devrites 6.0.4 → 6.1.1

package/pack/generated/pi/skills/rite-define/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 ---
 
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/spec-grammar.md","rite-define/reference/plan-template.md","rite-define/reference/gates.md","rite-define/reference/anti-patterns.md","rite-plan/reference/slicing.md","rite-plan/reference/task-breakdown.md","rite-spec/reference/acceptance-criteria.md","rite-spec/reference/state-workspace.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"agents":["devrites-lib/reference/standards/agents.md"],"applicability":["devrites-lib/reference/standards/repository-topology.md","devrites-lib/reference/standards/data-integrity.md","devrites-lib/reference/standards/integration-reliability.md"],"documentation":["devrites-lib/reference/standards/documentation.md"],"elicitation":["devrites-lib/reference/standards/elicitation.md"],"frontend":["devrites-frontend-craft/reference/fullstack.md"],"principles":["devrites-lib/reference/standards/principles.md"],"visual":["devrites-lib/reference/visual-playbooks/index.md"],"workflow":["devrites-lib/reference/standards/development-workflow.md"],"workflow-artifacts":["devrites-lib/reference/workspace-artifact-schema.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","strategy.md","design-brief.md","references.md"],"workspaceByRole":{"plan-drafter":["brief.md","spec.md","decision-coverage.md","questions.md","decisions.md","assumptions.md","architecture.md","strategy.md","design-brief.md","references.md","state.md"]}} -->
-> Read-set manifest: `devrites-engine context <slug> --phase define` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --phase define` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
 # /rite-define: plan from the spec
@@ -106,6 +106,8 @@ Pull these via `Read` when shaping the plan:
    capability end to end; first is the thinnest useful path, ordered by dependency then
    risk. Apply the slice-count and broad-refactor rules above plus
    [`slicing.md`](../rite-plan/reference/slicing.md) and [`task-breakdown.md`](../rite-plan/reference/task-breakdown.md).
+   Run `devrites-engine recall --paths <files likely touched>`; fold each relevant prior
+   decision, carry-forward constraint, or finding into that slice's `Prior-slice learnings`.
    Mark per slice: **Frontend craft required**
    and **Browser proof required** (UI), and whether it's **fullstack** (FE+BE → contract
    first, see [`fullstack.md`](../devrites-frontend-craft/reference/fullstack.md)). **For UI slices, name which
@@ -169,8 +171,7 @@ Pull these via `Read` when shaping the plan:
    `Plan sanity` (slice count + riskiest boundary/gate), `Expected build interruptions`
    (`none` or only justified action-time gates), and `Build exactly this?` (yes → approve;
    no → `/rite-plan revise`). When the human confirms the plan, write `Plan approved: <iso>` to
-   `state.md` (see [state-workspace](../rite-spec/reference/state-workspace.md)); `/rite-build`
-   checks this exists before building.
+   `state.md` (see [state-workspace](../rite-spec/reference/state-workspace.md)).
 
 ## tasks.md slice format
 

package/pack/generated/pi/skills/rite-doctor/SKILL.md

@@ -5,7 +5,7 @@ argument-hint: ""
 user-invocable: true
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md"],"workspace":["state.md"]} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-doctor` bundles every file named below into one deduplicated read.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite-doctor` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # /rite-doctor: DevRites diagnostics
 
@@ -27,12 +27,18 @@ Read-only: never repair files, advance a feature, or diagnose the application.
    For enabled surfaces, require the canonical Claude skills/settings and the
    generated Codex skills, exact agent profiles, config, and AGENTS bridge.
    Cross-check the loaded/effective host configuration when the host exposes it:
-   Claude root plan mode with only `devrites-slice-wright` writable; Codex root
-   `devrites-orchestrator`, wright `:workspace`, all reviewers `:read-only`.
-   Also allowed as writers: `fast-builder` (`acceptEdits` / `:workspace`) and the
-   `overhaul-*` agents (every tool); the other `fast-*` roles are read-only.
+   Claude read-only roles keep a tools allowlist without Edit/Write plus
+   `permissionMode: plan`, which Claude honors only while the parent is not in
+   acceptEdits/auto/bypass — the guarantee is tools + instructions, the mode is
+   best-effort; only `devrites-slice-wright` (`acceptEdits`) writes in the
+   lifecycle. Codex root `devrites-orchestrator`, wright `:workspace`, all
+   reviewers `:read-only`. Also allowed as writers: `fast-builder` (`acceptEdits`
+   / `:workspace`) and the `overhaul-*` agents (every tool; `overhaul-implementer`
+   `acceptEdits`); the other `fast-*` roles are read-only.
    File presence without effective loading is `WARN`; wrong permissions or a
-   missing required profile is `FAIL`.
+   missing required profile is `FAIL`. A project or local Claude
+   `permissions.defaultMode: plan` blocks the root's `.devrites` writes:
+   `FAIL`, remediation: remove it.
 4. **Inspect workspace topology.** Read `.devrites/ACTIVE` if present. An empty
    cursor is `OK` (no active feature). Otherwise require one safe slug, a
    contained regular `.devrites/work/<slug>/state.md`, and no symlink in the

package/pack/generated/pi/skills/rite-dogfood/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 disable-model-invocation: true
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-frontend-craft/reference/quality-standards.md","devrites-lib/reference/reply-contract.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"testing":["devrites-lib/reference/standards/testing.md"],"tooling":["devrites-lib/reference/standards/tooling.md"]},"workspace":["state.md","questions.md","dogfood.md"]} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-dogfood` bundles every file named below into one deduplicated read.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite-dogfood` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # /rite-dogfood: diff-scoped browser QA
 
@@ -26,7 +26,7 @@ Step 0: Read `.pi/skills/devrites-lib/reference/standards/core.md`, then [`tooli
 2. **Map changed journeys.** Read the diff and relevant routes/components. Write or update `.devrites/work/<slug>/dogfood.md` with Mermaid flowcharts for each touched user journey. Completion: every user-visible changed surface appears in at least one flow or is marked non-browser-testable.
 3. **Build matrix.** Turn flow nodes and branches into scenarios: happy, error, empty, permission, responsive, accessibility basics, and persona paper cuts. Completion: every flow branch has a scenario row.
 4. **Run browser.** Start/reuse the dev server (honor `--port N` when given), visit each route, capture screenshot/console/network notes, and mark each scenario `Pass`, `Fail`, `Fixed`, `Blocked (human verify)`, or `Blocked (human decision)`.
-5. **Safe fix loop.** For `Fail` or sharp paper cut: fix only if obvious and contained; add a regression test or record why a replay/screenshot is the only meaningful check; re-run the scenario. Otherwise record the decision for a human.
+5. **Safe fix loop.** For `Fail` or sharp paper cut: fix only if obvious and contained; add a regression test or record why a replay/screenshot is the only meaningful check; re-run the scenario. Otherwise record the decision for a human. The root never edits source/tests: each fix goes to exact `devrites-slice-wright` with an exact-path contract per [wright-dispatch.md § Standalone correction](../rite-build/reference/wright-dispatch.md#standalone-correction); reject any returned path outside it.
 6. **Finalize.** Run the relevant test command once, update `dogfood.md`, and add follow-ups to `questions.md` only for real human decisions.
 
 ## Output

package/pack/generated/pi/skills/rite-explain/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 disable-model-invocation: true
 ---
 <!-- loads: {"always":["rite-explain/reference/intake.md"],"triggers":{"repo":["devrites-lib/reference/standards/tooling.md"],"style":["devrites-lib/reference/standards/prose-style.md"],"principles":["devrites-lib/reference/standards/principles.md"]}} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-explain` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite-explain` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # /rite-explain: the human half of the learning loop
 

package/pack/generated/pi/skills/rite-fast/SKILL.md

@@ -7,7 +7,7 @@ disable-model-invocation: true
 ---
 
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/definition-of-done.md","devrites-lib/reference/standards/elicitation.md","devrites-lib/reference/standards/spec-grammar.md","rite-fast/reference/artifacts.md","rite-fast/reference/check-and-triage.md"],"triggers":{"risk":["devrites-lib/reference/standards/afk-hitl.md","devrites-lib/reference/standards/security.md"],"testing":["devrites-lib/reference/standards/testing.md"]},"workspace":["spec.md","plan.md","evidence.md"]} -->
-> Read-set manifest: `devrites-engine context <slug> --phase fast` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --phase fast` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # /rite-fast: shortened lane for mid-size work
 
@@ -49,10 +49,10 @@ proof) and drops the per-slice ceremony. It stands outside the engine lifecycle:
 
 | Role | Agent | Mode |
 | --- | --- | --- |
-| Planner: repo facts, draft spec and plan, ranked questions | [`fast-planner`](.pi/agents/fast-planner.md) | read-only |
-| Builder: slices and accepted fixes | [`fast-builder`](.pi/agents/fast-builder.md) | write-capable, exact paths |
-| Completeness checker | [`fast-checker`](.pi/agents/fast-checker.md) | read-only |
-| Critic: review and polish in one pass | [`fast-critic`](.pi/agents/fast-critic.md) | read-only |
+| Planner: repo facts, draft spec and plan, ranked questions | [`fast-planner`](../../agents/fast-planner.md) | read-only |
+| Builder: slices and accepted fixes | [`fast-builder`](../../agents/fast-builder.md) | write-capable, exact paths |
+| Completeness checker | [`fast-checker`](../../agents/fast-checker.md) | read-only |
+| Critic: review and polish in one pass | [`fast-critic`](../../agents/fast-critic.md) | read-only |
 
 Dispatch each role as its named agent in a fresh context with a packet that names
 the slug, the workspace paths, and the exact task. If the host cannot dispatch named
@@ -69,7 +69,9 @@ installed and no fresh context is available, stop with `Stopped: fast-* agents m
    record `unproven: no commands` and continue. PROVE will report it.
 3. Pick a short kebab-case slug from the task. If the argument names an existing
    `.devrites/work/<slug>/plan.md` with `Lane: fast`, **resume**: read the ledger and
-   continue at the first phase or slice that is not complete.
+   continue at the first phase or slice that is not complete. If `.devrites/work/<slug>/`
+   exists without `Lane: fast`, or `.devrites/archive/<slug>/` exists, pick a new slug;
+   if the user named that slug, stop instead — never overwrite another workspace.
 
 ## 1. Shape: spec, plan, questions
 

package/pack/generated/pi/skills/rite-frame/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 ---
 
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","rite-frame/reference/failure-modes.md"],"triggers":{"principles":["devrites-lib/reference/standards/principles.md"],"simplify":["devrites-lib/reference/standards/coding-style.md","devrites-lib/reference/standards/patterns.md"],"testing":["devrites-lib/reference/standards/testing.md"]},"workspace":[]} -->
-> Read-set manifest: `devrites-engine context <slug> --phase frame` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --phase frame` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
 # /rite-frame: frame the goal, audit the diff

package/pack/generated/pi/skills/rite-handoff/SKILL.md

@@ -6,7 +6,7 @@ disable-model-invocation: true
 argument-hint: "[what the next session will focus on]"
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","rite-handoff/reference/handoff-template.md","devrites-lib/reference/reply-contract.md"],"triggers":{"hygiene":["devrites-lib/reference/standards/context-hygiene.md"]}} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-handoff` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite-handoff` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # /rite-handoff: chat-only context, into a fresh-agent doc
 
@@ -48,8 +48,9 @@ For each of these, write the content into its **canonical home** first, then mer
 - **Assumption** about behaviour / API / user intent → append to `assumptions.md`.
 - **Drift event raised but not fully resolved** → update `drift.md` with the current
   resolution status (open / asked-user / repaired).
-- **Files modified in chat not yet in `touched-files.md`** → append to
-  `touched-files.md`.
+- **Files modified in chat not yet in `touched-files.md`** → no recorded provenance, so
+  record them as drift in `drift.md` (or a `questions.md` entry); never append them to
+  `touched-files.md`, the candidate manifest Ship stages.
 
 The handoff doc itself then says "synced N entries into decisions.md", not the entries
 themselves. The workspace is the canonical store; the handoff is the chat-only delta.

package/pack/generated/pi/skills/rite-learn/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 disable-model-invocation: true
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/documentation.md","devrites-lib/reference/standards/tooling.md"],"workspace":["state.md","decisions.md","drift.md","evidence.md","review.md","seal.md","questions.md"],"workspaceByRole":{"retrospector":["state.md","decisions.md","drift.md","evidence.md","review.md","seal.md","questions.md"]},"triggers":{"agents":["devrites-lib/reference/standards/agents.md"]}} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-learn` bundles every file named below into one deduplicated read.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite-learn` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # /rite-learn: review durable lessons
 
@@ -29,7 +29,7 @@ of one authority; it cannot promote a rule alone.
    A missing, failed, timed-out, or malformed result reports `Candidate: NOT-RUN
    (unavailable: <reason>)` as a gap, never `Candidate: none`; an unavailable role stops
    for HITL per [`agents.md`](../devrites-lib/reference/standards/agents.md) (trigger `agents`).
-3. Keep corrections repeated in two features, a judgement call made twice, or a defect class seen twice; drop one-off preferences, task-specific detail, generic advice.
+3. Keep corrections repeated in two features (a `## Carry-forward constraints` rule recurring in two archived `decisions.md` qualifies), a judgement call made twice, or a defect class seen twice; drop one-off preferences, task-specific detail, generic advice.
    Broad mode also proposes **retirements**: a rule found via a `rite-learn: accepted`
    marker whose cited failing case or owner no longer exists in live source, whose
    review-by date passed unverified, or that is a model-default no-op. Zero is valid but

package/pack/generated/pi/skills/rite-plan/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 ---
 
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/standards/acceptance-preserving-reslice.md","devrites-lib/reference/standards/tooling.md","devrites-lib/reference/standards/agents.md","rite-plan/reference/slicing.md","rite-plan/reference/replan-and-repair.md","rite-plan/reference/dependency-graph.md","rite-plan/reference/task-breakdown.md","rite-plan/reference/anti-patterns.md","rite-define/reference/plan-template.md"],"triggers":{"applicability":["devrites-lib/reference/standards/repository-topology.md","devrites-lib/reference/standards/data-integrity.md","devrites-lib/reference/standards/integration-reliability.md"],"one-shot":["devrites-lib/reference/standards/one-shot-actions.md"],"assumption-delta":["devrites-lib/reference/standards/assumption-checkpoints.md"],"workflow":["devrites-lib/reference/standards/development-workflow.md"],"workflow-artifacts":["devrites-lib/reference/standards/workflow-artifacts.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","drift.md"],"workspaceByRole":{"plan-drafter":["brief.md","spec.md","plan.md","tasks.md","decision-coverage.md","questions.md","decisions.md","assumptions.md","architecture.md","state.md","drift.md"]}} -->
-> Read-set manifest: `devrites-engine context <slug> --phase plan` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --phase plan` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
 # /rite-plan: (re)plan an active feature
@@ -177,7 +177,7 @@ Before classifying any Reslice, read `.pi/skills/devrites-lib/reference/standard
 
 When invoked inline by a controlling rite, return the completed Plan checkpoint
 to that caller so it can invoke Vet immediately. The phase boundary is not a
-user-facing stop unless a genuine HITL, safety/access, or exhausted-recovery
+user-facing stop unless a genuine HITL, safety/access, or parked-recovery
 condition was recorded.
 
 When invoked directly with no controlling caller and a planning artifact

package/pack/generated/pi/skills/rite-plan/reference/replan-and-repair.md

@@ -29,6 +29,8 @@ A drift event stopped the build. Steps:
 1. Read the `drift.md` entries and their classifications. Fold EVERY open entry
    and accepted finding for the affected artifacts in ONE pass, never serially.
 2. If the user answered a drift question, encode that decision in `decisions.md`.
+   Fold each `decisions.md` carry-forward constraint into `Prior-slice learnings`
+   of the remaining slices it affects.
 3. Update `spec.md` (only the affected sections) and `plan.md`/`tasks.md` to match
    reality. Adjust acceptance criteria if they were wrong.
    **Write the pointer, not the history.** Name the findings a fold closes by ID, one line

package/pack/generated/pi/skills/rite-plan/reference/slicing.md

@@ -165,4 +165,6 @@ while pivoting is still cheap.
 
 ## Slice independence
 Order by dependency, but minimize coupling. A slice that needs three other slices first
-is a smell: look for a thinner cut that stands alone.
+is a smell: look for a thinner cut that stands alone. An edge exists only when this slice
+reads something the other produces: write it as `SLICE-001 (via <interface>)`. If you
+cannot name what crosses, drop the edge; a shallow, wide graph runs in parallel.

package/pack/generated/pi/skills/rite-polish/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 ---
 
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/candidate-integrity.md","rite-polish/reference/code.md","rite-polish/reference/anti-patterns.md","rite-polish/reference/anti-ai-slop.md","rite-polish/reference/harden-checklist.md","rite-polish/reference/ledger.md","rite-build/reference/checkpoint.md"],"triggers":{"adr":["rite-polish/reference/adr-promotion.md"],"agents":["devrites-lib/reference/standards/agents.md"],"backend":["rite-polish/reference/backend-polish.md"],"coding":["devrites-lib/reference/standards/coding-style.md","devrites-lib/reference/standards/duplicate-code.md"],"errors":["devrites-lib/reference/standards/error-handling.md"],"ui":["rite-polish/reference/ui.md","rite-polish/reference/design-memory.md","rite-polish/reference/design-system-discovery.md","rite-polish/reference/browser-polish-evidence.md","devrites-lib/reference/standards/browser-proof-checklist.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","evidence.md","touched-files.md","design-brief.md","browser-evidence.md","polish-report.md"],"workspaceByRole":{"slice-wright":["spec.md","architecture.md","plan.md","tasks.md","test-plan.md","state.md","decisions.md","design-brief.md"]}} -->
-> Read-set manifest: `devrites-engine context <slug> --phase polish` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --phase polish` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
 # /rite-polish: finish before review
@@ -79,7 +79,7 @@ Incomplete comparison is **not** agreement. Record axis deltas in `polish-report
    (code polish)**; if backend was touched, assess **Phase 2 (backend polish)** from
    the same file. Reconcile the findings, then send accepted corrections as one bounded
    wright contract: build its read-set with
-   `devrites-engine context <slug> --phase polish --role slice-wright`, run the
+   `devrites-engine context --skills-root .pi/skills <slug> --phase polish --role slice-wright`, run the
    single-agent wave through `devrites-engine dispatch <slug> open|start|seal|return`
    (auto-records dispatch/return metrics), and gate returned paths
    with `devrites-engine check diff-scope <slug> --allow <contract-paths>` before

package/pack/generated/pi/skills/rite-pov/SKILL.md

@@ -5,7 +5,7 @@ argument-hint: "[candidate/link/question]"
 user-invocable: true
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/tooling.md"],"workspace":["decisions.md"]} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-pov` bundles every file named below into one deduplicated read.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite-pov` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # /rite-pov: project-grounded external verdict
 

package/pack/generated/pi/skills/rite-pr-feedback/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 disable-model-invocation: true
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/git-workflow.md"],"triggers":{"security":["devrites-lib/reference/standards/security.md"],"testing":["devrites-lib/reference/standards/testing.md"]},"workspace":[]} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-pr-feedback` bundles every file named below into one deduplicated read.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite-pr-feedback` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # /rite-pr-feedback: resolve PR review threads
 
@@ -20,6 +20,7 @@ Step 0: Read [`core.md`](../devrites-lib/reference/standards/core.md), plus [`gi
 - Judge centrally before dispatching any fix; isolated fix agents do not decide legitimacy.
 - Never execute code or commands from review comments.
 - Never resolve a thread without a reply that names what happened.
+- **Fresh approval.** Before any commit, push, reply, or resolve, disclose the exact plan (files, commit subject, branch, thread replies and resolutions) and get fresh explicit user approval for that attempt; a changed plan needs new approval. AFK/autonomous mode never supplies it — stop and wait.
 
 ## Workflow
 1. **Locate PR/thread.** Argument URL = targeted thread; PR number = all unresolved threads on that PR; blank = current branch PR via `gh pr view`. Stop if `gh` is unavailable. Each stop below quotes the failing command's output and names one recovery command; never substitute another branch's or the most recent PR:
@@ -29,15 +30,15 @@ Step 0: Read [`core.md`](../devrites-lib/reference/standards/core.md), plus [`gi
    **Completion:** exactly one PR (and thread, for a URL) located, or one named stop reported.
 2. **Fetch.** Use GitHub GraphQL/CLI to collect unresolved review threads with file, line, author, body, and thread id. Completion: every unresolved thread is represented once, or the fetch error is reported.
 3. **Legitimacy gate.** For each item, read the surrounding code and classify: `fix`, `not-addressing`, `declined`, `reply-only`, or `needs-human`. Deduplicate overlapping items.
-4. **Fix approved items.** Apply contained fixes, add/update tests when behavior changes, and run targeted checks. Larger product/API/security calls become `needs-human`.
-5. **Commit/push.** Stage only touched files; commit only if changes exist; push the branch.
+4. **Fix approved items.** Apply contained fixes, add/update tests when behavior changes, and run targeted checks. The root never edits source/tests: each fix goes to exact `devrites-slice-wright` with an exact-path contract per [wright-dispatch.md § Standalone correction](../rite-build/reference/wright-dispatch.md#standalone-correction); reject any returned path outside it. Larger product/API/security calls become `needs-human`.
+5. **Commit/push.** After fresh approval of the disclosed plan: stage only touched files; commit only if changes exist; push the branch.
    Push rejected (protected branch, non-fast-forward, hooks): stop and report the exact
    rejection — never force-push or rewrite a shared branch. Post-push checks fail: record
    the failing check, choose fix-forward or revert, put the choice + reason in the thread
    reply — never a silent red push.
    **Completion:** committed/pushed with SHA evidence and green checks, or no commit (empty
    diff), or the push failure reported verbatim.
-6. **Reply and resolve.** Reply to every thread with outcome and evidence. Resolve only `fix`, `not-addressing`, `declined`, and `reply-only`; leave `needs-human` open.
+6. **Reply and resolve.** Under the approved plan, reply to every thread with outcome and evidence. Resolve only `fix`, `not-addressing`, `declined`, and `reply-only`; leave `needs-human` open.
    **Completion:** every thread has one recorded outcome and only permitted terminal outcomes are resolved.
 7. **Verify.** Fetch unresolved threads again and report remaining intentional opens.
 

package/pack/generated/pi/skills/rite-pressure-test/SKILL.md

@@ -5,7 +5,7 @@ argument-hint: "[rough idea or plan to stress-test]"
 user-invocable: true
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/intent-map.md"],"workspace":["decisions.md","questions.md"]} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-pressure-test` bundles every file named below into one deduplicated read.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite-pressure-test` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # /rite-pressure-test: diverge then converge
 
@@ -40,9 +40,11 @@ If the hinge is an uncertain material fact, freeze at most three questions for
 `unavailable`, never support. Record claim, support, strongest contrary evidence, and
 `supported | assumption | refuted`. Refutation changes the recommendation; an assumption
 advances only when non-decisive with bounded downside. Weak/conflicting decisive evidence
-returns **Hold** with the resolving evidence, never `/rite-spec`. Persist a Hold as an open
-`questions.md` entry (`gate: blocking`, the premise and resolving evidence) in the active or
-provisional-slug workspace before stopping; a reply-only Hold is lost. Tie-breaker:
+returns **Hold** with the resolving evidence, never `/rite-spec`. Persist a Hold before
+stopping; a reply-only Hold is lost. In an active workspace (has `state.md`), append an open
+`questions.md` entry (`gate: blocking`, the premise and resolving evidence). Otherwise add a
+`Hold:` line (premise + resolving evidence) under `Not yet specified` in the provisional
+slug's `investigation-map.md`; `/rite-spec` carries it into `questions.md` on adoption. Tie-breaker:
 see [`intent-map.md`](../devrites-lib/reference/intent-map.md) (`rite-pressure-test`
 vs `rite-spec`). Do not research preferences
 or reversible implementation choices.
@@ -69,6 +71,6 @@ Changed: workspace only
 Evidence: options compared <n>; recommendation <option>; hinge <condition>; premises <supported/assumption/refuted + sources>
 Open: <none | unresolved premise and resolving evidence>
 Next: <when supported: /rite-spec <feature>; when Hold: none — requires <resolving evidence>; when Kill: none — not building: <reason>>
-Record: <investigation-map.md path | questions.md id (Hold) | not applicable>
+Record: <investigation-map.md path (incl. provisional Hold) | questions.md id (Hold) | not applicable>
 ↻ Hygiene: /clear before starting the lifecycle
 ```

package/pack/generated/pi/skills/rite-prototype/SKILL.md

@@ -6,7 +6,7 @@ disable-model-invocation: true
 argument-hint: "[the question the prototype is answering]"
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md"],"workspace":[]} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-prototype` bundles every file named below into one deduplicated read.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite-prototype` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # /rite-prototype: answer one question with throwaway code
 

package/pack/generated/pi/skills/rite-prove/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 ---
 
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/candidate-integrity.md","devrites-lib/reference/standards/testing.md","devrites-lib/reference/standards/spec-grammar.md","devrites-lib/reference/standards/test-proof-checklist.md","devrites-lib/reference/standards/agents.md","devrites-lib/reference/standards/gates.md","devrites-lib/reference/standards/verification-methods.md","rite-prove/reference/acceptance-proof.md","rite-prove/reference/proof-ladder.md","rite-prove/reference/failure-triage.md","rite-prove/reference/test-command-discovery.md","rite-prove/reference/anti-patterns.md","rite-build/reference/checkpoint.md"],"triggers":{"applicability":["devrites-lib/reference/standards/repository-topology.md","devrites-lib/reference/standards/data-integrity.md","devrites-lib/reference/standards/integration-reliability.md"],"browser":["devrites-lib/reference/standards/browser-proof-checklist.md","rite-prove/reference/browser-proof.md"],"devex":["devrites-lib/reference/standards/developer-experience.md"],"dod":["devrites-lib/reference/standards/definition-of-done.md"],"observability":["devrites-lib/reference/standards/observability.md"],"one-shot":["devrites-lib/reference/standards/one-shot-actions.md"],"performance":["devrites-lib/reference/standards/performance.md"],"workflow-artifacts":["devrites-lib/reference/standards/workflow-artifacts.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","evidence.md","touched-files.md","browser-evidence.md"],"workspaceByRole":{"proof-runner":["spec.md","test-plan.md","tasks.md","gates.md","evidence.md","touched-files.md","browser-evidence.md","state.md"],"spec-reviewer":["brief.md","spec.md","decision-coverage.md","questions.md","decisions.md","assumptions.md","state.md"]}} -->
-> Read-set manifest: `devrites-engine context <slug> --phase prove` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --phase prove` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
 # /rite-prove: prove the completed feature
@@ -37,8 +37,10 @@ TTHW, and exact signal-bearing errors; never assert DX (trigger `devex`).
   validates it. Only the bounded wright fixes product source/tests.
 - **Prove remains the controlling caller** during technical backtracking. Save
   its cursor; run Plan repair, Recovery Vet, remediation, and re-proof inline;
-  consume nested boundaries; resume the failed rung. Recovery exhausts after
-  three no-progress attempts on the exact same fingerprint. Closing one or exposing a distinct
+  consume nested boundaries; resume the failed rung. A strategy is spent after
+  three no-progress attempts on the exact same fingerprint; escalate it per the
+  [retry contract](../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve)
+  instead of stopping. Closing one or exposing a distinct
   Critical/Important invariant is progress, not a reason to hand work off.
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"Prove consumes installed Workflow Artifact or CLEANED rerun","action":"VERIFY_EXISTING or admitted proof path ending PROVE_AND_RETURN","return":"saved Prove cursor; stop before real action"} -->
 ## Released-workspace refresh

package/pack/generated/pi/skills/rite-prove/reference/failure-triage.md

@@ -47,6 +47,7 @@ loop to `devrites-debug-recovery`.
 - Three no-progress attempts on the exact same causal fingerprint consume the
   shared recovery cap. A recheck that closes the reproduction is progress; a
   different evidenced Critical/Important invariant gets its own fingerprint.
-  Preserve the reproduction and dead ends, then stop once as a technical blocker.
+  Preserve the reproduction and dead ends, then escalate or park per the
+  [retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve).
   Ask only when the remaining decision is human-owned.
 - A failure you can't fix in scope is a recorded **blocker**, not a silent skip.

package/pack/generated/pi/skills/rite-quick/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 ---
 
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/definition-of-done.md","devrites-lib/reference/orchestration-profiles.md"],"triggers":{"coding":["devrites-lib/reference/standards/coding-style.md"],"testing":["devrites-lib/reference/standards/testing.md"],"errors":["devrites-lib/reference/standards/error-handling.md"],"security":["devrites-lib/reference/standards/security.md"],"principles":["devrites-lib/reference/standards/principles.md"],"afk":["devrites-lib/reference/standards/afk-hitl.md"]},"workspace":["state.md"]} -->
-> Read-set manifest: `devrites-engine context <slug> --phase quick` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --phase quick` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
 # /rite-quick: express lane for small changes
@@ -64,7 +64,11 @@ Load this lane's conditional standards when needed:
 3. **Build with TDD.** Failing test first when behavior changes (see it fail for the right
    reason) → smallest complete change in the **project's idiom** (reuse before you write,
    anti-AI-slop) → cover every touched behavior / interactive element with a **real**
-   assertion. UI → check the states + a browser glance.
+   assertion. UI → check the states + a browser glance. The root never edits source/tests:
+   dispatch exact `devrites-slice-wright` with an exact-path contract per
+   [wright-dispatch.md § Standalone correction](../rite-build/reference/wright-dispatch.md#standalone-correction) and the
+   [source-writing boundary](../devrites-lib/reference/standards/agents.md#source-writing-boundary);
+   reject any returned path outside it.
 4. **Prove (scoped).** Run the **targeted** tests + typecheck / lint for what changed (not
    the whole suite) → green. Record the command + output — resolve the project's real
    typecheck/lint commands with `devrites-engine detect commands` rather than guessing.
@@ -74,10 +78,11 @@ Load this lane's conditional standards when needed:
    fail is not proof.
 5. **Review-lite + ship.** Self-review the diff for correctness, scope, and idiom. If
    `.devrites/principles.md` exists, confirm that no declared invariant is broken. This is
-   `/rite-frame`'s AUDIT pass: one pass, no subagent fan-out. Show the diff, then on the user's confirm commit it
-   (Conventional Commits, atomic), or hand to `/rite-ship` only when the change belongs to the active
-   feature's candidate; otherwise commit standalone. **Never push
-   without the user asking.**
+   `/rite-frame`'s AUDIT pass: one pass, no subagent fan-out. Show the diff. A change that belongs to the
+   active feature's candidate is not committed here: append its exact paths to
+   `touched-files.md`, then route to `/rite-prove` →
+   `/rite-review` → `/rite-seal` (`/rite-ship` needs Seal GO). Otherwise, on the
+   user's confirm, commit it standalone (Conventional Commits, atomic). **Never push without the user asking.**
 
 ## Escalation (mid-flight): the Spec Drift Guard still applies
 If the "small" change turns out to be not small: a second slice appears, a real design

package/pack/generated/pi/skills/rite-resolve/SKILL.md

@@ -1,12 +1,12 @@
 ---
 name: rite-resolve
 description: User-invoked resume verb for answering, dropping, or batch-resolving open `questions.md` gates.
-argument-hint: "<qid> \"<answer>\"  |  --drop <qid> [\"<reason>\"]  |  --batch <path-to-file>"
+argument-hint: "<qid> \"<answer>\"  |  --drop <qid> [\"<reason>\"]  |  --batch <plain-text-file>"
 user-invocable: true
 disable-model-invocation: true
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","rite-resolve/reference/answer-protocol.md"],"triggers":{"standards":["devrites-lib/reference/standards/afk-hitl.md","devrites-lib/reference/standards/documentation.md"]}} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-resolve` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite-resolve` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # /rite-resolve: answer the human gate
 
@@ -63,7 +63,7 @@ Pull these via `Read` when shaping the resolve:
    - `<qid> "<answer>"`: answer the single open question.
    - `--drop <qid>` (optional `"<reason>"`): mark the question `dropped`; record
      the reason inline.
-   - `--batch <path-to-file>`: bulk resolve, one entry per qid (see
+   - `--batch <plain-text-file>`: bulk resolve, one entry per qid (see
      [`reference/answer-protocol.md`](reference/answer-protocol.md) for the batch
      format).
 2. **Load context.** Read `state.md`, `questions.md`, and the relevant slice from

package/pack/generated/pi/skills/rite-resolve/reference/answer-protocol.md

@@ -48,11 +48,10 @@ q-2026-05-28-002: clinician sign-off required at runtime, not at plan time
 ```
 
 - One qid per line. The first colon is the separator; the rest of the line is the value.
-- Order matters only for `state.md` clearance: the script processes top-to-bottom and
-  flushes `Awaiting human` after each match.
-- Errors abort the batch at the first failing line so partial state is small and
-  diagnosable. Report the failing line, exit code, and the qids already applied. (Re-run after fixing the offending line; already-applied lines refuse to
-  re-apply because their `status` is no longer `open`.)
+- The batch is all-or-nothing: every line is validated before one atomic write, then
+  `Awaiting human` is cleared for the resolved qids.
+- An error applies nothing. Report the failing line and exit code, fix that line, and
+  re-run the whole file.
 
 ## Never overwrite
 

package/pack/generated/pi/skills/rite-review/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 ---
 
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/candidate-integrity.md","devrites-lib/reference/orchestration-profiles.md","devrites-lib/reference/parallel-dispatch.md","devrites-lib/reference/standards/agents.md","devrites-lib/reference/standards/tooling.md","rite-review/reference/feature-scoped-review.md","rite-review/reference/five-axis-review.md","rite-review/reference/anti-patterns.md"],"triggers":{"applicability":["devrites-lib/reference/standards/repository-topology.md","devrites-lib/reference/standards/data-integrity.md","devrites-lib/reference/standards/integration-reliability.md"],"code-review":["devrites-lib/reference/standards/code-review.md","devrites-lib/reference/standards/review-checklist.md","devrites-lib/reference/standards/review/README.md","devrites-lib/reference/standards/duplicate-code.md"],"performance":["devrites-lib/reference/standards/performance.md","rite-review/reference/performance-review.md","rite-review/reference/performance-checklist.md"],"principles":["devrites-lib/reference/standards/principles.md"],"security":["devrites-lib/reference/standards/security.md","devrites-lib/reference/standards/security-checklist.md","rite-review/reference/security-review.md"],"testing":["devrites-lib/reference/standards/testing.md"],"ui":["rite-review/reference/nielsen-heuristics.md","rite-review/reference/cognitive-load.md","rite-review/reference/performance-checklist.md"],"workflow-artifacts":["devrites-lib/reference/workspace-artifact-schema.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","evidence.md","touched-files.md","design-brief.md","browser-evidence.md"],"workspaceByRole":{"code-reviewer":["spec.md","plan.md","tasks.md","test-plan.md","architecture.md","decisions.md","state.md","evidence.md","touched-files.md"],"devex-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md"],"doubt-reviewer":["spec.md","plan.md","tasks.md","state.md","decisions.md"],"frontend-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","design-brief.md"],"performance-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md"],"plan-reviewer":["spec.md","plan.md","tasks.md","test-plan.md","decision-coverage.md","architecture.md","state.md"],"security-auditor":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md"],"simplifier-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md"],"spec-reviewer":["brief.md","spec.md","decision-coverage.md","questions.md","decisions.md","assumptions.md","state.md"],"test-analyst":["spec.md","tasks.md","test-plan.md","state.md","evidence.md"]}} -->
-> Read-set manifest: `devrites-engine context <slug> --phase review` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --phase review` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
 # /rite-review: feature-scoped review
@@ -77,7 +77,8 @@ Pull these via `Read` when the diff demands them:
    Read `touched-files.md` `## Review trail` and `eng-review.md` `## Deferred findings`:
    every deferred row is an input finding for the step-3 cohort (quoted in the owning
    reviewer's brief without severity) and ends in `review.md` with its own label and
-   action tag — never silently dropped.
+   action tag — never silently dropped. Hand each lane reviewer the
+   `devrites-engine recall --paths <its touched paths>` pointers as prior context, not findings.
 2. **Review tests first:** do they prove the acceptance criteria? Missing,
    weak, or wrong tests are the first findings.
    **Completion:** every acceptance criterion maps to a proven test or a labeled finding.

package/pack/generated/pi/skills/rite-seal/SKILL.md

@@ -5,8 +5,8 @@ argument-hint: "[feature-slug] [--full]"
 user-invocable: true
 ---
 
-<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/candidate-integrity.md","devrites-lib/reference/orchestration-profiles.md","devrites-lib/reference/parallel-dispatch.md","devrites-lib/reference/standards/verification-methods.md","rite-seal/reference/phase-contract.md","rite-seal/reference/final-evidence.md","rite-seal/reference/go-no-go.md","rite-seal/reference/risk-and-rollback.md","rite-seal/reference/seal-template.md","rite-seal/reference/output.md","rite-seal/reference/anti-patterns.md"],"triggers":{"agents":["devrites-lib/reference/standards/agents.md"],"browser":["devrites-lib/reference/standards/browser-proof-checklist.md"],"code-review":["devrites-lib/reference/standards/code-review.md"],"deprecation":["devrites-lib/reference/standards/deprecation.md"],"documentation":["devrites-lib/reference/standards/documentation.md"],"dod":["devrites-lib/reference/standards/definition-of-done.md"],"observability":["devrites-lib/reference/standards/observability.md"],"principles":["devrites-lib/reference/standards/principles.md"],"security":["devrites-lib/reference/standards/security.md"],"testing":["devrites-lib/reference/standards/testing.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","evidence.md","touched-files.md","review.md","seal.md"],"workspaceByRole":{"code-reviewer":["spec.md","plan.md","tasks.md","test-plan.md","architecture.md","decisions.md","state.md","evidence.md","touched-files.md","review.md"],"devex-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"doubt-reviewer":["spec.md","plan.md","tasks.md","state.md","decisions.md","review.md"],"frontend-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"performance-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"proof-runner":["spec.md","test-plan.md","tasks.md","gates.md","evidence.md","state.md"],"security-auditor":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"simplifier-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","review.md"],"spec-reviewer":["brief.md","spec.md","decision-coverage.md","questions.md","decisions.md","assumptions.md","state.md","review.md"],"test-analyst":["spec.md","tasks.md","test-plan.md","state.md","evidence.md","review.md"]}} -->
-> Read-set manifest: `devrites-engine context <slug> --phase seal` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/candidate-integrity.md","devrites-lib/reference/orchestration-profiles.md","devrites-lib/reference/parallel-dispatch.md","devrites-lib/reference/standards/verification-methods.md","rite-seal/reference/phase-contract.md","rite-seal/reference/final-evidence.md","rite-seal/reference/go-no-go.md","rite-seal/reference/risk-and-rollback.md","rite-seal/reference/seal-template.md","rite-seal/reference/output.md","rite-seal/reference/anti-patterns.md"],"triggers":{"agents":["devrites-lib/reference/standards/agents.md"],"browser":["devrites-lib/reference/standards/browser-proof-checklist.md"],"code-review":["devrites-lib/reference/standards/code-review.md"],"deprecation":["devrites-lib/reference/standards/deprecation.md"],"documentation":["devrites-lib/reference/standards/documentation.md"],"dod":["devrites-lib/reference/standards/definition-of-done.md"],"observability":["devrites-lib/reference/standards/observability.md"],"principles":["devrites-lib/reference/standards/principles.md"],"security":["devrites-lib/reference/standards/security.md"],"testing":["devrites-lib/reference/standards/testing.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","evidence.md","touched-files.md","review.md","seal.md"],"workspaceByRole":{"code-reviewer":["spec.md","plan.md","tasks.md","test-plan.md","architecture.md","decisions.md","state.md","evidence.md","touched-files.md","review.md"],"devex-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","devex.md","review.md"],"doubt-reviewer":["spec.md","plan.md","tasks.md","state.md","decisions.md","review.md"],"frontend-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"performance-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"proof-runner":["spec.md","test-plan.md","tasks.md","gates.md","evidence.md","state.md"],"security-auditor":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"simplifier-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","review.md"],"spec-reviewer":["brief.md","spec.md","decision-coverage.md","questions.md","decisions.md","assumptions.md","state.md","review.md"],"test-analyst":["spec.md","tasks.md","test-plan.md","state.md","evidence.md","review.md"]}} -->
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --phase seal` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
 # /rite-seal: GO / NO-GO
@@ -36,7 +36,7 @@ The host runs/reconciles named read-only reviewers; engine checks invariants.
 | State | Verdict |
 |---|---|
 | Acceptance proven, deterministic checks pass, no unresolved drift or human gate, `Critical == 0`, `Important == 0` | **GO** |
-| Same, but `Important > 0` | Ask `Important findings remain. Proceed to seal? [y/N]`; default **N** |
+| Same, but `Important > 0` | Ask `Important findings remain. Proceed to seal? [y/N]`; default **N**. Only a human answers `y`; unattended (AFK/autocomplete) keeps **N** and stops for a human if Important remains |
 | `Critical > 0` | **NO-GO** |
 | Any acceptance criterion, resolved prohibition, or declared key link lacks proof | **NO-GO** |
 | `gates status` is not `all-met` — an unmet, stale, unapproved, or abandoned ledger gate remains | **NO-GO** |
@@ -50,7 +50,7 @@ The host runs/reconciles named read-only reviewers; engine checks invariants.
 | `check windows` reports a deferral marker the change introduced without a `windows.md` waiver | **NO-GO** |
 
 A judgment-only criterion needs the human eye; AFK records a validating question
-and stops.
+(`slice: seal`) and stops. Autocomplete never auto-picks it; only a human answers.
 
 ## Workflow
 

package/pack/generated/pi/skills/rite-seal/reference/go-no-go.md

@@ -28,3 +28,5 @@ Important findings remain. Proceed to seal? [y/N]
 ```
 
 Default NO-GO. `y` accepts named Important risks only, never Critical/missing proof.
+Only a human answers `y`: an unattended (AFK/autocomplete) run keeps N and, if Important
+findings remain after its recovery, stops for the human.

package/pack/generated/pi/skills/rite-seal/reference/seal-template.md

@@ -10,7 +10,8 @@ Candidate SHA-256: <64 lowercase hex>
 <proof>
 ## Reviewer Accounts
 - devrites-spec-reviewer: <outcome>
-- devrites-code-reviewer: <outcome>
+- devrites-code-reviewer.<lane>: <outcome>   (one account per engineering lane)
+Lane map: <lane → path set, one per lane>
 - devrites-test-analyst: <outcome>
 - devrites-frontend-reviewer: <outcome>
 - devrites-security-auditor: <outcome>
@@ -23,7 +24,9 @@ Candidate SHA-256: <64 lowercase hex>
 ## Stood Decisions
 <doubt verdict per stood decision>
 ## Blockers / Follow-ups
-<blockers/follow-ups>
+Blockers: <none | - blocker>
+Follow-ups:
+- <non-blocking follow-up>
 ## Final Decision
 <verdict/reason>
 ```

package/pack/generated/pi/skills/rite-ship/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 ---
 
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/candidate-integrity.md","devrites-lib/reference/standards/git-workflow.md","devrites-lib/reference/standards/definition-of-done.md","devrites-lib/reference/standards/release/ship-checklist.md","rite-ship/reference/git-ship.md","rite-ship/reference/rollout.md","rite-ship/reference/close-out.md","rite-ship/reference/ship-template.md","rite-ship/reference/anti-patterns.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","evidence.md","touched-files.md","review.md","seal.md"]} -->
-> Read-set manifest: `devrites-engine context <slug> --phase ship` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --phase ship` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
 # /rite-ship: ship + close the task