devrites 6.0.3 → 6.1.0

package/engine/internal/parallel/pathdisjoint.go

@@ -67,21 +67,25 @@ func validateSlicePaths(paths []string, label, root string) ([]string, error) {
 		if err != nil {
 			return nil, fmt.Errorf("%s: %w", label, err)
 		}
+		// Comparisons fold case always: on a case-insensitive filesystem
+		// (macOS, Windows) .DEVRITES is the control tree and A.go is a.go; on a
+		// case-sensitive one a false overlap only serializes the slices.
+		folded := strings.ToLower(path)
 		// Parallel eligibility must reject workspace control metadata so slices
 		// cannot claim control-tree / SSOT files (docs: ".devrites/**").
-		if path == ".devrites" || strings.HasPrefix(path, ".devrites/") {
+		if folded == ".devrites" || strings.HasPrefix(folded, ".devrites/") {
 			return nil, fmt.Errorf("%s: path must not include .devrites: %q", label, path)
 		}
 		// Same for git internals: a transfer commit can never carry .git/**
 		// anyway, and inside a worktree .git is a file, so claiming it is
 		// pure footgun.
-		if path == ".git" || strings.HasPrefix(path, ".git/") {
+		if folded == ".git" || strings.HasPrefix(folded, ".git/") {
 			return nil, fmt.Errorf("%s: path must not include .git: %q", label, path)
 		}
-		if _, ok := seen[path]; ok {
+		if _, ok := seen[folded]; ok {
 			return nil, fmt.Errorf("%s: duplicate path %q", label, path)
 		}
-		seen[path] = struct{}{}
+		seen[folded] = struct{}{}
 		normalized = append(normalized, path)
 		if root != "" {
 			// Check every component, not just the leaf: a symlinked directory
@@ -122,6 +126,7 @@ func CheckPathDisjoint(slices []SlicePaths, root string) ([]string, error) {
 			return nil, err
 		}
 		for _, path := range paths {
+			path = strings.ToLower(path) // see validateSlicePaths: overlap folds case
 			owners[path] = append(owners[path], label)
 		}
 	}

package/engine/internal/release/release.go

@@ -145,15 +145,17 @@ func validTag(tag string) bool {
 }
 
 func platformBinaryName() (string, error) {
-	supported := (runtime.GOOS == "darwin" || runtime.GOOS == "linux") && (runtime.GOARCH == "amd64" || runtime.GOARCH == "arm64")
-	if runtime.GOOS == "windows" && runtime.GOARCH == "amd64" {
-		supported = true
-	}
-	if !supported {
-		return "", fmt.Errorf("no DevRites engine release for %s/%s", runtime.GOOS, runtime.GOARCH)
-	}
-	name := "devrites-" + runtime.GOOS + "-" + runtime.GOARCH
-	if runtime.GOOS == "windows" {
+	return binaryNameFor(runtime.GOOS, runtime.GOARCH)
+}
+
+// binaryNameFor names the release asset; CI publishes darwin, linux and
+// windows for both amd64 and arm64.
+func binaryNameFor(goos, goarch string) (string, error) {
+	if (goos != "darwin" && goos != "linux" && goos != "windows") || (goarch != "amd64" && goarch != "arm64") {
+		return "", fmt.Errorf("no DevRites engine release for %s/%s", goos, goarch)
+	}
+	name := "devrites-" + goos + "-" + goarch
+	if goos == "windows" {
 		name += ".exe"
 	}
 	return name, nil

package/engine/internal/safepath/safepath.go

@@ -1,6 +1,7 @@
 package safepath
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 )
@@ -28,9 +29,10 @@ func WithinResolved(candidate, parent string) bool {
 
 // ResolveExisting resolves symlinks in the longest existing path prefix, then
 // appends any missing tail without allowing it to change the resolved parent.
+// A dangling symlink is followed to its target: creating through it writes there.
 func ResolveExisting(filename string) (string, error) {
 	var tail []string
-	for {
+	for hops := 0; ; {
 		resolved, err := filepath.EvalSymlinks(filename)
 		if err == nil {
 			for i := len(tail) - 1; i >= 0; i-- {
@@ -41,6 +43,20 @@ func ResolveExisting(filename string) (string, error) {
 		if !os.IsNotExist(err) {
 			return "", err
 		}
+		if info, lerr := os.Lstat(filename); lerr == nil && info.Mode()&os.ModeSymlink != 0 {
+			target, rerr := os.Readlink(filename)
+			if rerr != nil {
+				return "", rerr
+			}
+			if hops++; hops > 255 {
+				return "", &os.PathError{Op: "resolve", Path: filename, Err: errors.New("too many symlinks")}
+			}
+			if !filepath.IsAbs(target) {
+				target = filepath.Join(filepath.Dir(filename), target)
+			}
+			filename = target
+			continue
+		}
 		parent := filepath.Dir(filename)
 		if parent == filename {
 			return "", err

package/engine/internal/state/budgets.go

@@ -78,17 +78,21 @@ func ArtifactLineBudget(name string) (int, bool) {
 
 // sanctionedRootFiles are workspace-root files the schema places there without a
 // line budget: conditional artifacts (`references.md`, `investigation-map.md`,
-// `dogfood.md`) and engine-owned machine files (the parallel lease, the metrics
-// ledger, the regression baseline). Anything else in the root is unsanctioned
-// placement — `packets/` and `history/` own by-reference packets and relocated
-// narrative (workspace-artifact-schema.md "Required by phase").
+// `dogfood.md`, `devex.md`) and engine-owned machine files (the parallel lease,
+// the metrics ledger, the regression baseline, the dispatch ledger, the drift
+// baseline). Anything else in the root is unsanctioned placement — `packets/`
+// and `history/` own by-reference packets and relocated narrative
+// (workspace-artifact-schema.md "Required by phase").
 var sanctionedRootFiles = map[string]bool{
 	"references.md":            true,
 	"investigation-map.md":     true,
 	"dogfood.md":               true,
+	"devex.md":                 true,
 	"parallel-lease.md":        true,
 	"metrics.jsonl":            true,
 	"regression-baseline.json": true,
+	"dispatch.json":            true,
+	"readiness-inputs.json":    true,
 }
 
 // SanctionedRootFile reports whether name is a legitimate workspace-root file:

package/engine/internal/state/feature.go

@@ -15,12 +15,14 @@ import (
 // ResolveRoot returns the .devrites directory to operate on. A non-empty
 // override (e.g. from DEVRITES_ROOT) may name either the project root or its
 // .devrites directory; otherwise the nearest ancestor .devrites is used.
+// Callers take Dir(root) as the project, so a symlinked .devrites (which
+// rootfacts proves resolves inside the project) keeps its project-side name.
 func ResolveRoot(override string) (string, error) {
 	facts, err := rootfacts.Resolve(override)
 	if err != nil {
 		return "", err
 	}
-	return facts.PhysicalRoot, nil
+	return filepath.Join(facts.PhysicalProject, devritespaths.DevritesRootName), nil
 }
 
 // featureDir is the canonical per-feature state directory under root.

package/engine/internal/state/observation.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"slices"
 	"sort"
 	"strings"
 
@@ -350,10 +351,12 @@ func observationWorkspaceOverrideValid(root, slug string) bool {
 	if raw == "" {
 		return true
 	}
-	if strings.TrimSpace(raw) != raw || filepath.Clean(raw) != raw {
+	if strings.TrimSpace(raw) != raw {
 		return false
 	}
-	if !filepath.IsAbs(raw) && !filepath.IsLocal(raw) {
+	// A ".." hop could route through a symlinked alias, so it is never
+	// cleaned away; "./" and trailing separators are harmless spellings.
+	if slices.Contains(strings.FieldsFunc(raw, func(r rune) bool { return r == '/' || r == filepath.Separator }), "..") {
 		return false
 	}
 	physicalRoot, err := filepath.EvalSymlinks(root)
@@ -364,16 +367,18 @@ func observationWorkspaceOverrideValid(root, slug string) bool {
 	if err != nil {
 		return false
 	}
-	override := raw
+	override := filepath.Clean(raw)
 	if !filepath.IsAbs(override) {
 		override = filepath.Join(filepath.Dir(physicalRoot), override)
 	}
-	override, err = filepath.Abs(override)
-	if err != nil {
+	// Only the selected root may be spelled through a symlink (/tmp versus
+	// /private/tmp); work/<slug> must match literally so an alias of the
+	// workspace itself never does.
+	if filepath.Base(override) != slug || filepath.Base(filepath.Dir(override)) != "work" {
 		return false
 	}
-	want := filepath.Join(physicalRoot, "work", slug)
-	return filepath.Clean(override) == filepath.Clean(want)
+	overrideRoot, err := filepath.EvalSymlinks(filepath.Dir(filepath.Dir(override)))
+	return err == nil && overrideRoot == physicalRoot
 }
 
 func observationInventory() []ArtifactPath {

package/engine/internal/state/taskgraph.go

@@ -3,16 +3,20 @@ package state
 import (
 	"fmt"
 	"regexp"
+	"slices"
 	"strings"
 	"unicode"
 
 	"github.com/devrites/devrites/internal/markdowntext"
 )
 
-// TaskSlice is one SLICE-### block parsed from tasks.md.
+// TaskSlice is one SLICE-### block parsed from tasks.md. Via maps a dependency
+// ID to the interface its `(via <text>)` suffix names; bare edges are absent.
 type TaskSlice struct {
-	ID           string
-	Dependencies []string
+	ID               string
+	Dependencies     []string
+	Via              map[string]string
+	ConsumesProduces string
 }
 
 // TaskGraphResult is the deterministic outcome of parsing a tasks.md slice graph.
@@ -26,8 +30,12 @@ type TaskGraphResult struct {
 var (
 	sliceHeaderRE  = regexp.MustCompile(`(?m)^##\s+(SLICE-\d+)\b`)
 	anyH2HeaderRE  = regexp.MustCompile(`(?m)^##\s`)
-	dependenciesRE = regexp.MustCompile(`(?m)^Dependencies:\s*(.+)\s*$`)
-	dependsOnRE    = regexp.MustCompile(`(?m)^depends_on:\s*(.+)\s*$`)
+	dependenciesRE = regexp.MustCompile(`(?m)^Dependencies:[ \t]*(.+)[ \t]*$`)
+	dependsOnRE    = regexp.MustCompile(`(?m)^depends_on:[ \t]*(.+)[ \t]*$`)
+	consumesRE     = regexp.MustCompile(`(?m)^Consumes / Produces:[ \t]*(.+)[ \t]*$`)
+	// viaSuffixRE matches a Dependencies `(via <text>)` suffix; group 2 is
+	// empty when the parenthetical is unclosed. Nested parentheses are unsupported.
+	viaSuffixRE    = regexp.MustCompile(`\([ \t]*via\b([^()]*)(\))?`)
 	sliceIDValidRE = regexp.MustCompile(`^SLICE-\d+$`)
 )
 
@@ -92,10 +100,10 @@ func ParseTaskGraph(tasksMarkdown []byte) TaskGraphResult {
 			end = headers[i+1][0]
 		}
 		block := text[start:end]
-		deps, problems := parseSliceGraph(id, block)
+		slice, problems := parseSliceGraph(id, block)
 		result.Problems = append(result.Problems, problems...)
-		result.Slices = append(result.Slices, TaskSlice{ID: id, Dependencies: deps})
-		for _, dep := range deps {
+		result.Slices = append(result.Slices, slice)
+		for _, dep := range slice.Dependencies {
 			if !known[dep] {
 				result.Unknown = append(result.Unknown, dep)
 				result.Problems = append(result.Problems, fmt.Sprintf("%s depends on unknown slice %s", id, dep))
@@ -121,14 +129,20 @@ func structuralTaskText(tasksMarkdown []byte) string {
 	return string(masked)
 }
 
-func parseSliceGraph(id, block string) ([]string, []string) {
+func parseSliceGraph(id, block string) (TaskSlice, []string) {
 	var problems []string
 	depsLine := firstLineValue(dependenciesRE, block)
 	mirrorLine := firstLineValue(dependsOnRE, block)
-	deps, malformed := parseIDList(depsLine)
-	for _, token := range malformed {
+	bare, via, malformed := splitDependencyVia(depsLine)
+	deps, malformedIDs := parseIDList(bare)
+	for _, token := range append(malformed, malformedIDs...) {
 		problems = append(problems, fmt.Sprintf("%s has malformed dependency %q", id, token))
 	}
+	for dep := range via {
+		if !slices.Contains(deps, dep) {
+			delete(via, dep) // its ID token is already reported malformed
+		}
+	}
 	mirror, mirrorMalformed := parseIDList(mirrorLine)
 	for _, token := range mirrorMalformed {
 		problems = append(problems, fmt.Sprintf("%s has malformed depends_on %q", id, token))
@@ -142,7 +156,48 @@ func parseSliceGraph(id, block string) ([]string, []string) {
 	if depsLine == "" {
 		deps = mirror
 	}
-	return deps, problems
+	return TaskSlice{ID: id, Dependencies: deps, Via: via, ConsumesProduces: firstLineValue(consumesRE, block)}, problems
+}
+
+// splitDependencyVia strips each `(via <text>)` suffix from a Dependencies
+// value, returning the bare ID list, the via text keyed by the ID it follows,
+// and any suffix that is empty, unclosed, or not directly after an ID.
+func splitDependencyVia(raw string) (string, map[string]string, []string) {
+	var bare strings.Builder
+	var via map[string]string
+	var malformed []string
+	last := 0
+	for _, m := range viaSuffixRE.FindAllStringSubmatchIndex(raw, -1) {
+		before := raw[last:m[0]]
+		bare.WriteString(before)
+		last = m[1]
+		text := strings.TrimSpace(raw[m[2]:m[3]])
+		dep := precedingSliceID(before)
+		if m[4] < 0 || text == "" || dep == "" {
+			malformed = append(malformed, strings.TrimSpace(raw[m[0]:m[1]]))
+			continue
+		}
+		if via == nil {
+			via = make(map[string]string)
+		}
+		if _, seen := via[dep]; !seen {
+			via[dep] = text
+		}
+	}
+	bare.WriteString(raw[last:])
+	return bare.String(), via, malformed
+}
+
+// precedingSliceID returns the SLICE-### token that ends s, separated from what
+// follows only by blanks, or "" when s ends in a separator or a non-ID token.
+func precedingSliceID(s string) string {
+	s = strings.TrimRight(s, " \t")
+	start := strings.LastIndexAny(s, ",; \t") + 1
+	id := strings.Trim(s[start:], "`'\"(){}[]")
+	if !sliceIDValidRE.MatchString(id) {
+		return ""
+	}
+	return id
 }
 
 func firstLineValue(re *regexp.Regexp, block string) string {

package/engine/internal/state/write.go

@@ -103,12 +103,18 @@ func WithFeatureLockRelease(root, slug string, fn func(release func()) error) er
 }
 
 // featureLockPath validates slug and creates the feature directory, returning
-// the lock file path inside it.
+// the lock file path inside it. A closed workspace (work/<slug> gone, archive/<slug>
+// present) is refused rather than resurrected by a late lock.
 func featureLockPath(root, slug string) (string, error) {
 	if !devritespaths.ValidSlug(slug) {
 		return "", fmt.Errorf("lock feature %q: not a feature slug", slug)
 	}
 	dir := featureDir(root, slug)
+	if _, err := os.Lstat(dir); errors.Is(err, fs.ErrNotExist) {
+		if _, archErr := os.Lstat(filepath.Join(root, "archive", slug)); archErr == nil {
+			return "", fmt.Errorf("lock feature %q: workspace is closed (archived)", slug)
+		}
+	}
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		return "", fmt.Errorf("lock feature %q: %w", slug, err)
 	}

package/engine/main.go

@@ -48,10 +48,12 @@ Usage:
   devrites-engine orient <slug>            Alias for observe summary
   devrites-engine next [slug]              Print the minimal remaining lifecycle path with advisory skips
   devrites-engine handoff [slug]           Emit the deterministic resume record (cursor, blocking gates, ledger, dead ends)
+  devrites-engine recall --paths <csv> [--limit n]
+                                         Point at archived features that touched these paths: decisions, constraints, findings (read-only)
   devrites-engine context [slug] (--phase <p> | --skill <name>) [--role <r>] [--slice <id>] [--trigger a,b]
                                          Emit one deduplicated read-set bundle for a phase, skill, or dispatch role
   devrites-engine metrics record <slug> --phase <p> --event <e> [--role r] [--bytes n] [--note s]
-  devrites-engine metrics summary [slug]   Summarize the per-feature metrics.jsonl event ledger
+  devrites-engine metrics summary [slug] [--by-slice]  Summarize the metrics ledger, or per-slice rounds and agent-minutes
   devrites-engine dispatch <slug> <sub>    Launch-wave barrier for parallel dispatch: open/start/seal/return/status/abandon (build wright waves: --slice, round cap)
   devrites-engine claim <add|release|list|check>   Advisory session-scoped file claims for same-tree concurrent sessions (.devrites/claims.jsonl)
   devrites-engine note <subcommand> <slug>         Anchored workspace notes bound to verbatim code quotes; drift regrades them (notes.md)
@@ -64,7 +66,7 @@ Usage:
   devrites-engine state resolve <qid> "<ans>"  Resolve an open question and update state atomically
   devrites-engine state merge-manifest <slug> [pred...]  Fold the recorded predecessor chain's manifests into the release candidate manifest
   devrites-engine state close <slug>       Archive a shipped feature and clear ACTIVE
-  devrites-engine migrate <slug> [--dry-run]  Normalize a pre-v5 workspace to the current schema
+  devrites-engine migrate <slug> [--dry-run] [--answer id=choice]  Normalize an older-schema workspace to the current schema
   devrites-engine secret-scan [--staged] [--stdin] [slug]  Scan exact staged blobs, stdin, or touched files; HIGH blocks
   devrites-engine open-visual <path-or-name> [--slug <slug>] [--no-open]
                                          Resolve a visual HTML file, optionally open it locally, print agent paths
@@ -134,6 +136,8 @@ func run(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 		return lib.RunNext(root, args[1:], stdout, stderr)
 	case "handoff":
 		return lib.RunHandoff(root, args[1:], stdout, stderr)
+	case "recall":
+		return lib.RunRecall(root, args[1:], stdout, stderr)
 	case "context":
 		return lib.RunContext(root, args[1:], stdout, stderr)
 	case "metrics":

package/pack/.claude/agents/_shared/composition-overhaul.md

@@ -1 +1,3 @@
 Do not invoke another agent. You are called by `/overhaul` and return your result to that orchestrator.
+
+Write your receipt (`schema` `overhaul.receipt/1`) to the packet's `receipt_path`, copying `run_id`, `task_id`, `attempt_id`, `lane` and `snapshot` verbatim from the packet and setting `role` to the unprefixed role name (`verifier`, not `overhaul-verifier`); follow `.claude/skills/overhaul/references/orchestration.md` § Receipts, since admission rejects any mismatch.

package/pack/.claude/agents/devrites-devex-reviewer.md

@@ -76,6 +76,10 @@ consistently:
 - **Docs accuracy:** examples must be correct and ready to copy. The documented
   signature must match the code, and changed behavior must update its docs in the
   same change.
+- **Agent use:** can a coding agent complete the flow with no human step?
+  Check non-interactive flags or env for every prompt, machine-readable output and
+  distinct exit codes where scripts consume results, headless setup and auth, and
+  commands instead of "click here" UI steps. Name each human-only step.
 
 ## Rules
 
@@ -112,6 +116,7 @@ Scorecard:
   error-messages    <actionable? | the unactionable ones, quoted>
   ergonomics        <consistent with project conventions? | the breaks>
   docs              <copy-pasteable + accurate? | the wrong examples>
+  agent-use         <completes headless? | the human-only steps | n/a>
 Boomerang (measure mode): predicted <…> vs measured <…> — gap: <none | the delta + why it matters>
 Overall: blockers? <yes/no — list>
 ```

package/pack/.claude/agents/devrites-evidence-scout.md

@@ -30,6 +30,10 @@ Read only the paths and bounded question supplied by the orchestrator.
 For structural questions, use the repository's code-intelligence index. Use exact
 sources, not recollection, and do not broaden the question.
 
+Report how things are today, not how the intended change should go. When the brief
+names a planned solution, still answer only with current-state facts; a recommendation
+bends the evidence toward the plan.
+
 ## Rules
 
 - Read-only. Do not edit source, tests, `.devrites/**`, Git state, or dependencies.

package/pack/.claude/agents/devrites-plan-reviewer.md

@@ -114,7 +114,9 @@ criterion, slice, or proof.
   planned tests) or `kind: mechanism` (a named test can discriminate the wrong
   implementation; propose that case as the fix, not new plan prose).
 - In a recheck, your verdict covers the listed fingerprints, the correction diff, and
-  the dependents of each changed clause. Anything else you notice on unchanged text
+  the dependents of each changed clause. Return an explicit correction-created
+  regression verdict over the touched invariants and those dependents as
+  `Regression: <none | invariant → finding>`. Anything else you notice on unchanged text
   goes under `Late:` with severity and site; it is recorded, not verdict-bearing.
 - When a dimension has no issue, say "strong: <why>" instead of inventing a
   finding.
@@ -134,6 +136,7 @@ Dimension bands (evidence → band):
   - … (all 7)
 Suppressed (confidence ≤4, unverified): <count + one-line each, appendix>
 Critical failure-mode gaps: <list | none>
+Regression (recheck only): <none | invariant → finding>
 Floor verdict: <weakest band> on <dimension> → PASS | BLOCKED
 ```
 

package/pack/.claude/agents/devrites-slice-wright.md

@@ -120,7 +120,10 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
    new fingerprint. At the limit return the gate and repro. `Escalation` is only for product/irreversible choices
    or human-only access; technical failure is a blocker.
    Before handoff, inspect your cumulative slice diff against the contract and
-   scenario matrix, including correction-affected adjacent variants. Fix supported
+   scenario matrix, including correction-affected adjacent variants, then against
+   the reviewers' own checks: [code review § What to check](../skills/devrites-lib/reference/standards/code-review.md#what-to-check-tests-first)
+   and test analysis (each acceptance criterion has a test that fails without the
+   change; no assertion-free, tautological, or mock-asserting test). Fix supported
    in-scope gaps together, rerun affected proof, and report remaining gaps. Self-check
    never replaces independent review; green tests do not prove all possible cases.
 5. **TRANSFER when isolated.** After green writer-safe proof, verify the diff again,

package/pack/.claude/agents/overhaul-implementer.md

@@ -1,6 +1,7 @@
 ---
 name: overhaul-implementer
 description: Implements one approved /overhaul repair task test-first inside its exact allowed paths. Dispatched only by the /overhaul skill after the user approves the plan; returns a patch receipt.
+permissionMode: acceptEdits
 ---
 
 <!-- include:_shared/untrusted-input.md -->

package/pack/.claude/settings.json

@@ -1,7 +1,6 @@
 {
-  "$comment": "DevRites keeps the root orchestration context source-read-only. Native subagents own specialist execution; only devrites-slice-wright may edit source in the lifecycle (fast-builder writes for /rite-fast; overhaul-* agents keep every tool). Its task lists exact project-relative paths, and the root rejects any returned diff outside that contract.",
+  "$comment": "DevRites keeps the root orchestration context source-read-only by instruction; no permission mode enforces it. These allow rules cover the engine, read-only git, code-graph tools and .devrites/ workspace edits. Native subagents own specialist execution; only devrites-slice-wright may edit source in the lifecycle (fast-builder writes for /rite-fast; overhaul-* agents keep every tool). Its task lists exact project-relative paths, and the root rejects any returned diff outside that contract.",
   "permissions": {
-    "defaultMode": "plan",
     "allow": [
       "Bash(devrites-engine check candidate *)",
       "Bash(devrites-engine check readiness *)",
@@ -19,6 +18,7 @@
       "Bash(devrites-engine orient *)",
       "Bash(devrites-engine next *)",
       "Bash(devrites-engine handoff *)",
+      "Bash(devrites-engine recall *)",
       "Bash(devrites-engine context *)",
       "Bash(devrites-engine metrics *)",
       "Bash(devrites-engine dispatch *)",
@@ -47,6 +47,7 @@
       "Bash(devrites-engine gates lint *)",
       "Bash(devrites-engine gates attest *)",
       "Bash(devrites-engine gates abandon *)",
+      "Bash(devrites-engine overhaul *)",
       "mcp__codegraph__*",
       "mcp__codebase-memory-mcp__*",
       "mcp__codebase-memory__*",
@@ -60,8 +61,7 @@
       "Bash(git show *)",
       "Bash(git rev-parse *)",
       "Bash(git merge-base *)",
-      "Edit(.devrites/**)",
-      "Write(.devrites/**)",
+      "Edit(/.devrites/**)",
       "Bash(devrites-engine secret-scan)",
       "Bash(devrites-engine secret-scan *)",
       "Bash(devrites-engine open-visual *)",

package/pack/.claude/skills/devrites-api-interface/SKILL.md

@@ -4,7 +4,7 @@ description: Shape stable API, type, module, or frontend/backend contracts befor
 user-invocable: false
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"deprecation":["devrites-lib/reference/standards/deprecation.md"],"security":["devrites-lib/reference/standards/security.md","rite-review/reference/security-review.md"]},"workspace":["spec.md","plan.md","tasks.md","state.md","decisions.md"]} -->
-> Read-set manifest: `devrites-engine context [slug] --skill devrites-api-interface` bundles every file named below into one deduplicated read.
+> Read-set manifest: `devrites-engine context <slug> --skill devrites-api-interface` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # devrites-api-interface: contract before implementation
 

package/pack/.claude/skills/devrites-audit/SKILL.md

@@ -5,7 +5,7 @@ argument-hint: "<security | perf | simplify>"
 user-invocable: false
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/parallel-dispatch.md","devrites-lib/reference/standards/agents.md"],"triggers":{"audit-coverage":["devrites-lib/reference/standards/audit-coverage.md"],"architecture-health":["devrites-lib/reference/standards/architecture-health.md"]},"workspace":["spec.md","plan.md","tasks.md","touched-files.md","evidence.md","state.md","decisions.md"],"workspaceByRole":{"performance-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md"],"security-auditor":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md"],"simplifier-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md"]}} -->
-> Read-set manifest: `devrites-engine context [slug] --skill devrites-audit` bundles every file named below into one deduplicated read.
+> Read-set manifest: `devrites-engine context <slug> --skill devrites-audit` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # devrites-audit: read-only audit dispatch
 

package/pack/.claude/skills/devrites-browser-proof/SKILL.md

@@ -4,7 +4,7 @@ description: Observe and prove working UI behavior in a real browser with screen
 user-invocable: false
 ---
 <!-- loads: {"always":["devrites-browser-proof/reference/browser-performance.md","devrites-browser-proof/reference/visual-verdict.md","devrites-frontend-craft/reference/quality-standards.md"],"triggers":{"security":["devrites-lib/reference/standards/security.md"],"devex":["devrites-lib/reference/standards/developer-experience.md"]}} -->
-> Read-set manifest: `devrites-engine context [slug] --skill devrites-browser-proof` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context <slug> --skill devrites-browser-proof` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # devrites-browser-proof: runtime evidence for UI
 

package/pack/.claude/skills/devrites-debug-recovery/SKILL.md

@@ -5,7 +5,7 @@ argument-hint: "[<slug>]"
 user-invocable: false
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/code-navigation.md","devrites-debug-recovery/reference/build-the-loop.md","devrites-debug-recovery/reference/cleanup-and-classify.md","devrites-debug-recovery/reference/hypotheses.md","devrites-debug-recovery/reference/instrumentation.md","devrites-debug-recovery/reference/regression-test.md","devrites-debug-recovery/reference/trace.md","devrites-lib/reference/standards/debug-recovery.md"],"triggers":{"one-shot":["devrites-lib/reference/standards/one-shot-actions.md"],"security":["devrites-lib/reference/standards/security.md"],"workspace":["devrites-lib/reference/standards/workflow-artifacts.md"]}} -->
-> Read-set manifest: `devrites-engine context [slug] --skill devrites-debug-recovery` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context <slug> --skill devrites-debug-recovery` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # devrites-debug-recovery: fix the root cause, not the symptom
 
@@ -32,7 +32,8 @@ has no clear next move. Optional slug selects the active workspace; defaults to
    Do not proceed without a reproduction input: the captured error text for
    repeatable actions, or the retained bounded artifact for consumptive ones.
 3. **Ranked hypotheses (3-5, falsifiable):** generate the list before testing
-   any of them. Each must state a prediction.
+   any of them. Each must state a prediction. With a `.devrites/archive/`, first run
+   `devrites-engine recall --paths <failing files>` for prior dead ends and causes.
    **Completion:** 3-5 distinct hypotheses each state an observable prediction.
    See [hypotheses.md](reference/hypotheses.md).
 4. **Trace when ambiguous:** if the cause is unclear, flaky, causal, or one fix

package/pack/.claude/skills/devrites-doubt/SKILL.md

@@ -4,7 +4,7 @@ description: Stress-test one consequential decision independently. Use for uncer
 user-invocable: false
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/agents.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"security":["devrites-lib/reference/standards/security.md"],"tooling":["devrites-lib/reference/standards/tooling.md"]},"workspace":["spec.md","plan.md","tasks.md","state.md","decisions.md"],"workspaceByRole":{"doubt-reviewer":["spec.md","plan.md","tasks.md","state.md","decisions.md"]}} -->
-> Read-set manifest: `devrites-engine context [slug] --skill devrites-doubt` bundles every file named below into one deduplicated read.
+> Read-set manifest: `devrites-engine context <slug> --skill devrites-doubt` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # devrites-doubt: CLAIM → EXTRACT → DOUBT → RECONCILE → STOP
 

package/pack/.claude/skills/devrites-frontend-craft/SKILL.md

@@ -4,7 +4,7 @@ description: Build accessible production UI and all states during /rite-build. U
 user-invocable: false
 ---
 <!-- loads: {"always":["devrites-frontend-craft/reference/craft.md","devrites-frontend-craft/reference/design-references.md","devrites-frontend-craft/reference/quality-standards.md","devrites-frontend-craft/reference/reuse-first.md","devrites-frontend-craft/reference/shape.md","rite-polish/reference/anti-ai-slop.md"],"triggers":{"fullstack":["devrites-frontend-craft/reference/fullstack.md"],"testing":["devrites-lib/reference/standards/testing.md"]}} -->
-> Read-set manifest: `devrites-engine context [slug] --skill devrites-frontend-craft` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context <slug> --skill devrites-frontend-craft` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # devrites-frontend-craft: UI like a senior designer-engineer
 

package/pack/.claude/skills/devrites-interview/SKILL.md

@@ -4,7 +4,7 @@ description: Interview the user one question at a time to extract intent. Use wh
 user-invocable: false
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","rite-spec/reference/interview-patterns.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"]},"workspace":["spec.md","questions.md","decisions.md","assumptions.md","decision-coverage.md","state.md"]} -->
-> Read-set manifest: `devrites-engine context [slug] --skill devrites-interview` bundles every file named below into one deduplicated read.
+> Read-set manifest: `devrites-engine context <slug> --skill devrites-interview` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # devrites-interview: extract intent
 

package/pack/.claude/skills/devrites-lib/reference/intent-map.md

@@ -69,15 +69,15 @@ Wrong-skill fire: stop, admit it, switch rites.
 | Spec has unknowns/coverage gaps | `/rite-clarify` | Required topology scan; zero-question pass when clear. |
 | Derive intent from existing code without an active feature contract | `/rite-adopt` | Establish the brownfield contract. |
 | Reconcile implementation with an active feature contract | `/rite-converge` | Identify gaps and add missing slices. |
-| Older workspace cannot resume | `/rite-upgrade` | Audit cited current-contract defects; age alone is no defect. Route semantic repairs to normal owners; preserve history without synthetic proof. |
+| Older workspace cannot resume (explicit only) | `/rite-upgrade` | Audit cited current-contract defects; age alone is no defect. Route semantic repairs to normal owners; preserve history without synthetic proof. |
 | Turn an approved spec into its first plan | `/rite-define` | No `tasks.md` slices yet; writes architecture, slices, traceability. |
 | Reslice, reorder, or repair an existing plan | `/rite-plan` | Slices exist and evidence invalidates them. |
 | Review plan before code | `/rite-vet` | Every plan; depth scales to risk. |
 | Small safe fix | `/rite-quick` | Escalates auth, migration, public API, destructive, ambiguous, or multi-slice work. |
 | Mid-size work, fast lane (explicit only) | `/rite-fast` | Spec + plan + questions once, ≤10 slices, one completeness check, review, polish, proof; risk deepens questions. |
 | Prove UI/runtime | `/rite-prove` + `devrites-browser-proof` | Capture real evidence. |
-| Stuck/unfamiliar | `/rite-zoom-out` | Map before editing. |
-| Teach me | `/rite-explain` | Human learning loop. |
+| Stuck/unfamiliar (explicit only) | `/rite-zoom-out` | Map before editing. |
+| Teach me (explicit only) | `/rite-explain` | Human learning loop. |
 | Decide ship readiness | `/rite-seal` | Decides; never mutates Git. |
 | Execute ship after GO | `/rite-ship` | Requires GO/type-GO. |
 | Unattended lifecycle | `/rite-autocomplete` | Clean baseline/checkpoints; hard gates stop. |

package/pack/.claude/skills/devrites-lib/reference/parallel-dispatch.md

@@ -4,7 +4,7 @@ Host dispatch; DevRites governs.
 
 ## Roster
 
-Review: Spec/Code; Seal: all applicable roles.
+Review: Spec/Code plus triggered frontend/security/performance; Seal: all applicable roles.
 
 | Reviewer | Fires | Trigger |
 |---|---|---|
@@ -38,8 +38,9 @@ If the candidate diff has no matching surfaces, record
    hand the bundle path as the packet's source list instead of a file roster.
    Build roles add `--slice <SLICE-ID>` (slice-scoped, slice-named bundle).
    Evaluate the skill's trigger conditions and pass each that fires — a role's
-   Trigger column maps to manifest names: `security-auditor` → `security`,
-   `frontend-reviewer` → `ui`/`frontend`, `performance-reviewer` → `performance`.
+   Trigger column maps to the phase manifest's names: `security-auditor` →
+   `security`; at Review, `frontend-reviewer` → `ui` and `performance-reviewer` →
+   `performance`. Seal declares neither; those roles load their own standards.
    The `agents` dispatch contract needs no flag: `--role` auto-fires it
    (`auto=[agents]` in the output). The command prints `unselected=[...]`; an
    omitted applicable trigger is a gap, not a shortcut.