine dual-read companion for the sibling HTML; outline wins on conflict; never a candidate path | 200 lines (advisory; not gate-checked) |
 | `visual/README.md` | optional index of visuals in the workspace | 80 lines (advisory; not gate-checked) |
-| `decisions.md` | ADR-style `DEC-###` log: status, context, options, decision, consequences, related IDs; optional `Files:`/`Tags:` fields make entries queryable by path or theme | 200 lines |
+| `decisions.md` | ADR-style `DEC-###` log: status, context, options, decision, consequences, related IDs; optional `Files:`/`Tags:` fields make entries queryable by path or theme; Build's `## Carry-forward constraints` lines (rule, source slice, evidence, `Files:`) | 200 lines |
 | `assumptions.md` | assumptions with confidence, owner, validation status | 160 lines |
 | `questions.md` | current `q-YYYY-MM-DD-NNN` (or released `Q-###`) open/resolved questions, gate, answer, impact | 180 lines |
 | `plan.md` | technical approach, slice strategy, canonical shared-contract proof, validation strategy, rollback | 220 lines |
@@ -61,7 +63,7 @@ accept safe legacy basenames. Ordinary phases never rename them.
 | `handoff.md` | resume objective/last slice/next action/blockers/read-next; sections hold content or `Nothing yet`; unevidenced recollections: `Not tried yet`, never results | 120 lines |
 | `polish-report.md` | polish axis deltas, re-verification lines, residual subjective preferences | 200 lines |
 | `ship.md` | ship preflight, disclosed Git plan, commit/push/tag/PR record | 120 lines |
-| `review.md` | reconciled Review verdict: `## Spec` and `## Code review` accounts, deferred-finding labels/actions, drift | 240 lines |
+| `review.md` | reconciled Review verdict: `## Spec` and `## Code review` accounts, triggered frontend/security/performance accounts or `Not-applicable` lines, deferred-finding labels/actions, drift | 240 lines |
 | `seal.md` | seal preflight, exact reviewer roster accounts, GO/NO-GO verdict and disclosures | 200 lines |
 | `ai-spec.md` | model/RAG/agent/eval/LLM-output scope for AI surfaces | 160 lines |
 | `windows.md` | deferral/bar-lowering waiver ledger: one `- path | marker | reason` row per introduced marker; `check windows` fails on unwaived hits | 120 lines |
@@ -206,7 +208,7 @@ Mode: <AFK | HITL>
 Gate: <advisory | validating | blocking | escalating>
 SLA: <15m | 4h | 24h | none>
 Checkpoint: <question + why it needs unavailable pre-code evidence or action-time approval | none>
-Dependencies: <SLICE-### list | none>
+Dependencies: <SLICE-### (via <interface it consumes>) list | none>
 depends_on: [<SLICE-### IDs>]
 Consumes / Produces: <interfaces read and exposed>
 Known-Gotchas: <ordering hazards and framework footguns | none>
@@ -228,7 +230,9 @@ Done condition: <checkable, exhaustive completion criterion>
 <!-- canonical-slice:end -->
 
 `depends_on` is the machine-readable mirror of `Dependencies`; keep the sets
-identical and cycle-free. `Gate`, `SLA`, and `Checkpoint` are required for HITL
+identical and cycle-free. Each dependency names what crosses it (`check task-graph` advises).
+Define and `$rite-plan` repair write `Prior-slice learnings`, folding Build's
+`decisions.md` carry-forward constraints; Build never edits `tasks.md`. `Gate`, `SLA`, and `Checkpoint` are required for HITL
 slices; use `none` when they do not apply. Complexity above 3 triggers reslicing
 unless the stated reason makes the boundary irreducible. A Writer allowlist of 12+
 files prints an engine `ADVISORY size:` line (`check task-graph`, `check slice`;
@@ -239,7 +243,7 @@ the inseparable capability.
 
 Run `devrites-engine next <slug>` at phase entry for the minimal remaining path
 (current phase, open questions, missing artifacts, next `/rite-*` command), then
-read the phase row below — or hand `devrites-engine context <slug> --phase <p>`
+read the phase row below — or hand `devrites-engine context --skills-root .agents/skills <slug> --phase <p>`
 to the engine and read the bundle it emits.
 
 | Phase | Read |

package/pack/generated/codex/skills/devrites-prose-craft/SKILL.md

@@ -4,7 +4,7 @@ description: Rewrite prose to remove AI tells while preserving meaning and voice
 user-invocable: false
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/prose-style.md"],"triggers":{"word-choice":["devrites-prose-craft/reference/banned-phrases.md"],"structure":["devrites-prose-craft/reference/structures.md"],"examples":["devrites-prose-craft/reference/examples.md"]}} -->
-> Read-set manifest: `devrites-engine context [slug] --skill devrites-prose-craft` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .agents/skills <slug> --skill devrites-prose-craft` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # devrites-prose-craft: prose that reads human
 

package/pack/generated/codex/skills/devrites-source-driven/SKILL.md

@@ -4,7 +4,7 @@ description: Verify uncertain framework or library behavior in installed source
 user-invocable: false
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/tooling.md"],"triggers":{"agents":["devrites-lib/reference/standards/agents.md"]},"workspace":["state.md","spec.md","plan.md","decisions.md","evidence.md","references.md"],"workspaceByRole":{"evidence-scout":["state.md","spec.md","plan.md","references.md"]}} -->
-> Read-set manifest: `devrites-engine context [slug] --skill devrites-source-driven` bundles every file named below into one deduplicated read.
+> Read-set manifest: `devrites-engine context --skills-root .agents/skills <slug> --skill devrites-source-driven` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # devrites-source-driven: verify, don't guess
 

package/pack/generated/codex/skills/devrites-ux-shape/SKILL.md

@@ -4,7 +4,7 @@ description: Shape UX/UI direction, states, and interactions before code. Use fo
 user-invocable: false
 ---
 <!-- loads: {"always":["devrites-ux-shape/reference/brief-template.md","devrites-ux-shape/reference/visual-direction-probe.md","rite-build/reference/frontend-trigger.md","devrites-frontend-craft/reference/design-references.md","devrites-frontend-craft/reference/quality-standards.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"]}} -->
-> Read-set manifest: `devrites-engine context [slug] --skill devrites-ux-shape` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .agents/skills <slug> --skill devrites-ux-shape` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # devrites-ux-shape: plan the UX/UI before code
 

package/pack/generated/codex/skills/overhaul/SKILL.md

@@ -101,24 +101,24 @@ deployment, or anything the user did not start with this command.
 
 ## Step 1 — Audit
 
-1. Dispatch `recon` ([`overhaul-recon`](.codex/agents/overhaul-recon.toml)); admit its inventory,
+1. Dispatch `recon` ([`overhaul-recon`](../../../.codex/agents/overhaul-recon.toml)); admit its inventory,
    components, lanes, partitions, contract seeds and journeys into `coverage.json`,
    `stack-profiles.json` and `contracts.json`, and record the applicability matrix
    in `coverage.json` ([`references/audit-domains.md`](references/audit-domains.md#applicability-matrix)).
 2. Compose profiles per component ([`references/stack-profiles.md`](references/stack-profiles.md));
    research unknown stacks through the unknown-stack procedure.
 3. Launch the concurrent engineering wave: when both lanes apply,
-   [`overhaul-frontend-engineer`](.codex/agents/overhaul-frontend-engineer.toml) and
-   [`overhaul-backend-engineer`](.codex/agents/overhaul-backend-engineer.toml) go out in the same dispatch
+   [`overhaul-frontend-engineer`](../../../.codex/agents/overhaul-frontend-engineer.toml) and
+   [`overhaul-backend-engineer`](../../../.codex/agents/overhaul-backend-engineer.toml) go out in the same dispatch
    batch before you await either. Fill remaining slots with
-   [`overhaul-boundary`](.codex/agents/overhaul-boundary.toml), [`overhaul-craft`](.codex/agents/overhaul-craft.toml) and
-   [`overhaul-specialist`](.codex/agents/overhaul-specialist.toml) in bounded waves; reserve verifier and
+   [`overhaul-boundary`](../../../.codex/agents/overhaul-boundary.toml), [`overhaul-craft`](../../../.codex/agents/overhaul-craft.toml) and
+   [`overhaul-specialist`](../../../.codex/agents/overhaul-specialist.toml) in bounded waves; reserve verifier and
    critic capacity first. Domain floor: [`references/audit-domains.md`](references/audit-domains.md).
    Without real concurrency: `BLOCKED_PARALLEL_CAPABILITY`; offer degraded
    sequential review only when fresh contexts can still be started one at a time.
 4. Admit every receipt with `devrites-engine overhaul admit receipt`; anchor every
    quoted location with `devrites-engine overhaul admit anchor`; send serious or
-   ambiguous candidates to [`overhaul-verifier`](.codex/agents/overhaul-verifier.toml) (`finding-verify`)
+   ambiguous candidates to [`overhaul-verifier`](../../../.codex/agents/overhaul-verifier.toml) (`finding-verify`)
    in lane batches of up to 8. Run coverage critics after waves, launch the gaps they
    name without waiting for verifiers, and run a final-clean critic before calling
    coverage complete.
@@ -143,7 +143,7 @@ deployment, or anything the user did not start with this command.
    reconfirmation otherwise), the re-hashed plan digest, the task closure, the current
    plan revision, no later stop, and for PR or branch scope a checked-out `HEAD` equal
    to the pinned head. Record it in `approval.json`.
-2. Execute the approved DAG with [`overhaul-implementer`](.codex/agents/overhaul-implementer.toml): one
+2. Execute the approved DAG with [`overhaul-implementer`](../../../.codex/agents/overhaul-implementer.toml): one
    writer per path, independent frontend and backend tasks concurrently, TDD per
    [`references/repair-and-measurement.md`](references/repair-and-measurement.md).
    Admit patches only when observed changed paths equal the contract.
@@ -166,14 +166,14 @@ revocation stays in force.
 
 | Role | Agent | Mode |
 | --- | --- | --- |
-| Reconnaissance and coverage mapper | [`overhaul-recon`](.codex/agents/overhaul-recon.toml) | read-only |
-| Frontend engineering reviewer | [`overhaul-frontend-engineer`](.codex/agents/overhaul-frontend-engineer.toml) | read-only |
-| Backend engineering reviewer | [`overhaul-backend-engineer`](.codex/agents/overhaul-backend-engineer.toml) | read-only |
-| Boundary and contract reviewer | [`overhaul-boundary`](.codex/agents/overhaul-boundary.toml) | read-only |
-| Frontend craft, interaction and accessibility | [`overhaul-craft`](.codex/agents/overhaul-craft.toml) | read-only |
-| Language, risk and other-lane specialist | [`overhaul-specialist`](.codex/agents/overhaul-specialist.toml) | read-only |
-| Frontend or backend remediation implementer | [`overhaul-implementer`](.codex/agents/overhaul-implementer.toml) | writes approved paths only |
-| Verifier, critic and final challenger | [`overhaul-verifier`](.codex/agents/overhaul-verifier.toml) | read-only |
+| Reconnaissance and coverage mapper | [`overhaul-recon`](../../../.codex/agents/overhaul-recon.toml) | read-only |
+| Frontend engineering reviewer | [`overhaul-frontend-engineer`](../../../.codex/agents/overhaul-frontend-engineer.toml) | read-only |
+| Backend engineering reviewer | [`overhaul-backend-engineer`](../../../.codex/agents/overhaul-backend-engineer.toml) | read-only |
+| Boundary and contract reviewer | [`overhaul-boundary`](../../../.codex/agents/overhaul-boundary.toml) | read-only |
+| Frontend craft, interaction and accessibility | [`overhaul-craft`](../../../.codex/agents/overhaul-craft.toml) | read-only |
+| Language, risk and other-lane specialist | [`overhaul-specialist`](../../../.codex/agents/overhaul-specialist.toml) | read-only |
+| Frontend or backend remediation implementer | [`overhaul-implementer`](../../../.codex/agents/overhaul-implementer.toml) | writes approved paths only |
+| Verifier, critic and final challenger | [`overhaul-verifier`](../../../.codex/agents/overhaul-verifier.toml) | read-only |
 
 Dispatch each role as its named agent with a packet
 ([`references/orchestration.md`](references/orchestration.md)). The agents keep every

package/pack/generated/codex/skills/overhaul/references/audit-domains.md

@@ -267,7 +267,7 @@ Review real source semantics under the active client profiles:
 
 ## Frontend craft, interaction and accessibility
 
-The craft role ([`overhaul-craft`](.codex/agents/overhaul-craft.toml)) examines the existing brief and
+The craft role ([`overhaul-craft`](../../../../.codex/agents/overhaul-craft.toml)) examines the existing brief and
 design system, hierarchy, typography, spacing, density, tokens, theming, semantics,
 focus, keyboard operation, touch and pointer, zoom and reflow, responsive or native
 layout, localization and long or RTL content; every UI state (loading, empty, error,
@@ -309,7 +309,7 @@ major restructuring.
 
 ## Cross-layer contracts
 
-The boundary role ([`overhaul-boundary`](.codex/agents/overhaul-boundary.toml)) owns the live graph of
+The boundary role ([`overhaul-boundary`](../../../../.codex/agents/overhaul-boundary.toml)) owns the live graph of
 API operations, events and messages, server actions, IPC/FFI, shared models,
 generated clients and the critical journeys consuming them, and checks both
 producer and consumer: schema, version, enum and nullability; numeric, ID and date

package/pack/generated/codex/skills/overhaul/references/orchestration.md

@@ -31,11 +31,11 @@ directory names or file extensions. One package or file can serve several lanes.
 
 | Lane | Owns | Agent |
 | --- | --- | --- |
-| Frontend engineering | Client correctness, state/data flow, component architecture, framework idioms, client security, frontend performance and tests (web, native, desktop, game UI) | [`overhaul-frontend-engineer`](.codex/agents/overhaul-frontend-engineer.toml) |
-| Backend engineering | Service, domain, API, job, data, concurrency, authorization and service performance, including server parts of full-stack frameworks | [`overhaul-backend-engineer`](.codex/agents/overhaul-backend-engineer.toml) |
-| Boundary / integration | Producer/consumer contracts, shared packages, serialization, trust transitions, deployment skew | [`overhaul-boundary`](.codex/agents/overhaul-boundary.toml) |
-| Frontend craft | Design system fit, interaction states, keyboard/focus, accessibility, responsive and motion evidence | [`overhaul-craft`](.codex/agents/overhaul-craft.toml) |
-| Other | Build tooling, CI, infrastructure, libraries, data/ML workloads, operations readiness, public API and CLI experience, documentation — explicit extra profiles, never forced into frontend/backend | [`overhaul-specialist`](.codex/agents/overhaul-specialist.toml) |
+| Frontend engineering | Client correctness, state/data flow, component architecture, framework idioms, client security, frontend performance and tests (web, native, desktop, game UI) | [`overhaul-frontend-engineer`](../../../../.codex/agents/overhaul-frontend-engineer.toml) |
+| Backend engineering | Service, domain, API, job, data, concurrency, authorization and service performance, including server parts of full-stack frameworks | [`overhaul-backend-engineer`](../../../../.codex/agents/overhaul-backend-engineer.toml) |
+| Boundary / integration | Producer/consumer contracts, shared packages, serialization, trust transitions, deployment skew | [`overhaul-boundary`](../../../../.codex/agents/overhaul-boundary.toml) |
+| Frontend craft | Design system fit, interaction states, keyboard/focus, accessibility, responsive and motion evidence | [`overhaul-craft`](../../../../.codex/agents/overhaul-craft.toml) |
+| Other | Build tooling, CI, infrastructure, libraries, data/ML workloads, operations readiness, public API and CLI experience, documentation — explicit extra profiles, never forced into frontend/backend | [`overhaul-specialist`](../../../../.codex/agents/overhaul-specialist.toml) |
 
 Frontend and backend engineering are always different agent invocations with
 different active profiles, even in a same-language codebase. The boundary reviewer
@@ -277,10 +277,14 @@ correctness gate.
 ## Admission tool
 
 `devrites-engine overhaul admit receipt <run> <receipt.json> [--observed <paths.txt>]` checks one
-receipt against its dispatch packet: run, role, lane and snapshot match; timestamps
+receipt against its dispatch packet: the file is the attempt's own
+`<run>/receipts/<run_id>__<task_id>__<attempt_id>__<role>.json` (not a copy elsewhere
+or a symlink, and the attempt's recorded `receipt` when it has one); run, role, lane
+and snapshot match; timestamps
 and an allowed `outcome` are present; `no-findings` names inspected ranges; a writer's
 claimed paths stay inside its task contract and equal the observed paths.
 `devrites-engine overhaul admit anchor <tree> <proposals.json>` checks that every quoted location in
 `{"findings": [...]}` matches its file lines under the reviewed tree. It never edits
 canonical records; record its verdict in a staged generation. Exit codes: 0
-admissible or anchored, 1 reject, 2 usage or I/O error, 3 duplicate or late receipt.
+admissible or anchored, 1 reject, 2 usage or I/O error (including an extra or
+misspelled argument), 3 duplicate or late receipt.

package/pack/generated/codex/skills/overhaul/references/records.md

@@ -123,14 +123,19 @@ verifier attempt, repository-relative locations (external ones are labels, never
 host paths); `revisions.plan.file` equal to `revisions/plan-r<rev>.json`, required
 once approvals or writers exist; plan digest pins; known, acyclic dependencies;
 allowed paths that are exact files inside the repository (no `*` or `?`, no
-directories, no `.git`, no symlink or traversal escape); a separate verifier role;
+directories, no `.git` component or run-area path in any letter case or through a
+symlink, no symlink or traversal escape); a separate verifier role;
 approval and `accept-degradation` events with quote and trusted channel, approvals
 matching the plan digest, closure and current revision, none active after a later
 stop; a scorecard only with `revisions.rubric` and the same verdict as `run.json`;
+`READY_FOR_USER_REVIEW` only with a scorecard whose verdict is `MEETS_TARGETS`, and
+`COMPLETED_WITH_APPROVED_DEGRADATION` only with `MEETS_TARGETS_WITH_APPROVED_DEGRADATION`,
+each listing every audit gate (plus every repair gate outside assessment-only runs) as
+`PASS` or `NOT_APPLICABLE` (`G-CONCURRENCY` may be `WAIVED_OPERATIONAL` for the degraded outcome);
 no approval or writer in an assessment-only run; unchanged `run_id`, `repo_root`,
 `mode` and `assessment_only`; writers authorized for their task; one live writer
-per path (case-folded, symlink-resolved); no `dispatched`, `running` or `returned`
-attempt once the outcome leaves `RUNNING`; one outcome per approved task at the end;
+per path (case-folded, symlink-resolved); every attempt `admitted`, `rejected` or
+`cancelled` once the outcome leaves `RUNNING` (`timed-out` and `unknown` are not settled); one outcome per approved task at the end;
 a coverage denominator that never shrinks; append-only cycles, findings history and
 approval events; immutable revisions; view stamps; manifest integrity; stale stages
 and interrupted publishes. Across records: every finding's `domain` is a score key;

package/pack/generated/codex/skills/rite/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 disable-model-invocation: true
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md"],"triggers":{"intent":["devrites-lib/reference/intent-map.md"],"menu":["rite/reference/menu.md"],"dispatch":["devrites-lib/reference/parallel-dispatch.md"],"reply":["devrites-lib/reference/reply-contract.md"]}} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .agents/skills <slug> --skill rite` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # $rite: DevRites menu + router
 
@@ -74,9 +74,10 @@ What each verb does lives once, in the Menu below; this table is the invocation
 Both forms call the same skill. The menu supports discovery; `/rite-<verb>` is the direct form.
 
 `use <slug>` is handled **inline**. There is no `rite-use` skill. Confirm
-`.devrites/work/<slug>/` exists, then re-point `.devrites/ACTIVE` to `<slug>` and report
+`<slug>` is a safe slug and `.devrites/work/<slug>/state.md` is a contained regular file, then re-point `.devrites/ACTIVE` to `<slug>` and report
 the now-active feature. It is cheap context-switching only: no re-spec, no phase run. If
-the workspace is missing, list the slugs under `.devrites/work/` and stop.
+the workspace or its `state.md` is missing, list the slugs under `.devrites/work/` that have
+`state.md` and stop.
 
 `guide` is an inline walkthrough for the first feature. Agree on one **real, small**
 change, then run spec → clarify → temper → define → vet → build → prove → polish → review → seal →

package/pack/generated/codex/skills/rite/reference/menu.md

@@ -32,14 +32,15 @@ Phase-ordered `$rite` reference. Load only for command detail or phase connectio
   `$rite-define` (plan) → `$rite-vet` (engineering review; light or full) →
   `$rite-build` ×N (all slices) → `$rite-prove` (once all built) →
   `$rite-polish` (always: code + UI if UI) → `$rite-review` → `$rite-seal` → `$rite-ship`.
-- **Existing codebase**: `$rite-adopt` → `$rite-clarify` → `$rite-define` → `$rite-vet` → build.
+- **Existing codebase**: `$rite-adopt` → `$rite-spec` → `$rite-clarify` → `$rite-define` → `$rite-vet` → build.
 - **Drift mid-build**: classify → bounded recovery for objective defects, `$rite-plan`
   repair for a wrong durable plan, or one user decision for real product/risk drift.
 - **Older workspace cannot resume**: `$rite-upgrade` audits first → only proven gaps use
-  Clarify/Plan repair/Converge/Vet or Prove/Polish/Review/Seal → resume. It never
-  migrates cursor format or invents a prior pass.
-- **Resumed / adopted / stalled**: `$rite-converge` (assess live code vs intent → append the
-  remaining slices) → `$rite-vet` → `$rite-build` ×N → continue at `$rite-prove`.
+  Clarify/Plan repair/Converge/Vet or Prove/Polish/Review/Seal → resume. A cursor with
+  no `schema` row needs `devrites-engine migrate <slug>` first; upgrade never migrates
+  cursor format itself or invents a prior pass.
+- **Resumed / stalled, or adopted after Define** (has `plan.md` + `tasks.md`): `$rite-converge`
+  (assess live code vs intent → append the remaining slices) → `$rite-vet` → `$rite-build` ×N → continue at `$rite-prove`.
 
 ## Rules this menu obeys
 

package/pack/generated/codex/skills/rite-adopt/SKILL.md

@@ -5,7 +5,7 @@ argument-hint: "[path or area to adopt] [+ what you want to build next]"
 user-invocable: true
 ---
 <!-- loads: {"always":["rite-adopt/reference/adoption.md","rite-adopt/reference/anti-patterns.md","rite-polish/reference/ledger.md"],"triggers":{"security":["devrites-lib/reference/standards/security.md"]}} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-adopt` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .agents/skills <slug> --skill rite-adopt` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # $rite-adopt: onboard existing code
 
@@ -48,7 +48,8 @@ parallel convention system.
    resistance. Never create convention bands, scores, or a command cache.
 6. A genuine non-negotiable invariant may be proposed for
    `.devrites/principles.md`; the human must ratify it.
-7. Set the next step to `$rite-clarify` and stop. Do not plan or build.
+7. Set the next step to `$rite-spec <slug>` and stop; Spec extends this workspace and owns
+   `brief.md`, `checklists/`, and `spec_gate`. Do not plan or build.
 
 > Refuse the rationalizations in [`anti-patterns`](reference/anti-patterns.md).
 
@@ -59,5 +60,5 @@ Done: adopted <scope> into <slug>.
 Changed: <workspace artifacts>; project guidance <proposed | unchanged>
 Evidence: <source/CI paths inspected>
 Open: <questions | none>
-Next: $rite-clarify
+Next: $rite-spec <slug>
 ```

package/pack/generated/codex/skills/rite-autocomplete/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 ---
 
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/afk-hitl.md","devrites-lib/reference/standards/one-shot-actions.md","devrites-lib/reference/orchestration-profiles.md","devrites-lib/reference/standards/acceptance-preserving-reslice.md","rite-autocomplete/reference/decision-policy.md","rite-autocomplete/reference/loop.md","rite-autocomplete/reference/stop-conditions.md"],"triggers":{"workflow-artifacts":["devrites-lib/reference/standards/workflow-artifacts.md"]},"workspace":["state.md","spec.md","plan.md","tasks.md","questions.md","decisions.md","drift.md","evidence.md","test-plan.md"]} -->
-> Read-set manifest: `devrites-engine context <slug> --phase autocomplete` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .agents/skills <slug> --phase autocomplete` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
 # $rite-autocomplete: full lifecycle, unattended
@@ -127,11 +127,12 @@ executable controller/harness/bundle bytes or a missing writer, read
    product scope is never auto-resolved by a recommended option; it stops for a human.
    Technical exhaustion records terminal
    `Next step: none`, never a routine phase command. **Completion:** no stop is active, or its cursor and reason are durable.
-6. **Seal boundary.** Without a ship flag, stop at Seal GO with `$rite-ship` —
-   unless `continue_sequence: false` or sequence budget is spent; otherwise
-   leave the sealed workspace unshipped and open the next recorded continuation
-   ([loop.md § Sequence continuation](reference/loop.md#sequence-continuation));
-   report the sequence position on every stop.
+6. **Seal boundary.** Without a ship flag, leave the sealed workspace unshipped and
+   open the next recorded continuation
+   ([loop.md § Sequence continuation](reference/loop.md#sequence-continuation))
+   unless `continue_sequence: false`, the sequence budget is spent, or no entry
+   remains; then stop at Seal GO with `$rite-ship`. Report the sequence position on
+   every stop.
    With a ship flag, perform Ship preflight, disclose the exact Git plan, and stop for
    fresh literal `GO` plus native approval. **Completion:** performed no Git action before fresh literal `GO` plus native approval.
 

package/pack/generated/codex/skills/rite-autocomplete/reference/loop.md

@@ -53,7 +53,8 @@ and parallel AFK headroom as stop conditions. Pass this invocation's
 that already name a ranked recommended option (recommended pick via
 `devrites-engine state resolve`) instead of queuing them or handing
 `$rite-resolve` to the user. Escalating, irreversible-risk, access, and
-blocking with no recommended option still pause.
+blocking with no recommended option still pause, as does Seal's judgment-only
+validating question (`slice: seal`).
 
 ## Phase arc
 

package/pack/generated/codex/skills/rite-autocomplete/reference/stop-conditions.md

@@ -66,7 +66,8 @@ exhausted.
   would add acceptance or product scope is never auto-picked, even with a
   recommended option; it stops for a human. Blocking with no
   recommended option still stops. Validating: auto-pick the recommended option,
-  close the question, continue.
+  close the question, continue — except Seal's judgment-only acceptance question
+  (`slice: seal`), which only a human answers; it stops.
 - **Temper:** `expand` and extra acceptance stop: ask through `AskUserQuestion`, hold the
   fold, and continue only after a human resolves the qid (an ADR is not that answer).
   Irreversible-risk still pauses. `hold-rigor`, `reduce-to-MVP`, and a skip do not pause.