devrites 6.10.0 → 7.0.0

package/pack/generated/codex/agents/devrites-strategy-reviewer.toml

@@ -38,9 +38,9 @@ to check a claim; never band the plan, which `devrites-plan-reviewer` owns. With
 `strategy.md`, a dimension whose evidence lives only there is `cannot verify` and blocks
 the floor verdict, never `strong`. Do not read the author's chat reasoning.
 
-Follow `.agents/skills/devrites-lib/reference/standards/tooling.md`: use the primary
-available code index for blast radius and placement, add at most one cross-check for a
-named incomplete/stale/conflicting predicate, then fall back to LSP or file search.
+Per `.agents/skills/devrites-lib/reference/standards/code-navigation.md`: placement from
+`get_architecture`, blast radius from `trace_path` (`direction: "inbound"`), and
+`check_index_coverage` on cited paths; then fall back to LSP or file search.
 
 ## Score the nine dimensions
 For each dimension, **cite the spec line or its absence first**, then assign the
@@ -88,9 +88,8 @@ pre-mortem risk remains.
 
 Return the report in this shape:
 ```
-Strategy review (<slug>) — independent, pre-plan
 Outcome: <findings | no-findings | gap>
-Counts: <n per severity or kind used in the rows below>
+Counts: critical=<n> important=<n> suggestion=<n> nit=<n> fyi=<n> gap=<n>
 Account: <admitted findings | No-findings | Gap per Result admission>
 Dimension bands (evidence → band):
   - Problem choice and ambition: <evidence> → <band>

package/pack/generated/codex/agents/devrites-test-analyst.toml

@@ -38,7 +38,11 @@ In workspace `.devrites/work/<slug>/`, read `spec.md` for the acceptance criteri
 `evidence.md`, `tasks.md`, and `touched-files.md` by the schema's bounded rule: when
 `devrites-engine orient <slug>` reports one over budget, index it (`grep -n`) and load only
 entries naming this candidate's AC/slice IDs. Run `git diff` limited to `touched-files.md`
-paths to inspect the code and tests, then read the test files.
+paths to inspect the code and tests, then read the test files. To find the tests that
+reach each changed symbol, use `trace_path` (`direction: "inbound"`, `include_tests:
+true`) and `TESTS` edges via `query_graph`, per
+`.agents/skills/devrites-lib/reference/standards/code-navigation.md`; a changed
+symbol no test reaches is a finding.
 
 ## Assess
 - **Coverage of acceptance criteria:** map each criterion to the tests that prove it.
@@ -86,9 +90,8 @@ paths to inspect the code and tests, then read the test files.
 
 Return the report in this shape:
 ```
-Test analysis (<slug>) — independent
 Outcome: <findings | no-findings | gap>
-Counts: <n per severity or kind used in the rows below>
+Counts: critical=<n> important=<n> suggestion=<n> nit=<n> fyi=<n> gap=<n>
 Account: <admitted findings | No-findings | Gap per Result admission>
 Claim map: <claim> | <exact_test> | <consumer_path> | <testing.md category> | <evidence gap> | <discriminating proof>
 Verdict: verified | behavior_unverified

package/pack/generated/codex/agents/fast-builder.toml

@@ -31,7 +31,9 @@ unclear boundary is an escalation, not a guess.
 ## Procedure
 
 1. **Orient.** Read the target files and their neighbors. Learn naming, layers, error
-   model, test style, and existing helpers. Reuse, then extend, then build new.
+   model, test style, and existing helpers. Reuse, then extend, then build new. Find
+   helpers with `search_graph` and callers with `trace_path` per
+   `.agents/skills/devrites-lib/reference/standards/code-navigation.md`.
 2. **Tests with the code.** For every AC in the contract, write a test that would
    fail without the change: real assertions on the new behavior, including the error
    and edge cases the AC names. Use the project's existing runner and style.

package/pack/generated/codex/agents/fast-checker.toml

@@ -31,7 +31,8 @@ baseline paths in `plan.md`.
 3. **Scope.** Every changed path belongs to a slice. Every new behavior belongs to an
    AC. Anything else is `out-of-scope`.
 4. **Contracts.** For each changed function, type, or interface, check its callers
-   still match.
+   still match: list them with `trace_path` (`direction: "inbound"`) per
+   `.agents/skills/devrites-lib/reference/standards/code-navigation.md`, then read each call site.
 5. **Leftovers.** `TODO`, `TBD`, stubs, `not implemented`, commented-out code, or
    debug output in changed lines.
 6. **Check run.** Each red command becomes one `failing-command` gap with its first

package/pack/generated/codex/agents/fast-critic.toml

@@ -22,7 +22,8 @@ input, auth, data, or integrations.
 
 `spec.md` and `plan.md` from `.devrites/work/<slug>/`, and the feature diff: `git diff`
 plus untracked files, minus the baseline paths in `plan.md`. Read the touched files
-and their callers, not only the hunks.
+and their callers, not only the hunks; list callers with `trace_path`
+(`direction: "inbound"`) per `.agents/skills/devrites-lib/reference/standards/code-navigation.md`.
 
 ## Review
 

package/pack/generated/codex/agents/fast-planner.toml

@@ -28,8 +28,8 @@ Formats live in `.agents/skills/rite-fast/reference/artifacts.md`
 
 1. **Facts from the repository, not from the user.** Find where the change lives,
    the existing helpers, types, and patterns to reuse, the test runner and test
-   style, and the callers the change affects. Use a code-intelligence index when
-   available, then Read/Grep/Glob. A question whose answer sits in a file is a
+   style, and the callers the change affects. Use `search_graph` and `trace_path`
+   (`direction: "inbound"`) per `.agents/skills/devrites-lib/reference/standards/code-navigation.md`, then Read/Grep/Glob. A question whose answer sits in a file is a
    defect in your output.
 2. **Acceptance criteria.** Observable behavior at a named surface, one test able
    to show each. Include error and edge behavior the task implies. No criteria for

package/pack/generated/codex/agents/overhaul-recon.toml

@@ -39,10 +39,11 @@ and proposals.
    denominator. Note submodules (boundary only), binaries and assets, candidate
    vendored or generated paths with the evidence for each (generator, header, config),
    and security-sensitive ignored inputs by path only.
-3. Use a code graph when the host offers one, to map faster, never to decide scope:
-   `codebase-memory-mcp` (architecture, call paths) or `codegraph` for a full project,
-   `code-review-graph` (changed nodes, impact radius) for a PR or branch. Record which
-   graph you used, its index time and the commit it was built from. A graph is a hint:
+3. Use codebase-memory-mcp when the host offers it, to map faster, never to decide
+   scope: `get_architecture` and `trace_path` for a full project, `detect_changes`
+   (explicit `base_branch`) for a PR or branch, per
+   `.agents/skills/devrites-lib/reference/standards/code-navigation.md`. Record the project, its `indexed_at`
+   and the commit it was built from. A graph is a hint:
    it may be stale or miss dynamic calls, so it can add entry points, contract seeds
    and cross-file edges but never remove a file, range or lane from the step 2
    inventory. Verify every graph-derived fact you report against the source. Without a

package/pack/generated/codex/skills/devrites-api-interface/SKILL.md

@@ -3,7 +3,7 @@ name: devrites-api-interface
 description: Shape stable API, type, module, or frontend/backend contracts before implementation. Use when a slice crosses a boundary; not for internal helpers.
 user-invocable: false
 ---
-<!-- loads: {"always":["devrites-lib/reference/standards/core.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"deprecation":["devrites-lib/reference/standards/deprecation.md"],"security":["devrites-lib/reference/standards/security.md","rite-review/reference/security-review.md"]},"workspace":["spec.md","plan.md","tasks.md","state.md","decisions.md"]} -->
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"deprecation":["devrites-lib/reference/standards/deprecation.md"],"security":["devrites-lib/reference/standards/security.md","rite-review/reference/security-review.md"]},"workspace":["spec.md","plan.md","tasks.md","state.md","decisions.md"],"rootOnly":["devrites-lib/reference/standards/afk-hitl.md"]} -->
 > Read-set manifest: `devrites-engine context --skills-root .agents/skills <slug> --skill devrites-api-interface` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # devrites-api-interface: contract before implementation

package/pack/generated/codex/skills/devrites-audit/SKILL.md

@@ -4,7 +4,7 @@ description: Audit one feature read-only for security, performance, or simplific
 argument-hint: "<security | perf | simplify>"
 user-invocable: false
 ---
-<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/parallel-dispatch.md","devrites-lib/reference/standards/agents.md"],"triggers":{"audit-coverage":["devrites-lib/reference/standards/audit-coverage.md"],"architecture-health":["devrites-lib/reference/standards/architecture-health.md"]},"workspace":["spec.md","plan.md","tasks.md","touched-files.md","evidence.md","state.md","decisions.md"],"workspaceByRole":{"performance-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md"],"security-auditor":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md"],"simplifier-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md"]}} -->
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/standards/code-index.md","devrites-lib/reference/parallel-dispatch.md","devrites-lib/reference/standards/agents.md"],"triggers":{"audit-coverage":["devrites-lib/reference/standards/audit-coverage.md"],"architecture-health":["devrites-lib/reference/standards/architecture-health.md"]},"workspace":["spec.md","plan.md","tasks.md","touched-files.md","evidence.md","state.md","decisions.md"],"workspaceByRole":{"performance-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md"],"security-auditor":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md"],"simplifier-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md"]},"rootOnly":["devrites-lib/reference/standards/code-index.md","devrites-lib/reference/parallel-dispatch.md"]} -->
 > Read-set manifest: `devrites-engine context --skills-root .agents/skills <slug> --skill devrites-audit` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # devrites-audit: read-only audit dispatch

package/pack/generated/codex/skills/devrites-debug-recovery/SKILL.md

@@ -4,7 +4,7 @@ description: Fix application test, build, CI, runtime, browser, or 500 failures
 argument-hint: "[<slug>]"
 user-invocable: false
 ---
-<!-- loads: {"always":["devrites-lib/reference/standards/code-navigation.md","devrites-debug-recovery/reference/build-the-loop.md","devrites-debug-recovery/reference/cleanup-and-classify.md","devrites-debug-recovery/reference/hypotheses.md","devrites-debug-recovery/reference/instrumentation.md","devrites-debug-recovery/reference/regression-test.md","devrites-debug-recovery/reference/trace.md","devrites-lib/reference/standards/debug-recovery.md"],"triggers":{"one-shot":["devrites-lib/reference/standards/one-shot-actions.md"],"security":["devrites-lib/reference/standards/security.md"],"workspace":["devrites-lib/reference/standards/workflow-artifacts.md"]}} -->
+<!-- loads: {"always":["devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/standards/code-index.md","devrites-debug-recovery/reference/build-the-loop.md","devrites-debug-recovery/reference/cleanup-and-classify.md","devrites-debug-recovery/reference/hypotheses.md","devrites-debug-recovery/reference/instrumentation.md","devrites-debug-recovery/reference/regression-test.md","devrites-debug-recovery/reference/trace.md","devrites-lib/reference/standards/debug-recovery.md"],"triggers":{"one-shot":["devrites-lib/reference/standards/one-shot-actions.md"],"security":["devrites-lib/reference/standards/security.md"],"workspace":["devrites-lib/reference/standards/workflow-artifacts.md"]},"rootOnly":["devrites-lib/reference/standards/code-index.md","devrites-lib/reference/standards/workflow-artifacts.md"]} -->
 > Read-set manifest: `devrites-engine context --skills-root .agents/skills <slug> --skill devrites-debug-recovery` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # devrites-debug-recovery: fix the root cause, not the symptom

package/pack/generated/codex/skills/devrites-doubt/SKILL.md

@@ -3,7 +3,7 @@ name: devrites-doubt
 description: Stress-test one consequential decision independently. Use for uncertainty around boundaries, data, auth, APIs, or migrations; not trivial choices.
 user-invocable: false
 ---
-<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/agents.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"security":["devrites-lib/reference/standards/security.md"],"tooling":["devrites-lib/reference/standards/tooling.md"]},"workspace":["spec.md","plan.md","tasks.md","state.md","decisions.md"],"workspaceByRole":{"doubt-reviewer":["spec.md","plan.md","tasks.md","state.md","decisions.md"]}} -->
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/agents.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"security":["devrites-lib/reference/standards/security.md"],"tooling":["devrites-lib/reference/standards/tooling.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/standards/code-index.md"]},"workspace":["spec.md","plan.md","tasks.md","state.md","decisions.md"],"workspaceByRole":{"doubt-reviewer":["spec.md","plan.md","tasks.md","state.md","decisions.md"]},"rootOnly":["devrites-lib/reference/standards/afk-hitl.md","devrites-lib/reference/standards/code-index.md","devrites-lib/reference/standards/tooling.md"]} -->
 > Read-set manifest: `devrites-engine context --skills-root .agents/skills <slug> --skill devrites-doubt` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # devrites-doubt: CLAIM → EXTRACT → DOUBT → RECONCILE → STOP
@@ -42,10 +42,10 @@ complexity reappears across N callers, the abstraction concentrates real complex
 Wait for a second real caller before keeping a pass-through that fails this test.
 
 ## Rules
-- For "where does this claim reach / what would change with it" questions, prefer a
-  code-intelligence index under [`tooling.md`](../devrites-lib/reference/standards/tooling.md): use the primary available index,
-  add at most one cross-check for a named incomplete/stale/conflicting predicate, then fall
-  back to LSP or file search. Do not query several indexes for reassurance.
+- For "where does this claim reach / what would change with it" questions (trigger
+  `tooling`), use codebase-memory `trace_path` (`direction: "inbound"`) per
+  [`code-navigation.md`](../devrites-lib/reference/standards/code-navigation.md),
+  then fall back to LSP or file search. Do not repeat a query for reassurance.
 - The reviewer prompt must be adversarial: its job is to break the claim, not to agree.
 - Strip your own justification before review; reasoning anchors the reviewer toward
   agreement.

package/pack/generated/codex/skills/devrites-frontend-craft/reference/reuse-first.md

@@ -9,9 +9,9 @@ This applies to UI **and** non-UI code: utilities, helpers, types, validators, s
 formatters, hooks, query helpers: anything that might already exist.
 
 ## The decision (in order)
-1. **Search first.** Apply `../../devrites-lib/reference/standards/tooling.md`: use the
-   primary available code index to find similar definitions, cross-check only a named
-   unresolved predicate, then fall back to grep/glob over `components/`, design tokens, hooks/,
+1. **Search first.** Apply `../../devrites-lib/reference/standards/code-navigation.md`: find
+   similar definitions with codebase-memory `search_graph` (`semantic_query` plus
+   `name_pattern` variants), then fall back to grep/glob over `components/`, design tokens, hooks/,
    utils/, lib/. Look for things doing the *same job*, not just the same name.
 2. **Exact fit → REUSE.** Compose / import the existing thing. No copy, no fork.
 3. **Close fit → EXTEND.** Add a variant/prop/option that the existing component or util

package/pack/generated/codex/skills/devrites-interview/SKILL.md

@@ -3,7 +3,7 @@ name: devrites-interview
 description: Interview the user one question at a time to extract intent. Use when the user says "interview me", "I am not sure what I want", or the ask is underspecified. Not for casual clarification.
 user-invocable: false
 ---
-<!-- loads: {"always":["devrites-lib/reference/standards/core.md","rite-spec/reference/interview-patterns.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"]},"workspace":["spec.md","questions.md","decisions.md","assumptions.md","decision-coverage.md","state.md"]} -->
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","rite-spec/reference/interview-patterns.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"]},"workspace":["spec.md","questions.md","decisions.md","assumptions.md","decision-coverage.md","state.md"],"rootOnly":["devrites-lib/reference/standards/afk-hitl.md"]} -->
 > Read-set manifest: `devrites-engine context --skills-root .agents/skills <slug> --skill devrites-interview` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # devrites-interview: extract intent

package/pack/generated/codex/skills/devrites-lib/SKILL.md

@@ -45,14 +45,16 @@ lifecycle state from chat or optional `README.md`.
 The engine is limited to:
 
 - Checks: `check candidate` (content-bound identity), `check readiness`
-  (structure; `--emit-binding` emits the Build-input binding), `check seal` (structure
+  (structure; `--emit-binding` emits the Build-input binding), `check
+  preconditions` (Vet preflight rows), `check seal` (structure
   plus exact artifact bindings and evidence freshness), `check slice` (slice
   contract preflight before wright dispatch), `check task-graph`, `check
   diff-scope` (mechanical changed-paths ⊆ allowlist before reviewer dispatch),
   `check path-disjoint`, `check skill-trust`, `check indexes`, `check
   regression` (progress high-water mark), `check drift` (readiness-input
   attribution), `check windows` (deferral-marker waivers), `check dup`
-  (advisory near-duplicates), `detect commands` (repository test/lint wiring).
+  (advisory near-duplicates), `check anchors` (Critical/Important quote
+  anchoring), `check perturb` (safe-perturbation probe), `detect commands` (repository test/lint wiring).
 - Observation: `observe summary` (`orient` alias), `observe slice`, `next`
   (minimal remaining lifecycle path), `handoff` (deterministic resume record).
 - Coordination: `context` emits one deduplicated read-set bundle from each
@@ -71,17 +73,20 @@ The engine is limited to:
   principles presence); confirm them rather than re-deriving conditions. Repeat
   calls with unchanged inputs print `unchanged` and reuse the existing bundle.
   `dispatch` owns the launch-wave barrier — seal needs a distinct handle per
-  role, return needs seal, and start/return auto-record into the `metrics`
-  ledger. `claim` owns the advisory session-scoped `claims.jsonl` ledger;
+  role (the last start seals), return needs seal, open --claim-session/--claim
+  takes the wave's file claim (released by the completing return or abandon
+  --release), and start/return auto-record into the `metrics` ledger;
+  `candidate freeze` and `packet` write a wave's frozen diff and packets. `claim` owns the advisory session-scoped `claims.jsonl` ledger;
   `note` owns anchored `notes.md` entries (`check seal` refuses non-exact
   anchors); `parallel` owns deterministic worktree lease/create/integrate/
   cleanup for parallel slices.
 - `gates` owns the machine-checked acceptance ledger (`gates.md`): `scaffold`,
-  `status`, `run`, `reverify`, `lint`, `attest`, `abandon` — grammar and
+  `status`, `run`, `reverify`, `lint`, `precheck`, `attest`, `abandon` — grammar and
   authoring rules in
   [`reference/standards/gates.md`](reference/standards/gates.md).
 - Atomic state: `state resolve` for answer/drop/batch, `state merge-manifest`
-  for the predecessor-chain union, transactional `state close`, and `migrate`
+  for the predecessor-chain union, `state set`/`state append` for cursor fields and
+  ledger sections, transactional `state close`, and `migrate`
   for fail-closed workspace-schema normalization.
 - `secret-scan`, `open-visual`, and `version` remain read-only helpers.
 - Offline, local `install`, `update`, and `uninstall`; their shell/npm callers

package/pack/generated/codex/skills/devrites-lib/reference/orchestration-profiles.md

@@ -1,5 +1,7 @@
 # Native execution profiles
 
+> Root-only: not inlined in --role bundles.
+
 Profiles scale **change depth**, not orchestration machinery. The host discovers
 the exact project specialist named by a workflow, dispatches it in fresh context,
 waits for the result, validates the result shape, and reconciles the evidence.

package/pack/generated/codex/skills/devrites-lib/reference/parallel-dispatch.md

@@ -1,5 +1,7 @@
 # Native review dispatch
 
+> Root-only: not inlined in --role bundles.
+
 Host dispatch; DevRites governs.
 
 ## Roster
@@ -27,7 +29,9 @@ If the candidate diff has no matching surfaces, record
 
 ## Dispatch contract
 
-1. Freeze one candidate; give each reviewer the same spec, paths, and diff.
+1. Freeze one candidate with `devrites-engine candidate freeze <slug> --wave <w>
+   (--slice <SLICE-ID> | --paths <path>...) [--base <ref>]` (writes
+   `packets/<w>.diff` and `packets/<w>.sha256`); give each reviewer the same spec, paths, and diff.
    Parallelize only when writes/state/locks/tool sessions/scarce resources
    (ports/processes/quotas/FDs/browsers/MCP) are compatible. Frozen read-only
    usually is; pressure requires batches or serial work.
@@ -37,8 +41,10 @@ If the candidate diff has no matching surfaces, record
    still validate each result's context and candidate.
 2. Build each reviewer's read-set once with
    `devrites-engine context --skills-root .agents/skills <slug> --phase <p> --role <role> --trigger <set>` and
-   hand the bundle path as the packet's source list instead of a file roster.
-   Build roles add `--slice <SLICE-ID>` (slice-scoped, slice-named bundle).
+   render each reviewer, auditor, and test-analyst packet (other roles, such as
+   `proof-runner`, keep their own) with `devrites-engine packet <slug> --wave <w> --phase <p>
+   --role <role> [--slice <SLICE-ID>] [--focus <file>]`: it names the bundle and frozen
+   diff by reference, copies the digests, and runs the `open` lints. Build roles add `--slice <SLICE-ID>` (slice-scoped, slice-named bundle).
    Evaluate the skill's trigger conditions and pass each that fires — a role's
    Trigger column maps to the phase manifest's names: `security-auditor` →
    `security`; at Review, `frontend-reviewer` → `ui` and `performance-reviewer` →
@@ -48,21 +54,25 @@ If the candidate diff has no matching surfaces, record
    omitted applicable trigger is a gap, not a shortcut.
 3. Enforce the launch barrier through the engine, not prose. Open the wave
    (`devrites-engine dispatch <slug> open --phase <p> --wave <w> --role <r>...`;
-   a reviewer, auditor, or test-analyst wave adds `--packet <file>`, the exact packet
-   those agents receive, and `open` refuses one that seeds a gate result, outcome,
-   count, or "already passed" claim; at Review and Seal it also needs the packet to
-   name the frozen candidate diff and the manifest to cover every checkpointed path), launch every native agent nonblocking through the host's own agent
+   a reviewer, auditor, or test-analyst wave adds `--packet <file>`, any one of the
+   wave's rendered `packets/<w>.<role>.md` (hand each agent its own file unedited), and `open` refuses one that seeds a gate result, outcome,
+   count, or "already passed" claim; a Build reviewer wave adds `--slice <SLICE-ID>`
+   so its findings key on that slice; at Review and Seal it also needs the packet to
+   name the frozen candidate diff and the manifest to cover every checkpointed path;
+   a same-tree writer wave adds `--claim-session <id> --claim <path>...` per
+   [`wright-dispatch.md`](../../rite-build/reference/wright-dispatch.md#run)), launch every native agent nonblocking through the host's own agent
    tool (never a shell-launched host CLI such as `omp -p` or `claude -p`: that is a
    dispatch bridge, its PID handle dies with the session, and its return is a `gap`),
    record each returned host handle
-   (`dispatch ... start --wave <w> --role <r> --handle <id>`), then `seal` —
-   seal fails until every declared role has a distinct handle, which makes a
+   (`dispatch ... start --wave <w> --role <r> --handle <id>`) — the last start
+   seals the wave (an explicit `seal` is a no-op), which makes a
    serial launch-then-wait pattern impossible to record. Record each completion
-   with `dispatch ... return`; `return` refuses before seal. `dispatch status`
+   with `dispatch ... return`; a reviewer adds `--result <file>` holding its return verbatim (the engine stores it as `packets/<wave>-<role>.return.md`, derives the outcome from its head, and records its `Finding:` keys; a file already at that path is kept), or `--outcome <findings|no-findings|gap>` when the host cannot hand the return over as a file; `return` refuses before seal. `dispatch status`
    exits nonzero while the wave is open, sealed, or abandoned. `start`/`return`
    auto-record the dispatch/return metrics events — no separate ledger call. If
    an opened wave cannot obtain every handle or reach `seal`, run
-   `devrites-engine dispatch <slug> abandon --wave <w> --reason <reason>` before
+   `devrites-engine dispatch <slug> abandon --wave <w> --reason <reason>` (with
+   `--release` on a host-confirmed stop or refused launch) before
    recording the gap; never leave an open wave to block a retry.
 4. Ask for each exact named agent in fresh context; omit native syntax and
    `agent_type`/`task_name`/`fork_turns` from the instruction.
@@ -142,13 +152,14 @@ session, the claim proof below settles it. A result classification alone
 does not prove host termination.
 
 On resume (compaction or a new session), run `devrites-engine dispatch <slug>
-status`, `parallel status`, and `claim list --all` before any dispatch. A read-only
+status`, `parallel status`, and `claim list` before any dispatch. A read-only
 wave whose handles this session cannot query: `abandon` it, record each unreturned
 role `gap`, and re-dispatch fresh on the current digest; its late returns are
 `stale`. A writer keeps its claim and lease — no relaunch on those paths until the
 claim is released or its holder is proven terminal. For an unqueryable writer,
-`claim list --all` showing its claim `released` or `dead` (the engine proved the
-holding session exited on this host) is that proof: `abandon` the wave, record the
+`claim list` showing its claim `dead` (the engine proved the holding session
+exited on this host), or `claim list --all --session <id>` showing it `released`
+(bare `list` only counts released rows), is that proof: `abandon` the wave, record the
 role `gap`, claim the paths, and re-dispatch without waiting on the launching
 session. `live` or `expired` stays held. A wright that never returned an
 admitted result leaves unadmitted bytes: task-path changes since its pre-dispatch

package/pack/generated/codex/skills/devrites-lib/reference/standards/README.md

@@ -47,7 +47,8 @@ topic's owner.
 | `afk-hitl.md` | A pause, question, resume, or AFK decision is possible. |
 | `one-shot-actions.md` | A failed proof/action would spend paid or rate-limited quota, mutate external state, or delete its own failure evidence. |
 | `tooling.md` | Structural lookup, current external facts, or architecture memory is needed. |
-| `code-navigation.md` | Choosing graph, LSP, grep, or read routes before cross-file edits. |
+| `code-navigation.md` | Editing across files or claiming a blast radius: affected set, enclosing-body reads, fresh diagnostics, static-graph blind spots. |
+| `code-index.md` | Choosing graph, LSP, grep, or read routes: index preflight, route table, coverage, query budget, host access. |
 | `skill-authoring.md` | Creating, editing, routing, evaluating, or pruning a DevRites skill. |
 | `definition-of-done.md` | Prove, Seal, Ship, or Quick must decide whether work is finished. |
 | `review-checklist.md` | A compact review pass/fail sweep is enough. |

package/pack/generated/codex/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -1,5 +1,7 @@
 # AFK & HITL: the pause/resume contract
 
+> Root-only: not inlined in --role bundles.
+
 > Applies when: any rite/devrites skill that can pause for a human or run unattended; irreversible-risk list, budgets, recovery accounting.
 
 Defines two modes for `rite-*`/`devrites-*` skills that may pause; main
@@ -211,6 +213,9 @@ Wherever a gap, checkpoint, or non-trivial decision surfaces (`$rite-spec`, `$ri
   sequential packets, then obtain final confirmation. Materially distinct options MUST NOT
   be silently dropped, merged, or preselected to fit the UI.
 - Recommend for project conventions, stack, scale, and domain, not a generic default.
+- **One visit per decision chain.** Ask the follow-ups an answer predictably triggers (a
+  dependency's lock lines, a rerun after a failed measurement) in the same entry or one
+  `--batch`; each link asked alone costs one human wait.
 
 **HITL** renders the set via `AskUserQuestion`; the human's pick resolves the gate **in place**.
 **AFK** auto-picks option 1 for gates it may auto-handle. Record the chosen option verbatim and
@@ -271,8 +276,8 @@ options: |                                    # ranked option set; recommended F
   1. <recommended> (Recommended) — logic: … · infra: … · business: … · architecture: …
   2. <alternative> — <dimension-tagged rationale + trade-off>
   3. Something else — describe it
-proposed: <the recommended option restated — the HITL default + the AFK auto-pick>
-raised_at: <iso>
+proposed: <the recommended option restated — the HITL default + the AFK auto-pick; omit with no (Recommended)>
+raised_at: <full RFC 3339 timestamp, e.g. 2026-10-19T08:17:08Z>
 answered_at: <iso, when status flips off "open">
 answer: <chosen option (or human's verbatim reply / drop reason)>
 answered_by: human                            # only when a human resolved it (`state resolve --human`)
@@ -280,6 +285,8 @@ answered_by: human                            # only when a human resolved it (`
 
 Rules:
 - `NNN` is sequential per date: the next-available 3-digit integer.
+- `state append` refuses a new open entry that breaks this schema (2-4 options plus the escape
+  hatch, `(Recommended)` only on option 1); length is advisory.
 - `status: open` is the only state `$rite-resolve` can mutate; `answered` and `dropped`
   are terminal.
 - `answered_by: human` is written only by `state resolve --human`. HITL live picks and `$rite-resolve`
@@ -295,7 +302,8 @@ boundary owns any such request and requires explicit user approval.
 ## `state.md` `Awaiting human` block
 
 When a HITL gate fires, `$rite-build` sets cursor `status` to `awaiting_human` and
-`next_action` to `$rite-resolve <qid> "<answer>"`, then writes the `Awaiting human` table
+`next_action` to `$rite-resolve <qid> "<answer>"` via `devrites-engine state set` (under AFK
+it names questions the sentinel auto-picks: resolve those unless irreversible-risk), then writes the `Awaiting human` table
 (`question_id`, `gate`, `blocking_slices`) owned by
 [`state-workspace.md`](../../../rite-spec/reference/state-workspace.md#statemd-template) § state.md template.
 The question text, `proposed` answer, and `raised_at` live in the `questions.md` entry.

package/pack/generated/codex/skills/devrites-lib/reference/standards/agents.md

@@ -6,11 +6,14 @@ Follow DevRites policy and [`depth profiles`](../orchestration-profiles.md).
 
 ## Authority
 
+<!-- root-only -->
 - Root owns scope, questions/decisions/results, `.devrites/**`, phase transitions — not product source/tests; vetted executable workflow artifacts follow [`workflow-artifacts.md`](workflow-artifacts.md).
-- Only bounded wright writes product source/tests; others inspect an immutable candidate.
 - Every named role runs; unavailable → HITL, never skip/substitute.
+<!-- /root-only -->
+- Only bounded wright writes product source/tests; others inspect an immutable candidate.
 - Leaves never invoke agents, ask humans, change phase, push, install/deploy, migrate live data, or act irreversibly; they return evidence/proposals for root acceptance. Sole exception: one local unpushed transfer commit by an eligible native-worktree `devrites-slice-wright` — transport, not shipping authority or a checkpoint.
 
+<!-- root-only -->
 ## Agents
 
 | Agent |
@@ -34,7 +37,9 @@ Follow DevRites policy and [`depth profiles`](../orchestration-profiles.md).
 | `devrites-slice-wright` |
 
 Files own briefs; [`parallel-dispatch.md`](../parallel-dispatch.md) owns rosters.
+<!-- /root-only -->
 
+<!-- root-only -->
 ## Native invocation
 
 Skills name exact fresh roles, omit native fields;
@@ -47,6 +52,7 @@ dispatch <slug> open|start|seal|return` (a solo dispatch is a wave of one;
 start/return auto-record metrics). Without a workspace the plain host dispatch
 contract above applies and no engine tracking is required.
 Workflow-named skills (e.g. devrites-source-driven) are invoked inline in the root context, never dispatched as agents.
+<!-- /root-only -->
 
 ## Source-writing boundary
 
@@ -59,22 +65,24 @@ Each job gets objective/exclusions, exact paths/immutable candidate, rubric/resu
 **Same-tree concurrent sessions claim first.** Worktree dispatch isolates
 parallel batch siblings, but two agent *sessions* (two hosts, two features, or
 a human plus an agent) can share one working tree. Before a same-tree writer
-starts, it records an advisory claim — `devrites-engine claim add --session
-<id> <paths>` — retains the returned `<claim-id>`, then checks the same paths
-with `devrites-engine claim check --session <id> <paths>`; a held claim from a
+starts, its `dispatch open` records an advisory claim with `--claim-session <id>
+--claim <path>...` and fails, creating no wave, while a live foreign session holds
+a path (without a wave: `claim add --session <id> <paths>`, keep its `<claim-id>`,
+then `claim check`); a held claim from a
 live foreign session is never merged later or overridden. Unattended, skip only
-work that needs those paths, run independent work, and re-check `claim list --all`
-before stopping; stop and report the holder only when nothing independent remains. On every
-host-confirmed terminal path after `add` ([unknown outcomes keep it](../parallel-dispatch.md#cancellation-and-terminal-reconciliation)) — return,
-rejected result, stop, or a launch refused with no handle — run
+work that needs those paths, run independent work, and re-check `claim list`
+before stopping; stop and report the holder only when nothing independent remains.
+On every host-confirmed terminal path after `add` or a claimed `dispatch open` ([unknown outcomes keep it](../parallel-dispatch.md#cancellation-and-terminal-reconciliation)),
+the wave's completing `return` releases its claim, `dispatch abandon --release`
+releases it on any other (a stop or a refused launch), and a `claim add` claim runs
 `devrites-engine claim release --session <id> --id <claim-id>`. Claims expire
 by TTL only as crash recovery; `claim list` shows who holds what. Claims are
 advisory coordination, never a substitute for the one-writer-per-worktree rule.
 Claims cover product paths only; root-authored `.devrites/**` files use
 [`workflow-artifacts.md`](workflow-artifacts.md) admission instead.
-Expiry is not proof the holder stopped: size `claim add --ttl <minutes>` to the
+Expiry is not proof the holder stopped: size `--claim-ttl` or `claim add --ttl <minutes>` to the
 expected write (engine max 240) and re-add before it lapses; before writing, also
-read `claim list --all` — a foreign `expired` claim on overlapping paths whose
+read `claim list` — a foreign `expired` claim on overlapping paths whose
 session is not proven terminal counts as held (stop and report). `dead` (engine-proven
 exited holder) or `released` is terminal: reconcile per
 [§ Cancellation](../parallel-dispatch.md#cancellation-and-terminal-reconciliation). **Failing case:**
@@ -102,22 +110,25 @@ Each required reviewer/analyst/auditor starts with exactly one:
 
 ```text
 Outcome: <findings | no-findings | gap>
-Counts: <n per severity or kind used in the rows below>
-Finding: <severity> conf <n> | <file:line or artifact section> | <observed quote/result> | when <input/state/sequence> → <effect> | breaks <ID or standard §> "<quoted line>" | <minimum fix>
+Counts: critical=<n> important=<n> suggestion=<n> nit=<n> fyi=<n> gap=<n>
+Finding: <severity> conf <n> | <file:line or artifact section> | `<quoted cited line>` <observed result> | when <input/state/sequence> → <effect> | breaks <ID or standard §> "<quoted line>" | <minimum fix>
 Basis: <files read · commands run to reach this finding>
 ```
 
 - **`findings`:** each row uses the shape above; confidence 1–10 on Critical/Important.
   Critical/Important requires 7+, exact evidence, concrete impact, and a non-empty
   `Basis` — a correct verdict reached by an unrecorded inspection path is unproven.
-  A Critical/Important row carries `conf <n>` in its severity cell and writes impact
-  as `when <input/state/sequence> → <effect>`; missing either, root admits it as
+  A Critical/Important row carries `conf <n>` in its severity cell, opens its observed
+  cell with the cited line's quote in backticks, and writes impact
+  as `when <input/state/sequence> → <effect>`; missing conf or trigger, root admits it as
   `Unverified: <claim> — missing trigger` (stays `gap`).
 - **Proportionality:** a Critical/Important row's `breaks` quotes the line it violates:
   a spec ID (`AC`/`REQ`/`INV`/`PROH`/`DEC`/`EDGE`) or a shipped standard rule
   (`<standard>.md § <section>`: security, regression, principles). Root anchors the
-  quote like the `file:line` quote. A repair contract, recheck packet or earlier
-  finding only restates a prior claim and is never an anchor. No anchor, or one
+  quote like the `file:line` quote. A repair contract, recheck packet, earlier
+  finding or plan item (`plan.md`, `tasks.md`, `architecture.md`, `test-plan.md`)
+  only restates root's own claim and is never an anchor; quote the spec ID or
+  standard rule it traces to. No anchor, or one
   the defect does not break,
   admits the row as Suggestion logged `Deferred: <claim> — no spec anchor` for an
   optional follow-up slice; it never drives a repair round. Hardening no spec line
@@ -147,10 +158,12 @@ Basis: <files read · commands run to reach this finding>
   and `$rite-doctor`. Never design capture or retention machinery around it.
 
 Root treats results as claims; verifies proposed Critical/Important blockers
-against candidate, first anchoring each row's quote at its cited `file:line` on the
-frozen digest: exact → admit; found at exactly one other location → relocate,
+against candidate, first running `devrites-engine check anchors --skills-root .agents/skills <slug> <return-file>`,
+which anchors each row's quote at its cited `file:line` on the live candidate and its
+`breaks` quote, and prints the digest root confirms equals the reviewed packet's: exact → admit; found at exactly one other location → relocate,
 keeping both locations; not found or found at several → `Unverified: <claim> —
-anchor lost|ambiguous`, a gap that is never a finding or a dismissal. A leaf result
+anchor lost|ambiguous`, a gap that is never a finding, a dismissal or a repair-round
+input (exit 3). A leaf result
 produced by spawning a nested agent is `gap`, and each hidden child counts toward
 the concurrent pool and `max_agents`. Missing fields become
 `Unverified: <claim> — missing <proof>` and stay `gap` until verified/rejected
@@ -167,6 +180,15 @@ return is the bundle the root writes) and the wright's change evidence.
 
 - Lead with the result line (`Outcome:` for reviewers, the role's own status line
   otherwise), then `Counts:` with the number of rows per severity or kind.
+- A reviewer, auditor or test-analyst head is strict: line 1 is
+  `Outcome: findings|no-findings|gap` (no title line above it), line 2 is
+  `Counts: key=N ...` with keys from the role's closed vocabulary:
+  `critical important suggestion nit fyi gap`, plus `contract mechanism` for
+  `devrites-plan-reviewer`, only `suggestion nit fyi gap` for
+  `devrites-simplifier-reviewer`. `findings` needs a non-`gap` count above 0;
+  `no-findings` needs every count at 0. `dispatch return --result <file>` stores
+  the return and records a malformed or inconsistent head as `gap`, never
+  `no-findings`.
 - No restated task, preamble, approach narrative or closing summary. An optional
   `Notes:` block carries at most five lines that no row can hold.
 - Point, don't paste: cite `file:line` with at most one quoted line (160
@@ -177,6 +199,7 @@ return is the bundle the root writes) and the wright's change evidence.
   never rewrites, merges or summarizes a row; deduplication references rows by
   position or ID instead of rewording them.
 
+<!-- root-only -->
 ## Reconciliation
 
 Root rejects stale/out-of-scope work, dedupes by root cause, records
@@ -189,3 +212,4 @@ Route defects before correction: product/acceptance → Spec Drift Guard/Clarify
 architecture/slicing/proof → Plan/Vet; source/test → wright;
 external/pre-existing → blocker/defer. Never patch downstream to hide an upstream
 defect.
+<!-- /root-only -->

package/pack/generated/codex/skills/devrites-lib/reference/standards/architecture-health.md

@@ -11,7 +11,7 @@ and never substitutes for review.
 ## When to measure
 
 Compute a score only when a code index covers the repo (see
-[`code-navigation.md`](code-navigation.md) § Index freshness). With no index,
+[`code-index.md`](code-index.md) § Preflight). With no index,
 report `unmeasured` — a placeholder number presented as a measurement is a
 false pass. **Failing case:** an audit reports "health: 100/100" on a repo the
 instrument could not parse.