devrites 6.10.0 → 7.0.0

package/pack/generated/claude/skills/devrites-lib/reference/parallel-dispatch.md

@@ -1,5 +1,7 @@
 # Native review dispatch
 
+> Root-only: not inlined in --role bundles.
+
 Host dispatch; DevRites governs.
 
 ## Roster
@@ -27,7 +29,9 @@ If the candidate diff has no matching surfaces, record
 
 ## Dispatch contract
 
-1. Freeze one candidate; give each reviewer the same spec, paths, and diff.
+1. Freeze one candidate with `devrites-engine candidate freeze <slug> --wave <w>
+   (--slice <SLICE-ID> | --paths <path>...) [--base <ref>]` (writes
+   `packets/<w>.diff` and `packets/<w>.sha256`); give each reviewer the same spec, paths, and diff.
    Parallelize only when writes/state/locks/tool sessions/scarce resources
    (ports/processes/quotas/FDs/browsers/MCP) are compatible. Frozen read-only
    usually is; pressure requires batches or serial work.
@@ -37,8 +41,10 @@ If the candidate diff has no matching surfaces, record
    still validate each result's context and candidate.
 2. Build each reviewer's read-set once with
    `devrites-engine context <slug> --phase <p> --role <role> --trigger <set>` and
-   hand the bundle path as the packet's source list instead of a file roster.
-   Build roles add `--slice <SLICE-ID>` (slice-scoped, slice-named bundle).
+   render each reviewer, auditor, and test-analyst packet (other roles, such as
+   `proof-runner`, keep their own) with `devrites-engine packet <slug> --wave <w> --phase <p>
+   --role <role> [--slice <SLICE-ID>] [--focus <file>]`: it names the bundle and frozen
+   diff by reference, copies the digests, and runs the `open` lints. Build roles add `--slice <SLICE-ID>` (slice-scoped, slice-named bundle).
    Evaluate the skill's trigger conditions and pass each that fires — a role's
    Trigger column maps to the phase manifest's names: `security-auditor` →
    `security`; at Review, `frontend-reviewer` → `ui` and `performance-reviewer` →
@@ -48,21 +54,25 @@ If the candidate diff has no matching surfaces, record
    omitted applicable trigger is a gap, not a shortcut.
 3. Enforce the launch barrier through the engine, not prose. Open the wave
    (`devrites-engine dispatch <slug> open --phase <p> --wave <w> --role <r>...`;
-   a reviewer, auditor, or test-analyst wave adds `--packet <file>`, the exact packet
-   those agents receive, and `open` refuses one that seeds a gate result, outcome,
-   count, or "already passed" claim; at Review and Seal it also needs the packet to
-   name the frozen candidate diff and the manifest to cover every checkpointed path), launch every native agent nonblocking through the host's own agent
+   a reviewer, auditor, or test-analyst wave adds `--packet <file>`, any one of the
+   wave's rendered `packets/<w>.<role>.md` (hand each agent its own file unedited), and `open` refuses one that seeds a gate result, outcome,
+   count, or "already passed" claim; a Build reviewer wave adds `--slice <SLICE-ID>`
+   so its findings key on that slice; at Review and Seal it also needs the packet to
+   name the frozen candidate diff and the manifest to cover every checkpointed path;
+   a same-tree writer wave adds `--claim-session <id> --claim <path>...` per
+   [`wright-dispatch.md`](../../rite-build/reference/wright-dispatch.md#run)), launch every native agent nonblocking through the host's own agent
    tool (never a shell-launched host CLI such as `omp -p` or `claude -p`: that is a
    dispatch bridge, its PID handle dies with the session, and its return is a `gap`),
    record each returned host handle
-   (`dispatch ... start --wave <w> --role <r> --handle <id>`), then `seal` —
-   seal fails until every declared role has a distinct handle, which makes a
+   (`dispatch ... start --wave <w> --role <r> --handle <id>`) — the last start
+   seals the wave (an explicit `seal` is a no-op), which makes a
    serial launch-then-wait pattern impossible to record. Record each completion
-   with `dispatch ... return`; `return` refuses before seal. `dispatch status`
+   with `dispatch ... return`; a reviewer adds `--result <file>` holding its return verbatim (the engine stores it as `packets/<wave>-<role>.return.md`, derives the outcome from its head, and records its `Finding:` keys; a file already at that path is kept), or `--outcome <findings|no-findings|gap>` when the host cannot hand the return over as a file; `return` refuses before seal. `dispatch status`
    exits nonzero while the wave is open, sealed, or abandoned. `start`/`return`
    auto-record the dispatch/return metrics events — no separate ledger call. If
    an opened wave cannot obtain every handle or reach `seal`, run
-   `devrites-engine dispatch <slug> abandon --wave <w> --reason <reason>` before
+   `devrites-engine dispatch <slug> abandon --wave <w> --reason <reason>` (with
+   `--release` on a host-confirmed stop or refused launch) before
    recording the gap; never leave an open wave to block a retry.
 4. Ask for each exact named agent in fresh context; omit native syntax and
    `agent_type`/`task_name`/`fork_turns` from the instruction.
@@ -142,13 +152,14 @@ session, the claim proof below settles it. A result classification alone
 does not prove host termination.
 
 On resume (compaction or a new session), run `devrites-engine dispatch <slug>
-status`, `parallel status`, and `claim list --all` before any dispatch. A read-only
+status`, `parallel status`, and `claim list` before any dispatch. A read-only
 wave whose handles this session cannot query: `abandon` it, record each unreturned
 role `gap`, and re-dispatch fresh on the current digest; its late returns are
 `stale`. A writer keeps its claim and lease — no relaunch on those paths until the
 claim is released or its holder is proven terminal. For an unqueryable writer,
-`claim list --all` showing its claim `released` or `dead` (the engine proved the
-holding session exited on this host) is that proof: `abandon` the wave, record the
+`claim list` showing its claim `dead` (the engine proved the holding session
+exited on this host), or `claim list --all --session <id>` showing it `released`
+(bare `list` only counts released rows), is that proof: `abandon` the wave, record the
 role `gap`, claim the paths, and re-dispatch without waiting on the launching
 session. `live` or `expired` stays held. A wright that never returned an
 admitted result leaves unadmitted bytes: task-path changes since its pre-dispatch

package/pack/generated/claude/skills/devrites-lib/reference/standards/README.md

@@ -47,7 +47,8 @@ topic's owner.
 | `afk-hitl.md` | A pause, question, resume, or AFK decision is possible. |
 | `one-shot-actions.md` | A failed proof/action would spend paid or rate-limited quota, mutate external state, or delete its own failure evidence. |
 | `tooling.md` | Structural lookup, current external facts, or architecture memory is needed. |
-| `code-navigation.md` | Choosing graph, LSP, grep, or read routes before cross-file edits. |
+| `code-navigation.md` | Editing across files or claiming a blast radius: affected set, enclosing-body reads, fresh diagnostics, static-graph blind spots. |
+| `code-index.md` | Choosing graph, LSP, grep, or read routes: index preflight, route table, coverage, query budget, host access. |
 | `skill-authoring.md` | Creating, editing, routing, evaluating, or pruning a DevRites skill. |
 | `definition-of-done.md` | Prove, Seal, Ship, or Quick must decide whether work is finished. |
 | `review-checklist.md` | A compact review pass/fail sweep is enough. |

package/pack/generated/claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -1,5 +1,7 @@
 # AFK & HITL: the pause/resume contract
 
+> Root-only: not inlined in --role bundles.
+
 > Applies when: any rite/devrites skill that can pause for a human or run unattended; irreversible-risk list, budgets, recovery accounting.
 
 Defines two modes for `rite-*`/`devrites-*` skills that may pause; main
@@ -211,6 +213,9 @@ Wherever a gap, checkpoint, or non-trivial decision surfaces (`/rite-spec`, `/ri
   sequential packets, then obtain final confirmation. Materially distinct options MUST NOT
   be silently dropped, merged, or preselected to fit the UI.
 - Recommend for project conventions, stack, scale, and domain, not a generic default.
+- **One visit per decision chain.** Ask the follow-ups an answer predictably triggers (a
+  dependency's lock lines, a rerun after a failed measurement) in the same entry or one
+  `--batch`; each link asked alone costs one human wait.
 
 **HITL** renders the set via `AskUserQuestion`; the human's pick resolves the gate **in place**.
 **AFK** auto-picks option 1 for gates it may auto-handle. Record the chosen option verbatim and
@@ -271,8 +276,8 @@ options: |                                    # ranked option set; recommended F
   1. <recommended> (Recommended) — logic: … · infra: … · business: … · architecture: …
   2. <alternative> — <dimension-tagged rationale + trade-off>
   3. Something else — describe it
-proposed: <the recommended option restated — the HITL default + the AFK auto-pick>
-raised_at: <iso>
+proposed: <the recommended option restated — the HITL default + the AFK auto-pick; omit with no (Recommended)>
+raised_at: <full RFC 3339 timestamp, e.g. 2026-10-19T08:17:08Z>
 answered_at: <iso, when status flips off "open">
 answer: <chosen option (or human's verbatim reply / drop reason)>
 answered_by: human                            # only when a human resolved it (`state resolve --human`)
@@ -280,6 +285,8 @@ answered_by: human                            # only when a human resolved it (`
 
 Rules:
 - `NNN` is sequential per date: the next-available 3-digit integer.
+- `state append` refuses a new open entry that breaks this schema (2-4 options plus the escape
+  hatch, `(Recommended)` only on option 1); length is advisory.
 - `status: open` is the only state `/rite-resolve` can mutate; `answered` and `dropped`
   are terminal.
 - `answered_by: human` is written only by `state resolve --human`. HITL live picks and `/rite-resolve`
@@ -295,7 +302,8 @@ boundary owns any such request and requires explicit user approval.
 ## `state.md` `Awaiting human` block
 
 When a HITL gate fires, `/rite-build` sets cursor `status` to `awaiting_human` and
-`next_action` to `/rite-resolve <qid> "<answer>"`, then writes the `Awaiting human` table
+`next_action` to `/rite-resolve <qid> "<answer>"` via `devrites-engine state set` (under AFK
+it names questions the sentinel auto-picks: resolve those unless irreversible-risk), then writes the `Awaiting human` table
 (`question_id`, `gate`, `blocking_slices`) owned by
 [`state-workspace.md`](../../../rite-spec/reference/state-workspace.md#statemd-template) § state.md template.
 The question text, `proposed` answer, and `raised_at` live in the `questions.md` entry.

package/pack/generated/claude/skills/devrites-lib/reference/standards/agents.md

@@ -6,11 +6,14 @@ Follow DevRites policy and [`depth profiles`](../orchestration-profiles.md).
 
 ## Authority
 
+<!-- root-only -->
 - Root owns scope, questions/decisions/results, `.devrites/**`, phase transitions — not product source/tests; vetted executable workflow artifacts follow [`workflow-artifacts.md`](workflow-artifacts.md).
-- Only bounded wright writes product source/tests; others inspect an immutable candidate.
 - Every named role runs; unavailable → HITL, never skip/substitute.
+<!-- /root-only -->
+- Only bounded wright writes product source/tests; others inspect an immutable candidate.
 - Leaves never invoke agents, ask humans, change phase, push, install/deploy, migrate live data, or act irreversibly; they return evidence/proposals for root acceptance. Sole exception: one local unpushed transfer commit by an eligible native-worktree `devrites-slice-wright` — transport, not shipping authority or a checkpoint.
 
+<!-- root-only -->
 ## Agents
 
 | Agent |
@@ -34,7 +37,9 @@ Follow DevRites policy and [`depth profiles`](../orchestration-profiles.md).
 | `devrites-slice-wright` |
 
 Files own briefs; [`parallel-dispatch.md`](../parallel-dispatch.md) owns rosters.
+<!-- /root-only -->
 
+<!-- root-only -->
 ## Native invocation
 
 Skills name exact fresh roles, omit native fields;
@@ -47,6 +52,7 @@ dispatch <slug> open|start|seal|return` (a solo dispatch is a wave of one;
 start/return auto-record metrics). Without a workspace the plain host dispatch
 contract above applies and no engine tracking is required.
 Workflow-named skills (e.g. devrites-source-driven) are invoked inline in the root context, never dispatched as agents.
+<!-- /root-only -->
 
 ## Source-writing boundary
 
@@ -59,22 +65,24 @@ Each job gets objective/exclusions, exact paths/immutable candidate, rubric/resu
 **Same-tree concurrent sessions claim first.** Worktree dispatch isolates
 parallel batch siblings, but two agent *sessions* (two hosts, two features, or
 a human plus an agent) can share one working tree. Before a same-tree writer
-starts, it records an advisory claim — `devrites-engine claim add --session
-<id> <paths>` — retains the returned `<claim-id>`, then checks the same paths
-with `devrites-engine claim check --session <id> <paths>`; a held claim from a
+starts, its `dispatch open` records an advisory claim with `--claim-session <id>
+--claim <path>...` and fails, creating no wave, while a live foreign session holds
+a path (without a wave: `claim add --session <id> <paths>`, keep its `<claim-id>`,
+then `claim check`); a held claim from a
 live foreign session is never merged later or overridden. Unattended, skip only
-work that needs those paths, run independent work, and re-check `claim list --all`
-before stopping; stop and report the holder only when nothing independent remains. On every
-host-confirmed terminal path after `add` ([unknown outcomes keep it](../parallel-dispatch.md#cancellation-and-terminal-reconciliation)) — return,
-rejected result, stop, or a launch refused with no handle — run
+work that needs those paths, run independent work, and re-check `claim list`
+before stopping; stop and report the holder only when nothing independent remains.
+On every host-confirmed terminal path after `add` or a claimed `dispatch open` ([unknown outcomes keep it](../parallel-dispatch.md#cancellation-and-terminal-reconciliation)),
+the wave's completing `return` releases its claim, `dispatch abandon --release`
+releases it on any other (a stop or a refused launch), and a `claim add` claim runs
 `devrites-engine claim release --session <id> --id <claim-id>`. Claims expire
 by TTL only as crash recovery; `claim list` shows who holds what. Claims are
 advisory coordination, never a substitute for the one-writer-per-worktree rule.
 Claims cover product paths only; root-authored `.devrites/**` files use
 [`workflow-artifacts.md`](workflow-artifacts.md) admission instead.
-Expiry is not proof the holder stopped: size `claim add --ttl <minutes>` to the
+Expiry is not proof the holder stopped: size `--claim-ttl` or `claim add --ttl <minutes>` to the
 expected write (engine max 240) and re-add before it lapses; before writing, also
-read `claim list --all` — a foreign `expired` claim on overlapping paths whose
+read `claim list` — a foreign `expired` claim on overlapping paths whose
 session is not proven terminal counts as held (stop and report). `dead` (engine-proven
 exited holder) or `released` is terminal: reconcile per
 [§ Cancellation](../parallel-dispatch.md#cancellation-and-terminal-reconciliation). **Failing case:**
@@ -102,22 +110,25 @@ Each required reviewer/analyst/auditor starts with exactly one:
 
 ```text
 Outcome: <findings | no-findings | gap>
-Counts: <n per severity or kind used in the rows below>
-Finding: <severity> conf <n> | <file:line or artifact section> | <observed quote/result> | when <input/state/sequence> → <effect> | breaks <ID or standard §> "<quoted line>" | <minimum fix>
+Counts: critical=<n> important=<n> suggestion=<n> nit=<n> fyi=<n> gap=<n>
+Finding: <severity> conf <n> | <file:line or artifact section> | `<quoted cited line>` <observed result> | when <input/state/sequence> → <effect> | breaks <ID or standard §> "<quoted line>" | <minimum fix>
 Basis: <files read · commands run to reach this finding>
 ```
 
 - **`findings`:** each row uses the shape above; confidence 1–10 on Critical/Important.
   Critical/Important requires 7+, exact evidence, concrete impact, and a non-empty
   `Basis` — a correct verdict reached by an unrecorded inspection path is unproven.
-  A Critical/Important row carries `conf <n>` in its severity cell and writes impact
-  as `when <input/state/sequence> → <effect>`; missing either, root admits it as
+  A Critical/Important row carries `conf <n>` in its severity cell, opens its observed
+  cell with the cited line's quote in backticks, and writes impact
+  as `when <input/state/sequence> → <effect>`; missing conf or trigger, root admits it as
   `Unverified: <claim> — missing trigger` (stays `gap`).
 - **Proportionality:** a Critical/Important row's `breaks` quotes the line it violates:
   a spec ID (`AC`/`REQ`/`INV`/`PROH`/`DEC`/`EDGE`) or a shipped standard rule
   (`<standard>.md § <section>`: security, regression, principles). Root anchors the
-  quote like the `file:line` quote. A repair contract, recheck packet or earlier
-  finding only restates a prior claim and is never an anchor. No anchor, or one
+  quote like the `file:line` quote. A repair contract, recheck packet, earlier
+  finding or plan item (`plan.md`, `tasks.md`, `architecture.md`, `test-plan.md`)
+  only restates root's own claim and is never an anchor; quote the spec ID or
+  standard rule it traces to. No anchor, or one
   the defect does not break,
   admits the row as Suggestion logged `Deferred: <claim> — no spec anchor` for an
   optional follow-up slice; it never drives a repair round. Hardening no spec line
@@ -147,10 +158,12 @@ Basis: <files read · commands run to reach this finding>
   and `/rite-doctor`. Never design capture or retention machinery around it.
 
 Root treats results as claims; verifies proposed Critical/Important blockers
-against candidate, first anchoring each row's quote at its cited `file:line` on the
-frozen digest: exact → admit; found at exactly one other location → relocate,
+against candidate, first running `devrites-engine check anchors <slug> <return-file>`,
+which anchors each row's quote at its cited `file:line` on the live candidate and its
+`breaks` quote, and prints the digest root confirms equals the reviewed packet's: exact → admit; found at exactly one other location → relocate,
 keeping both locations; not found or found at several → `Unverified: <claim> —
-anchor lost|ambiguous`, a gap that is never a finding or a dismissal. A leaf result
+anchor lost|ambiguous`, a gap that is never a finding, a dismissal or a repair-round
+input (exit 3). A leaf result
 produced by spawning a nested agent is `gap`, and each hidden child counts toward
 the concurrent pool and `max_agents`. Missing fields become
 `Unverified: <claim> — missing <proof>` and stay `gap` until verified/rejected
@@ -167,6 +180,15 @@ return is the bundle the root writes) and the wright's change evidence.
 
 - Lead with the result line (`Outcome:` for reviewers, the role's own status line
   otherwise), then `Counts:` with the number of rows per severity or kind.
+- A reviewer, auditor or test-analyst head is strict: line 1 is
+  `Outcome: findings|no-findings|gap` (no title line above it), line 2 is
+  `Counts: key=N ...` with keys from the role's closed vocabulary:
+  `critical important suggestion nit fyi gap`, plus `contract mechanism` for
+  `devrites-plan-reviewer`, only `suggestion nit fyi gap` for
+  `devrites-simplifier-reviewer`. `findings` needs a non-`gap` count above 0;
+  `no-findings` needs every count at 0. `dispatch return --result <file>` stores
+  the return and records a malformed or inconsistent head as `gap`, never
+  `no-findings`.
 - No restated task, preamble, approach narrative or closing summary. An optional
   `Notes:` block carries at most five lines that no row can hold.
 - Point, don't paste: cite `file:line` with at most one quoted line (160
@@ -177,6 +199,7 @@ return is the bundle the root writes) and the wright's change evidence.
   never rewrites, merges or summarizes a row; deduplication references rows by
   position or ID instead of rewording them.
 
+<!-- root-only -->
 ## Reconciliation
 
 Root rejects stale/out-of-scope work, dedupes by root cause, records
@@ -189,3 +212,4 @@ Route defects before correction: product/acceptance → Spec Drift Guard/Clarify
 architecture/slicing/proof → Plan/Vet; source/test → wright;
 external/pre-existing → blocker/defer. Never patch downstream to hide an upstream
 defect.
+<!-- /root-only -->

package/pack/generated/claude/skills/devrites-lib/reference/standards/architecture-health.md

@@ -11,7 +11,7 @@ and never substitutes for review.
 ## When to measure
 
 Compute a score only when a code index covers the repo (see
-[`code-navigation.md`](code-navigation.md) § Index freshness). With no index,
+[`code-index.md`](code-index.md) § Preflight). With no index,
 report `unmeasured` — a placeholder number presented as a measurement is a
 false pass. **Failing case:** an audit reports "health: 100/100" on a repo the
 instrument could not parse.

package/pack/generated/claude/skills/devrites-lib/reference/standards/code-index.md

@@ -0,0 +1,111 @@
+# Code index
+
+> Root-only: not inlined in --role bundles.
+
+> Applies when: choosing structural search tools (code index vs grep) before exploring.
+
+Decision tree for structural questions. Load with [`tooling.md`](tooling.md);
+this file is the pack-canonical routing table agents cite in Build, Vet, and
+Review. Edit-safety rules that hold with or without an index live in
+[`code-navigation.md`](code-navigation.md). The one supported code index is
+**codebase-memory-mcp**. Every call takes `project`: pass the absolute
+repository root (it resolves to the indexed project that contains it); never
+guess a project name.
+
+## Preflight
+
+Once per agent, before the first structural claim:
+
+1. `index_status` (`project` = repo root). An error or "not indexed" means no
+   index. The **root** session may run `index_repository` once (`repo_path` =
+   repo root, default mode, never `persistence: true`, which writes
+   `.codebase-memory/` into the repo), then re-check. A subagent never indexes:
+   it records `index: unavailable` and uses the fallback column.
+2. `status: ready` only means the graph has nodes; it is not freshness. When
+   the response carries `watch.watched: true`, auto-sync keeps it current.
+   Otherwise, if files changed after `indexed_at`, the root may re-run
+   `index_repository`; everyone else relies on the coverage check below.
+
+## Route by question
+
+| Question | First call | Fallback |
+| --- | --- | --- |
+| Orient in an area, architecture | `get_architecture` (`aspects: ["overview"]`, `path`) | Glob + targeted `Read` |
+| Where is X | `search_graph` (`name_pattern` regex, or BM25 `query`) | Grep |
+| Does a similar implementation already exist? | `search_graph` with `semantic_query: [purpose words]`, then `name_pattern` variants | Grep on purpose-words |
+| Callers, callees, call paths across files | `search_graph` for the exact name, then `trace_path` (`direction` `inbound`/`outbound`/`both`, `depth` 1-3) | LSP references + Grep |
+| Which tests reach a symbol | `trace_path` (`direction: "inbound"`, `include_tests: true`); direct tests: `query_graph` on `TESTS` edges | Grep test files for the name |
+| Value/taint flow | `trace_path` (`mode: "data_flow"`), then read each hop ([`tooling.md`](tooling.md) route table) | `cannot_verify` |
+| Blast radius of a diff | `detect_changes` (`base_branch` = feature base, always explicit; `scope: "impact"`, `depth: 2`) | `git diff --name-only` + `trace_path` per changed symbol |
+| Exact symbol body before edit | `get_code_snippet` (`qualified_name` from `search_graph`) | Targeted `Read` |
+| File outline | `get_file_outline` | `Read` |
+| Multi-hop structure | `query_graph` (read-only Cypher, always with `LIMIT`) | Split into `trace_path` calls |
+| Rename, references, diagnostics | LSP (`lsp` rename/references) when available | `trace_path` + Grep |
+| Known file, one-line fix | `Read` at offset/limit | — |
+| Literal string, config value, non-code file | `Grep` | — |
+
+Exact values matter: an unknown `mode` silently becomes `calls`, and an
+unknown `detect_changes` `scope` silently returns files only. `semantic_query`
+is an array, cannot combine with `query`, and needs a `full`/`moderate` index.
+`detect_changes` covers commits since the merge base plus unstaged, staged, and
+untracked files; `scope: "tests"` exists only from v0.12. Results page: check
+`has_more` and continue with `offset`/`cursor`.
+
+## Coverage before citing
+
+After the candidate paths are known, call `check_index_coverage` once with every
+path the claim relies on (`paths`, max 128), plus `scopes` for negative or
+exhaustive claims ("no other callers", "dead"). `no_recorded_issue` is best
+effort, not proof. For `freshness` other than `metadata_match`, or `status`
+`partial`/`excluded`/`skipped`/`coverage_unavailable`, read or grep those files
+directly and qualify the claim.
+
+## Query budget
+
+Spend the minimum that settles the question:
+
+- Minimal output first — pass the smallest detail/scope option a tool offers;
+  escalate to a fuller answer only when the minimal one cannot decide.
+- One structural question ≈ five index calls. The sixth means the question needs
+  re-scoping or a file read, not another query.
+- Stop at sufficiency: an index answer that names the symbols and their source
+  ends the search; re-verifying it with grep is waste, not diligence.
+
+## Index location
+
+The index lives in the server's store (`~/.cache/codebase-memory-mcp`, or
+`$CBM_CACHE_DIR`), not in the repository. `devrites-engine check indexes` only
+detects an in-repo `.codebase-memory/` artifact; `index_status` is
+authoritative.
+
+## Tool availability
+
+- **MCP:** Claude hosts expose `mcp__codebase-memory-mcp__<tool>` (allowlisted
+  in `.claude/settings.json` and agent `tools:` lines). omp subagents and
+  Codex children inherit every MCP server of the parent session (omp names
+  the tools `mcp__codebase_memory_mcp_<tool>`; a Codex agent file cannot add
+  servers). Generated Pi agents list none: pi-subagents fails a child whose
+  `tools:` names a tool it cannot load. A missing server offers no tools — use
+  the fallback column.
+- **CLI** when the host exposes no MCP tools (e.g. Devin agents via `exec`,
+  Pi agents via `bash`):
+  `codebase-memory-mcp cli <tool> --project <repo root> --format json` with
+  kebab-case flags (`--function-name X --direction inbound --include-tests`);
+  repeat a flag for array values. Exit 1 means the tool returned an error.
+- **Read-only sandbox** or no tool route at all: the CLI cannot run in a
+  read-only sandbox (it writes daemon locks outside the workspace). Use
+  **parent handoff**: the root runs the queries and puts the
+  project, each query, its raw rows, cited paths, and coverage status in the
+  dispatch packet. Raw query output is input, like a diff; never add the root's
+  interpretation ([`agents.md`](agents.md) seeding rule). A child whose packet
+  lacks what it needs returns the exact query for the root to run instead of
+  guessing.
+- Forbidden index calls are listed in
+  [`code-navigation.md`](code-navigation.md) § Anti-patterns.
+
+## Anti-patterns
+
+- Duplicate graph queries for reassurance.
+- Whole-file reads when `get_code_snippet` or `get_file_outline` suffices.
+- `trace_path` on a guessed name instead of the exact name from `search_graph`.
+- Citing a graph result without `check_index_coverage` on the cited paths.

package/pack/generated/claude/skills/devrites-lib/reference/standards/code-navigation.md

@@ -1,30 +1,20 @@
 # Code navigation
 
-> Applies when: choosing structural search tools (code index vs grep) before exploring.
+> Applies when: editing across files or claiming a blast radius, with or without a code index.
 
-Decision tree for structural questions. Load with [`tooling.md`](tooling.md);
-this file is the pack-canonical routing table agents cite in Build, Vet, and
-Review.
-
-## Route by question
-
-| Question | First tool | Fallback |
-| --- | --- | --- |
-| Explore unfamiliar area, architecture, blast radius | `codegraph_explore` or codebase-memory `search_graph` / `get_architecture` | code-review-graph `detect_changes_tool` / `get_impact_radius_tool` |
-| Callers, callees, call paths across files (value/taint flow: [`tooling.md`](tooling.md) route table) | codebase-memory `trace_path` | code-review-graph `query_graph_tool` |
-| PR/review context for a diff | code-review-graph `get_review_context_tool` | `detect_changes_tool` |
-| Exact symbol body before edit | `read_symbol` / `module_report` (pi-lens) | `get_code_snippet` then targeted `Read` |
-| Rename, references, diagnostics | LSP (`lsp` rename/references) when available | graph trace + grep |
-| Known file, one-line fix | `Read` at offset/limit | — |
-| Literal string / config value | `Grep` | — |
-| Does a similar implementation already exist? | embedding/similarity tool when present | `search_graph` on purpose-words and name variants, then targeted `Read` |
+Edit-safety rules that hold whatever tool finds the code. Index routing
+(preflight, route table with a fallback for every question, coverage, query
+budget, host access) lives in [`code-index.md`](code-index.md); load it with
+[`tooling.md`](tooling.md) when choosing a structural search route.
 
 ## Before cross-file edits
 
-1. Run **one** primary route from the table (record tool + query in the artifact).
+1. Run **one** primary route from the [`code-index.md`](code-index.md) route
+   table; use its fallback column only when no index is available (record
+   tool + query in the artifact).
    **Compute the affected set before writing code, not after** — the blast-radius
    list is the edit plan: every file on it is a touch or a conscious skip.
-2. Read symbol bodies you will change (`read_symbol` counts as read), comments
+2. Read symbol bodies you will change (`get_code_snippet` counts as read), comments
    included — a why-comment is often the only record of a decision.
 3. After edits: LSP diagnostics + project tests. Compiler errors are the oracle
    for callers the graph listed — fix them in dependency order, direct
@@ -42,17 +32,6 @@ Review.
 Skipping step 1 on a multi-file slice is a Build orient gap unless recorded
 `cannot_verify`.
 
-## Query budget
-
-Spend the minimum that settles the question:
-
-- Minimal output first — pass the smallest detail/scope option a tool offers;
-  escalate to a fuller answer only when the minimal one cannot decide.
-- One structural question ≈ five index calls. The sixth means the question needs
-  re-scoping or a file read, not another query.
-- Stop at sufficiency: an index answer that names the symbols and their source
-  ends the search; re-verifying it with grep is waste, not diligence.
-
 ## What the static graph cannot see
 
 Import/call edges are only the statically visible share of the dependency
@@ -81,39 +60,10 @@ The compiler and the test suite are the oracle for everything in this list:
 zero static dependents + zero compiler errors + green tests is evidence;
 zero static dependents alone is a hypothesis.
 
-## Index freshness
-
-| Index path | Provider |
-| --- | --- |
-| `.codegraph/` | CodeGraph |
-| `.code-review-graph/` | code-review-graph MCP |
-| `.codebase-memory/` | codebase-memory MCP |
-| `graph.json` | Graphify (`graphify query` / `graphify path A B`) |
-Run `devrites-engine check indexes` for a quick presence check. It detects
-**in-repo artifacts only** — codebase-memory may be indexed in the server's
-central store with no `.codebase-memory/` dir; when the MCP server answers
-(`list_projects`/`index_status`), trust it over the file probe. Stale or missing
-index: build/refresh per provider docs, or fall back to LSP + grep and note the gap.
-
-## Tool availability
-
-- On Claude hosts, provider tools arrive as `mcp__<server>__<tool>` — e.g.
-  `mcp__codegraph__codegraph_explore`, `mcp__code-review-graph__query_graph_tool`,
-  `mcp__codebase-memory-mcp__search_graph`. DevRites agent profiles and
-  `.claude/settings.json` already allowlist these servers; a server that is not
-  installed simply offers no tools — fall back per the table, no error path needed.
-- Server names are install-configured (`codebase-memory-mcp` and `codebase-memory`
-  are both allowlisted). If your server uses another name, add it to
-  `settings.json` allow and the agent `tools:` lines.
-- CodeGraph and Graphify also run as CLIs (`codegraph explore`,
-  `graphify query` / `graphify path A B`) — allowlisted via `Bash(...)` rules.
-- On non-Claude hosts the `mcp__*` entries are ignored by generation; use each
-  host's own nav extensions or the CLI forms. All listed tools are read-only
-  navigation — do not call index rebuild, refactor-apply, or mutation tools.
-
 ## Anti-patterns
 
-- Duplicate graph queries for reassurance.
-- Whole-file reads when `read_symbol` or `module_report` suffices.
-- Grep-only blast-radius claims when an index is present.
 - Editing without reading the enclosing symbol body.
+- Grep-only blast-radius claims when an index is present.
+- Calling `delete_project`, `manage_adr` `update`/`set_sections`, or
+  `ingest_traces`; only the root calls `index_repository`, never with
+  `persistence: true`, and a subagent never indexes.

package/pack/generated/claude/skills/devrites-lib/reference/standards/context-hygiene.md

@@ -46,18 +46,17 @@ changed contracts, implementation, proof, or dependencies, not every prior gener
 Required review rosters and final proof remain. Preserve protected history unchanged;
 a compact current view references originals without omitting active requirements.
 
-**Compaction fallback:** after compaction, reload `.devrites/ACTIVE`, `state.md`,
-`questions.md`, `decisions.md`, `test-plan.md`, and `evidence.md`. When hooks do
-not restore context, run
-`devrites-engine handoff [slug]` first — one deterministic resume record reduced
-from durable artifacts (cursor, `awaiting_human`, open `questions.md` gates,
-the `gates.md` reduction with unmet/stale ids, `decisions.md` dead ends, and the
-canonical read-next order). Open the artifacts `read_next` names; resume from
-the record, not from transcript memory. Then `devrites-engine check
+**Compaction fallback:** after compaction or a resumed session, always run
+`devrites-engine handoff [slug] --resume` first (slug from `.devrites/ACTIVE`) — one
+deterministic resume record reduced from durable artifacts (cursor, `awaiting_human`,
+open `questions.md` gates, the `gates.md` reduction with unmet/stale ids,
+`decisions.md` dead ends, in-flight dispatch waves, and the read-next order over
+`state.md`, `test-plan.md`, `evidence.md`, and the other present artifacts). Open only
+the artifacts `read_next` names; resume from the record, not from transcript memory. Then `devrites-engine check
 regression <slug>`: `BLOCKED` names a durable fact lost since the last
 checkpoint; `unproven` does not block. Before any re-dispatch, run
 `devrites-engine dispatch <slug> status`, `devrites-engine parallel status --root <repo>
---slug <slug>`, and `devrites-engine claim list --all`, and reconcile open waves, leases, and
+--slug <slug>`, and `devrites-engine claim list`, and reconcile open waves, leases, and
 claims per [`parallel-dispatch.md`](../parallel-dispatch.md#cancellation-and-terminal-reconciliation) § Cancellation.
 **Failing case:** after compaction the root re-dispatches a review cohort whose original
 children still run, and duplicate accounts arrive.

package/pack/generated/claude/skills/devrites-lib/reference/standards/core.md

@@ -23,7 +23,7 @@ Repository conventions follow [Precedence](#precedence).
 1. **Right step, right time:** use the smallest workflow and load only relevant
    files. Batch independent reads and cover the relevant code, not just the first
    match. Prefer an available code index for structure; see
-   [`tooling.md`](tooling.md) and [`code-navigation.md`](code-navigation.md).
+   [`tooling.md`](tooling.md) and [`code-index.md`](code-index.md).
 2. **No silent assumptions:** surface material assumptions; ask when the answer
    changes scope, architecture, data model, UX, security, migration risk, or
    acceptance.
@@ -59,7 +59,9 @@ Repository conventions follow [Precedence](#precedence).
 
 ## Lifecycle rest points
 
+<!-- root-only -->
 Before advancing a phase, run `devrites-engine check readiness <slug>` for structure, including artifact budgets (semantics belong to exact agents/checklists). Standalone rites persist and stop on block; under a controlling caller, agent-owned technical blocks return backward as a nested phase boundary, not a user-facing handoff. `/rite-seal` runs `devrites-engine check seal <slug>` for structure/freshness, not prose. HITL/blocked stops follow [Persistence before stopping](#persistence-before-stopping-handoff-discipline).
+<!-- /root-only -->
 
 ### Gate contract
 
@@ -85,6 +87,7 @@ Verdict discipline — no vacuous verdicts:
   (the FAIL/NOT-RUN is recorded with its marker and the run proceeds). Both are legal;
   silent is not.
 
+<!-- root-only -->
 ## Caller-owned technical backtracking
 
 When a rite invokes an earlier rite inline to repair an agent-owned technical gap, the original rite stays the controlling caller: a nested `STOP` is a phase boundary, not user-facing. The caller re-reads `state.md`, follows the return cursor/`next_action`, and resumes unless a human-owned, safety, access, budget, or parked-recovery stop is active ([Persistence before stopping](#persistence-before-stopping-handoff-discipline)). Derive `parked-recovery` from the fingerprint's recorded no-progress attempts and escalations, not from a stale `state.md` label; one consumed authorization doesn't exhaust offline recovery from retained new evidence.
@@ -93,12 +96,15 @@ An intermediate `Next step` is cold-resume metadata. Do not ask the human to
 copy routine `/rite-plan repair`, `/rite-vet`, `/rite-build`, or proof-rerun
 commands during the active recovery chain. Only the controlling caller emits
 the final response; standalone phase invocations still stop normally.
+<!-- /root-only -->
 
+<!-- root-only -->
 ## Final response
 
 Immediately before its final response, each rite loads
 [`reply-contract.md`](../reply-contract.md) then uses the compact form: evidenced
 claims plus one next action.
+<!-- /root-only -->
 
 ## Rationalization guard
 
@@ -140,6 +146,7 @@ These universal musts link to their full rules; load depth only when needed.
 - **Atomic commits, Conventional Commits.** One logical change per commit;
   it builds + passes tests on its own. → [`git-workflow.md`](git-workflow.md)
 
+<!-- root-only -->
 ## Persistence before stopping (handoff discipline)
 
 Before any `rite-*` skill stops:
@@ -156,8 +163,12 @@ Before any `rite-*` skill stops:
   [`state-workspace.md`](../../../rite-spec/reference/state-workspace.md#statemd-template) § state.md template;
   resume via `/rite-resolve <qid> "<answer>"`. See [`afk-hitl.md`](afk-hitl.md) for the
   full AFK / HITL contract.
+- Bookkeeping write? → cursor fields via `devrites-engine state set <slug> key=value…
+  [--unset key]`; a new ledger section via `state append <slug> <ledger> --heading "<id>"
+  --body-file <path|->`. Never splice workspace Markdown with an ad-hoc script or regex.
 
 A skill that stops without doing this leaves the workspace incomplete.
+<!-- /root-only -->
 
 ## Context hygiene (end of every phase)
 
@@ -166,9 +177,11 @@ Long contexts degrade reasoning quality. Act on context at **50-70% used, not 95
 Read the engine `context` bundle once per phase instead of re-reading the files it
 contains; after compaction re-read the bundle, not its sources.
 
+<!-- root-only -->
 Every rite names the single resume command on its action line; a `↻ Hygiene:` footer
 advises `/clear`, `/compact`, or `/rite-handoff` and never a competing command. Full phase-by-phase guidance:
 [`context-hygiene.md`](context-hygiene.md).
+<!-- /root-only -->
 
 ## Precedence
 

package/pack/generated/claude/skills/devrites-lib/reference/standards/deprecation.md

@@ -6,7 +6,7 @@ Removing behavior is riskier than adding it because hidden consumers may depend
 
 ## Prove it is unused
 
-Find callers, subscribers, stored data, external clients, and scheduled jobs with code intelligence, then confirm runtime usage through [`observability.md`](observability.md). Static absence alone does not prove zero consumers. If zero usage cannot be proven, deprecate instead of deleting.
+Find callers, subscribers, stored data, external clients, and scheduled jobs with codebase-memory `trace_path` (`direction: "inbound"`, `mode: "cross_service"` for service edges; [`code-navigation.md`](code-navigation.md)), then confirm runtime usage through [`observability.md`](observability.md). Static absence alone does not prove zero consumers. If zero usage cannot be proven, deprecate instead of deleting.
 
 ### Dead-code confidence